last executing test programs: 3m46.820414628s ago: executing program 0 (id=139): r0 = open(&(0x7f00000000c0)='./bus\x00', 0x18d03e, 0x0) openat$fb1(0xffffff9c, &(0x7f0000000180), 0x0, 0x0) open(&(0x7f00000004c0)='./bus\x00', 0xc2802, 0x181) quotactl_fd$Q_SETINFO(0xffffffffffffffff, 0xffffffff80000600, 0x0, 0x0) socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="0180c200000000000000000008004500001c0000000010029078ac1e0001e000000111009078e0000001144a1ba2"], 0x0) prlimit64(0x0, 0xc, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$packet(0x11, 0x3, 0x300) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) connect$packet(r2, &(0x7f0000000200)={0x1f, 0xf8, 0x0, 0x1, 0x2}, 0x14) shutdown(r2, 0x1) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB], 0x14}, 0x1, 0x40030000000000}, 0x4000) 3m44.207778776s ago: executing program 0 (id=141): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_int(r0, 0x1, 0x1e, 0x0, &(0x7f0000002900)) (fail_nth: 3) 3m43.742283646s ago: executing program 0 (id=144): r0 = socket$packet(0x11, 0x2, 0x300) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'trusted:', 'syz', 0x20, 0xcb}, 0x0, 0xfffffffffffffff9) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000010400004009959e40c16c39e100", @ANYRES32=0x0, @ANYBLOB="01020400000000002800128008000100736974001c00028008000200c6120001060008001900000005000a00fd000000080004000100"], 0x58}}, 0x0) eventfd(0xfb) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x201, 0x402) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x11, r3, 0x1f) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)={0x30, r5, 0x5, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @crypto_settings=[@NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x4}]]}, 0x30}}, 0x4104) read$usbfs(r3, &(0x7f00000002c0)=""/118, 0x76) r7 = syz_io_uring_setup(0xf00, &(0x7f0000000340)={0x0, 0x8006605, 0x10000, 0x1, 0x36}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(r7, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) getsockname$packet(r1, 0x0, &(0x7f00000000c0)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r11 = syz_io_uring_setup(0xf00, &(0x7f0000001800)={0x0, 0x1e5a, 0x100, 0x2, 0x365}, &(0x7f0000000280), &(0x7f00000001c0), &(0x7f0000000340)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) io_uring_register$IORING_REGISTER_EVENTFD(r11, 0x4, &(0x7f0000000040), 0x1) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x437, 0x70bc27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x50561}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg(r0, &(0x7f0000000340)=[{{&(0x7f00000002c0)=@xdp={0x2c, 0xa888, 0x0, 0x7}, 0x14, 0x0}}], 0x1, 0x80) ioctl$XFS_IOC_SET_RESBLKS(r0, 0xc0105872, &(0x7f0000000080)={0x7, 0x2}) 3m42.173151932s ago: executing program 0 (id=149): r0 = open(&(0x7f00000000c0)='./bus\x00', 0x18d03e, 0x0) openat$fb1(0xffffff9c, &(0x7f0000000180), 0x0, 0x0) open(&(0x7f00000004c0)='./bus\x00', 0xc2802, 0x181) quotactl_fd$Q_SETINFO(0xffffffffffffffff, 0xffffffff80000600, 0x0, 0x0) socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="0180c200000000000000000008004500001c0000000010029078ac1e0001e000000111009078e0000001144a1ba2"], 0x0) prlimit64(0x0, 0xc, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$packet(0x11, 0x3, 0x300) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) connect$packet(r2, &(0x7f0000000200)={0x1f, 0xf8, 0x0, 0x1, 0x2}, 0x14) shutdown(r2, 0x1) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="270e28bd7000"], 0x14}, 0x1, 0x40030000000000}, 0x4000) 3m40.666731267s ago: executing program 0 (id=151): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c00000010000700"/20, @ANYRES32=0x0, @ANYBLOB="04010100010a000008000f00000000001400030077673000000000000000000000000000d4d34336e6e3b3a2f6382932bc06c1527bd49ed6619365a057d4e2aaaed40a8b869190afe015f49b7dc4d8f4f2525705dcc261fad5cf168f63786cb467a00383e628009f25e7755b3073417e0667e65f97992741464fcea9f540d092d4e862397d7b468bcac7f6b5750e726f7f14e722b50663a045148bd805bbf0424af8d35d87832764d1b324f5f8872550b6e24b64331b974811e2230e4eab7edec839475b74457e331ba52eeaeb"], 0x3c}}, 0x840) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c00000010000700"/20, @ANYRES32=0x0, @ANYBLOB="04010100010a000008000f00000000001400030077673000000000000000000000000000d4d34336e6e3b3a2f6382932bc06c1527bd49ed6619365a057d4e2aaaed40a8b869190afe015f49b7dc4d8f4f2525705dcc261fad5cf168f63786cb467a00383e628009f25e7755b3073417e0667e65f97992741464fcea9f540d092d4e862397d7b468bcac7f6b5750e726f7f14e722b50663a045148bd805bbf0424af8d35d87832764d1b324f5f8872550b6e24b64331b974811e2230e4eab7edec839475b74457e331ba52eeaeb"], 0x3c}}, 0x840) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x40104d05, &(0x7f0000000900)="0000010000000000000001") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) io_setup(0x6, &(0x7f0000000200)) (async) io_setup(0x6, &(0x7f0000000200)=0x0) eventfd(0x8) (async) r5 = eventfd(0x8) io_submit(r4, 0x1, &(0x7f0000000580)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x4, r3, &(0x7f0000000480)="657b42d9ce7b2f0bf171b6fe8f4d8def15c5f963725977d0917ec1d0c9f21620a2d1ec7bdf6624cc1c3cf54994ef87689f1f59ceca5e694a9f2464c3a0e32707de7b2a51a3b044cfe2bf770e3cc76364baf224fecd8abb21cbd0bdbbf059df30cdea35a09d197f19f3697f830c196d0905", 0x71, 0x1, 0x0, 0x3, r5}]) (async) io_submit(r4, 0x1, &(0x7f0000000580)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x4, r3, &(0x7f0000000480)="657b42d9ce7b2f0bf171b6fe8f4d8def15c5f963725977d0917ec1d0c9f21620a2d1ec7bdf6624cc1c3cf54994ef87689f1f59ceca5e694a9f2464c3a0e32707de7b2a51a3b044cfe2bf770e3cc76364baf224fecd8abb21cbd0bdbbf059df30cdea35a09d197f19f3697f830c196d0905", 0x71, 0x1, 0x0, 0x3, r5}]) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r7, 0x1, &(0x7f0000000440)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r6, 0x0}]) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323bac0c45b45602067fffffff81004e22030d00ff00289242a8002000eaa57b00090080020e1b05000000000000ff0004f0c70f000800ffffffffffffffffff0300e7ee0000000000000000020000", 0x58}], 0x1) (async) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323bac0c45b45602067fffffff81004e22030d00ff00289242a8002000eaa57b00090080020e1b05000000000000ff0004f0c70f000800ffffffffffffffffff0300e7ee0000000000000000020000", 0x58}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/UDC\x00', 0x401, 0x81) write(r8, &(0x7f0000000600)='dummy_udc.0\n', 0xc) (async) write(r8, &(0x7f0000000600)='dummy_udc.0\n', 0xc) close(0x3) socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r9, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r10, 0x200, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0x14, 0x18, {0x9, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8050}, 0x20000004) 3m40.105479134s ago: executing program 0 (id=153): listen(0xffffffffffffffff, 0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000002c000000030a010800000000000000000100000b0900030073797a32000000000900010073797a300000000060000000060a010400000000000000000100000008000b40000000000900010073797a300000000038000480340001800a0001006d61746368000000240002800c000300b07346e358c219250b0001006367726f75700000080002"], 0xd4}}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000080)=ANY=[@ANYBLOB="f572c10000a88c43c226f0a6380778c72739a0", @ANYRESOCT=r0], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x104) open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(0xffffffffffffffff, 0x6804, 0x0) r3 = openat$pmem0(0xffffffffffffff9c, &(0x7f0000002340), 0x80d01, 0x0) pwrite64(r3, &(0x7f0000000000)="a5", 0xfffffe8c, 0x2) write$binfmt_format(0xffffffffffffffff, &(0x7f0000000040)='1\x00', 0x2) ioctl$BLKRRPART(r3, 0x125f, 0x1f) 3m24.955747606s ago: executing program 32 (id=153): listen(0xffffffffffffffff, 0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000002c000000030a010800000000000000000100000b0900030073797a32000000000900010073797a300000000060000000060a010400000000000000000100000008000b40000000000900010073797a300000000038000480340001800a0001006d61746368000000240002800c000300b07346e358c219250b0001006367726f75700000080002"], 0xd4}}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000080)=ANY=[@ANYBLOB="f572c10000a88c43c226f0a6380778c72739a0", @ANYRESOCT=r0], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x104) open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(0xffffffffffffffff, 0x6804, 0x0) r3 = openat$pmem0(0xffffffffffffff9c, &(0x7f0000002340), 0x80d01, 0x0) pwrite64(r3, &(0x7f0000000000)="a5", 0xfffffe8c, 0x2) write$binfmt_format(0xffffffffffffffff, &(0x7f0000000040)='1\x00', 0x2) ioctl$BLKRRPART(r3, 0x125f, 0x1f) 3m22.557395233s ago: executing program 1 (id=193): openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$kcm(0x21, 0x7, 0x2) r0 = socket$packet(0x11, 0x2, 0x300) close(r0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0xb3b54c18e0590239, 0x0, &(0x7f0000bbdffc)) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc00c9207, &(0x7f0000000440)={0x0, 0x0, 0x4}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)=0x0) mkdir(&(0x7f0000000040)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='trace/events/sched/sched_switch/filter\x00', 0x1, 0x0) write(r6, &(0x7f0000000140)='prev_state.', 0xb) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r9, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) sendto$inet6(r9, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r9, &(0x7f0000000c80)="7cffa9061b2f8b082b6f69ae50430c8a8b6aa3162ba083c4a52e1ab0ac50ed4a19b1a69988000d5bed4433daaa4932dbb1cb3550dee8b23579d76ce37d574b43fca1eed8ebd38d1303240ed0d84517692128dd5aef5c4d60a6659952a1437c6f0ac3ed75806011ccbaa504f41a7e0abcf8823bc4a71ef8c52c2b297b539eaf752c56ebfe9b0542543069257dafcbf76c958d4cbf4eaaa67c5c2bd9e6518be34b56add7613ab83d389724b664e62c154e1a5aac073a53a0e8cadcf51ef495ebbcc77d5e36ff24c3f282289cc077374b714e08fbfecbdc8f14ef3fd409af4caf6fcb7d663beab335f239a1e93b399c93d7c036e1b39a7c477945f82b6dde53b1c21b590a58ba688ac4fb530d2c5b1195a127d2eaec840ab59f090d7047c278611e080cebe7b28588c11a44be99fe6f88c73441bf625b70565669997f4c3cda5afe1d6429908a69a459d35ba8c2f28076d8711f2667de749a783fac94ebd02680f20fb723c35c287a1f45064846385750665ffa74579083fbb1b1d6b7c90168252b1c5313544569203e7adb8e271a94f7413e5cfd6aa3157c4fc29bddba3683fcd032aecb513b2f27530fbefa0000000000000003c058e812d8db87de5e3eceae268b91f7d59daf77646fa4df99877dd5a9540934c7af91b96486eea62897be6acbe1bae8e46b112f1385e7cea9e4daccc6f1b98ce3b4322af8299a45ddcb5be8d3e469fdde9896ca324a2f3c88c616a7dccde331698ce2d39f96220251011b4dfbec953b5c30e94adb5586cec0af234859805bb7df1101ae80318ff127e913178d79cfa918d54585b6184255e872e2dc33a5c7c30a756bbd63c32a3e6a22863781747d185acb64583976c4289394d642b07d18e2932d0a78bd2ccf92b3e94e82f1e9239fa272402f4c9efcf068709a44d6f652a4f23df89f9a15e6bf0c7e65d8f3e32c35e83d30298074d16cb5ff4ded1df81009bbae888fceb9a8109ba319605e1776e52d2069b5cd7de07cf8dc488ba6a9c7559ff49674a490991f323736f302004007d0ccf2e5eaceac6b56f48f2b00592d7a378f118d8b3e5ecd2035c8252374c91bc79cf26ac11ddffe2c09e1aa032da0713732387f950e3f4e301eb1d26e5a2b19318e50d555c832e279894d8c9b03e8940738c0fe391b29907d0d5f9214d6e697a19247f4e8221aca2ac47debd7c45b8344941cbecbaf44af343b24a4f88caf207d72002fb8b7d156997cb7275f535e6a9d6480046246e60bea0cf6f54abc69ff9418b6cb9301eb6890227215b633a886fb13c89698e51e482c42ca99613b20e22e5ce15272f5bda8b18cf53d49130a94135dd8a9692c", 0x34000, 0xbcff, 0x0, 0x0) shutdown(r9, 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r9, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x80000000}, 0xc) writev(r9, &(0x7f0000001300)=[{&(0x7f0000000100)='^', 0xfdef}], 0x1) syz_ublk_setup_queues(r8, r5, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x1, 0x255}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x9e, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) 3m21.13554237s ago: executing program 1 (id=198): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x3ff, 0x10003, 0xcb8, 0x7, "b003000018bfff4000"}) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000240)={0x9, 0x800, 0x534d, 0x7f, 0x1, "9440f5d0866a7a3c97876e2e5f64afdd35dc47"}) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0xff) (fail_nth: 3) 3m20.392481826s ago: executing program 1 (id=201): socket(0x28, 0x5, 0x0) socket(0x28, 0x5, 0x0) fsopen(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) msgctl$MSG_INFO(0x0, 0xc, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$user(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r4, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13, 0x4}) r5 = syz_open_dev$vbi(&(0x7f0000000340), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f00000000c0)=0x3) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c0000001000010028bd700002d4df2500000000", @ANYRES32=r8, @ANYBLOB="984e0600c10a01002c001280110001006272696467655f736c617665000300001400058005001e0001"], 0x4c}, 0x1, 0x0, 0x0, 0x400c080}, 0x200088c2) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r5, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0x8a5, 0x92, 0x1, 0x2, 0xd59f80, 0x19ef, 0x5, 0x19ef, 0x3, 0x4, 0x27ff, 0x2800, 0x2, 0xbb6, 0x0, 0x13, {0x8, 0xfffffffb}, 0xd0, 0x9}}) connect$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) 3m18.975659546s ago: executing program 1 (id=206): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x3ff, 0x10003, 0xcb8, 0x7, "b003000018bfff4000"}) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000240)={0x9, 0x800, 0x534d, 0x7f, 0x1, "9440f5d0866a7a3c97876e2e5f64afdd35dc47"}) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0xff) 3m18.54888929s ago: executing program 1 (id=207): syz_emit_ethernet(0x2e, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000e5dd000008004503002000000000000490"], 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x41100, 0x4b, '\x00', 0x0, @cgroup_skb=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x2, 0x1, 0x0, 0x0, 0x0, 0xd5e855c9ff29405c}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000880)) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000080)) 3m18.383605142s ago: executing program 1 (id=210): mknodat$null(0xffffffffffffff9c, &(0x7f0000002440)='./file0\x00', 0x2, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), 0x400, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000020000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c000b607dfbc762ba4e158a0eca3af800305d4d669657d10d487c804ee5bb58089c01050ca6a41294e10f321f710f13afc10805ffab6098c4686402697347f2c7362ac94c507341209041de9ed80d5285d984ba0278c8c70170ed6a1ec248c4330b8d79b163afb1133a46eb0c5e4c8ac529e8c3c937c9c355316386e3196d94a5cbc42ae00ccfa297b2ee98174aef6e8566aefc19204569d7e7952469d6893f95cfa5b827a3e8fb94040681796909125997dec1e5"]) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fanotify_init(0x200, 0x400) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="03c800341f30e51d2ada9852ea20033c3ba772e15f0b8f7b868423941b600c253e8f98b7d6a7ae5ab7530a6c5a2a373b4e9cfd3673df8e72"], 0x38) r1 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4000000) r2 = openat(0xffffffffffffff9c, 0x0, 0x4, 0x80) getdents64(r2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r2, 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000006540)={0x2020}, 0xfffffce2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) 3m3.290802899s ago: executing program 33 (id=210): mknodat$null(0xffffffffffffff9c, &(0x7f0000002440)='./file0\x00', 0x2, 0x103) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), 0x400, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000020000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c000b607dfbc762ba4e158a0eca3af800305d4d669657d10d487c804ee5bb58089c01050ca6a41294e10f321f710f13afc10805ffab6098c4686402697347f2c7362ac94c507341209041de9ed80d5285d984ba0278c8c70170ed6a1ec248c4330b8d79b163afb1133a46eb0c5e4c8ac529e8c3c937c9c355316386e3196d94a5cbc42ae00ccfa297b2ee98174aef6e8566aefc19204569d7e7952469d6893f95cfa5b827a3e8fb94040681796909125997dec1e5"]) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fanotify_init(0x200, 0x400) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="03c800341f30e51d2ada9852ea20033c3ba772e15f0b8f7b868423941b600c253e8f98b7d6a7ae5ab7530a6c5a2a373b4e9cfd3673df8e72"], 0x38) r1 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4000000) r2 = openat(0xffffffffffffff9c, 0x0, 0x4, 0x80) getdents64(r2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r2, 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000006540)={0x2020}, 0xfffffce2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) 6.224346854s ago: executing program 2 (id=838): openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000001c0)="d80000001e0081054e81f782060000000000000006007c095dd2466518000e800a00142603600e1208000f0000000406a80016c00800094013000000035c0461c1d67f6f94007134cf6efb8007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791433a5ee4ce1b14d6d930dfe1d9d33dfe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad909d5e1cace81ed0bffece0b42a9eca0200e6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a9410000", 0xd8}, {&(0x7f0000000300)="814412262061ce452f5419d760f802ce31197242186e0bf1d5eda654e964476680ac44f6072c329c695f7ccceda75c40048d46fa640c7515ac2d219cff787188518c0a0bc688df12739a44a03972", 0x4e}], 0x2}, 0x8084) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$vsock_stream(0x28, 0x1, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r3}, 0x8) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1, 0xf, &(0x7f0000000540)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000002c0)=r5, 0x4) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000700)="d80000001a0081044e81f782db4cb904021d08004f1e81f8d8150019001105142603600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aebfb0daa7b0cd39e4edbb57a5025ccca9e020000000000000040fad95667e006dcbd63951f215ce3bb9ad809d5e1cace81017f5b5cef443dc3ed0bffece0b42a9ecbee5de6ccd40dd6e4", 0xd8}], 0x1}, 0x0) r6 = inotify_init1(0x0) r7 = inotify_add_watch(r6, &(0x7f0000000200)='.\x00', 0x44000160) r8 = dup(r6) inotify_rm_watch(r8, r7) ioctl$sock_TIOCINQ(r8, 0x541b, &(0x7f0000000040)) r9 = open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x0) fcntl$setsig(r9, 0xa, 0x21) fcntl$setlease(r9, 0x400, 0x1) r10 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close_range(r9, r10, 0x0) r11 = accept4$vsock_stream(r3, &(0x7f00000001c0)={0x28, 0x0, 0x0, @hyper}, 0x10, 0x800) bind$vsock_stream(r11, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) socket$vsock_stream(0x28, 0x1, 0x0) 6.088639953s ago: executing program 3 (id=840): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000040)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x3b) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1b6) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) mkdir(&(0x7f0000000240)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1f7) symlink(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', &(0x7f0000000f00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') 5.831983677s ago: executing program 3 (id=843): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000400), 0x60200, 0x0) ioctl$SW_SYNC_IOC_INC(r1, 0x40045701, &(0x7f0000000440)=0xffffffff) pipe(0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x403, 0x70bd25, 0xffffffff, {0x0, 0x0, 0x0, 0x0, 0x4540}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x10}]}}}, @IFLA_MASTER={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000881}, 0x48004) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="440000001000010000000000000000000000000071d8d038d7e96f3ee95dff05bc7628a2b839db8e644c29232573388d3decfffff3880670ee5949858bc24de45ac3c763400dafdd33e42d862dbed408ef10f49ca757dd", @ANYRES32=r3, @ANYRES64], 0x3}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x10500, 0x0) fremovexattr(r1, &(0x7f0000000000)=@random={'system.', '/sys/kernel/debug/sync/sw_sync\x00'}) setsockopt$inet6_int(r0, 0x29, 0x1, &(0x7f0000000400)=0x6, 0x4) 5.7343776s ago: executing program 3 (id=845): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) symlink(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', &(0x7f0000000f00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') (fail_nth: 4) 5.609871113s ago: executing program 3 (id=846): ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0xaf01, &(0x7f0000000080)) 5.191352986s ago: executing program 2 (id=848): syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000100)={0x80000000, 0x0, 0xfffffffc}, 0x10) write(r0, &(0x7f0000000040)="240000001a005f0214f9f4070009821d1f000000fe009f10a69a0000cf00070408000f20fd", 0x25) r1 = openat$nullb(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000140)={0x7, 0xa1}) 5.143665229s ago: executing program 3 (id=849): r0 = socket(0x10, 0x803, 0x0) syz_open_dev$sndmidi(0x0, 0x3, 0x40041) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000700)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x6, &(0x7f00000000c0), &(0x7f0000000140)=0x4) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/bus/input/devices\x00', 0x0, 0x0) io_setup(0x3, &(0x7f0000000140)=0x0) io_submit(r4, 0x200001a6, &(0x7f0000000a40)=[&(0x7f0000000840)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}]) syz_open_dev$sg(&(0x7f00000001c0), 0x81dc, 0x200) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount(&(0x7f0000000080)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='vfat\x00', 0xa08410, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x38, 0x5, 0x8, 0x5, 0x0, 0x9, 0x0, 0x2, 0xfa11, 0xffffffff}, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) pread64$ublk_ch(0xffffffffffffffff, 0x0, 0x0, 0x9) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) io_pgetevents(0x0, 0x4, 0x0, 0x0, 0x0, 0x0) mbind(&(0x7f00005b4000/0x4000)=nil, 0x4000, 0x2, 0x0, 0x0, 0x2) connect$inet(r5, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) link(&(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) sendmmsg$inet(r5, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) 5.071680089s ago: executing program 2 (id=851): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000040)={0xf0f015, 0x4}) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'das16m1\x00', [0x100, 0x4, 0x13600, 0x6, 0x0, 0x10004, 0x79, 0x3, 0xffffdff4, 0x5, 0x2, 0x64, 0x8, 0x1, 0x10, 0xfd, 0x8, 0x9, 0x3, 0x7fffffff, 0xb740, 0x8ca9f, 0x9, 0x20001e58, 0x8, 0xf39e, 0x6, 0x1539b804, 0x3, 0x1, 0x2]}) 4.565869358s ago: executing program 2 (id=854): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x3b) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) (fail_nth: 4) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1b6) mkdir(0x0, 0x1ff) mkdir(&(0x7f0000000240)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1f7) symlink(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', &(0x7f0000000f00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') 4.407173565s ago: executing program 5 (id=855): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r0, 0x29, 0x1, &(0x7f0000000400)=0x6, 0x4) 4.133557299s ago: executing program 2 (id=856): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_emit_vhci(&(0x7f00000024c0)=ANY=[@ANYBLOB="05c9"], 0xe) close(r0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt(r1, 0x84, 0x80, &(0x7f00000002c0)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) sendto$inet6(r1, &(0x7f00000004c0)="b0", 0x1, 0x1f4, &(0x7f0000000240)={0xa, 0x4e23, 0x7, @loopback, 0x4}, 0x1c) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e23, 0x3, @loopback, 0xb578}}}, 0x84) 3.976809684s ago: executing program 5 (id=858): r0 = socket(0x10, 0x80003, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) socket(0x10, 0x5, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0xe22, 0x6, @rand_addr, 0x3}, 0x1c) syz_emit_ethernet(0xb6, &(0x7f00000003c0)=ANY=[@ANYBLOB="0180c2000000004b0f4600000000008100210086dd60000000007c11012001000000000000002b23db273103f13900000000000002ff0200000000000000000000000000013302010100000000fe80000000000000000000000000000f40004e23006490780200000002000000020000001983426a97e3503bbbc12ef01ae488918c1ea89a08a25f78de9f802d2628cc4bb6e5e8bfb69252b136c8f50eaee89ebe26e39726e261b1997fe90de7841c2e1f8def4140bfc500000000000000"], 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x9, 0x8000, 0x3, 0x9, 0xfffffffffffffffe, 0x1008c24}, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r6) sendmsg$NL80211_CMD_RELOAD_REGDB(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r7, 0x501, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x24044855}, 0x4040044) r8 = syz_open_dev$cec(&(0x7f0000000500), 0x0, 0x783481) ioctl$CEC_S_MODE(r8, 0x40046109, &(0x7f0000000540)=0x80) mkdirat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x2a) mount$9p_virtio(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x10000, 0x0) removexattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)=@known='system.posix_acl_default\x00') r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000270009002abd7000fddbdf250e"], 0x14}, 0x1, 0x0, 0x0, 0x46}, 0x4000080) setsockopt$inet6_int(r3, 0x29, 0x46, &(0x7f0000000100)=0x5, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) r11 = socket(0x10, 0x80002, 0xfffffffc) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x4000005) 3.798655189s ago: executing program 4 (id=860): syz_emit_vhci(&(0x7f00000003c0)=ANY=[@ANYBLOB="040e04f34120", @ANYRESDEC], 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1df) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdir(&(0x7f0000000440)='./config/usb_gadget/g1/functions/midi.usb0/id\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='myproc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='myproc/iomem\x00', 0x88401, 0x0) read(r0, &(0x7f0000000500), 0xfa0) r1 = syz_clone3(&(0x7f0000000380)={0x2140280, 0x0, 0x0, 0x0, {0x34}, 0x0, 0x0, 0x0, &(0x7f0000000340)}, 0x58) openat(0xffffffffffffff9c, &(0x7f00000001c0)='myproc\x00', 0x280, 0xca) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi.usb0/id\x00', 0x1, 0x0) write(r2, &(0x7f0000000180)='Mid', 0x3) openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/midi.usb0/in_ports\x00', 0x1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/midi.usb0/out_ports\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='2\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) setxattr$incfs_id(&(0x7f0000000240)='myproc\x00', &(0x7f00000004c0), &(0x7f0000000540)={'0000000000000000000000000000000', 0x33}, 0x20, 0x2) symlinkat(&(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./proc\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/UDC\x00', 0x501841, 0x0) write(r4, &(0x7f00000003c0)='dummy_udc.0\n', 0xc) syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00') mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) userfaultfd(0x80001) capset(&(0x7f0000000500)={0x20080522, r1}, &(0x7f0000000180)={0x200005, 0x200127, 0x801, 0x0, 0x7, 0x4}) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x8) 3.48775522s ago: executing program 5 (id=861): openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$kcm(0x21, 0x7, 0x2) r0 = socket$packet(0x11, 0x2, 0x300) close(r0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0xb3b54c18e0590239, 0x0, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc00c9207, &(0x7f0000000440)={0x0, 0x0, 0x4}) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)=0x0) mkdir(&(0x7f0000000040)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='trace/events/sched/sched_switch/filter\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='prev_state.', 0xb) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r10, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) sendto$inet6(r10, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r10, &(0x7f0000000c80)="7cffa9061b2f8b082b6f69ae50430c8a8b6aa3162ba083c4a52e1ab0ac50ed4a19b1a69988000d5bed4433daaa4932dbb1cb3550dee8b23579d76ce37d574b43fca1eed8ebd38d1303240ed0d84517692128dd5aef5c4d60a6659952a1437c6f0ac3ed75806011ccbaa504f41a7e0abcf8823bc4a71ef8c52c2b297b539eaf752c56ebfe9b0542543069257dafcbf76c958d4cbf4eaaa67c5c2bd9e6518be34b56add7613ab83d389724b664e62c154e1a5aac073a53a0e8cadcf51ef495ebbcc77d5e36ff24c3f282289cc077374b714e08fbfecbdc8f14ef3fd409af4caf6fcb7d663beab335f239a1e93b399c93d7c036e1b39a7c477945f82b6dde53b1c21b590a58ba688ac4fb530d2c5b1195a127d2eaec840ab59f090d7047c278611e080cebe7b28588c11a44be99fe6f88c73441bf625b70565669997f4c3cda5afe1d6429908a69a459d35ba8c2f28076d8711f2667de749a783fac94ebd02680f20fb723c35c287a1f45064846385750665ffa74579083fbb1b1d6b7c90168252b1c5313544569203e7adb8e271a94f7413e5cfd6aa3157c4fc29bddba3683fcd032aecb513b2f27530fbefa0000000000000003c058e812d8db87de5e3eceae268b91f7d59daf77646fa4df99877dd5a9540934c7af91b96486eea62897be6acbe1bae8e46b112f1385e7cea9e4daccc6f1b98ce3b4322af8299a45ddcb5be8d3e469fdde9896ca324a2f3c88c616a7dccde331698ce2d39f96220251011b4dfbec953b5c30e94adb5586cec0af234859805bb7df1101ae80318ff127e913178d79cfa918d54585b6184255e872e2dc33a5c7c30a756bbd63c32a3e6a22863781747d185acb64583976c4289394d642b07d18e2932d0a78bd2ccf92b3e94e82f1e9239fa272402f4c9efcf068709a44d6f652a4f23df89f9a15e6bf0c7e65d8f3e32c35e83d30298074d16cb5ff4ded1df81009bbae888fceb9a8109ba319605e1776e52d2069b5cd7de07cf8dc488ba6a9c7559ff49674a490991f323736f302004007d0ccf2e5eaceac6b56f48f2b00592d7a378f118d8b3e5ecd2035c8252374c91bc79cf26ac11ddffe2c09e1aa032da0713732387f950e3f4e301eb1d26e5a2b19318e50d555c832e279894d8c9b03e8940738c0fe391b29907d0d5f9214d6e697a19247f4e8221aca2ac47debd7c45b8344941cbecbaf44af343b24a4f88caf207d72002fb8b7d156997cb7275f535e6a9d6480046246e60bea0cf6f54abc69ff9418b6cb9301eb6890227215b633a886fb13c89698e51e482c42ca99613b20e22e5ce15272f5bda8b18cf53d49130a94135dd8a9692c", 0x34000, 0xbcff, 0x0, 0x0) shutdown(r10, 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r10, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x80000000}, 0xc) writev(r10, &(0x7f0000001300)=[{&(0x7f0000000100)='^', 0xfdef}], 0x1) syz_ublk_setup_queues(r9, r6, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x1, 0x255}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x9e, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) 3.474716603s ago: executing program 2 (id=862): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$netlink(r1, 0x10e, 0x5, &(0x7f0000000280)=""/165, &(0x7f0000000340)=0xa5) r2 = socket$rds(0x15, 0x5, 0x0) syz_open_pts(0xffffffffffffffff, 0x81) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a7565aba55a87d2a251c295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507a0592c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd106926acb583ad63a4e7e1ca17c1b6aac63fefa9dcbe429d00"}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket(0xa, 0x1, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'lo\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYRES32=r6, @ANYBLOB="4000100a14000100009a"], 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x20024090) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x2000010}, [@generic={0x6b, 0x1, 0x1, 0x4}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f00000000c0)={"ff87c89d4e3e6bd4ae7ee3551b880c0ac56cb2a58b7da498a7045278c8043bbe"}) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f0000000280)={'erspan0\x00', &(0x7f0000000000)={'syztnl2\x00', r6, 0x7, 0x7800, 0x67a, 0x7, {{0x6, 0x4, 0x2, 0x29, 0x18, 0x64, 0x0, 0x6, 0x2f, 0x0, @remote, @remote, {[@ra={0x94, 0x4}]}}}}}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24008080) bind$rds(r2, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f0000000800)={&(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000740)=[@mask_cswp={0x58, 0x114, 0x9, {{0x1, 0x80200000}, 0x0, 0x0, 0xfffffffffffffff8, 0xff, 0x9, 0xffffffffffffffff, 0x40, 0x4}}], 0x58, 0x4044004}, 0x40) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9fe601001800000000000000280000002800000000000200001a000200000000000013020000000200000100"/57], 0x0, 0x42}, 0x28) syz_emit_ethernet(0x112, &(0x7f0000000380)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0xdc, 0x6, 0x0, @remote, @local, {[@hopopts={0x2c, 0x14, '\x00', [@hao={0xc9, 0x10, @private1={0xfc, 0x1, '\x00', 0x1}}, @calipso={0x7, 0x50, {0x0, 0x12, 0xa5, 0x3, [0x8, 0xb0bd, 0xfff, 0x8000, 0x9, 0xc, 0x3, 0x7, 0xddd0]}}, @ra={0x5, 0x2, 0x8}, @pad1, @pad1, @ra={0x5, 0x2, 0x3}, @generic={0x0, 0x2a, "6aa00c3ce8ff775e1942148ffd7dc99c1256b40bc221ec57292eb03e33facd24a1e6aff3389c52fb4baf"}, @pad1, @enc_lim={0x4, 0x1, 0xb9}]}, @fragment={0x89, 0x0, 0x1, 0x1, 0x0, 0x0, 0x66}, @dstopts={0x87, 0x0, '\x00', [@jumbo={0xc2, 0x4, 0x7}]}], {{0x4e20, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaacf3cccaf382f08004500002c00000000fe069078ac1414bb8000000000004e228d485eac74a58cfd53482f456a90fd46ae740e9a6678298aaf5883cebb1055c0765ba2c2fa89bd97d88693ca11f991eabd14fe33118e72f4f602d6893bf0a7c881bb2acfab13720ecb2cd2b8281f11a149be5ea269c15b2551a3f65c7231f10c744004fa6fb882b0e70845b376796c978f8ab87b52c146eb5b67485cc0cb8eaf29237dca0039af0ecd9d736ec57d8114a32c5455238fc2352a80b8ee940cf4315dd5a518b72315b644f984aeb42b43362f32af93de249a39c213abf2076203da", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="6c02ffff907800040204bb0c"], 0x0) 3.41678712s ago: executing program 4 (id=863): sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, 0x0, 0xc114) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() read$FUSE(0xffffffffffffffff, &(0x7f0000006100)={0x2020}, 0x2020) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x1401, 0x1, 0x70bd2a, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x20004000}, 0x22000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='10000', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r4, &(0x7f0000000280)='0', 0x1) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) pipe(0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, &(0x7f0000000040)=@v3={0x3000000, [{0x967, 0xfffffff7}, {0x10, 0x5}]}, 0x18, 0x1) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000980), r5) kexec_load(0x0, 0x1, &(0x7f0000000000)=[{0x0, 0x1f, 0x7ffdd000, 0x8000}], 0x320000) mount(&(0x7f0000000040)=@sr0, &(0x7f0000000100)='.\x00', &(0x7f0000000000)='iso9660\x00', 0x1008081, 0x0) 3.06755257s ago: executing program 3 (id=864): sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, 0x0, 0xc114) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() read$FUSE(0xffffffffffffffff, &(0x7f0000006100)={0x2020}, 0x2020) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x1401, 0x1, 0x70bd2a, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x20004000}, 0x22000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='10000', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r4, &(0x7f0000000280)='0', 0x1) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) pipe(0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, &(0x7f0000000040)=@v3={0x3000000, [{0x967, 0xfffffff7}, {0x10, 0x5}]}, 0x18, 0x1) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000980), r5) kexec_load(0x0, 0x1, &(0x7f0000000000)=[{0x0, 0x1f, 0x7ffdd000, 0x8000}], 0x320000) mount(&(0x7f0000000040)=@sr0, &(0x7f0000000100)='.\x00', &(0x7f0000000000)='iso9660\x00', 0x1008081, 0x0) 2.885377527s ago: executing program 5 (id=865): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYBLOB="01000000010000001c0012000c0001006272696467"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000b80)=@newtfilter={0x3b4, 0x28, 0x575ac7824d421509, 0x60bd29, 0x4, {0x0, 0x0, 0x0, r3, {0xd}, {0xffff}, {0xc, 0x5}}, [@filter_kind_options=@f_basic={{0xa}, {0x37c, 0x2, [@TCA_BASIC_EMATCHES={0x378, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x1a0, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xec, 0x3, 0x0, 0x0, {{0x6, 0x0, 0x2}, "20f2150b1ab7b1aae5b359d5a2cefb92fd959933c3a6f23f4433167e977179477e42d6e21915e1d0560d309a2827a6e3f329be47f422e3031ec8870cacbdb49c037e1801d6ab5a2d2fcb1fe4e0e2169ee2ee764b6ce96d6cfa861d68def65c4ea87a22e078596d762403c884394be5db966b1d9033c2027c95bcec5757814d097ffa8c819931fdd509cbfc2077d7a39ab932e38d2d971a4fcfc893b8e7bcaf74bba8342912046d97c378894304912ef24c32e89aa2d3fed6e8e67166b13b82a437ca409f56a99e94dd321e90ad7dacab8dde76c50cc2587d969fbe65b0892f1f"}}, @TCF_EM_IPSET={0x10, 0x2, 0x0, 0x0, {{0x9, 0x8, 0x5}, {0x3, 0x3, 0x1}}}, @TCF_EM_IPT={0x88, 0x2, 0x0, 0x0, {{0xa, 0x9, 0x3}, [@TCA_EM_IPT_NFPROTO={0x5}, @TCA_EM_IPT_HOOK={0x8, 0x1, 0x2}, @TCA_EM_IPT_MATCH_DATA={0x52, 0x5, "cadffbfad91382471d661c044995ecc910f576aa357ae4e6991f538689bd3add6436115ef58a7884b22b36bf09ddc1cb4d5af313cf2aba69218d73e06d1421c43ced9148536875eae121cf1c866c"}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x7}, @TCA_EM_IPT_HOOK={0x8, 0x1, 0x1}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x2}]}}, @TCF_EM_NBYTE={0x18, 0x1, 0x0, 0x0, {{0x1, 0x2, 0x7fff}, {0x0, 0x8, 0x1, "3cbc8d03f0aec0dc"}}}]}, @TCA_EMATCH_TREE_LIST={0x1bc, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x114, 0x5, 0x0, 0x0, {{0x400, 0x9, 0x8}, [@TCA_EM_IPT_MATCH_DATA={0xd5, 0x5, "af8caebc0350e189e2854f1c50e44e6c8090846dda6696e0b1f1ad97fb31c5fc028d454c97fda84bd971be3702292a6f5706229d2bd1e105117705d3dcfc63eab0558e1fb9ab057863a734a41be0b1fb92eb5d4f0261fafd2385afc5fc2e745db4b9771ff7f57d4ae95dc7ba126991a374ec8749e96b3397587316afc1d0f2cc84b40b918e0a91669c33b19fd04ac28629039593fac2e27c8f1bced54b8d647a8f9391715d015aaae78f88a4b36cafd525f09f638e2e6791e7804181b8188d87d6c58375c6c07bc03d005bfa676b4ab5f5"}, @TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0xbc}, @TCA_EM_IPT_HOOK={0x8, 0x1, 0x4}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x7}, @TCA_EM_IPT_MATCH_REVISION={0x25, 0x3, 0x6}, @TCA_EM_IPT_NFPROTO={0x5}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x1}]}}, @TCF_EM_CANID={0x0, 0x1, 0x0, 0x0, {{0x100, 0x7, 0x4}, {{0x3, 0x1, 0x0, 0x1}, {0x3}}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x4, 0x1, 0x8}, {0x9, 0x85e, 0x401, 0x3, 0x2, 0x2, 0x1}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xfffd}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x3}}, @TCA_EMATCH_TREE_HDR={0x8}]}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0xc}}]}, 0x3b4}, 0x1, 0x0, 0x0, 0x11}, 0x40) r4 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r4, &(0x7f0000000140), 0x4924b68, 0x0) (fail_nth: 4) 2.481783854s ago: executing program 5 (id=866): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x200}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="38000000100001082cbd7000ffffffff00000000", @ANYRES32=0x0, @ANYBLOB="fffe01000100000008001b000000000010001a800c0000000000080003000000"], 0x38}}, 0x0) close(r1) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet6_int(r3, 0x29, 0x33, 0x0, &(0x7f0000000080)) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'sit0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x7, 0x1f45, 0x4, 0x7ff}, 0x4, 0x1, 0x0, 0x7, 0x2ff, 0xb, 0x1a, 0x1c, 0x4, 0x7131d5f9, {0x7, 0x80000001, 0x7, 0x81, 0x3, 0xf70a}}}}]}, 0x78}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x4}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x2, 0x3ff}}}]}, 0x3c}}, 0x8004) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket$kcm(0x11, 0x3, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@o_path={&(0x7f00000002c0)='./file0\x00', 0x0, 0x8, r10}, 0x14) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) r12 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r12, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r13 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r13, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) dup3(r13, r12, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) 1.706084658s ago: executing program 5 (id=867): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) set_robust_list(&(0x7f0000000400), 0x18) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mount(&(0x7f0000000140)=@sr0, 0x0, &(0x7f0000000000)='ntfs3\x00', 0x2208004, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0xb, &(0x7f0000000400)=""/92, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x8001, 0x0, 0xaf, 0x0, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) rename(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file1\x00') sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x20000080) gettid() sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) time(0xffffffffffffffff) syz_clone3(&(0x7f000000c340)={0xa802180, 0x0, 0x0, 0x0, {0x2b}, 0x0, 0x0, 0x0, 0x0}, 0x58) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x40) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, 0x0, 0x0, &(0x7f0000000400), 0x401, 0xffffffffffffffff, 0x0, 0xa002a0}, 0x38) 1.163839193s ago: executing program 4 (id=868): ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000140)={0x7, 0xa1}) 1.028119984s ago: executing program 4 (id=869): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_POLL(r0, 0x640f) socket(0x2, 0x5, 0x9) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="2c00000041000100fcff07000400000001000000040048800c0001800800108004000680080002"], 0x2c}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000280)={0x1, 0x4, 0x1}) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$vga_arbiter(r4, &(0x7f0000000000)=@other={'decodes', ' ', 'io'}, 0xb) r5 = socket(0x40000000015, 0x805, 0x0) getsockopt(r5, 0x114, 0x271d, 0x0, &(0x7f0000000000)) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000080)={0x1082, 0x1, 0x1}) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'ip_vti0\x00', 0x0}) sendto$packet(r7, &(0x7f0000000180)="0b03feff4f11021202004788aa96a13bb1000011000088ca1a00", 0x1fffc, 0x0, &(0x7f0000000140)={0x11, 0x0, r8}, 0x14) r9 = dup(r3) r10 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$KDSKBENT(r10, 0x4b47, &(0x7f0000000000)={0x2, 0x4, 0xa8b}) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000006c0)={0x55, 0x101, 0x1, {0x0, 0x1}, {0x48, 0xfbff}, @rumble={0xe, 0xff}}) r11 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) write$char_usb(r11, &(0x7f0000000040)="e2", 0x12d8) write$UHID_INPUT(r9, 0x0, 0x0) 74.268703ms ago: executing program 4 (id=870): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0xe4, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x32) openat(0xffffffffffffff9c, 0x0, 0x4043, 0x1ff) epoll_create1(0x0) r2 = creat(0x0, 0xecf86c37d53049cc) close(r2) execve(0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000640)={0x2020}, 0xeb0) 0s ago: executing program 4 (id=871): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testnqn\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testnqn/attr_allow_any_host\x00', 0x2, 0x0) write(r0, &(0x7f0000000340), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testnqn/namespaces/1\x00', 0x1ed) openat(0xffffffffffffff9c, &(0x7f0000000400)='./backing_file\x00', 0x42, 0x1ed) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testnqn/namespaces/1/device_path\x00', 0x2, 0x0) write(r1, &(0x7f0000000480)='./backing_file', 0xe) r2 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/subsystems/testnqn/namespaces/1/enable\x00', 0x2, 0x0) write(r2, &(0x7f0000000580)='1\x00', 0x1f) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r3, &(0x7f0000000680)='loop', 0x4) symlinkat(&(0x7f00000006c0)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testnqn\x00') r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) write(r4, &(0x7f0000000780)='transport=loop,nqn=testnqn', 0x1a) kernel console output (not intermixed with test programs): 7914] Call Trace: [ 297.287192][ T7914] [ 297.287201][ T7914] dump_stack_lvl+0x100/0x190 [ 297.287485][ T7914] should_fail_ex.cold+0x5/0xa [ 297.287507][ T7914] should_failslab+0xc2/0x120 [ 297.287535][ T7914] __kmalloc_cache_noprof+0x91/0x6c0 [ 297.287582][ T7914] ? copy_ipcs+0x10d/0x7e0 [ 297.287610][ T7914] copy_ipcs+0x10d/0x7e0 [ 297.287633][ T7914] create_new_namespaces+0x20a/0xac0 [ 297.287656][ T7914] ? security_capable+0x80/0x260 [ 297.287677][ T7914] unshare_nsproxy_namespaces+0xf2/0x220 [ 297.287699][ T7914] ksys_unshare+0x438/0xab0 [ 297.287725][ T7914] ? __pfx_ksys_unshare+0x10/0x10 [ 297.287746][ T7914] ? fput+0x79/0x100 [ 297.287763][ T7914] ? ksys_write+0x1ac/0x250 [ 297.287774][ T7914] ? __pfx_ksys_write+0x10/0x10 [ 297.287788][ T7914] __ia32_sys_unshare+0x30/0x40 [ 297.287804][ T7914] __do_fast_syscall_32+0xe7/0x970 [ 297.287824][ T7914] ? lockdep_hardirqs_on+0x78/0x100 [ 297.287841][ T7914] do_fast_syscall_32+0x32/0x70 [ 297.287859][ T7914] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 297.287877][ T7914] RIP: 0023:0xf702efec [ 297.287901][ T7914] Code: Unable to access opcode bytes at 0xf702efc2. [ 297.287911][ T7914] RSP: 002b:00000000f53fc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000136 [ 297.287929][ T7914] RAX: ffffffffffffffda RBX: 000000006a040200 RCX: 0000000000000000 [ 297.287941][ T7914] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 297.287951][ T7914] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 297.287962][ T7914] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 297.287972][ T7914] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 297.287988][ T7914] [ 298.259684][ T7925] netlink: 4 bytes leftover after parsing attributes in process `syz.3.418'. [ 298.468223][ T7925] batadv0: entered promiscuous mode [ 298.530730][ T7925] macsec1: entered promiscuous mode [ 298.536538][ T7925] macsec1: entered allmulticast mode [ 298.568781][ T7925] batadv0: entered allmulticast mode [ 298.575243][ T7925] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 298.712062][ T7925] batadv0: left allmulticast mode [ 298.714525][ T7925] batadv0: left promiscuous mode [ 299.143910][ T7932] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 299.190044][ T5874] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 299.366248][ T5874] usb 10-1: Using ep0 maxpacket: 16 [ 299.376596][ T5874] usb 10-1: no configurations [ 299.380255][ T5874] usb 10-1: can't read configurations, error -22 [ 299.590236][ T5874] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 299.788725][ T5874] usb 10-1: Using ep0 maxpacket: 16 [ 299.791992][ T5874] usb 10-1: no configurations [ 299.794501][ T5874] usb 10-1: can't read configurations, error -22 [ 299.823007][ T5874] usb usb10-port1: attempt power cycle [ 299.830414][ T7940] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 300.206967][ T5874] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 300.274528][ T5874] usb 10-1: Using ep0 maxpacket: 16 [ 300.289184][ T5874] usb 10-1: no configurations [ 300.338566][ T5874] usb 10-1: can't read configurations, error -22 [ 300.487770][ T5874] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 300.550721][ T5874] usb 10-1: Using ep0 maxpacket: 16 [ 300.556529][ T5874] usb 10-1: no configurations [ 300.560017][ T5874] usb 10-1: can't read configurations, error -22 [ 300.565163][ T5874] usb usb10-port1: unable to enumerate USB device [ 300.676979][ T7960] syz.2.427 uses obsolete (PF_INET,SOCK_PACKET) [ 301.634876][ T7994] trusted_key: encrypted_key: master key parameter 'truited:syz' is invalid [ 301.693728][ T7994] trusted_key: encrypted_key: master key parameter 'defauht' is invalid [ 301.730172][ T7991] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 302.109376][ T8003] binder: 8001:8003 ioctl c0306201 80000040 returned -22 [ 302.165693][ T8006] binder: 8001:8006 ioctl c0306201 80000640 returned -22 [ 302.212169][ T8003] CIFS: Attempting to mount //127.0.0.1/share [ 302.897159][ T8003] CIFS: VFS: cifs_mount failed w/return code = -112 [ 303.196386][ T8017] netlink: 4 bytes leftover after parsing attributes in process `syz.2.437'. [ 303.231092][ T8017] netlink: 4 bytes leftover after parsing attributes in process `syz.2.437'. [ 303.423752][ T8027] gretap1: entered promiscuous mode [ 303.511546][ T8030] FAULT_INJECTION: forcing a failure. [ 303.511546][ T8030] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 303.546165][ T8030] CPU: 2 UID: 0 PID: 8030 Comm: syz.4.442 Tainted: G L syzkaller #0 PREEMPT(full) [ 303.546203][ T8030] Tainted: [L]=SOFTLOCKUP [ 303.546212][ T8030] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 303.546225][ T8030] Call Trace: [ 303.546235][ T8030] [ 303.546245][ T8030] dump_stack_lvl+0x100/0x190 [ 303.546280][ T8030] should_fail_ex.cold+0x5/0xa [ 303.546306][ T8030] ? __pfx_tun_chr_compat_ioctl+0x10/0x10 [ 303.546338][ T8030] _copy_from_user+0x2e/0xd0 [ 303.546373][ T8030] ? __pfx_tun_chr_compat_ioctl+0x10/0x10 [ 303.546400][ T8030] __tun_chr_ioctl+0x1df/0x47c0 [ 303.546426][ T8030] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 303.546464][ T8030] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 303.546493][ T8030] ? hook_file_ioctl_common+0x140/0x440 [ 303.546532][ T8030] ? __fget_files+0x21f/0x3d0 [ 303.546580][ T8030] ? __pfx_tun_chr_compat_ioctl+0x10/0x10 [ 303.546609][ T8030] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 303.546646][ T8030] __do_fast_syscall_32+0xe7/0x970 [ 303.546678][ T8030] ? lockdep_hardirqs_on+0x78/0x100 [ 303.546710][ T8030] do_fast_syscall_32+0x32/0x70 [ 303.546745][ T8030] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 303.546776][ T8030] RIP: 0023:0xf708efec [ 303.546807][ T8030] Code: Unable to access opcode bytes at 0xf708efc2. [ 303.546819][ T8030] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 303.546843][ T8030] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000400454ca [ 303.546859][ T8030] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 303.546873][ T8030] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 303.546886][ T8030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 303.546900][ T8030] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 303.546931][ T8030] [ 304.552271][ T8057] CIFS: Attempting to mount //127.0.0.1/share [ 304.582672][ T8053] binder: 8051:8053 ioctl c0306201 80000040 returned -14 [ 304.805722][ T8063] fuse: Unknown parameter 'nQ' [ 304.887966][ T8045] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 305.342180][ T8057] CIFS: VFS: cifs_mount failed w/return code = -112 [ 307.713390][ T8098] ucma_write: process 511 (syz.2.459) changed security contexts after opening file descriptor, this is not allowed. [ 308.674421][ T8116] FAULT_INJECTION: forcing a failure. [ 308.674421][ T8116] name failslab, interval 1, probability 0, space 0, times 0 [ 308.742842][ T8116] CPU: 0 UID: 0 PID: 8116 Comm: syz.5.464 Tainted: G L syzkaller #0 PREEMPT(full) [ 308.742876][ T8116] Tainted: [L]=SOFTLOCKUP [ 308.742883][ T8116] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 308.742894][ T8116] Call Trace: [ 308.742901][ T8116] [ 308.742908][ T8116] dump_stack_lvl+0x100/0x190 [ 308.742935][ T8116] should_fail_ex.cold+0x5/0xa [ 308.742957][ T8116] should_failslab+0xc2/0x120 [ 308.742981][ T8116] __kmalloc_cache_noprof+0x91/0x6c0 [ 308.743000][ T8116] ? nvmf_dev_write+0x14c/0xb60 [ 308.743030][ T8116] nvmf_dev_write+0x14c/0xb60 [ 308.743060][ T8116] vfs_write+0x2aa/0x1050 [ 308.743079][ T8116] ? __pfx_nvmf_dev_write+0x10/0x10 [ 308.743107][ T8116] ? __pfx_vfs_write+0x10/0x10 [ 308.743122][ T8116] ? find_held_lock+0x2b/0x80 [ 308.743145][ T8116] ? __fget_files+0x215/0x3d0 [ 308.743162][ T8116] ? __fget_files+0x215/0x3d0 [ 308.743183][ T8116] ? __fget_files+0x21f/0x3d0 [ 308.743206][ T8116] ksys_write+0x12a/0x250 [ 308.743223][ T8116] ? __pfx_ksys_write+0x10/0x10 [ 308.743239][ T8116] ? ksys_write+0x1ac/0x250 [ 308.743256][ T8116] ? __pfx_ksys_write+0x10/0x10 [ 308.743278][ T8116] __do_fast_syscall_32+0xe7/0x970 [ 308.743306][ T8116] ? lockdep_hardirqs_on+0x78/0x100 [ 308.743332][ T8116] do_fast_syscall_32+0x32/0x70 [ 308.743357][ T8116] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 308.743380][ T8116] RIP: 0023:0xf702efec [ 308.743402][ T8116] Code: Unable to access opcode bytes at 0xf702efc2. [ 308.743410][ T8116] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 308.743428][ T8116] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000780 [ 308.743439][ T8116] RDX: 000000000000001a RSI: 0000000000000000 RDI: 0000000000000000 [ 308.743449][ T8116] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 308.743459][ T8116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 308.743468][ T8116] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 308.743491][ T8116] [ 309.113337][ T8124] netlink: 8 bytes leftover after parsing attributes in process `syz.4.463'. [ 309.114582][ T8124] netlink: 8 bytes leftover after parsing attributes in process `syz.4.463'. [ 309.114972][ T8124] netlink: 8 bytes leftover after parsing attributes in process `syz.4.463'. [ 309.115569][ T8124] netlink: 8 bytes leftover after parsing attributes in process `syz.4.463'. [ 309.524809][ T8122] Context (ID=0x0) not attached to queue pair (handle=0xffffffff:0x9) [ 309.966948][ T8139] FAULT_INJECTION: forcing a failure. [ 309.966948][ T8139] name failslab, interval 1, probability 0, space 0, times 0 [ 309.966986][ T8139] CPU: 1 UID: 0 PID: 8139 Comm: syz.4.469 Tainted: G L syzkaller #0 PREEMPT(full) [ 309.967014][ T8139] Tainted: [L]=SOFTLOCKUP [ 309.967021][ T8139] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 309.967032][ T8139] Call Trace: [ 309.967039][ T8139] [ 309.967045][ T8139] dump_stack_lvl+0x100/0x190 [ 309.967076][ T8139] should_fail_ex.cold+0x5/0xa [ 309.967098][ T8139] should_failslab+0xc2/0x120 [ 309.967125][ T8139] kmem_cache_alloc_noprof+0x91/0x6a0 [ 309.967146][ T8139] ? __might_fault+0xc5/0x140 [ 309.967165][ T8139] ? do_getname+0x35/0x390 [ 309.967191][ T8139] do_getname+0x35/0x390 [ 309.967217][ T8139] user_path_at+0x26/0x60 [ 309.967245][ T8139] __ia32_sys_mount+0x1fb/0x310 [ 309.967267][ T8139] ? __pfx___ia32_sys_mount+0x10/0x10 [ 309.967286][ T8139] ? ksys_write+0x1ac/0x250 [ 309.967302][ T8139] ? __pfx_ksys_write+0x10/0x10 [ 309.967322][ T8139] __do_fast_syscall_32+0xe7/0x970 [ 309.967349][ T8139] ? lockdep_hardirqs_on+0x78/0x100 [ 309.967375][ T8139] do_fast_syscall_32+0x32/0x70 [ 309.967398][ T8139] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 309.967421][ T8139] RIP: 0023:0xf708efec [ 309.967443][ T8139] Code: Unable to access opcode bytes at 0xf708efc2. [ 309.967451][ T8139] RSP: 002b:00000000f545c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 309.967470][ T8139] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000180 [ 309.967482][ T8139] RDX: 0000000000000000 RSI: 0000000000086022 RDI: 0000000080000040 [ 309.967493][ T8139] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 309.967503][ T8139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 309.967514][ T8139] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 309.967537][ T8139] [ 311.094491][ T8150] (syz.5.472,8150,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 311.230549][ T8159] FAULT_INJECTION: forcing a failure. [ 311.230549][ T8159] name failslab, interval 1, probability 0, space 0, times 0 [ 311.238867][ T8159] CPU: 2 UID: 0 PID: 8159 Comm: syz.2.475 Tainted: G L syzkaller #0 PREEMPT(full) [ 311.238897][ T8159] Tainted: [L]=SOFTLOCKUP [ 311.238903][ T8159] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 311.238913][ T8159] Call Trace: [ 311.238923][ T8159] [ 311.238931][ T8159] dump_stack_lvl+0x100/0x190 [ 311.238958][ T8159] should_fail_ex.cold+0x5/0xa [ 311.238979][ T8159] should_failslab+0xc2/0x120 [ 311.239003][ T8159] kmem_cache_alloc_noprof+0x91/0x6a0 [ 311.239023][ T8159] ? __might_fault+0xc5/0x140 [ 311.239042][ T8159] ? do_getname+0x35/0x390 [ 311.239071][ T8159] do_getname+0x35/0x390 [ 311.239090][ T8159] user_path_at+0x26/0x60 [ 311.239112][ T8159] __ia32_sys_mount+0x1fb/0x310 [ 311.239132][ T8159] ? __pfx___ia32_sys_mount+0x10/0x10 [ 311.239150][ T8159] ? ksys_write+0x1ac/0x250 [ 311.239164][ T8159] ? __pfx_ksys_write+0x10/0x10 [ 311.239186][ T8159] __do_fast_syscall_32+0xe7/0x970 [ 311.239213][ T8159] ? lockdep_hardirqs_on+0x78/0x100 [ 311.239238][ T8159] do_fast_syscall_32+0x32/0x70 [ 311.239260][ T8159] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 311.239282][ T8159] RIP: 0023:0xf706efec [ 311.239304][ T8159] Code: Unable to access opcode bytes at 0xf706efc2. [ 311.239312][ T8159] RSP: 002b:00000000f543c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 311.239327][ T8159] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000180 [ 311.239338][ T8159] RDX: 0000000000000000 RSI: 0000000000086022 RDI: 0000000080000040 [ 311.239350][ T8159] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 311.239360][ T8159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 311.239371][ T8159] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 311.239394][ T8159] [ 311.264828][ T8150] (syz.5.472,8150,0):ocfs2_fill_super:1177 ERROR: status = -22 [ 312.330001][ T41] audit: type=1800 audit(1785944272.387:10): pid=8165 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.476" name="host_addr" dev="configfs" ino=21575 res=0 errno=0 [ 312.354656][ T8165] tmpfs: Unknown parameter 'jr_blocks' [ 313.547116][ T8176] gretap1: entered promiscuous mode [ 313.894858][ T41] audit: type=1800 audit(1785944273.997:11): pid=8185 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.483" name="memory_backed" dev="configfs" ino=19718 res=0 errno=0 [ 313.925020][ T8185] netlink: 'syz.5.483': attribute type 1 has an invalid length. [ 313.960580][ T41] audit: type=1800 audit(1785944274.017:12): pid=8185 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.483" name="zoned" dev="configfs" ino=19719 res=0 errno=0 [ 313.969341][ T8185] netlink: 84 bytes leftover after parsing attributes in process `syz.5.483'. [ 313.986382][ T8185] netlink: 'syz.5.483': attribute type 2 has an invalid length. [ 313.989922][ T8185] netlink: 4 bytes leftover after parsing attributes in process `syz.5.483'. [ 314.030240][ T41] audit: type=1800 audit(1785944274.117:13): pid=8185 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.483" name="power" dev="configfs" ino=19725 res=0 errno=0 [ 314.050400][ T8185] null_blk: my_zoned_dev: using native zone append [ 314.269555][ T8185] null_blk: disk my_zoned_dev created [ 314.517186][ T8189] block device autoloading is deprecated and will be removed. [ 314.671739][ T8203] CIFS: Attempting to mount //127.0.0.1/share [ 314.679860][ T8202] binder: 8201:8202 ioctl c0306201 80000040 returned -14 [ 315.420599][ T8203] CIFS: VFS: cifs_mount failed w/return code = -512 [ 315.908740][ T8213] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 316.244635][ T8229] FAULT_INJECTION: forcing a failure. [ 316.244635][ T8229] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 316.271016][ T8229] CPU: 2 UID: 0 PID: 8229 Comm: syz.2.494 Tainted: G L syzkaller #0 PREEMPT(full) [ 316.271046][ T8229] Tainted: [L]=SOFTLOCKUP [ 316.271051][ T8229] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 316.271062][ T8229] Call Trace: [ 316.271071][ T8229] [ 316.271078][ T8229] dump_stack_lvl+0x100/0x190 [ 316.271105][ T8229] should_fail_ex.cold+0x5/0xa [ 316.271126][ T8229] _copy_from_iter+0x1f4/0x1690 [ 316.271156][ T8229] ? __asan_memset+0x23/0x50 [ 316.271175][ T8229] ? __pfx__copy_from_iter+0x10/0x10 [ 316.271198][ T8229] ? __pfx___alloc_skb+0x10/0x10 [ 316.271229][ T8229] netlink_sendmsg+0x808/0xda0 [ 316.271254][ T8229] ? __pfx_netlink_sendmsg+0x10/0x10 [ 316.271274][ T8229] ? apparmor_socket_sendmsg+0x15b/0x270 [ 316.271304][ T8229] ____sys_sendmsg+0xa4d/0xbe0 [ 316.271322][ T8229] ? __pfx_netlink_sendmsg+0x10/0x10 [ 316.271341][ T8229] ? __pfx_____sys_sendmsg+0x10/0x10 [ 316.271369][ T8229] ___sys_sendmsg+0x190/0x1e0 [ 316.271389][ T8229] ? __pfx____sys_sendmsg+0x10/0x10 [ 316.271418][ T8229] ? find_held_lock+0x2b/0x80 [ 316.271453][ T8229] __sys_sendmsg+0x160/0x210 [ 316.271477][ T8229] ? __pfx___sys_sendmsg+0x10/0x10 [ 316.271506][ T8229] ? __pfx_ksys_write+0x10/0x10 [ 316.271527][ T8229] __do_fast_syscall_32+0xe7/0x970 [ 316.271553][ T8229] ? lockdep_hardirqs_on+0x78/0x100 [ 316.271576][ T8229] do_fast_syscall_32+0x32/0x70 [ 316.271598][ T8229] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 316.271619][ T8229] RIP: 0023:0xf706efec [ 316.271642][ T8229] Code: Unable to access opcode bytes at 0xf706efc2. [ 316.271650][ T8229] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 316.271667][ T8229] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 316.271678][ T8229] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 316.271687][ T8229] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 316.271696][ T8229] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 316.271705][ T8229] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 316.271726][ T8229] [ 317.473547][ T8256] 9p: Bad value for 'rfdno' [ 318.865800][ T41] audit: type=1804 audit(1785944278.977:14): pid=8244 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.500" name="/newroot/74/cgroup.controllers" dev="tmpfs" ino=447 res=1 errno=0 [ 318.895350][ T41] audit: type=1800 audit(1785944278.977:15): pid=8244 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.500" name="cgroup.controllers" dev="tmpfs" ino=447 res=0 errno=0 [ 320.517483][ T8273] FAULT_INJECTION: forcing a failure. [ 320.517483][ T8273] name failslab, interval 1, probability 0, space 0, times 0 [ 320.585502][ T8273] CPU: 3 UID: 0 PID: 8273 Comm: syz.5.505 Tainted: G L syzkaller #0 PREEMPT(full) [ 320.585534][ T8273] Tainted: [L]=SOFTLOCKUP [ 320.585539][ T8273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 320.585549][ T8273] Call Trace: [ 320.585557][ T8273] [ 320.585566][ T8273] dump_stack_lvl+0x100/0x190 [ 320.585618][ T8273] should_fail_ex.cold+0x5/0xa [ 320.585638][ T8273] should_failslab+0xc2/0x120 [ 320.585662][ T8273] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 320.585687][ T8273] ? gadget_dev_desc_UDC_store+0x51/0x2e0 [ 320.585720][ T8273] kstrdup+0x51/0xe0 [ 320.585742][ T8273] gadget_dev_desc_UDC_store+0x51/0x2e0 [ 320.585767][ T8273] configfs_write_iter+0x302/0x4e0 [ 320.585789][ T8273] vfs_write+0x6ac/0x1050 [ 320.585805][ T8273] ? __pfx_configfs_write_iter+0x10/0x10 [ 320.585823][ T8273] ? __pfx_vfs_write+0x10/0x10 [ 320.585836][ T8273] ? find_held_lock+0x2b/0x80 [ 320.585873][ T8273] ksys_write+0x12a/0x250 [ 320.585888][ T8273] ? __pfx_ksys_write+0x10/0x10 [ 320.585901][ T8273] ? ksys_write+0x1ac/0x250 [ 320.585915][ T8273] ? __pfx_ksys_write+0x10/0x10 [ 320.585936][ T8273] __do_fast_syscall_32+0xe7/0x970 [ 320.585959][ T8273] ? lockdep_hardirqs_on+0x78/0x100 [ 320.585982][ T8273] do_fast_syscall_32+0x32/0x70 [ 320.586004][ T8273] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 320.586026][ T8273] RIP: 0023:0xf702efec [ 320.586047][ T8273] Code: Unable to access opcode bytes at 0xf702efc2. [ 320.586055][ T8273] RSP: 002b:00000000f53fc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 320.586071][ T8273] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800003c0 [ 320.586082][ T8273] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 320.586091][ T8273] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 320.586099][ T8273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 320.586109][ T8273] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 320.586131][ T8273] [ 321.385265][ T8276] bond1: entered promiscuous mode [ 324.668976][ T8308] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 324.672895][ T8308] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 324.680296][ T8308] vhci_hcd vhci_hcd.0: Device attached [ 324.751133][ T8308] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 324.847038][ T8308] netlink: 4 bytes leftover after parsing attributes in process `syz.3.510'. [ 325.008147][ T8327] vhci_hcd: connection closed [ 325.008645][ T5605] vhci_hcd vhci_hcd.3: stop threads [ 325.012528][ T5605] vhci_hcd vhci_hcd.3: release socket [ 325.016724][ T5605] vhci_hcd vhci_hcd.3: disconnect device [ 325.028565][ T1230] usb 44-1: enqueue for inactive port 0 [ 325.561215][ T1230] usb usb44-port1: attempt power cycle [ 326.194745][ T1230] usb usb44-port1: unable to enumerate USB device [ 328.166507][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 328.170128][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 329.054762][ T8359] usb usb1: usbfs: interface 0 claimed by hub while 'syz.4.522' sets config #1024 [ 329.255222][ T8365] FAULT_INJECTION: forcing a failure. [ 329.255222][ T8365] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 329.267640][ T8365] CPU: 0 UID: 0 PID: 8365 Comm: syz.3.524 Tainted: G L syzkaller #0 PREEMPT(full) [ 329.267677][ T8365] Tainted: [L]=SOFTLOCKUP [ 329.267684][ T8365] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 329.267696][ T8365] Call Trace: [ 329.267704][ T8365] [ 329.267712][ T8365] dump_stack_lvl+0x100/0x190 [ 329.267743][ T8365] should_fail_ex.cold+0x5/0xa [ 329.267767][ T8365] _copy_from_user+0x2e/0xd0 [ 329.267799][ T8365] get_compat_msghdr+0xb3/0x480 [ 329.267819][ T8365] ? __pfx_get_compat_msghdr+0x10/0x10 [ 329.267842][ T8365] ? _kstrtoull+0x13c/0x1f0 [ 329.277227][ T8365] ? __pfx__kstrtoull+0x10/0x10 [ 329.277253][ T8365] ___sys_sendmsg+0x1b6/0x1e0 [ 329.277277][ T8365] ? __pfx____sys_sendmsg+0x10/0x10 [ 329.277295][ T8365] ? __lock_acquire+0x49f/0x1a40 [ 329.277352][ T8365] __sys_sendmmsg+0x309/0x440 [ 329.277380][ T8365] ? __pfx___sys_sendmmsg+0x10/0x10 [ 329.277404][ T8365] ? find_held_lock+0x2b/0x80 [ 329.277432][ T8365] ? __mutex_unlock_slowpath+0x35d/0x930 [ 329.277470][ T8365] ? fput+0x79/0x100 [ 329.277490][ T8365] ? ksys_write+0x1ac/0x250 [ 329.277510][ T8365] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 329.277528][ T8365] ? lockdep_hardirqs_on+0x78/0x100 [ 329.277574][ T8365] __do_fast_syscall_32+0xe7/0x970 [ 329.277599][ T8365] ? lockdep_hardirqs_on+0x78/0x100 [ 329.277623][ T8365] do_fast_syscall_32+0x32/0x70 [ 329.277647][ T8365] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 329.277670][ T8365] RIP: 0023:0xf7f03fec [ 329.277693][ T8365] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 329.277700][ T8365] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 329.277718][ T8365] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 329.277729][ T8365] RDX: 000000000000009f RSI: 0000000000000000 RDI: 0000000000000000 [ 329.277739][ T8365] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 329.277748][ T8365] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 329.277758][ T8365] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 329.277781][ T8365] [ 329.294499][ T8363] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 329.311557][ T8359] netlink: 4 bytes leftover after parsing attributes in process `syz.4.522'. [ 329.618704][ T8359] bridge_slave_1: left allmulticast mode [ 329.621692][ T8359] bridge_slave_1: left promiscuous mode [ 329.631975][ T8359] bridge0: port 2(bridge_slave_1) entered disabled state [ 329.769303][ T42] Bluetooth: hci0: Frame reassembly failed (-84) [ 329.776498][ T8359] bridge_slave_0: left allmulticast mode [ 329.809937][ T8359] bridge_slave_0: left promiscuous mode [ 329.831326][ T8359] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.698019][ T8388] FAULT_INJECTION: forcing a failure. [ 330.698019][ T8388] name failslab, interval 1, probability 0, space 0, times 0 [ 330.705056][ T8388] CPU: 1 UID: 0 PID: 8388 Comm: syz.3.526 Tainted: G L syzkaller #0 PREEMPT(full) [ 330.705087][ T8388] Tainted: [L]=SOFTLOCKUP [ 330.705093][ T8388] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 330.705103][ T8388] Call Trace: [ 330.705113][ T8388] [ 330.705122][ T8388] dump_stack_lvl+0x100/0x190 [ 330.705149][ T8388] should_fail_ex.cold+0x5/0xa [ 330.705172][ T8388] should_failslab+0xc2/0x120 [ 330.705202][ T8388] kmem_cache_alloc_noprof+0x91/0x6a0 [ 330.705226][ T8388] ? trace_kmem_cache_alloc+0xdd/0x100 [ 330.705251][ T8388] ? security_file_alloc+0x34/0x2c0 [ 330.705281][ T8388] security_file_alloc+0x34/0x2c0 [ 330.705305][ T8388] init_file+0x95/0x480 [ 330.705328][ T8388] alloc_empty_file+0x79/0x1c0 [ 330.705351][ T8388] path_openat+0xe7/0x4280 [ 330.705370][ T8388] ? kasan_save_track+0x14/0x30 [ 330.705390][ T8388] ? __kasan_slab_alloc+0x89/0x90 [ 330.705411][ T8388] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 330.705432][ T8388] ? do_getname+0x35/0x390 [ 330.705452][ T8388] ? do_sys_openat2+0xc7/0x1e0 [ 330.705474][ T8388] ? __ia32_compat_sys_openat+0x12d/0x210 [ 330.705495][ T8388] ? __do_fast_syscall_32+0xe7/0x970 [ 330.705550][ T8388] ? __pfx_path_openat+0x10/0x10 [ 330.705576][ T8388] do_file_open+0x20e/0x430 [ 330.705592][ T8388] ? __lock_acquire+0x49f/0x1a40 [ 330.705622][ T8388] ? __pfx_do_file_open+0x10/0x10 [ 330.705656][ T8388] ? _raw_spin_unlock+0x28/0x50 [ 330.705676][ T8388] ? alloc_fd+0x471/0x7a0 [ 330.705699][ T8388] do_sys_openat2+0x10f/0x1e0 [ 330.705722][ T8388] ? __pfx_do_sys_openat2+0x10/0x10 [ 330.705748][ T8388] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 330.705778][ T8388] __ia32_compat_sys_openat+0x12d/0x210 [ 330.705804][ T8388] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 330.705827][ T8388] ? fput+0x79/0x100 [ 330.705848][ T8388] ? ksys_write+0x1ac/0x250 [ 330.705864][ T8388] ? __pfx_ksys_write+0x10/0x10 [ 330.705885][ T8388] __do_fast_syscall_32+0xe7/0x970 [ 330.705909][ T8388] ? lockdep_hardirqs_on+0x78/0x100 [ 330.705934][ T8388] do_fast_syscall_32+0x32/0x70 [ 330.705958][ T8388] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 330.705981][ T8388] RIP: 0023:0xf7f03fec [ 330.706004][ T8388] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 330.706012][ T8388] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 330.706031][ T8388] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000040 [ 330.706041][ T8388] RDX: 0000000000149002 RSI: 0000000000000000 RDI: 0000000000000000 [ 330.706052][ T8388] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 330.706061][ T8388] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 330.706070][ T8388] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 330.706092][ T8388] [ 331.280050][ T5777] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 331.800260][ T5777] Bluetooth: hci0: command 0x1003 tx timeout [ 331.806881][ T5772] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 331.874336][ T41] audit: type=1326 audit(1785944291.907:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8395 comm="syz.3.530" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f03fec code=0x7ffc0000 [ 331.981590][ T41] audit: type=1326 audit(1785944291.907:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8395 comm="syz.3.530" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f03fec code=0x7ffc0000 [ 332.174746][ T41] audit: type=1326 audit(1785944292.027:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8395 comm="syz.3.530" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f03fec code=0x7ffc0000 [ 332.298848][ T41] audit: type=1326 audit(1785944292.027:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8395 comm="syz.3.530" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f03fec code=0x7ffc0000 [ 332.489570][ T41] audit: type=1326 audit(1785944292.027:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8395 comm="syz.3.530" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f03fec code=0x7ffc0000 [ 332.536395][ T41] audit: type=1326 audit(1785944292.027:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8395 comm="syz.3.530" exe="/syz-executor" sig=0 arch=40000003 syscall=242 compat=1 ip=0xf7f03fec code=0x7ffc0000 [ 332.578538][ T41] audit: type=1326 audit(1785944292.027:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8395 comm="syz.3.530" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f03fec code=0x7ffc0000 [ 332.608665][ T41] audit: type=1326 audit(1785944292.027:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8395 comm="syz.3.530" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f03fec code=0x7ffc0000 [ 332.646086][ T41] audit: type=1326 audit(1785944292.027:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8395 comm="syz.3.530" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f03fec code=0x7ffc0000 [ 332.660453][ T41] audit: type=1326 audit(1785944292.027:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8395 comm="syz.3.530" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f03fec code=0x7ffc0000 [ 333.246777][ T8416] FAULT_INJECTION: forcing a failure. [ 333.246777][ T8416] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 333.270926][ T8416] CPU: 3 UID: 0 PID: 8416 Comm: syz.5.534 Tainted: G L syzkaller #0 PREEMPT(full) [ 333.270959][ T8416] Tainted: [L]=SOFTLOCKUP [ 333.270965][ T8416] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 333.270976][ T8416] Call Trace: [ 333.270983][ T8416] [ 333.270990][ T8416] dump_stack_lvl+0x100/0x190 [ 333.271020][ T8416] should_fail_ex.cold+0x5/0xa [ 333.271043][ T8416] _copy_from_iter+0x1f4/0x1690 [ 333.271075][ T8416] ? __asan_memset+0x23/0x50 [ 333.271100][ T8416] ? __pfx__copy_from_iter+0x10/0x10 [ 333.271128][ T8416] ? __pfx___alloc_skb+0x10/0x10 [ 333.271169][ T8416] netlink_sendmsg+0x808/0xda0 [ 333.271198][ T8416] ? __pfx_netlink_sendmsg+0x10/0x10 [ 333.271222][ T8416] ? apparmor_socket_sendmsg+0x15b/0x270 [ 333.271248][ T8416] ____sys_sendmsg+0xa4d/0xbe0 [ 333.271268][ T8416] ? __pfx_netlink_sendmsg+0x10/0x10 [ 333.271293][ T8416] ? __pfx_____sys_sendmsg+0x10/0x10 [ 333.271324][ T8416] ___sys_sendmsg+0x190/0x1e0 [ 333.271346][ T8416] ? __pfx____sys_sendmsg+0x10/0x10 [ 333.271379][ T8416] ? find_held_lock+0x2b/0x80 [ 333.271419][ T8416] __sys_sendmsg+0x160/0x210 [ 333.271447][ T8416] ? __pfx___sys_sendmsg+0x10/0x10 [ 333.271481][ T8416] ? __pfx_ksys_write+0x10/0x10 [ 333.271504][ T8416] __do_fast_syscall_32+0xe7/0x970 [ 333.271533][ T8416] ? lockdep_hardirqs_on+0x78/0x100 [ 333.271558][ T8416] do_fast_syscall_32+0x32/0x70 [ 333.271583][ T8416] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 333.271607][ T8416] RIP: 0023:0xf702efec [ 333.271632][ T8416] Code: Unable to access opcode bytes at 0xf702efc2. [ 333.271641][ T8416] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 333.271659][ T8416] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 333.271670][ T8416] RDX: 0000000024004800 RSI: 0000000000000000 RDI: 0000000000000000 [ 333.271680][ T8416] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 333.271690][ T8416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 333.271701][ T8416] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 333.271725][ T8416] [ 334.134071][ T8433] binder: 8431:8433 ioctl c0306201 80000040 returned -14 [ 334.144051][ T8434] CIFS: Attempting to mount //127.0.0.1/share [ 334.144237][ T8427] memory length for this resource is wrong [ 334.225088][ T8427] isp1760 0000:00:03.0: probe with driver isp1760 failed with error -12 [ 334.747951][ T8429] socket: no more sockets [ 334.913614][ T8434] CIFS: VFS: cifs_mount failed w/return code = -112 [ 335.400915][ T8449] FAULT_INJECTION: forcing a failure. [ 335.400915][ T8449] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 335.411230][ T8449] CPU: 3 UID: 0 PID: 8449 Comm: syz.4.544 Tainted: G L syzkaller #0 PREEMPT(full) [ 335.411264][ T8449] Tainted: [L]=SOFTLOCKUP [ 335.411271][ T8449] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 335.411281][ T8449] Call Trace: [ 335.411288][ T8449] [ 335.411301][ T8449] dump_stack_lvl+0x100/0x190 [ 335.411330][ T8449] should_fail_ex.cold+0x5/0xa [ 335.411353][ T8449] _copy_from_iter+0x1f4/0x1690 [ 335.411385][ T8449] ? __asan_memset+0x23/0x50 [ 335.411407][ T8449] ? __pfx__copy_from_iter+0x10/0x10 [ 335.411434][ T8449] ? __pfx___alloc_skb+0x10/0x10 [ 335.411470][ T8449] netlink_sendmsg+0x808/0xda0 [ 335.411497][ T8449] ? __pfx_netlink_sendmsg+0x10/0x10 [ 335.411521][ T8449] ? apparmor_socket_sendmsg+0x15b/0x270 [ 335.411547][ T8449] ____sys_sendmsg+0xa4d/0xbe0 [ 335.411566][ T8449] ? __pfx_netlink_sendmsg+0x10/0x10 [ 335.411589][ T8449] ? __pfx_____sys_sendmsg+0x10/0x10 [ 335.411620][ T8449] ___sys_sendmsg+0x190/0x1e0 [ 335.411642][ T8449] ? __pfx____sys_sendmsg+0x10/0x10 [ 335.411674][ T8449] ? find_held_lock+0x2b/0x80 [ 335.411713][ T8449] __sys_sendmsg+0x160/0x210 [ 335.411740][ T8449] ? __pfx___sys_sendmsg+0x10/0x10 [ 335.411772][ T8449] ? __pfx_ksys_write+0x10/0x10 [ 335.411795][ T8449] __do_fast_syscall_32+0xe7/0x970 [ 335.411822][ T8449] ? lockdep_hardirqs_on+0x78/0x100 [ 335.411848][ T8449] do_fast_syscall_32+0x32/0x70 [ 335.411873][ T8449] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 335.411896][ T8449] RIP: 0023:0xf708efec [ 335.411920][ T8449] Code: Unable to access opcode bytes at 0xf708efc2. [ 335.411929][ T8449] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 335.411947][ T8449] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000500 [ 335.411958][ T8449] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 335.411968][ T8449] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 335.411977][ T8449] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 335.411987][ T8449] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 335.412009][ T8449] [ 336.020033][ T8455] FAULT_INJECTION: forcing a failure. [ 336.020033][ T8455] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 336.024932][ T8455] CPU: 3 UID: 0 PID: 8455 Comm: syz.4.545 Tainted: G L syzkaller #0 PREEMPT(full) [ 336.024962][ T8455] Tainted: [L]=SOFTLOCKUP [ 336.024968][ T8455] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 336.024979][ T8455] Call Trace: [ 336.024988][ T8455] [ 336.024996][ T8455] dump_stack_lvl+0x100/0x190 [ 336.025025][ T8455] should_fail_ex.cold+0x5/0xa [ 336.025047][ T8455] _copy_from_iter+0x1f4/0x1690 [ 336.025078][ T8455] ? __asan_memset+0x23/0x50 [ 336.025098][ T8455] ? __pfx__copy_from_iter+0x10/0x10 [ 336.025125][ T8455] ? __pfx___alloc_skb+0x10/0x10 [ 336.025158][ T8455] netlink_sendmsg+0x808/0xda0 [ 336.025186][ T8455] ? __pfx_netlink_sendmsg+0x10/0x10 [ 336.025209][ T8455] ? apparmor_socket_sendmsg+0x15b/0x270 [ 336.025233][ T8455] ____sys_sendmsg+0xa4d/0xbe0 [ 336.025252][ T8455] ? __pfx_netlink_sendmsg+0x10/0x10 [ 336.025274][ T8455] ? __pfx_____sys_sendmsg+0x10/0x10 [ 336.025304][ T8455] ___sys_sendmsg+0x190/0x1e0 [ 336.025326][ T8455] ? __pfx____sys_sendmsg+0x10/0x10 [ 336.025358][ T8455] ? find_held_lock+0x2b/0x80 [ 336.025393][ T8455] __sys_sendmsg+0x160/0x210 [ 336.025417][ T8455] ? __pfx___sys_sendmsg+0x10/0x10 [ 336.025445][ T8455] ? __pfx_ksys_write+0x10/0x10 [ 336.025466][ T8455] __do_fast_syscall_32+0xe7/0x970 [ 336.025492][ T8455] ? lockdep_hardirqs_on+0x78/0x100 [ 336.026070][ T8455] do_fast_syscall_32+0x32/0x70 [ 336.026095][ T8455] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 336.026119][ T8455] RIP: 0023:0xf708efec [ 336.026141][ T8455] Code: Unable to access opcode bytes at 0xf708efc2. [ 336.026148][ T8455] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 336.026165][ T8455] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 336.026175][ T8455] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 336.026184][ T8455] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 336.026193][ T8455] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 336.026203][ T8455] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 336.026225][ T8455] [ 337.396702][ T8473] netlink: 4 bytes leftover after parsing attributes in process `syz.3.549'. [ 338.502311][ T8484] netlink: 8 bytes leftover after parsing attributes in process `syz.3.553'. [ 339.605412][ T8499] FAULT_INJECTION: forcing a failure. [ 339.605412][ T8499] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 339.612304][ T8499] CPU: 3 UID: 0 PID: 8499 Comm: syz.5.556 Tainted: G L syzkaller #0 PREEMPT(full) [ 339.612334][ T8499] Tainted: [L]=SOFTLOCKUP [ 339.612339][ T8499] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 339.612350][ T8499] Call Trace: [ 339.612357][ T8499] [ 339.612365][ T8499] dump_stack_lvl+0x100/0x190 [ 339.612392][ T8499] should_fail_ex.cold+0x5/0xa [ 339.612413][ T8499] _copy_from_iter+0x1f4/0x1690 [ 339.612443][ T8499] ? __asan_memset+0x23/0x50 [ 339.612463][ T8499] ? __pfx__copy_from_iter+0x10/0x10 [ 339.612488][ T8499] ? __pfx___alloc_skb+0x10/0x10 [ 339.612521][ T8499] netlink_sendmsg+0x808/0xda0 [ 339.612546][ T8499] ? __pfx_netlink_sendmsg+0x10/0x10 [ 339.612568][ T8499] ? apparmor_socket_sendmsg+0x15b/0x270 [ 339.612591][ T8499] ____sys_sendmsg+0xa4d/0xbe0 [ 339.612609][ T8499] ? __pfx_netlink_sendmsg+0x10/0x10 [ 339.612629][ T8499] ? __pfx_____sys_sendmsg+0x10/0x10 [ 339.612654][ T8499] ___sys_sendmsg+0x190/0x1e0 [ 339.612674][ T8499] ? __pfx____sys_sendmsg+0x10/0x10 [ 339.612702][ T8499] ? find_held_lock+0x2b/0x80 [ 339.612737][ T8499] __sys_sendmsg+0x160/0x210 [ 339.612762][ T8499] ? __pfx___sys_sendmsg+0x10/0x10 [ 339.612791][ T8499] ? __pfx_ksys_write+0x10/0x10 [ 339.612812][ T8499] __do_fast_syscall_32+0xe7/0x970 [ 339.612838][ T8499] ? lockdep_hardirqs_on+0x78/0x100 [ 339.612862][ T8499] do_fast_syscall_32+0x32/0x70 [ 339.612884][ T8499] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 339.612906][ T8499] RIP: 0023:0xf702efec [ 339.612930][ T8499] Code: Unable to access opcode bytes at 0xf702efc2. [ 339.612938][ T8499] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 339.612955][ T8499] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 339.612966][ T8499] RDX: 000000000000c804 RSI: 0000000000000000 RDI: 0000000000000000 [ 339.612976][ T8499] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 339.612986][ T8499] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 339.612995][ T8499] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 339.613016][ T8499] [ 339.720143][ T1493] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 340.311297][ T8507] binder: 8506:8507 ioctl c0306201 80000040 returned -14 [ 340.329063][ T8507] CIFS: Attempting to mount //127.0.0.1/share [ 340.972813][ T8507] CIFS: VFS: cifs_mount failed w/return code = -112 [ 341.260366][ T8527] netlink: 8 bytes leftover after parsing attributes in process `syz.3.562'. [ 350.512066][ T8552] netlink: 36 bytes leftover after parsing attributes in process `syz.4.564'. [ 351.093600][ T8578] netlink: 48 bytes leftover after parsing attributes in process `syz.3.568'. [ 351.243804][ T8580] netlink: 12 bytes leftover after parsing attributes in process `syz.3.569'. [ 351.357129][ T8582] netlink: 44 bytes leftover after parsing attributes in process `syz.3.569'. [ 352.263643][ T8585] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 352.272945][ T8585] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 352.276481][ T8585] vhci_hcd vhci_hcd.0: Device attached [ 352.542947][ T8597] FAULT_INJECTION: forcing a failure. [ 352.542947][ T8597] name failslab, interval 1, probability 0, space 0, times 0 [ 352.551152][ T8597] CPU: 2 UID: 0 PID: 8597 Comm: syz.3.571 Tainted: G L syzkaller #0 PREEMPT(full) [ 352.551183][ T8597] Tainted: [L]=SOFTLOCKUP [ 352.551189][ T8597] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 352.551199][ T8597] Call Trace: [ 352.551207][ T8597] [ 352.551214][ T8597] dump_stack_lvl+0x100/0x190 [ 352.551244][ T8597] should_fail_ex.cold+0x5/0xa [ 352.551266][ T8597] should_failslab+0xc2/0x120 [ 352.551289][ T8597] __kmalloc_noprof+0xfc/0x820 [ 352.551317][ T8597] ? trace_kmalloc+0xeb/0x110 [ 352.551340][ T8597] ? lsm_blob_alloc+0x68/0x90 [ 352.551361][ T8597] lsm_blob_alloc+0x68/0x90 [ 352.551378][ T8597] security_sk_alloc+0x2d/0x290 [ 352.551399][ T8597] sk_prot_alloc+0x12a/0x2a0 [ 352.551424][ T8597] sk_alloc+0x36/0xe80 [ 352.551447][ T8597] __netlink_create+0x5e/0x2c0 [ 352.551474][ T8597] ? __wake_up+0x3f/0x60 [ 352.551499][ T8597] netlink_create+0x29b/0x610 [ 352.551516][ T8597] ? __pfx_rtnetlink_bind+0x10/0x10 [ 352.551541][ T8597] __sock_create+0x339/0x860 [ 352.551566][ T8597] __sys_socket+0x14d/0x260 [ 352.551586][ T8597] ? __pfx___sys_socket+0x10/0x10 [ 352.551603][ T8597] ? fput+0x79/0x100 [ 352.551622][ T8597] ? ksys_write+0x1ac/0x250 [ 352.551638][ T8597] ? __pfx_ksys_write+0x10/0x10 [ 352.551657][ T8597] __ia32_sys_socket+0x72/0xb0 [ 352.551675][ T8597] ? lockdep_hardirqs_on+0x78/0x100 [ 352.551702][ T8597] __do_fast_syscall_32+0xe7/0x970 [ 352.551725][ T8597] ? lockdep_hardirqs_on+0x78/0x100 [ 352.551748][ T8597] do_fast_syscall_32+0x32/0x70 [ 352.551771][ T8597] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 352.551794][ T8597] RIP: 0023:0xf7f03fec [ 352.551818][ T8597] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 352.551826][ T8597] RSP: 002b:00000000f53a150c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 352.551844][ T8597] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 0000000000000003 [ 352.551854][ T8597] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 352.551863][ T8597] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 352.551872][ T8597] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 352.551882][ T8597] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 352.551903][ T8597] [ 352.944569][ T8591] vhci_hcd: connection closed [ 352.944898][ T5605] vhci_hcd vhci_hcd.4: stop threads [ 352.949414][ T5605] vhci_hcd vhci_hcd.4: release socket [ 352.951737][ T5605] vhci_hcd vhci_hcd.4: disconnect device [ 354.157719][ T8628] netlink: 'syz.2.578': attribute type 1 has an invalid length. [ 354.255937][ T8635] netlink: 'syz.2.578': attribute type 10 has an invalid length. [ 354.326202][ T8635] netlink: 40 bytes leftover after parsing attributes in process `syz.2.578'. [ 354.431974][ T8628] 8021q: adding VLAN 0 to HW filter on device bond2 [ 354.490975][ T8632] bond2: (slave dummy0): Enslaving as a backup interface with an up link [ 354.523071][ T5843] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 354.590730][ T8635] dummy0: entered promiscuous mode [ 354.641879][ T5843] bond2: (slave dummy0): link status up again after 0 ms [ 354.685553][ T5843] bond2: (slave dummy0): link status up again after 0 ms [ 354.695372][ T5843] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 354.710509][ T5843] bond2: (slave dummy0): link status up again after 0 ms [ 354.757773][ T5843] bond2: (slave dummy0): link status up again after 0 ms [ 354.831341][ T5843] bond2: (slave dummy0): link status up again after 0 ms [ 354.867413][ T5843] bond2: (slave dummy0): link status up again after 0 ms [ 354.889370][ T5843] bond2: (slave dummy0): link status up again after 0 ms [ 354.918941][ T5843] bond2: (slave dummy0): link status up again after 0 ms [ 355.214034][ T8635] bond2: (slave dummy0): Removing an active aggregator [ 355.323447][ T8635] bond2: (slave dummy0): Releasing backup interface [ 355.423454][ T8650] netlink: 24 bytes leftover after parsing attributes in process `syz.3.581'. [ 356.244026][ T8656] binder: 8655:8656 ioctl c0306201 80000040 returned -14 [ 356.248707][ T8656] CIFS: Attempting to mount //127.0.0.1/share [ 356.960614][ T8656] CIFS: VFS: cifs_mount failed w/return code = -112 [ 358.025995][ T8693] veth0: entered promiscuous mode [ 358.144114][ T5915] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 358.167314][ T8690] veth0: left promiscuous mode [ 358.361520][ T5915] usb 10-1: Using ep0 maxpacket: 16 [ 358.521019][ T5915] usb 10-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 358.578480][ T5915] usb 10-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 358.696836][ T5915] usb 10-1: Product: syz [ 358.699619][ T5915] usb 10-1: Manufacturer: syz [ 358.702321][ T5915] usb 10-1: SerialNumber: syz [ 358.713892][ T5915] usb 10-1: config 0 descriptor?? [ 359.312903][ T8709] netlink: 4 bytes leftover after parsing attributes in process `syz.4.595'. [ 359.379846][ T8705] isofs_fill_super: bread failed, dev=sr0, iso_blknum=32, block=32 [ 359.391594][ T8709] netlink: 20 bytes leftover after parsing attributes in process `syz.4.595'. [ 359.736105][ T8703] net_ratelimit: 13 callbacks suppressed [ 359.736130][ T8703] socket: no more sockets [ 360.053095][ T8712] binder: 8711:8712 ioctl c0306201 80000040 returned -14 [ 360.084709][ T8712] CIFS: Attempting to mount //127.0.0.1/share [ 360.691142][ T43] usb 10-1: USB disconnect, device number 6 [ 360.851101][ T8712] CIFS: VFS: cifs_mount failed w/return code = -112 [ 361.370253][ T41] kauditd_printk_skb: 19 callbacks suppressed [ 361.370273][ T41] audit: type=1800 audit(1785944321.467:45): pid=8737 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.599" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 361.516108][ T8741] netlink: 4 bytes leftover after parsing attributes in process `syz.5.605'. [ 362.304409][ T8749] sysfs: Unknown parameter '' [ 362.343240][ T8749] Invalid option length (1047276) for dns_resolver key [ 362.593694][ T8752] gretap1: entered promiscuous mode [ 362.674169][ T8750] socket: no more sockets [ 362.787039][ T8755] binder: 8754:8755 ioctl c0306201 80000040 returned -14 [ 362.810462][ T8755] CIFS: Attempting to mount //127.0.0.1/share [ 362.832607][ T8759] sysfs: Unknown parameter '' [ 362.836968][ T8759] FAULT_INJECTION: forcing a failure. [ 362.836968][ T8759] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 362.847925][ T8759] CPU: 2 UID: 0 PID: 8759 Comm: syz.4.611 Tainted: G L syzkaller #0 PREEMPT(full) [ 362.847956][ T8759] Tainted: [L]=SOFTLOCKUP [ 362.847963][ T8759] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 362.847974][ T8759] Call Trace: [ 362.847980][ T8759] [ 362.847987][ T8759] dump_stack_lvl+0x100/0x190 [ 362.848018][ T8759] should_fail_ex.cold+0x5/0xa [ 362.848041][ T8759] strncpy_from_user+0x3b/0x2d0 [ 362.848074][ T8759] __do_sys_add_key+0xd4/0x460 [ 362.848101][ T8759] ? __pfx___do_sys_add_key+0x10/0x10 [ 362.848119][ T8759] ? fput+0x79/0x100 [ 362.848142][ T8759] ? __pfx_ksys_write+0x10/0x10 [ 362.848164][ T8759] __do_fast_syscall_32+0xe7/0x970 [ 362.848191][ T8759] ? lockdep_hardirqs_on+0x78/0x100 [ 362.848217][ T8759] do_fast_syscall_32+0x32/0x70 [ 362.848242][ T8759] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 362.848266][ T8759] RIP: 0023:0xf708efec [ 362.848291][ T8759] Code: Unable to access opcode bytes at 0xf708efc2. [ 362.848299][ T8759] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 000000000000011e [ 362.848318][ T8759] RAX: ffffffffffffffda RBX: 0000000080000080 RCX: 0000000000000000 [ 362.848328][ T8759] RDX: 0000000080000100 RSI: 00000000000fffff RDI: 00000000ffffffff [ 362.848360][ T8759] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 362.848369][ T8759] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 362.848379][ T8759] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 362.848402][ T8759] [ 363.547698][ T8755] CIFS: VFS: cifs_mount failed w/return code = -112 [ 363.701631][ T8771] ip6gretap1: entered allmulticast mode [ 363.715782][ T8771] batman_adv: batadv0: Adding interface: ip6gretap1 [ 363.720489][ T8771] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.768673][ T44] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 363.783624][ T8771] batman_adv: batadv0: Interface activated: ip6gretap1 [ 363.984379][ T8771] comedi comedi3: dt2815: I/O base address or length out of range [ 364.102892][ T44] usb 7-1: Using ep0 maxpacket: 8 [ 364.128678][ T44] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 364.132809][ T44] usb 7-1: config 0 has no interface number 0 [ 364.140466][ T44] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 364.210066][ T44] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 364.217731][ T44] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 364.246331][ T44] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 364.259998][ T44] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 364.269632][ T44] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 364.330547][ T44] usb 7-1: config 0 descriptor?? [ 364.403227][ T44] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 364.724415][ T8781] FAULT_INJECTION: forcing a failure. [ 364.724415][ T8781] name failslab, interval 1, probability 0, space 0, times 0 [ 364.748045][ T8781] CPU: 0 UID: 0 PID: 8781 Comm: syz.3.617 Tainted: G L syzkaller #0 PREEMPT(full) [ 364.748076][ T8781] Tainted: [L]=SOFTLOCKUP [ 364.748083][ T8781] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 364.748093][ T8781] Call Trace: [ 364.748100][ T8781] [ 364.748107][ T8781] dump_stack_lvl+0x100/0x190 [ 364.748141][ T8781] should_fail_ex.cold+0x5/0xa [ 364.748163][ T8781] should_failslab+0xc2/0x120 [ 364.748188][ T8781] __kvmalloc_node_noprof+0x116/0x970 [ 364.748214][ T8781] ? file_tty_write.isra.0+0x64e/0x890 [ 364.748247][ T8781] file_tty_write.isra.0+0x64e/0x890 [ 364.748270][ T8781] ? security_file_permission+0x76/0x210 [ 364.748296][ T8781] ? rw_verify_area+0xce/0x6d0 [ 364.748324][ T8781] vfs_write+0x6ac/0x1050 [ 364.748359][ T8781] ? __pfx_tty_write+0x10/0x10 [ 364.748385][ T8781] ? __pfx_vfs_write+0x10/0x10 [ 364.748399][ T8781] ? find_held_lock+0x2b/0x80 [ 364.748438][ T8781] ksys_write+0x12a/0x250 [ 364.748454][ T8781] ? __pfx_ksys_write+0x10/0x10 [ 364.748469][ T8781] ? ksys_write+0x1ac/0x250 [ 364.748485][ T8781] ? __pfx_ksys_write+0x10/0x10 [ 364.748506][ T8781] __do_fast_syscall_32+0xe7/0x970 [ 364.748532][ T8781] ? lockdep_hardirqs_on+0x78/0x100 [ 364.748557][ T8781] do_fast_syscall_32+0x32/0x70 [ 364.748582][ T8781] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 364.748605][ T8781] RIP: 0023:0xf7f03fec [ 364.748628][ T8781] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 364.748636][ T8781] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 364.748653][ T8781] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 364.748664][ T8781] RDX: 000000000000ff2e RSI: 0000000000000000 RDI: 0000000000000000 [ 364.748675][ T8781] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 364.748684][ T8781] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 364.748694][ T8781] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 364.748736][ T8781] [ 365.867800][ T8789] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 365.883912][ T8789] block device autoloading is deprecated and will be removed. [ 366.104052][ T8800] binder_alloc: binder_alloc_mmap_handler: 8799 80ffd000-81000000 already mapped failed -16 [ 366.153293][ T43] usb 7-1: USB disconnect, device number 19 [ 366.181066][ T43] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 366.404889][ T8806] CIFS: Attempting to mount //127.0.0.1/share [ 366.405978][ T8805] binder: 8804:8805 ioctl c0306201 80000040 returned -14 [ 367.211535][ T8821] FAULT_INJECTION: forcing a failure. [ 367.211535][ T8821] name failslab, interval 1, probability 0, space 0, times 0 [ 367.215996][ T8821] CPU: 2 UID: 0 PID: 8821 Comm: syz.2.626 Tainted: G L syzkaller #0 PREEMPT(full) [ 367.216031][ T8821] Tainted: [L]=SOFTLOCKUP [ 367.216037][ T8821] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 367.216048][ T8821] Call Trace: [ 367.216060][ T8821] [ 367.216070][ T8821] dump_stack_lvl+0x100/0x190 [ 367.216099][ T8821] should_fail_ex.cold+0x5/0xa [ 367.216123][ T8821] should_failslab+0xc2/0x120 [ 367.216150][ T8821] __kmalloc_noprof+0xfc/0x820 [ 367.216178][ T8821] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 367.216201][ T8821] ? sock_kmalloc+0x111/0x170 [ 367.216229][ T8821] sock_kmalloc+0x111/0x170 [ 367.216251][ T8821] alg_setsockopt+0x390/0xe80 [ 367.216279][ T8821] ? __pfx_alg_setsockopt+0x10/0x10 [ 367.216302][ T8821] ? aa_sock_opt_perm+0xfe/0x1b0 [ 367.216325][ T8821] ? __pfx_alg_setsockopt+0x10/0x10 [ 367.216349][ T8821] do_sock_setsockopt+0xf3/0x1d0 [ 367.216371][ T8821] __sys_setsockopt+0x119/0x190 [ 367.216403][ T8821] __ia32_sys_setsockopt+0xbc/0x160 [ 367.216429][ T8821] ? __do_fast_syscall_32+0x98/0x970 [ 367.216457][ T8821] ? lockdep_hardirqs_on+0x78/0x100 [ 367.216478][ T8821] __do_fast_syscall_32+0xe7/0x970 [ 367.216502][ T8821] ? lockdep_hardirqs_on+0x78/0x100 [ 367.216529][ T8821] do_fast_syscall_32+0x32/0x70 [ 367.216555][ T8821] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 367.216579][ T8821] RIP: 0023:0xf706efec [ 367.216606][ T8821] Code: Unable to access opcode bytes at 0xf706efc2. [ 367.216614][ T8821] RSP: 002b:00000000f543c50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 367.216635][ T8821] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000000117 [ 367.216646][ T8821] RDX: 0000000000000001 RSI: 00000000800004c0 RDI: 0000000000000004 [ 367.216656][ T8821] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 367.216667][ T8821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 367.216679][ T8821] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 367.216702][ T8821] [ 367.767036][ T8806] CIFS: VFS: cifs_mount failed w/return code = -512 [ 370.065781][ T5772] Bluetooth: hci1: command 0x0406 tx timeout [ 370.081543][ T8826] Bluetooth: hci1: Opcode 0x0401 failed: -110 [ 370.757789][ T8857] binder: 8856:8857 ioctl c0306201 80000040 returned -14 [ 370.763626][ T8862] CIFS: Attempting to mount //127.0.0.1/share [ 371.202626][ T8874] netlink: 4 bytes leftover after parsing attributes in process `syz.2.640'. [ 371.463982][ T8862] CIFS: VFS: cifs_mount failed w/return code = -112 [ 372.309472][ T8898] FAULT_INJECTION: forcing a failure. [ 372.309472][ T8898] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 372.314529][ T8898] CPU: 1 UID: 0 PID: 8898 Comm: syz.5.649 Tainted: G L syzkaller #0 PREEMPT(full) [ 372.314570][ T8898] Tainted: [L]=SOFTLOCKUP [ 372.314578][ T8898] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 372.314589][ T8898] Call Trace: [ 372.314595][ T8898] [ 372.314603][ T8898] dump_stack_lvl+0x100/0x190 [ 372.314631][ T8898] should_fail_ex.cold+0x5/0xa [ 372.314653][ T8898] _copy_to_user+0x32/0xd0 [ 372.314684][ T8898] simple_read_from_buffer+0xcb/0x170 [ 372.314717][ T8898] proc_fail_nth_read+0x1af/0x230 [ 372.314744][ T8898] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 372.314770][ T8898] ? rw_verify_area+0xce/0x6d0 [ 372.314796][ T8898] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 372.314821][ T8898] vfs_read+0x1e4/0xb40 [ 372.314841][ T8898] ? __pfx_vfs_read+0x10/0x10 [ 372.314856][ T8898] ? find_held_lock+0x2b/0x80 [ 372.314879][ T8898] ? __fget_files+0x215/0x3d0 [ 372.314902][ T8898] ? __fget_files+0x21f/0x3d0 [ 372.314924][ T8898] ksys_read+0x12a/0x250 [ 372.314941][ T8898] ? __pfx_ksys_read+0x10/0x10 [ 372.314965][ T8898] do_int80_emulation+0x14b/0x720 [ 372.314997][ T8898] asm_int80_emulation+0x1a/0x20 [ 372.315015][ T8898] RIP: 0023:0xf71674eb [ 372.315031][ T8898] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 372.315049][ T8898] RSP: 002b:00000000f541d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 372.315067][ T8898] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f541d5d0 [ 372.315078][ T8898] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 372.315088][ T8898] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 372.315098][ T8898] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 372.315108][ T8898] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 372.315133][ T8898] [ 372.675939][ T8896] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(2147484608.28.0), cmd(9) [ 373.210342][ T8912] netlink: 8 bytes leftover after parsing attributes in process `syz.3.653'. [ 373.488291][ T5772] Bluetooth: hci1: SCO packet for unknown connection handle 200 [ 373.900429][ T8915] socket: no more sockets [ 376.074815][ T8915] isofs_fill_super: bread failed, dev=sr0, iso_blknum=32, block=32 [ 377.346149][ T8930] netlink: 4 bytes leftover after parsing attributes in process `syz.2.659'. [ 377.714632][ T8942] FAULT_INJECTION: forcing a failure. [ 377.714632][ T8942] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 377.720583][ T8942] CPU: 0 UID: 0 PID: 8942 Comm: syz.2.664 Tainted: G L syzkaller #0 PREEMPT(full) [ 377.720614][ T8942] Tainted: [L]=SOFTLOCKUP [ 377.720620][ T8942] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 377.720631][ T8942] Call Trace: [ 377.720641][ T8942] [ 377.720648][ T8942] dump_stack_lvl+0x100/0x190 [ 377.720678][ T8942] should_fail_ex.cold+0x5/0xa [ 377.720700][ T8942] _copy_to_user+0x32/0xd0 [ 377.720729][ T8942] simple_read_from_buffer+0xcb/0x170 [ 377.720761][ T8942] proc_fail_nth_read+0x1af/0x230 [ 377.720786][ T8942] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 377.720810][ T8942] ? rw_verify_area+0xce/0x6d0 [ 377.720836][ T8942] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 377.720859][ T8942] vfs_read+0x1e4/0xb40 [ 377.720878][ T8942] ? __pfx_vfs_read+0x10/0x10 [ 377.720892][ T8942] ? find_held_lock+0x2b/0x80 [ 377.720914][ T8942] ? __fget_files+0x215/0x3d0 [ 377.720934][ T8942] ? __fget_files+0x21f/0x3d0 [ 377.720955][ T8942] ksys_read+0x12a/0x250 [ 377.720973][ T8942] ? __pfx_ksys_read+0x10/0x10 [ 377.720995][ T8942] do_int80_emulation+0x14b/0x720 [ 377.721023][ T8942] asm_int80_emulation+0x1a/0x20 [ 377.721041][ T8942] RIP: 0023:0xf71a74eb [ 377.721055][ T8942] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 377.721071][ T8942] RSP: 002b:00000000f545d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 377.721088][ T8942] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f545d5d0 [ 377.721099][ T8942] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 377.721108][ T8942] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 377.721118][ T8942] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 377.721127][ T8942] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 377.721150][ T8942] [ 378.109653][ T8928] socket: no more sockets [ 380.667482][ T8974] program syz.4.673 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 380.798902][ T8976] binder: 8975:8976 ioctl c0306201 80000040 returned -14 [ 380.803853][ T8978] CIFS: Attempting to mount //127.0.0.1/share [ 381.492208][ T8974] infiniband syz0: set active [ 381.504167][ T8974] infiniband syz0: added bond_slave_1 [ 381.515097][ T8974] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 381.533185][ T8974] infiniband syz0: Couldn't open port 1 [ 381.563327][ T8974] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 381.582926][ T8974] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 381.588833][ T8978] CIFS: VFS: cifs_mount failed w/return code = -112 [ 381.609607][ T8974] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 381.787142][ T8974] RDS/IB: syz0: added [ 381.789501][ T8974] smc: adding ib device syz0 with port count 1 [ 381.792407][ T8974] smc: ib device syz0 port 1 has no pnetid [ 382.209436][ T8988] FAULT_INJECTION: forcing a failure. [ 382.209436][ T8988] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 382.234869][ T8988] CPU: 0 UID: 0 PID: 8988 Comm: syz.2.676 Tainted: G L syzkaller #0 PREEMPT(full) [ 382.234905][ T8988] Tainted: [L]=SOFTLOCKUP [ 382.234912][ T8988] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 382.234924][ T8988] Call Trace: [ 382.234933][ T8988] [ 382.234941][ T8988] dump_stack_lvl+0x100/0x190 [ 382.234972][ T8988] should_fail_ex.cold+0x5/0xa [ 382.234997][ T8988] _copy_to_user+0x32/0xd0 [ 382.235030][ T8988] simple_read_from_buffer+0xcb/0x170 [ 382.235066][ T8988] proc_fail_nth_read+0x1af/0x230 [ 382.235094][ T8988] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 382.235131][ T8988] ? rw_verify_area+0xce/0x6d0 [ 382.235160][ T8988] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 382.235203][ T8988] vfs_read+0x1e4/0xb40 [ 382.235228][ T8988] ? __pfx_vfs_read+0x10/0x10 [ 382.235245][ T8988] ? find_held_lock+0x2b/0x80 [ 382.235272][ T8988] ? __fget_files+0x215/0x3d0 [ 382.235298][ T8988] ? __fget_files+0x21f/0x3d0 [ 382.235326][ T8988] ksys_read+0x12a/0x250 [ 382.235345][ T8988] ? __pfx_ksys_read+0x10/0x10 [ 382.235372][ T8988] do_int80_emulation+0x14b/0x720 [ 382.235406][ T8988] asm_int80_emulation+0x1a/0x20 [ 382.235427][ T8988] RIP: 0023:0xf71a74eb [ 382.235445][ T8988] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 382.235465][ T8988] RSP: 002b:00000000f545d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 382.235485][ T8988] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f545d5d0 [ 382.235499][ T8988] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 382.235510][ T8988] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 382.235522][ T8988] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 382.235534][ T8988] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 382.235561][ T8988] [ 382.646365][ T8992] FAULT_INJECTION: forcing a failure. [ 382.646365][ T8992] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 382.753521][ T8992] CPU: 0 UID: 0 PID: 8992 Comm: syz.2.678 Tainted: G L syzkaller #0 PREEMPT(full) [ 382.753553][ T8992] Tainted: [L]=SOFTLOCKUP [ 382.753559][ T8992] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 382.753571][ T8992] Call Trace: [ 382.753578][ T8992] [ 382.753585][ T8992] dump_stack_lvl+0x100/0x190 [ 382.753616][ T8992] should_fail_ex.cold+0x5/0xa [ 382.753637][ T8992] _copy_from_iter+0x1f4/0x1690 [ 382.753675][ T8992] ? __asan_memset+0x23/0x50 [ 382.753697][ T8992] ? __pfx__copy_from_iter+0x10/0x10 [ 382.753722][ T8992] ? __pfx___alloc_skb+0x10/0x10 [ 382.753755][ T8992] netlink_sendmsg+0x808/0xda0 [ 382.753780][ T8992] ? __pfx_netlink_sendmsg+0x10/0x10 [ 382.753803][ T8992] ? apparmor_socket_sendmsg+0x15b/0x270 [ 382.753824][ T8992] ____sys_sendmsg+0xa4d/0xbe0 [ 382.753858][ T8992] ? __pfx_netlink_sendmsg+0x10/0x10 [ 382.753879][ T8992] ? __pfx_____sys_sendmsg+0x10/0x10 [ 382.754108][ T8992] ___sys_sendmsg+0x190/0x1e0 [ 382.754126][ T8992] ? __pfx____sys_sendmsg+0x10/0x10 [ 382.754152][ T8992] ? find_held_lock+0x2b/0x80 [ 382.754186][ T8992] __sys_sendmsg+0x160/0x210 [ 382.754209][ T8992] ? __pfx___sys_sendmsg+0x10/0x10 [ 382.754235][ T8992] ? __pfx_ksys_write+0x10/0x10 [ 382.754254][ T8992] __do_fast_syscall_32+0xe7/0x970 [ 382.754278][ T8992] ? lockdep_hardirqs_on+0x78/0x100 [ 382.754299][ T8992] do_fast_syscall_32+0x32/0x70 [ 382.754319][ T8992] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 382.754339][ T8992] RIP: 0023:0xf706efec [ 382.754360][ T8992] Code: Unable to access opcode bytes at 0xf706efc2. [ 382.754367][ T8992] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 382.754384][ T8992] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000440 [ 382.754393][ T8992] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 382.754402][ T8992] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 382.754410][ T8992] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 382.754419][ T8992] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 382.754439][ T8992] [ 382.994518][ T8996] netlink: 8 bytes leftover after parsing attributes in process `syz.5.680'. [ 383.592233][ C2] sched: DL replenish lagged too much [ 384.822604][ T9007] bond3: Removing last arp target with arp_interval on [ 384.857861][ T9007] bond3: entered promiscuous mode [ 384.873067][ T9007] bond3: entered allmulticast mode [ 384.886190][ T9007] 8021q: adding VLAN 0 to HW filter on device bond3 [ 385.101676][ T9017] binder: 9016:9017 ioctl c0306201 80000040 returned -14 [ 385.105704][ T9017] CIFS: Attempting to mount //127.0.0.1/share [ 385.591492][ T9014] socket: no more sockets [ 385.703164][ T9028] bond4 (unregistering): Released all slaves [ 385.842160][ T9017] CIFS: VFS: cifs_mount failed w/return code = -112 [ 386.041084][ T9034] netlink: 8 bytes leftover after parsing attributes in process `syz.5.690'. [ 386.058959][ T9036] FAULT_INJECTION: forcing a failure. [ 386.058959][ T9036] name failslab, interval 1, probability 0, space 0, times 0 [ 386.065593][ T9036] CPU: 3 UID: 0 PID: 9036 Comm: syz.3.691 Tainted: G L syzkaller #0 PREEMPT(full) [ 386.065655][ T9036] Tainted: [L]=SOFTLOCKUP [ 386.065661][ T9036] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 386.065671][ T9036] Call Trace: [ 386.065680][ T9036] [ 386.065687][ T9036] dump_stack_lvl+0x100/0x190 [ 386.065749][ T9036] should_fail_ex.cold+0x5/0xa [ 386.065767][ T9036] should_failslab+0xc2/0x120 [ 386.065822][ T9036] __kmalloc_noprof+0xfc/0x820 [ 386.065844][ T9036] ? software_key_query+0x1b8/0xe30 [ 386.065870][ T9036] software_key_query+0x1b8/0xe30 [ 386.065930][ T9036] ? __pfx_software_key_query+0x10/0x10 [ 386.065964][ T9036] ? __pfx_software_key_query+0x10/0x10 [ 386.066022][ T9036] query_asymmetric_key+0x104/0x160 [ 386.066044][ T9036] keyctl_pkey_params_get_2+0x1c6/0x3f0 [ 386.066107][ T9036] ? __pfx_keyctl_pkey_params_get_2+0x10/0x10 [ 386.066132][ T9036] ? find_held_lock+0x2b/0x80 [ 386.066194][ T9036] keyctl_pkey_e_d_s+0xac/0x360 [ 386.066218][ T9036] ? __pfx_keyctl_pkey_e_d_s+0x10/0x10 [ 386.066273][ T9036] ? __fget_files+0x21f/0x3d0 [ 386.066294][ T9036] ? fput+0x79/0x100 [ 386.066315][ T9036] __ia32_compat_sys_keyctl+0x2f2/0x550 [ 386.066374][ T9036] __do_fast_syscall_32+0xe7/0x970 [ 386.066398][ T9036] ? lockdep_hardirqs_on+0x78/0x100 [ 386.066454][ T9036] do_fast_syscall_32+0x32/0x70 [ 386.066477][ T9036] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 386.066497][ T9036] RIP: 0023:0xf7f03fec [ 386.066550][ T9036] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 386.066558][ T9036] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000120 [ 386.066575][ T9036] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000080000180 [ 386.066585][ T9036] RDX: 0000000080000840 RSI: 0000000000000000 RDI: 0000000000000000 [ 386.066595][ T9036] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 386.066638][ T9036] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 386.066647][ T9036] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 386.066666][ T9036] [ 386.636593][ T9048] netlink: 'syz.3.695': attribute type 1 has an invalid length. [ 387.172362][ T9068] FAULT_INJECTION: forcing a failure. [ 387.172362][ T9068] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 387.177911][ T9068] CPU: 3 UID: 0 PID: 9068 Comm: syz.4.697 Tainted: G L syzkaller #0 PREEMPT(full) [ 387.177939][ T9068] Tainted: [L]=SOFTLOCKUP [ 387.177945][ T9068] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 387.177956][ T9068] Call Trace: [ 387.177966][ T9068] [ 387.177975][ T9068] dump_stack_lvl+0x100/0x190 [ 387.178003][ T9068] should_fail_ex.cold+0x5/0xa [ 387.178021][ T9068] _copy_to_user+0x32/0xd0 [ 387.178046][ T9068] ctl_ioctl+0x17b/0xcd0 [ 387.178079][ T9068] ? __pfx_ctl_ioctl+0x10/0x10 [ 387.178131][ T9068] ? __fget_files+0x21f/0x3d0 [ 387.178151][ T9068] dm_compat_ctl_ioctl+0x23/0x30 [ 387.178174][ T9068] ? __pfx_dm_compat_ctl_ioctl+0x10/0x10 [ 387.178196][ T9068] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 387.178224][ T9068] __do_fast_syscall_32+0xe7/0x970 [ 387.178248][ T9068] ? lockdep_hardirqs_on+0x78/0x100 [ 387.178271][ T9068] do_fast_syscall_32+0x32/0x70 [ 387.178295][ T9068] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 387.178317][ T9068] RIP: 0023:0xf708efec [ 387.178368][ T9068] Code: Unable to access opcode bytes at 0xf708efc2. [ 387.178377][ T9068] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 387.178394][ T9068] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c138fd09 [ 387.178406][ T9068] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 387.178415][ T9068] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 387.178424][ T9068] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 387.178434][ T9068] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 387.178457][ T9068] [ 387.624363][ T9076] netlink: 20 bytes leftover after parsing attributes in process `syz.5.702'. [ 387.882834][ T9078] netlink: 8 bytes leftover after parsing attributes in process `syz.5.703'. [ 388.277284][ T9087] FAULT_INJECTION: forcing a failure. [ 388.277284][ T9087] name failslab, interval 1, probability 0, space 0, times 0 [ 388.300437][ T9087] CPU: 2 UID: 0 PID: 9087 Comm: syz.5.707 Tainted: G L syzkaller #0 PREEMPT(full) [ 388.300465][ T9087] Tainted: [L]=SOFTLOCKUP [ 388.300470][ T9087] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 388.300478][ T9087] Call Trace: [ 388.300488][ T9087] [ 388.300494][ T9087] dump_stack_lvl+0x100/0x190 [ 388.300521][ T9087] should_fail_ex.cold+0x5/0xa [ 388.300541][ T9087] should_failslab+0xc2/0x120 [ 388.300565][ T9087] __kmalloc_cache_noprof+0x91/0x6c0 [ 388.300583][ T9087] ? x509_cert_parse+0x50/0x910 [ 388.300621][ T9087] x509_cert_parse+0x50/0x910 [ 388.300648][ T9087] x509_key_preparse+0x65/0x9c0 [ 388.300668][ T9087] asymmetric_key_preparse+0xce/0x1d0 [ 388.300689][ T9087] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 388.300712][ T9087] __key_create_or_update+0x463/0xe30 [ 388.300741][ T9087] ? __pfx___key_create_or_update+0x10/0x10 [ 388.300765][ T9087] ? lookup_user_key+0x3f3/0x1300 [ 388.300796][ T9087] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 388.300817][ T9087] ? __pfx_keyring_search_iterator+0x10/0x10 [ 388.300845][ T9087] key_create_or_update+0x42/0x60 [ 388.300871][ T9087] __do_sys_add_key+0x2e8/0x460 [ 388.300890][ T9087] ? __pfx___do_sys_add_key+0x10/0x10 [ 388.300905][ T9087] ? fput+0x79/0x100 [ 388.300926][ T9087] ? __pfx_ksys_write+0x10/0x10 [ 388.300947][ T9087] __do_fast_syscall_32+0xe7/0x970 [ 388.300971][ T9087] ? lockdep_hardirqs_on+0x78/0x100 [ 388.300995][ T9087] do_fast_syscall_32+0x32/0x70 [ 388.301018][ T9087] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 388.301040][ T9087] RIP: 0023:0xf702efec [ 388.301064][ T9087] Code: Unable to access opcode bytes at 0xf702efc2. [ 388.301071][ T9087] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 000000000000011e [ 388.301087][ T9087] RAX: ffffffffffffffda RBX: 0000000080000040 RCX: 0000000000000000 [ 388.301098][ T9087] RDX: 0000000080000780 RSI: 0000000000000559 RDI: 000000001ca374c9 [ 388.301107][ T9087] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 388.301116][ T9087] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 388.301126][ T9087] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 388.301146][ T9087] [ 388.950164][ T9094] veth1_macvtap: left promiscuous mode [ 388.954354][ T9094] macsec0: entered promiscuous mode [ 389.353354][ T9103] FAULT_INJECTION: forcing a failure. [ 389.353354][ T9103] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 389.359815][ T9103] CPU: 3 UID: 0 PID: 9103 Comm: syz.2.712 Tainted: G L syzkaller #0 PREEMPT(full) [ 389.359850][ T9103] Tainted: [L]=SOFTLOCKUP [ 389.359856][ T9103] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 389.359869][ T9103] Call Trace: [ 389.359878][ T9103] [ 389.359886][ T9103] dump_stack_lvl+0x100/0x190 [ 389.359919][ T9103] should_fail_ex.cold+0x5/0xa [ 389.359943][ T9103] _copy_from_user+0x2e/0xd0 [ 389.359975][ T9103] kstrtouint_from_user+0xd6/0x1d0 [ 389.360000][ T9103] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 389.360023][ T9103] ? __lock_acquire+0x49f/0x1a40 [ 389.360067][ T9103] proc_fail_nth_write+0x83/0x220 [ 389.360095][ T9103] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 389.360129][ T9103] vfs_write+0x2aa/0x1050 [ 389.360150][ T9103] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 389.360180][ T9103] ? __pfx_vfs_write+0x10/0x10 [ 389.360197][ T9103] ? find_held_lock+0x2b/0x80 [ 389.360220][ T9103] ? __fget_files+0x215/0x3d0 [ 389.360244][ T9103] ? __fget_files+0x21f/0x3d0 [ 389.360271][ T9103] ksys_write+0x12a/0x250 [ 389.360289][ T9103] ? __pfx_ksys_write+0x10/0x10 [ 389.360316][ T9103] do_int80_emulation+0x14b/0x720 [ 389.360350][ T9103] asm_int80_emulation+0x1a/0x20 [ 389.360371][ T9103] RIP: 0023:0xf71a74eb [ 389.360387][ T9103] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 389.360407][ T9103] RSP: 002b:00000000f541b4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 389.360427][ T9103] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f541b5d0 [ 389.360440][ T9103] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 389.360451][ T9103] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 389.360463][ T9103] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 389.360474][ T9103] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 389.360502][ T9103] [ 389.512585][ T9107] netlink: 8 bytes leftover after parsing attributes in process `syz.2.715'. [ 389.562041][ T24] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 389.564186][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 389.725443][ T9111] netlink: 'syz.2.716': attribute type 11 has an invalid length. [ 389.748478][ T24] usb 9-1: Using ep0 maxpacket: 32 [ 389.775663][ T24] usb 9-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 389.779892][ T24] usb 9-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 389.785608][ T24] usb 9-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 389.787520][ T9092] socket: no more sockets [ 389.799025][ T24] usb 9-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 389.849201][ T24] usb 9-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 389.853351][ T24] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.878598][ T24] usb 9-1: Product: syz [ 389.906724][ T24] usb 9-1: Manufacturer: syz [ 389.908773][ T24] usb 9-1: SerialNumber: syz [ 389.930471][ T9114] netlink: 'syz.2.716': attribute type 10 has an invalid length. [ 389.965426][ C2] imon 9-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 389.990386][ T24] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:155.0/input/input7 [ 390.048169][ T9114] syz_tun: entered promiscuous mode [ 390.092721][ T9114] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 390.133003][ T9115] bridge0: port 2(bridge_slave_1) entered blocking state [ 390.139344][ T9115] bridge0: port 2(bridge_slave_1) entered forwarding state [ 390.142725][ T9115] bridge0: port 1(bridge_slave_0) entered blocking state [ 390.150429][ T9115] bridge0: port 1(bridge_slave_0) entered forwarding state [ 390.284753][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 390.322740][ T9115] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 390.475800][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 390.638620][ T24] imon 9-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 390.645469][ T24] (id 0x00) [ 390.738887][ T24] rc_core: IR keymap rc-imon-pad not found [ 390.741490][ T24] Registered IR keymap rc-empty [ 390.744044][ T24] imon 9-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 390.749406][ T24] imon 9-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 390.770590][ T24] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:155.0/rc/rc0 [ 390.783084][ T24] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:155.0/rc/rc0/input8 [ 390.817667][ T24] imon 9-1:155.0: iMON device (15c2:ffdc, intf0) on usb<9:8> initialized [ 390.974932][ T9092] isofs_fill_super: bread failed, dev=sr0, iso_blknum=32, block=32 [ 391.536067][ C3] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 391.557036][ C3] IPv6: bridge0: IPv6 duplicate address fe80::a8aa:aaff:feaa:aa1b used by aa:aa:aa:aa:aa:1b detected! [ 392.200272][ T9124] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.229599][ T9139] binder: 9137:9139 ioctl c0306201 80000040 returned -14 [ 392.234915][ T9139] CIFS: Attempting to mount //127.0.0.1/share [ 392.255478][ T9141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.724'. [ 392.461205][ T9145] FAULT_INJECTION: forcing a failure. [ 392.461205][ T9145] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 392.461888][ T13] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.506056][ T9145] CPU: 2 UID: 0 PID: 9145 Comm: syz.3.725 Tainted: G L syzkaller #0 PREEMPT(full) [ 392.506093][ T9145] Tainted: [L]=SOFTLOCKUP [ 392.506099][ T9145] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 392.506110][ T9145] Call Trace: [ 392.506121][ T9145] [ 392.506130][ T9145] dump_stack_lvl+0x100/0x190 [ 392.506159][ T9145] should_fail_ex.cold+0x5/0xa [ 392.506180][ T9145] _copy_to_user+0x32/0xd0 [ 392.506212][ T9145] ctl_ioctl+0x17b/0xcd0 [ 392.506245][ T9145] ? __pfx_ctl_ioctl+0x10/0x10 [ 392.506294][ T9145] ? __fget_files+0x21f/0x3d0 [ 392.506318][ T9145] dm_compat_ctl_ioctl+0x23/0x30 [ 392.506344][ T9145] ? __pfx_dm_compat_ctl_ioctl+0x10/0x10 [ 392.506370][ T9145] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 392.506406][ T9145] __do_fast_syscall_32+0xe7/0x970 [ 392.506755][ T9145] ? lockdep_hardirqs_on+0x78/0x100 [ 392.506783][ T9145] do_fast_syscall_32+0x32/0x70 [ 392.506810][ T9145] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 392.506834][ T9145] RIP: 0023:0xf7f03fec [ 392.506859][ T9145] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 392.506868][ T9145] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 392.506886][ T9145] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c138fd02 [ 392.506897][ T9145] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 392.506908][ T9145] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 392.506918][ T9145] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 392.506928][ T9145] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 392.506951][ T9145] [ 392.850297][ T9124] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.945588][ T9139] CIFS: VFS: cifs_mount failed w/return code = -512 [ 393.001846][ T9127] netdevsim netdevsim10 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 393.342059][ T9156] tipc: Started in network mode [ 393.345013][ T9156] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 393.356772][ T9156] tipc: New replicast peer: 2001:0000:0000:0000:0000:0000:0000:0002 [ 393.367186][ T9156] tipc: Enabled bearer , priority 10 [ 394.107987][ T9173] binder: 9172:9173 ioctl c0306201 80000040 returned -14 [ 394.113454][ T9174] CIFS: Attempting to mount //127.0.0.1/share [ 394.155285][ T9146] imon:send_packet: task interrupted [ 394.161307][ T9146] imon:send_packet: packet tx failed (-512) [ 394.177297][ T9146] imon:vfd_write: send packet #5 failed [ 394.274316][ T9] usb 9-1: USB disconnect, device number 8 [ 394.385044][ T5850] tipc: Node number set to 1 [ 394.845582][ T9171] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 394.877651][ T9174] CIFS: VFS: cifs_mount failed w/return code = -112 [ 395.712444][ T9192] FAULT_INJECTION: forcing a failure. [ 395.712444][ T9192] name failslab, interval 1, probability 0, space 0, times 0 [ 395.718356][ T9192] CPU: 3 UID: 0 PID: 9192 Comm: syz.3.743 Tainted: G L syzkaller #0 PREEMPT(full) [ 395.718393][ T9192] Tainted: [L]=SOFTLOCKUP [ 395.718400][ T9192] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 395.718412][ T9192] Call Trace: [ 395.718422][ T9192] [ 395.718431][ T9192] dump_stack_lvl+0x100/0x190 [ 395.718464][ T9192] should_fail_ex.cold+0x5/0xa [ 395.718489][ T9192] should_failslab+0xc2/0x120 [ 395.718521][ T9192] __kmalloc_noprof+0xfc/0x820 [ 395.718557][ T9192] ? software_key_query+0x1b8/0xe30 [ 395.718595][ T9192] software_key_query+0x1b8/0xe30 [ 395.718631][ T9192] ? __pfx_software_key_query+0x10/0x10 [ 395.718679][ T9192] ? __pfx_software_key_query+0x10/0x10 [ 395.718711][ T9192] query_asymmetric_key+0x104/0x160 [ 395.718745][ T9192] keyctl_pkey_params_get_2+0x1c6/0x3f0 [ 395.718781][ T9192] ? __pfx_keyctl_pkey_params_get_2+0x10/0x10 [ 395.718816][ T9192] ? find_held_lock+0x2b/0x80 [ 395.718859][ T9192] keyctl_pkey_e_d_s+0xac/0x360 [ 395.718890][ T9192] ? __pfx_keyctl_pkey_e_d_s+0x10/0x10 [ 395.718917][ T9192] ? __fget_files+0x21f/0x3d0 [ 395.718944][ T9192] ? fput+0x79/0x100 [ 395.718975][ T9192] __ia32_compat_sys_keyctl+0x2f2/0x550 [ 395.719005][ T9192] __do_fast_syscall_32+0xe7/0x970 [ 395.719039][ T9192] ? lockdep_hardirqs_on+0x78/0x100 [ 395.719069][ T9192] do_fast_syscall_32+0x32/0x70 [ 395.719100][ T9192] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 395.719127][ T9192] RIP: 0023:0xf7f03fec [ 395.719152][ T9192] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 395.719161][ T9192] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000120 [ 395.719182][ T9192] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000080000180 [ 395.719194][ T9192] RDX: 0000000080000840 RSI: 0000000000000000 RDI: 0000000000000000 [ 395.719206][ T9192] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 395.719217][ T9192] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 395.719228][ T9192] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 395.719254][ T9192] [ 396.116598][ T9193] netlink: 8 bytes leftover after parsing attributes in process `syz.4.742'. [ 396.118951][ T5772] Bluetooth: hci1: command 0x0406 tx timeout [ 396.154112][ T9193] netlink: 8 bytes leftover after parsing attributes in process `syz.4.742'. [ 396.607653][ T9203] binder: 9202:9203 ioctl c0306201 80000040 returned -14 [ 396.613721][ T9203] CIFS: Attempting to mount //127.0.0.1/share [ 397.291783][ T9201] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 397.484325][ T9203] CIFS: VFS: cifs_mount failed w/return code = -512 [ 398.021490][ T9219] FAULT_INJECTION: forcing a failure. [ 398.021490][ T9219] name failslab, interval 1, probability 0, space 0, times 0 [ 398.039025][ T9219] CPU: 0 UID: 0 PID: 9219 Comm: syz.2.751 Tainted: G L syzkaller #0 PREEMPT(full) [ 398.039077][ T9219] Tainted: [L]=SOFTLOCKUP [ 398.039085][ T9219] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 398.039100][ T9219] Call Trace: [ 398.039107][ T9219] [ 398.039116][ T9219] dump_stack_lvl+0x100/0x190 [ 398.039145][ T9219] should_fail_ex.cold+0x5/0xa [ 398.039167][ T9219] should_failslab+0xc2/0x120 [ 398.039193][ T9219] kmem_cache_alloc_noprof+0x91/0x6a0 [ 398.039217][ T9219] ? trace_kmem_cache_alloc+0xdd/0x100 [ 398.039244][ T9219] ? security_file_alloc+0x34/0x2c0 [ 398.039276][ T9219] security_file_alloc+0x34/0x2c0 [ 398.039301][ T9219] init_file+0x95/0x480 [ 398.039324][ T9219] alloc_empty_file+0x79/0x1c0 [ 398.039348][ T9219] path_openat+0xe7/0x4280 [ 398.039367][ T9219] ? kasan_save_track+0x14/0x30 [ 398.039389][ T9219] ? __kasan_slab_alloc+0x89/0x90 [ 398.039410][ T9219] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 398.039430][ T9219] ? do_getname+0x35/0x390 [ 398.039452][ T9219] ? do_sys_openat2+0xc7/0x1e0 [ 398.039473][ T9219] ? __ia32_compat_sys_openat+0x12d/0x210 [ 398.039497][ T9219] ? __do_fast_syscall_32+0xe7/0x970 [ 398.039532][ T9219] ? __pfx_path_openat+0x10/0x10 [ 398.039558][ T9219] do_file_open+0x20e/0x430 [ 398.039575][ T9219] ? __lock_acquire+0x49f/0x1a40 [ 398.039604][ T9219] ? __pfx_do_file_open+0x10/0x10 [ 398.039640][ T9219] ? _raw_spin_unlock+0x28/0x50 [ 398.039660][ T9219] ? alloc_fd+0x471/0x7a0 [ 398.039685][ T9219] do_sys_openat2+0x10f/0x1e0 [ 398.039708][ T9219] ? __pfx_do_sys_openat2+0x10/0x10 [ 398.039735][ T9219] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 398.039765][ T9219] __ia32_compat_sys_openat+0x12d/0x210 [ 398.039789][ T9219] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 398.039812][ T9219] ? fput+0x79/0x100 [ 398.039833][ T9219] ? ksys_write+0x1ac/0x250 [ 398.039850][ T9219] ? __pfx_ksys_write+0x10/0x10 [ 398.039871][ T9219] __do_fast_syscall_32+0xe7/0x970 [ 398.039896][ T9219] ? lockdep_hardirqs_on+0x78/0x100 [ 398.039921][ T9219] do_fast_syscall_32+0x32/0x70 [ 398.039946][ T9219] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 398.039969][ T9219] RIP: 0023:0xf706efec [ 398.039993][ T9219] Code: Unable to access opcode bytes at 0xf706efc2. [ 398.040001][ T9219] RSP: 002b:00000000f545d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 398.040019][ T9219] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800002c0 [ 398.040030][ T9219] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 398.040039][ T9219] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 398.040048][ T9219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 398.040058][ T9219] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 398.040081][ T9219] [ 398.532919][ T5772] Bluetooth: hci1: command 0x0406 tx timeout [ 398.563499][ T9124] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.241595][ T9124] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.624327][ T13] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.695848][ T13] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.815831][ T13] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.908674][ T5605] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 400.058836][ T9243] netlink: 'syz.2.757': attribute type 1 has an invalid length. [ 400.094974][ T9243] 8021q: adding VLAN 0 to HW filter on device bond4 [ 400.186718][ T9245] bond4: (slave geneve2): making interface the new active one [ 400.272458][ T9245] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 400.529512][ T9249] FAULT_INJECTION: forcing a failure. [ 400.529512][ T9249] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 400.534675][ T9249] CPU: 3 UID: 0 PID: 9249 Comm: syz.5.760 Tainted: G L syzkaller #0 PREEMPT(full) [ 400.534710][ T9249] Tainted: [L]=SOFTLOCKUP [ 400.534716][ T9249] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 400.534727][ T9249] Call Trace: [ 400.534738][ T9249] [ 400.534747][ T9249] dump_stack_lvl+0x100/0x190 [ 400.534777][ T9249] should_fail_ex.cold+0x5/0xa [ 400.534801][ T9249] _copy_from_iter+0x1f4/0x1690 [ 400.534836][ T9249] ? __asan_memset+0x23/0x50 [ 400.534858][ T9249] ? __pfx__copy_from_iter+0x10/0x10 [ 400.534887][ T9249] ? __pfx___alloc_skb+0x10/0x10 [ 400.534924][ T9249] netlink_sendmsg+0x808/0xda0 [ 400.534953][ T9249] ? __pfx_netlink_sendmsg+0x10/0x10 [ 400.534980][ T9249] ? apparmor_socket_sendmsg+0x15b/0x270 [ 400.535008][ T9249] ____sys_sendmsg+0xa4d/0xbe0 [ 400.535029][ T9249] ? __pfx_netlink_sendmsg+0x10/0x10 [ 400.535062][ T9249] ? __pfx_____sys_sendmsg+0x10/0x10 [ 400.535095][ T9249] ___sys_sendmsg+0x190/0x1e0 [ 400.535133][ T9249] ? __pfx____sys_sendmsg+0x10/0x10 [ 400.535164][ T9249] ? find_held_lock+0x2b/0x80 [ 400.535204][ T9249] __sys_sendmsg+0x160/0x210 [ 400.535232][ T9249] ? __pfx___sys_sendmsg+0x10/0x10 [ 400.535266][ T9249] ? __pfx_ksys_write+0x10/0x10 [ 400.535290][ T9249] __do_fast_syscall_32+0xe7/0x970 [ 400.535318][ T9249] ? lockdep_hardirqs_on+0x78/0x100 [ 400.535344][ T9249] do_fast_syscall_32+0x32/0x70 [ 400.535371][ T9249] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 400.535398][ T9249] RIP: 0023:0xf702efec [ 400.535427][ T9249] Code: Unable to access opcode bytes at 0xf702efc2. [ 400.535436][ T9249] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 400.535455][ T9249] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000080 [ 400.535467][ T9249] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 400.535478][ T9249] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 400.535488][ T9249] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 400.535499][ T9249] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 400.535524][ T9249] [ 400.737195][ T9241] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 401.478270][ T9267] netlink: 44 bytes leftover after parsing attributes in process `syz.3.765'. [ 401.523610][ T9267] netlink: 12 bytes leftover after parsing attributes in process `syz.3.765'. [ 401.627105][ T9267] nfs: Bad value for 'mountport' [ 402.005818][ T5772] Bluetooth: hci1: command 0x0406 tx timeout [ 402.260592][ T9271] FAULT_INJECTION: forcing a failure. [ 402.260592][ T9271] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 402.286889][ T9271] CPU: 1 UID: 0 PID: 9271 Comm: syz.3.766 Tainted: G L syzkaller #0 PREEMPT(full) [ 402.286920][ T9271] Tainted: [L]=SOFTLOCKUP [ 402.286926][ T9271] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 402.286937][ T9271] Call Trace: [ 402.286943][ T9271] [ 402.286950][ T9271] dump_stack_lvl+0x100/0x190 [ 402.286977][ T9271] should_fail_ex.cold+0x5/0xa [ 402.286997][ T9271] strncpy_from_user+0x3b/0x2d0 [ 402.287028][ T9271] do_getname+0x78/0x390 [ 402.287052][ T9271] __ia32_sys_mkdirat+0x77/0xc0 [ 402.287072][ T9271] __do_fast_syscall_32+0xe7/0x970 [ 402.287096][ T9271] ? lockdep_hardirqs_on+0x78/0x100 [ 402.287119][ T9271] do_fast_syscall_32+0x32/0x70 [ 402.287142][ T9271] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 402.287162][ T9271] RIP: 0023:0xf7f03fec [ 402.287188][ T9271] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 402.287196][ T9271] RSP: 002b:00000000f53a550c EFLAGS: 00000292 ORIG_RAX: 0000000000000128 [ 402.287213][ T9271] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800001c0 [ 402.287224][ T9271] RDX: 00000000000001ff RSI: 0000000000000000 RDI: 0000000000000000 [ 402.287233][ T9271] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 402.287245][ T9271] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 402.287254][ T9271] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 402.287276][ T9271] [ 402.399837][ T9273] binder: 9272:9273 ioctl c0306201 80000040 returned -14 [ 402.542132][ T9277] CIFS: Attempting to mount //127.0.0.1/share [ 402.594137][ T9277] CIFS: VFS: Error connecting to socket. Aborting operation. [ 402.599675][ T9277] CIFS: VFS: cifs_mount failed w/return code = -111 [ 403.782754][ T9324] netlink: 8 bytes leftover after parsing attributes in process `syz.5.775'. [ 403.887092][ T9328] faux_driver vgem: [drm] Unknown color mode 55545; guessing buffer size. [ 404.114985][ T9329] netlink: 'syz.2.776': attribute type 1 has an invalid length. [ 405.689994][ T9337] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 406.921327][ T5772] Bluetooth: hci1: command 0x0406 tx timeout [ 407.627135][ T9379] FAULT_INJECTION: forcing a failure. [ 407.627135][ T9379] name failslab, interval 1, probability 0, space 0, times 0 [ 407.644102][ T9379] CPU: 0 UID: 0 PID: 9379 Comm: syz.4.789 Tainted: G L syzkaller #0 PREEMPT(full) [ 407.644134][ T9379] Tainted: [L]=SOFTLOCKUP [ 407.644141][ T9379] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 407.644152][ T9379] Call Trace: [ 407.644162][ T9379] [ 407.644170][ T9379] dump_stack_lvl+0x100/0x190 [ 407.644199][ T9379] should_fail_ex.cold+0x5/0xa [ 407.644221][ T9379] should_failslab+0xc2/0x120 [ 407.644247][ T9379] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 407.644273][ T9379] ? __d_alloc+0x35/0xa50 [ 407.644298][ T9379] __d_alloc+0x35/0xa50 [ 407.644321][ T9379] d_alloc_parallel+0x105/0x14b0 [ 407.644355][ T9379] ? __pfx_d_alloc_parallel+0x10/0x10 [ 407.644381][ T9379] ? __pfx___might_resched+0x10/0x10 [ 407.644410][ T9379] ? try_to_unlazy+0x296/0x910 [ 407.644439][ T9379] ? down_read+0x13b/0x4c0 [ 407.644467][ T9379] ? __pfx_down_read+0x10/0x10 [ 407.644494][ T9379] __lookup_slow+0x98/0x320 [ 407.644520][ T9379] lookup_slow+0x50/0x70 [ 407.644544][ T9379] path_lookupat+0x5e8/0xc40 [ 407.644575][ T9379] filename_lookup+0x202/0x590 [ 407.644605][ T9379] ? __pfx_filename_lookup+0x10/0x10 [ 407.644632][ T9379] ? stack_trace_save+0x8e/0xc0 [ 407.644689][ T9379] vfs_statx+0xff/0x3f0 [ 407.644713][ T9379] ? __pfx_vfs_statx+0x10/0x10 [ 407.644742][ T9379] do_statx+0xf1/0x170 [ 407.644765][ T9379] ? __pfx_do_statx+0x10/0x10 [ 407.644803][ T9379] ? do_getname+0x191/0x390 [ 407.644829][ T9379] __ia32_sys_statx+0x140/0x1f0 [ 407.644856][ T9379] __do_fast_syscall_32+0xe7/0x970 [ 407.644883][ T9379] ? lockdep_hardirqs_on+0x78/0x100 [ 407.644908][ T9379] do_fast_syscall_32+0x32/0x70 [ 407.644933][ T9379] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 407.644956][ T9379] RIP: 0023:0xf708efec [ 407.644982][ T9379] Code: Unable to access opcode bytes at 0xf708efc2. [ 407.644998][ T9379] RSP: 002b:00000000f543b50c EFLAGS: 00000292 ORIG_RAX: 000000000000017f [ 407.645016][ T9379] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000640 [ 407.645028][ T9379] RDX: 0000000000001000 RSI: 0000000000000100 RDI: 0000000000000000 [ 407.645039][ T9379] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 407.645049][ T9379] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 407.645060][ T9379] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 407.645083][ T9379] [ 407.730492][ T9378] fuse: Bad value for 'user_id' [ 407.934183][ T9378] fuse: Bad value for 'user_id' [ 408.858718][ T9388] binder: 9387:9388 ioctl c0306201 80000040 returned -14 [ 408.886177][ T9388] CIFS: Attempting to mount //127.0.0.1/share [ 409.041202][ T9398] FAULT_INJECTION: forcing a failure. [ 409.041202][ T9398] name failslab, interval 1, probability 0, space 0, times 0 [ 409.041543][ T41] audit: type=1800 audit(1785944369.147:46): pid=9382 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.792" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 409.050366][ T9398] CPU: 2 UID: 0 PID: 9398 Comm: syz.3.796 Tainted: G L syzkaller #0 PREEMPT(full) [ 409.050468][ T9398] Tainted: [L]=SOFTLOCKUP [ 409.050475][ T9398] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 409.050486][ T9398] Call Trace: [ 409.050495][ T9398] [ 409.050570][ T9398] dump_stack_lvl+0x100/0x190 [ 409.050604][ T9398] should_fail_ex.cold+0x5/0xa [ 409.050668][ T9398] should_failslab+0xc2/0x120 [ 409.050698][ T9398] kmem_cache_alloc_noprof+0x91/0x6a0 [ 409.050762][ T9398] ? trace_kmem_cache_alloc+0xdd/0x100 [ 409.050790][ T9398] ? security_file_alloc+0x34/0x2c0 [ 409.050890][ T9398] security_file_alloc+0x34/0x2c0 [ 409.050999][ T9398] init_file+0x95/0x480 [ 409.051025][ T9398] alloc_empty_file+0x79/0x1c0 [ 409.051048][ T9398] path_openat+0xe7/0x4280 [ 409.051137][ T9398] ? kasan_save_track+0x14/0x30 [ 409.051161][ T9398] ? __kasan_slab_alloc+0x89/0x90 [ 409.051185][ T9398] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 409.051245][ T9398] ? do_getname+0x35/0x390 [ 409.051268][ T9398] ? do_sys_openat2+0xc7/0x1e0 [ 409.051364][ T9398] ? __ia32_compat_sys_openat+0x12d/0x210 [ 409.051391][ T9398] ? __do_fast_syscall_32+0xe7/0x970 [ 409.051493][ T9398] ? __pfx_path_openat+0x10/0x10 [ 409.051519][ T9398] do_file_open+0x20e/0x430 [ 409.051536][ T9398] ? __lock_acquire+0x49f/0x1a40 [ 409.051637][ T9398] ? __pfx_do_file_open+0x10/0x10 [ 409.051709][ T9398] ? _raw_spin_unlock+0x28/0x50 [ 409.051764][ T9398] ? alloc_fd+0x471/0x7a0 [ 409.051792][ T9398] do_sys_openat2+0x10f/0x1e0 [ 409.051884][ T9398] ? __pfx_do_sys_openat2+0x10/0x10 [ 409.051913][ T9398] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 409.052010][ T9398] __ia32_compat_sys_openat+0x12d/0x210 [ 409.052039][ T9398] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 409.052132][ T9398] ? fput+0x79/0x100 [ 409.052154][ T9398] ? ksys_write+0x1ac/0x250 [ 409.052174][ T9398] ? __pfx_ksys_write+0x10/0x10 [ 409.052233][ T9398] __do_fast_syscall_32+0xe7/0x970 [ 409.052292][ T9398] ? lockdep_hardirqs_on+0x78/0x100 [ 409.052366][ T9398] do_fast_syscall_32+0x32/0x70 [ 409.052395][ T9398] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 409.052458][ T9398] RIP: 0023:0xf7f03fec [ 409.052484][ T9398] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 409.052492][ T9398] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 409.052575][ T9398] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000780 [ 409.052587][ T9398] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 409.052596][ T9398] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 409.052609][ T9398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 409.052619][ T9398] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 409.052704][ T9398] [ 409.294373][ T9396] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.301433][ T9396] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.364219][ T41] audit: type=1807 audit(1785944369.467:47): action=measure func=FILE_CHECK res=1 [ 409.366155][ T9400] ima: policy update completed [ 409.399607][ T41] audit: type=1802 audit(1785944369.497:48): pid=9400 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=completed comm="syz.3.797" res=1 errno=0 [ 409.451589][ T9402] evm: overlay not supported [ 409.600602][ T9388] CIFS: VFS: cifs_mount failed w/return code = -112 [ 409.605955][ T9396] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 409.615649][ T9396] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 409.722171][ T41] audit: type=1800 audit(1785944369.807:49): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 409.849695][ T41] audit: type=1800 audit(1785944369.927:50): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 410.068815][ T41] audit: type=1800 audit(1785944370.177:51): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 410.370637][ T9415] ehci-pci 0000:00:1d.7: remove, state 1 [ 410.377689][ T41] audit: type=1800 audit(1785944370.467:52): pid=9415 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.803" name="remove" dev="sysfs" ino=3034 res=0 errno=0 [ 410.380798][ T9415] usb usb2: USB disconnect, device number 1 [ 410.408587][ T9415] usb 2-1: USB disconnect, device number 2 [ 410.565731][ T5843] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.569860][ T5843] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.574667][ T5843] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.628799][ T5843] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 411.217721][ T9415] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 411.336849][ T41] audit: type=1800 audit(1785944371.427:53): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 411.395988][ T41] audit: type=1800 audit(1785944371.487:54): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=3033 res=0 errno=0 [ 411.439591][ T9430] netlink: 8 bytes leftover after parsing attributes in process `syz.3.807'. [ 411.545578][ T9] usb 1-1: new full-speed USB device number 2 using uhci_hcd [ 411.807574][ T9] usb 1-1: not running at top speed; connect to a high speed hub [ 411.824852][ T41] audit: type=1800 audit(1785944371.927:55): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 411.899107][ T9] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 411.929455][ T9] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 411.954820][ T9440] netlink: 32 bytes leftover after parsing attributes in process `syz.4.811'. [ 411.955583][ T9] usb 1-1: Product: QEMU USB Tablet [ 412.008161][ T9440] netlink: 12 bytes leftover after parsing attributes in process `syz.4.811'. [ 412.015648][ T9] usb 1-1: Manufacturer: QEMU [ 412.038097][ T9] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 412.407799][ T9] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb1/1-1/1-1:1.0/0003:0627:0001.0002/input/input9 [ 412.656946][ T9] hid-generic 0003:0627:0001.0002: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 414.036432][ T5909] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 414.185911][ T9468] netlink: 8 bytes leftover after parsing attributes in process `syz.4.818'. [ 414.258642][ T9] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 414.265505][ T5909] usb 10-1: config 0 has no interfaces? [ 414.268573][ T5909] usb 10-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 414.272247][ T5909] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.282384][ T5909] usb 10-1: config 0 descriptor?? [ 414.358269][ T41] kauditd_printk_skb: 34 callbacks suppressed [ 414.358289][ T41] audit: type=1800 audit(1785944374.407:90): pid=8666 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=161451 res=0 errno=0 [ 414.425570][ T41] audit: type=1800 audit(1785944374.457:91): pid=8666 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=161480 res=0 errno=0 [ 414.438254][ T9] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 414.444944][ T41] audit: type=1800 audit(1785944374.467:92): pid=8666 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=161458 res=0 errno=0 [ 414.490864][ T9] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 414.516026][ T41] audit: type=1800 audit(1785944374.467:93): pid=8666 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=161459 res=0 errno=0 [ 414.535231][ T9] usb 8-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 414.535260][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.535278][ T9] usb 8-1: Product: syz [ 414.535291][ T9] usb 8-1: Manufacturer: syz [ 414.535305][ T9] usb 8-1: SerialNumber: syz [ 414.602449][ T41] audit: type=1800 audit(1785944374.467:94): pid=8666 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=161460 res=0 errno=0 [ 414.621345][ T41] audit: type=1800 audit(1785944374.557:95): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 414.632676][ T41] audit: type=1800 audit(1785944374.657:96): pid=8694 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=161518 res=0 errno=0 [ 414.648149][ T41] audit: type=1800 audit(1785944374.657:97): pid=8694 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=161550 res=0 errno=0 [ 414.661870][ T41] audit: type=1800 audit(1785944374.657:98): pid=8694 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=161525 res=0 errno=0 [ 414.674628][ T41] audit: type=1800 audit(1785944374.687:99): pid=8694 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=161526 res=0 errno=0 [ 414.767133][ T34] usb 10-1: USB disconnect, device number 7 [ 414.848836][ T9] usblp 8-1:1.0: usblp0: USB Bidirectional printer dev 8 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 414.891819][ T9475] FAULT_INJECTION: forcing a failure. [ 414.891819][ T9475] name failslab, interval 1, probability 0, space 0, times 0 [ 414.905359][ T9462] netlink: 44 bytes leftover after parsing attributes in process `syz.5.816'. [ 414.929064][ T9475] CPU: 1 UID: 0 PID: 9475 Comm: syz.4.822 Tainted: G L syzkaller #0 PREEMPT(full) [ 414.929094][ T9475] Tainted: [L]=SOFTLOCKUP [ 414.929099][ T9475] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 414.929110][ T9475] Call Trace: [ 414.929115][ T9475] [ 414.929122][ T9475] dump_stack_lvl+0x100/0x190 [ 414.929185][ T9475] should_fail_ex.cold+0x5/0xa [ 414.929204][ T9475] should_failslab+0xc2/0x120 [ 414.929228][ T9475] kmem_cache_alloc_noprof+0x91/0x6a0 [ 414.929264][ T9475] ? trace_kmem_cache_alloc+0xdd/0x100 [ 414.929357][ T9475] ? security_file_alloc+0x34/0x2c0 [ 414.929390][ T9475] security_file_alloc+0x34/0x2c0 [ 414.929413][ T9475] init_file+0x95/0x480 [ 414.929432][ T9475] alloc_empty_file+0x79/0x1c0 [ 414.929454][ T9475] path_openat+0xe7/0x4280 [ 414.929471][ T9475] ? kasan_save_track+0x14/0x30 [ 414.929492][ T9475] ? __kasan_slab_alloc+0x89/0x90 [ 414.929513][ T9475] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 414.929532][ T9475] ? do_getname+0x35/0x390 [ 414.929552][ T9475] ? do_sys_openat2+0xc7/0x1e0 [ 414.929571][ T9475] ? __ia32_compat_sys_openat+0x12d/0x210 [ 414.929594][ T9475] ? __do_fast_syscall_32+0xe7/0x970 [ 414.929627][ T9475] ? __pfx_path_openat+0x10/0x10 [ 414.929651][ T9475] do_file_open+0x20e/0x430 [ 414.929668][ T9475] ? __lock_acquire+0x49f/0x1a40 [ 414.929696][ T9475] ? __pfx_do_file_open+0x10/0x10 [ 414.929725][ T9475] ? _raw_spin_unlock+0x28/0x50 [ 414.929744][ T9475] ? alloc_fd+0x471/0x7a0 [ 414.929767][ T9475] do_sys_openat2+0x10f/0x1e0 [ 414.929791][ T9475] ? __pfx_do_sys_openat2+0x10/0x10 [ 414.929815][ T9475] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 414.929844][ T9475] __ia32_compat_sys_openat+0x12d/0x210 [ 414.929869][ T9475] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 414.929891][ T9475] ? fput+0x79/0x100 [ 414.929911][ T9475] ? ksys_write+0x1ac/0x250 [ 414.929927][ T9475] ? __pfx_ksys_write+0x10/0x10 [ 414.929948][ T9475] __do_fast_syscall_32+0xe7/0x970 [ 414.929977][ T9475] ? lockdep_hardirqs_on+0x78/0x100 [ 414.930001][ T9475] do_fast_syscall_32+0x32/0x70 [ 414.930022][ T9475] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 414.930041][ T9475] RIP: 0023:0xf708efec [ 414.930063][ T9475] Code: Unable to access opcode bytes at 0xf708efc2. [ 414.930071][ T9475] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 414.930089][ T9475] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000100 [ 414.930099][ T9475] RDX: 0000000000880cc2 RSI: 0000000000000020 RDI: 0000000000000000 [ 414.930111][ T9475] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 414.930120][ T9475] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 414.930131][ T9475] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 414.930155][ T9475] [ 415.979388][ T9487] netlink: 4 bytes leftover after parsing attributes in process `syz.4.825'. [ 416.027468][ T9487] team0: Port device team_slave_0 removed [ 416.721614][ T9496] overlayfs: missing 'lowerdir' [ 417.085396][ T5909] usb 8-1: USB disconnect, device number 8 [ 417.144292][ T5909] usblp0: removed [ 417.205304][ T5772] Bluetooth: hci1: ISO packet for unknown connection handle 201 [ 417.226816][ T9508] netlink: 4 bytes leftover after parsing attributes in process `syz.3.831'. [ 417.245338][ T9508] netlink: 20 bytes leftover after parsing attributes in process `syz.3.831'. [ 417.351533][ T9515] ip_vti0: left promiscuous mode [ 418.400454][ T9534] netlink: 156 bytes leftover after parsing attributes in process `syz.2.838'. [ 418.569335][ T9538] bridge0: entered promiscuous mode [ 418.587128][ T9536] se_device not configured yet, cannot port link [ 418.726616][ T9534] netlink: 188 bytes leftover after parsing attributes in process `syz.2.838'. [ 418.852504][ T9545] FAULT_INJECTION: forcing a failure. [ 418.852504][ T9545] name failslab, interval 1, probability 0, space 0, times 0 [ 418.862147][ T9548] FAULT_INJECTION: forcing a failure. [ 418.862147][ T9548] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 418.880471][ T9548] CPU: 3 UID: 0 PID: 9548 Comm: syz.3.845 Tainted: G L syzkaller #0 PREEMPT(full) [ 418.880501][ T9548] Tainted: [L]=SOFTLOCKUP [ 418.880507][ T9548] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 418.880517][ T9548] Call Trace: [ 418.880523][ T9548] [ 418.880530][ T9548] dump_stack_lvl+0x100/0x190 [ 418.880557][ T9548] should_fail_ex.cold+0x5/0xa [ 418.880576][ T9548] strncpy_from_user+0x3b/0x2d0 [ 418.880601][ T9548] do_getname+0x78/0x390 [ 418.880625][ T9548] __ia32_sys_symlink+0x65/0xb0 [ 418.880645][ T9548] __do_fast_syscall_32+0xe7/0x970 [ 418.880668][ T9548] ? lockdep_hardirqs_on+0x78/0x100 [ 418.880691][ T9548] do_fast_syscall_32+0x32/0x70 [ 418.880713][ T9548] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 418.880733][ T9548] RIP: 0023:0xf7f03fec [ 418.880754][ T9548] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 418.880761][ T9548] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000053 [ 418.880778][ T9548] RAX: ffffffffffffffda RBX: 0000000080000e00 RCX: 0000000080000f00 [ 418.880787][ T9548] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 418.880796][ T9548] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 418.880805][ T9548] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 418.880814][ T9548] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 418.880833][ T9548] [ 418.880847][ T9545] CPU: 0 UID: 0 PID: 9545 Comm: syz.4.842 Tainted: G L syzkaller #0 PREEMPT(full) [ 418.880875][ T9545] Tainted: [L]=SOFTLOCKUP [ 418.880881][ T9545] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 418.880892][ T9545] Call Trace: [ 418.880898][ T9545] [ 418.880904][ T9545] dump_stack_lvl+0x100/0x190 [ 418.880929][ T9545] should_fail_ex.cold+0x5/0xa [ 418.880950][ T9545] should_failslab+0xc2/0x120 [ 418.880991][ T9545] __kmalloc_noprof+0xfc/0x820 [ 418.881016][ T9545] ? tomoyo_encode2+0xfb/0x3c0 [ 418.881046][ T9545] tomoyo_encode2+0xfb/0x3c0 [ 418.881076][ T9545] tomoyo_encode+0x29/0x50 [ 418.881101][ T9545] tomoyo_realpath_from_path+0x18c/0x690 [ 418.881153][ T9545] tomoyo_path_number_perm+0x23c/0x580 [ 418.881177][ T9545] ? tomoyo_path_number_perm+0x22e/0x580 [ 418.881201][ T9545] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 418.881224][ T9545] ? get_pid_task+0x106/0x250 [ 418.881270][ T9545] ? find_held_lock+0x2b/0x80 [ 418.881296][ T9545] ? __fget_files+0x215/0x3d0 [ 418.881311][ T9545] ? hook_file_ioctl_common+0x140/0x440 [ 418.881334][ T9545] ? __fget_files+0x215/0x3d0 [ 418.881354][ T9545] ? __fget_files+0x21f/0x3d0 [ 418.881374][ T9545] security_file_ioctl_compat+0xd3/0x230 [ 418.881406][ T9545] __ia32_compat_sys_ioctl+0xc2/0x360 [ 418.881436][ T9545] __do_fast_syscall_32+0xe7/0x970 [ 418.881462][ T9545] ? lockdep_hardirqs_on+0x78/0x100 [ 418.881488][ T9545] do_fast_syscall_32+0x32/0x70 [ 418.881511][ T9545] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 418.881534][ T9545] RIP: 0023:0xf708efec [ 418.881555][ T9545] Code: Unable to access opcode bytes at 0xf708efc2. [ 418.881563][ T9545] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 418.881580][ T9545] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040946400 [ 418.881590][ T9545] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 418.881599][ T9545] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 418.881608][ T9545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 418.881620][ T9545] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 418.881641][ T9545] [ 418.881856][ T5772] Bluetooth: hci3: ISO packet for unknown connection handle 201 [ 418.938880][ T9545] ERROR: Out of memory at tomoyo_realpath_from_path. [ 419.340091][ T9545] genirq: Flags mismatch irq 4. 00200000 (das16m1) vs. 00200080 (ttyS0) [ 419.498515][ T41] kauditd_printk_skb: 24 callbacks suppressed [ 419.498535][ T41] audit: type=1800 audit(1785944379.607:124): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 419.554934][ T9559] syzkaller0: entered promiscuous mode [ 419.572006][ T9559] syzkaller0: entered allmulticast mode [ 419.814722][ T9565] genirq: Flags mismatch irq 4. 00200000 (das16m1) vs. 00200080 (ttyS0) [ 419.908510][ T41] audit: type=1800 audit(1785944379.987:125): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 420.082830][ T9566] /dev/nullb0: Can't open blockdev [ 420.118316][ T9577] FAULT_INJECTION: forcing a failure. [ 420.118316][ T9577] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 420.149497][ T9577] CPU: 3 UID: 0 PID: 9577 Comm: syz.2.854 Tainted: G L syzkaller #0 PREEMPT(full) [ 420.149532][ T9577] Tainted: [L]=SOFTLOCKUP [ 420.149538][ T9577] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 420.149549][ T9577] Call Trace: [ 420.149558][ T9577] [ 420.149565][ T9577] dump_stack_lvl+0x100/0x190 [ 420.149593][ T9577] should_fail_ex.cold+0x5/0xa [ 420.149615][ T9577] _copy_from_user+0x2e/0xd0 [ 420.149645][ T9577] kstrtouint_from_user+0xd6/0x1d0 [ 420.149667][ T9577] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 420.149689][ T9577] ? __lock_acquire+0x49f/0x1a40 [ 420.149726][ T9577] proc_fail_nth_write+0x83/0x220 [ 420.149753][ T9577] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 420.149787][ T9577] vfs_write+0x2aa/0x1050 [ 420.149808][ T9577] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 420.149833][ T9577] ? __pfx_vfs_write+0x10/0x10 [ 420.149847][ T9577] ? find_held_lock+0x2b/0x80 [ 420.149871][ T9577] ? __fget_files+0x215/0x3d0 [ 420.149892][ T9577] ? __fget_files+0x21f/0x3d0 [ 420.149916][ T9577] ksys_write+0x12a/0x250 [ 420.149935][ T9577] ? __pfx_ksys_write+0x10/0x10 [ 420.149960][ T9577] do_int80_emulation+0x14b/0x720 [ 420.149992][ T9577] asm_int80_emulation+0x1a/0x20 [ 420.150013][ T9577] RIP: 0023:0xf71a74eb [ 420.150031][ T9577] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 420.150050][ T9577] RSP: 002b:00000000f545d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 420.150070][ T9577] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f545d5d0 [ 420.150081][ T9577] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 420.150091][ T9577] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 420.150100][ T9577] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 420.150111][ T9577] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 420.150134][ T9577] [ 420.483783][ T41] audit: type=1800 audit(1785944380.537:126): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 420.645146][ T41] audit: type=1800 audit(1785944380.757:127): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 420.789611][ T5772] Bluetooth: hci1: ISO packet for unknown connection handle 201 [ 420.839324][ T41] audit: type=1800 audit(1785944380.917:128): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 420.963154][ T41] audit: type=1800 audit(1785944381.047:129): pid=9590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.860" name="id" dev="configfs" ino=27735 res=0 errno=0 [ 420.965110][ T5772] Bluetooth: hci4: unexpected event for opcode 0x2041 [ 420.986137][ T41] audit: type=1800 audit(1785944381.047:130): pid=9590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.860" name="in_ports" dev="configfs" ino=27736 res=0 errno=0 [ 420.986191][ T41] audit: type=1800 audit(1785944381.047:131): pid=9590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.860" name="out_ports" dev="configfs" ino=27737 res=0 errno=0 [ 421.237925][ T9595] atomic_op ffff88804d1ad998 conn xmit_atomic 0000000000000000 [ 421.416045][ T41] audit: type=1800 audit(1785944381.527:132): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 421.790227][ T9605] netlink: 16 bytes leftover after parsing attributes in process `syz.5.865'. [ 421.804151][ T9605] netlink: 8 bytes leftover after parsing attributes in process `syz.5.865'. [ 421.824436][ T9605] FAULT_INJECTION: forcing a failure. [ 421.824436][ T9605] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 421.830822][ T9605] CPU: 2 UID: 0 PID: 9605 Comm: syz.5.865 Tainted: G L syzkaller #0 PREEMPT(full) [ 421.830855][ T9605] Tainted: [L]=SOFTLOCKUP [ 421.830861][ T9605] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 421.830873][ T9605] Call Trace: [ 421.830880][ T9605] [ 421.830889][ T9605] dump_stack_lvl+0x100/0x190 [ 421.830919][ T9605] should_fail_ex.cold+0x5/0xa [ 421.830943][ T9605] _copy_from_iter+0x1f4/0x1690 [ 421.830981][ T9605] ? __asan_memset+0x23/0x50 [ 421.831004][ T9605] ? __pfx__copy_from_iter+0x10/0x10 [ 421.831033][ T9605] ? __pfx___alloc_skb+0x10/0x10 [ 421.831071][ T9605] netlink_sendmsg+0x808/0xda0 [ 421.831098][ T9605] ? __pfx_netlink_sendmsg+0x10/0x10 [ 421.831124][ T9605] ? apparmor_socket_sendmsg+0x15b/0x270 [ 421.831151][ T9605] ____sys_sendmsg+0xa4d/0xbe0 [ 421.831171][ T9605] ? __pfx_netlink_sendmsg+0x10/0x10 [ 421.831195][ T9605] ? __pfx_____sys_sendmsg+0x10/0x10 [ 421.831220][ T9605] ? _kstrtoull+0x13c/0x1f0 [ 421.831242][ T9605] ? __pfx__kstrtoull+0x10/0x10 [ 421.831266][ T9605] ___sys_sendmsg+0x190/0x1e0 [ 421.831289][ T9605] ? __pfx____sys_sendmsg+0x10/0x10 [ 421.831309][ T9605] ? __lock_acquire+0x49f/0x1a40 [ 421.831366][ T9605] __sys_sendmmsg+0x309/0x440 [ 421.831395][ T9605] ? __pfx___sys_sendmmsg+0x10/0x10 [ 421.831422][ T9605] ? find_held_lock+0x2b/0x80 [ 421.831451][ T9605] ? __mutex_unlock_slowpath+0x35d/0x930 [ 421.831490][ T9605] ? fput+0x79/0x100 [ 421.831512][ T9605] ? ksys_write+0x1ac/0x250 [ 421.831534][ T9605] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 421.831554][ T9605] ? lockdep_hardirqs_on+0x78/0x100 [ 421.831581][ T9605] __do_fast_syscall_32+0xe7/0x970 [ 421.831607][ T9605] ? lockdep_hardirqs_on+0x78/0x100 [ 421.831632][ T9605] do_fast_syscall_32+0x32/0x70 [ 421.831659][ T9605] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 421.831682][ T9605] RIP: 0023:0xf702efec [ 421.831708][ T9605] Code: Unable to access opcode bytes at 0xf702efc2. [ 421.831716][ T9605] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 421.831736][ T9605] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000140 [ 421.831749][ T9605] RDX: 0000000004924b68 RSI: 0000000000000000 RDI: 0000000000000000 [ 421.831759][ T9605] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 421.831770][ T9605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 421.831781][ T9605] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 421.831804][ T9605] [ 422.858035][ T9614] socket: no more sockets [ 423.408176][ T41] audit: type=1800 audit(1785944383.507:133): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 423.637227][ T9625] openvswitch: netlink: IP tunnel dst address not specified [ 423.795364][ T9627] bochs-drm 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 424.599178][ T41] kauditd_printk_skb: 5 callbacks suppressed [ 424.599197][ T41] audit: type=1800 audit(1785944384.707:139): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0 [ 424.815474][ T41] audit: type=1800 audit(1785944384.927:140): pid=9631 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.871" name="attr_allow_any_host" dev="configfs" ino=26976 res=0 errno=0 [ 424.834292][ T9631] nvmet: adding nsid 1 to subsystem testnqn [ 424.881206][ T41] audit: type=1800 audit(1785944384.997:141): pid=9631 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.871" name="device_path" dev="configfs" ino=26978 res=0 errno=0 [ 425.017749][ T41] audit: type=1800 audit(1785944385.117:142): pid=9632 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.871" name="enable" dev="configfs" ino=27775 res=0 errno=0 [ 425.070976][ T9632] [ 425.075672][ T9632] ====================================================== [ 425.078919][ T9632] WARNING: possible circular locking dependency detected [ 425.083467][ T9632] syzkaller #0 Tainted: G L [ 425.095509][ T9632] ------------------------------------------------------ [ 425.099519][ T9632] syz.4.871/9632 is trying to acquire lock: [ 425.104336][ T9632] ffff888074a0e9a8 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2350 [ 425.112707][ T9632] [ 425.112707][ T9632] but task is already holding lock: [ 425.116965][ T9632] ffff888021595068 (&subsys->lock){+.+.}-{4:4}, at: nvmet_ns_enable+0x4f/0x5d0 [ 425.139812][ T9632] [ 425.139812][ T9632] which lock already depends on the new lock. [ 425.139812][ T9632] [ 425.143693][ T9632] [ 425.143693][ T9632] the existing dependency chain (in reverse order) is: [ 425.147463][ T9632] [ 425.147463][ T9632] -> #2 (&subsys->lock){+.+.}-{4:4}: [ 425.152990][ T9632] lock_acquire+0x1b9/0x370 [ 425.156369][ T9632] __mutex_lock+0x1a4/0x1bd0 [ 425.159231][ T9632] nvmet_ns_device_path_store+0x57/0x1c0 [ 425.162974][ T9632] configfs_write_iter+0x302/0x4e0 [ 425.166939][ T9632] vfs_write+0x6ac/0x1050 [ 425.170754][ T9632] ksys_write+0x12a/0x250 [ 425.175504][ T9632] __do_fast_syscall_32+0xe7/0x970 [ 425.179781][ T9632] do_fast_syscall_32+0x32/0x70 [ 425.182735][ T9632] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 425.186339][ T9632] [ 425.186339][ T9632] -> #1 (&p->frag_sem){.+.+}-{4:4}: [ 425.191811][ T9632] lock_acquire+0x1b9/0x370 [ 425.207443][ T9632] down_read+0x99/0x4c0 [ 425.209370][ T9632] __configfs_open_file+0xe8/0x9c0 [ 425.211368][ T9632] do_dentry_open+0x6ab/0x14d0 [ 425.214033][ T9632] vfs_open+0x82/0x3f0 [ 425.216487][ T9632] dentry_open+0x71/0xd0 [ 425.219061][ T9632] ima_calc_file_hash+0xe1/0x380 [ 425.237656][ T9632] ima_collect_measurement+0x94f/0xb30 [ 425.240858][ T9632] process_measurement+0xdfe/0x2350 [ 425.243865][ T9632] ima_file_check+0xcc/0x120 [ 425.246885][ T9632] security_file_post_open+0xc4/0x210 [ 425.250480][ T9632] path_openat+0x985/0x4280 [ 425.254320][ T9632] do_file_open+0x20e/0x430 [ 425.258299][ T9632] do_sys_openat2+0x10f/0x1e0 [ 425.263518][ T9632] __ia32_compat_sys_openat+0x12d/0x210 [ 425.269391][ T9632] __do_fast_syscall_32+0xe7/0x970 [ 425.283567][ T9632] do_fast_syscall_32+0x32/0x70 [ 425.288149][ T9632] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 425.306780][ T9632] [ 425.306780][ T9632] -> #0 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 425.309903][ T9632] check_prev_add+0xeb/0xe60 [ 425.311621][ T9632] __lock_acquire+0x136c/0x1a40 [ 425.314019][ T9632] lock_acquire+0x1b9/0x370 [ 425.317229][ T9632] __mutex_lock+0x1a4/0x1bd0 [ 425.326449][ T9632] process_measurement+0x5ab/0x2350 [ 425.330722][ T9632] ima_file_check+0xcc/0x120 [ 425.334187][ T9632] security_file_post_open+0xc4/0x210 [ 425.337027][ T9632] path_openat+0x985/0x4280 [ 425.339999][ T9632] do_file_open+0x20e/0x430 [ 425.347296][ T9632] file_open_name+0x1c3/0x3e0 [ 425.354500][ T9632] filp_open+0x2e/0x50 [ 425.361939][ T9632] nvmet_file_ns_enable+0x95/0x420 [ 425.371395][ T9632] nvmet_ns_enable+0x35f/0x5d0 [ 425.377305][ T9632] nvmet_ns_enable_store+0x11e/0x160 [ 425.385911][ T9632] configfs_write_iter+0x302/0x4e0 [ 425.394196][ T9632] vfs_write+0x6ac/0x1050 [ 425.402204][ T9632] ksys_write+0x12a/0x250 [ 425.405420][ T9632] __do_fast_syscall_32+0xe7/0x970 [ 425.409264][ T9632] do_fast_syscall_32+0x32/0x70 [ 425.412521][ T9632] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 425.420658][ T9632] [ 425.420658][ T9632] other info that might help us debug this: [ 425.420658][ T9632] [ 425.431266][ T9632] Chain exists of: [ 425.431266][ T9632] &ima_iint_mutex_key[depth] --> &p->frag_sem --> &subsys->lock [ 425.431266][ T9632] [ 425.449564][ T9632] Possible unsafe locking scenario: [ 425.449564][ T9632] [ 425.457839][ T9632] CPU0 CPU1 [ 425.462593][ T9632] ---- ---- [ 425.466753][ T9632] lock(&subsys->lock); [ 425.471741][ T9632] lock(&p->frag_sem); [ 425.480522][ T9632] lock(&subsys->lock); [ 425.492232][ T9632] lock(&ima_iint_mutex_key[depth]); [ 425.500878][ T9632] [ 425.500878][ T9632] *** DEADLOCK *** [ 425.500878][ T9632] [ 425.503460][ T9601] isofs_fill_super: bread failed, dev=sr0, iso_blknum=32, block=32 [ 425.514062][ T9632] 6 locks held by syz.4.871/9632: [ 425.537779][ T9632] #0: ffff888023a3f5f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 425.546589][ T9632] #1: ffff8880220d0450 (sb_writers#19){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 425.551959][ T9632] #2: ffff88802ac8d080 (&buffer->mutex#2){+.+.}-{4:4}, at: configfs_write_iter+0x76/0x4e0 [ 425.558662][ T9632] #3: ffff88802a1c7270 (&p->frag_sem){.+.+}-{4:4}, at: configfs_write_iter+0x218/0x4e0 [ 425.564551][ T9632] #4: ffffffff8fd33748 (nvmet_config_sem){+.+.}-{4:4}, at: nvmet_ns_enable_store+0xa5/0x160 [ 425.571042][ T9632] #5: ffff888021595068 (&subsys->lock){+.+.}-{4:4}, at: nvmet_ns_enable+0x4f/0x5d0 [ 425.591775][ T9632] [ 425.591775][ T9632] stack backtrace: [ 425.595178][ T9632] CPU: 2 UID: 0 PID: 9632 Comm: syz.4.871 Tainted: G L syzkaller #0 PREEMPT(full) [ 425.595209][ T9632] Tainted: [L]=SOFTLOCKUP [ 425.595216][ T9632] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 425.595229][ T9632] Call Trace: [ 425.595238][ T9632] [ 425.595247][ T9632] dump_stack_lvl+0x100/0x190 [ 425.595271][ T9632] print_circular_bug.cold+0x178/0x1c7 [ 425.595301][ T9632] check_noncircular+0x146/0x160 [ 425.595327][ T9632] ? arch_stack_walk+0xa6/0xf0 [ 425.595354][ T9632] check_prev_add+0xeb/0xe60 [ 425.595379][ T9632] ? stack_trace_save+0x8e/0xc0 [ 425.595400][ T9632] __lock_acquire+0x136c/0x1a40 [ 425.595425][ T9632] lock_acquire+0x1b9/0x370 [ 425.595446][ T9632] ? process_measurement+0x5ab/0x2350 [ 425.595465][ T9632] ? __pfx___might_resched+0x10/0x10 [ 425.595488][ T9632] __mutex_lock+0x1a4/0x1bd0 [ 425.595509][ T9632] ? process_measurement+0x5ab/0x2350 [ 425.595526][ T9632] ? process_measurement+0x5ab/0x2350 [ 425.595637][ T9632] ? __pfx___mutex_lock+0x10/0x10 [ 425.595661][ T9632] ? __pfx___might_resched+0x10/0x10 [ 425.595688][ T9632] ? down_write+0x146/0x1f0 [ 425.595714][ T9632] ? process_measurement+0x5ab/0x2350 [ 425.595734][ T9632] process_measurement+0x5ab/0x2350 [ 425.595756][ T9632] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 425.595780][ T9632] ? __pfx_process_measurement+0x10/0x10 [ 425.595800][ T9632] ? tomoyo_check_open_permission+0x211/0x3c0 [ 425.595818][ T9632] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 425.595840][ T9632] ? hook_file_open+0x24f/0x8f0 [ 425.595864][ T9632] ? __pfx_apparmor_file_open+0x10/0x10 [ 425.595881][ T9632] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 425.595901][ T9632] ima_file_check+0xcc/0x120 [ 425.595920][ T9632] ? __pfx_ima_file_check+0x10/0x10 [ 425.595949][ T9632] security_file_post_open+0xc4/0x210 [ 425.595970][ T9632] path_openat+0x985/0x4280 [ 425.595989][ T9632] ? __pfx_path_openat+0x10/0x10 [ 425.596003][ T9632] ? kasan_save_stack+0x30/0x50 [ 425.596021][ T9632] ? kasan_save_track+0x14/0x30 [ 425.596038][ T9632] ? __kasan_slab_alloc+0x89/0x90 [ 425.596056][ T9632] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 425.596074][ T9632] ? do_getname_kernel+0x5d/0x250 [ 425.596090][ T9632] ? filp_open+0x1d/0x50 [ 425.596108][ T9632] ? nvmet_file_ns_enable+0x95/0x420 [ 425.596131][ T9632] ? nvmet_ns_enable+0x35f/0x5d0 [ 425.596202][ T9632] do_file_open+0x20e/0x430 [ 425.596218][ T9632] ? __pfx_do_file_open+0x10/0x10 [ 425.596240][ T9632] ? rcu_is_watching+0x12/0xc0 [ 425.596260][ T9632] file_open_name+0x1c3/0x3e0 [ 425.596322][ T9632] ? __pfx_file_open_name+0x10/0x10 [ 425.596341][ T9632] ? do_getname_kernel+0x5d/0x250 [ 425.596358][ T9632] ? __asan_memcpy+0x3c/0x60 [ 425.596374][ T9632] ? do_getname_kernel+0x1be/0x250 [ 425.596391][ T9632] filp_open+0x2e/0x50 [ 425.596409][ T9632] nvmet_file_ns_enable+0x95/0x420 [ 425.596431][ T9632] nvmet_ns_enable+0x35f/0x5d0 [ 425.596451][ T9632] nvmet_ns_enable_store+0x11e/0x160 [ 425.596467][ T9632] ? __pfx_nvmet_ns_enable_store+0x10/0x10 [ 425.596485][ T9632] configfs_write_iter+0x302/0x4e0 [ 425.596502][ T9632] vfs_write+0x6ac/0x1050 [ 425.596516][ T9632] ? __pfx_configfs_write_iter+0x10/0x10 [ 425.596531][ T9632] ? __pfx_vfs_write+0x10/0x10 [ 425.596543][ T9632] ? find_held_lock+0x2b/0x80 [ 425.596651][ T9632] ksys_write+0x12a/0x250 [ 425.596667][ T9632] ? __pfx_ksys_write+0x10/0x10 [ 425.596683][ T9632] __do_fast_syscall_32+0xe7/0x970 [ 425.596708][ T9632] do_fast_syscall_32+0x32/0x70 [ 425.596728][ T9632] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 425.596749][ T9632] RIP: 0023:0xf708efec [ 425.596772][ T9632] Code: Unable to access opcode bytes at 0xf708efc2. [ 425.596779][ T9632] RSP: 002b:00000000f545c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 425.596795][ T9632] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000580 [ 425.596805][ T9632] RDX: 000000000000001f RSI: 0000000000000000 RDI: 0000000000000000 [ 425.596814][ T9632] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 425.596823][ T9632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 425.596832][ T9632] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 425.596845][ T9632] [ 425.622615][ T1163] nvmet: connect request for invalid subsystem testnqn! [ 425.669992][ T41] audit: type=1800 audit(1785944385.777:143): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=161895 res=0 errno=0 [ 425.677634][ T9631] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 426.269826][ T41] audit: type=1800 audit(1785944386.387:144): pid=5158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16394 res=0 errno=0