last executing test programs: 9m45.277660745s ago: executing program 3 (id=69): userfaultfd(0x1) bpf$MAP_CREATE(0x0, 0x0, 0x50) openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x41, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x1, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x3}, {0x6, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x8c}, {0x0, 0x2, 0x9, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}]}) socket(0x10, 0x80002, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b24, &(0x7f0000000000)={'wlan0\x00'}) msgget$private(0x0, 0x4a0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0xf, 0x3, 0xffffffffffffffff, 0x1000000000000002, 0x102000000000002, 0x8000000d, 0x2004c8, 0xffff, 0x3, 0x2000000fffffffd, 0x10000, 0x7fffffffffffffff, 0xd0b, 0xfffffffffffffff9, 0x2000000000000002, 0x18], 0x80a0000, 0x1806c4}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) 9m42.673274351s ago: executing program 3 (id=78): bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="050000000500000002000000"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYRES32=r1, @ANYBLOB="d72dc96c9e733a3dbe0724b059d2965d989490d2f464d158ac466a0b288d282c1147685b8e33114d521e9098008b88139ce7ad8c6b93ed9c4c6063a30af1a734f60911ee88d391e728cec281b68d356daec8577b65dc799c67a10852f5f0081e"], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x20000090) openat$loop_ctrl(0xffffff9c, 0x0, 0x8000, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_SOCKET={0x2d, 0x0, 0x0, 0xda, 0xfffffffffffffff2, 0x0, 0x4d5d, 0x0, 0x1, {0x0, 0x0, 0x6}}) io_uring_enter(0xffffffffffffffff, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r4 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r4, 0x1000006) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000740)={0x53, 0xfffffffffffffffe, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0xffff140f, 0x0, 0x0, 0x0}) fcntl$addseals(r4, 0x409, 0x7) ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f0000000000)={r4, 0x0, 0x0, 0x1000000}) ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f00000001c0)={r4, 0x0, 0x0, 0x1000000}) 9m42.401966742s ago: executing program 3 (id=80): socket$kcm(0x21, 0x7, 0x2) socket$packet(0x11, 0x2, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000400)='ns/cgroup\x00') r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc00c9207, &(0x7f0000000440)={0x0, 0x0, 0x4}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 9m41.263102029s ago: executing program 3 (id=83): setresgid(0xee00, 0xee01, 0x0) r0 = openat$hpet(0xffffff9c, &(0x7f0000000080), 0x103000, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r1 = socket(0xf, 0x3, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000040)=0xc) setregid(0xffffffffffffffff, r2) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000280), 0x80a00, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000004c0)={'syzkaller0\x00', 0x7101}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000000106fab91cebff32c0e0000000700000a20000000000a010400000000000000000200000a0900010073797a300000000040000000030a010200000000000000000200000a0900010073797a30000000000900030073797a300000000014000480080001400000000408000240fffffffefe000000060a010400000000000000000200000a0900010073797a30000000000900020073797a3000000000"], 0xd4}}, 0x4000) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x20040084) sendmsg$nl_route_sched(r4, 0x0, 0x20000000) 9m40.142312413s ago: executing program 3 (id=87): syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) openat$tun(0xffffff9c, &(0x7f0000000200), 0x0, 0x0) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_DISHNETWORK_SEND_LEGACY_CMD(r0, 0x6f50, 0x8) userfaultfd(0x801) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000001680)) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r2, 0x4601, &(0x7f0000000100)={0x400, 0xa, 0x0, 0x0, 0x0, 0x180, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x4, 0x20, 0x0, 0x0, 0x1, 0x2, 0x4, 0x80, 0x0, 0xfffffffd, 0x26, 0x0, 0x1}) ioctl$FBIOGET_FSCREENINFO(r2, 0x4602, 0x0) 9m40.009345292s ago: executing program 3 (id=89): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) poll(&(0x7f00000002c0)=[{r0, 0x80ad}], 0x1, 0x2) r1 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x42202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r1, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick=0xffffff3f, {}, {}, @raw32={[0x0, 0x0, 0x2000000]}}], 0x1c) r2 = memfd_create(&(0x7f0000000600)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc0N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc00x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x10000, 0xbdf1, 0x6, 0x4e64070c, 0xfffffffe}, 0x2, r3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 8m59.378924885s ago: executing program 0 (id=190): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0xc}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x5fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0xb, 0xfff3}, {}, {0x7, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x8000, 0x1, 0x6, 0x77}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x2}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x24040894}, 0x0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r6, 0x3e}, 0x80, &(0x7f0000000180)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4) 8m59.113944508s ago: executing program 0 (id=191): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0x40, 0x0, 0x800, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}]}]}, 0x40}}, 0x4c800) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f00000003c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002800128009000100626f6e640000000018000280140008"], 0x48}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYRESHEX=r3, @ANYRES16=r0, @ANYRES8=r2], 0xcc}, 0x1, 0x0, 0x0, 0x20008805}, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000580)='./proc\x00', &(0x7f00000005c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0) write(r4, &(0x7f0000000640)='1', 0x1) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000680)={@local, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x1234, 0x4000, 0x40, 0x11, 0x0, @rand_addr=0x1020304, @rand_addr=0x8080808}, {0x1234, 0x5678, 0x8}}}}}, 0x0) sendmmsg$inet(r0, &(0x7f0000000380)=[{{0x0, 0x4b, &(0x7f00000003c0), 0x1}}], 0x1, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_SET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="959b23dc3c61eef0e22a6858f210076c40282f3153a489dd475f88b8e117f6871159e16b9f9d1cb38db733fb66148cdbc1b17880c920b866b746dd7b90522b0dfb2485086bc7e4feceb8fadd505779135463dd8982a3c7bb272a8ced876a6d80df654fcc9df4d0d11233ff2b87a92dc17761cb702675542158eb82e075ef1999f1c1b17dccc895c2854e09a080d3b1788c3880d619d86aeebc55d0b6312092e26c6ffb13d95bc98a9cfe0e9cea1ec6bfe4dcc0cdd25b97512b480732ae72b9ff1b737ca10d71087eaa3a6c1f3edcbc40cd547dedbcb7", @ANYRESHEX=r7, @ANYRESDEC=r6, @ANYRESHEX=r7], 0x58}}, 0x80) 8m58.897789188s ago: executing program 0 (id=194): syz_open_dev$video4linux(&(0x7f0000000000), 0x7, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0xe0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x4c0142, 0x161) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x30, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x30}}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x50000, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) sendfile(r2, r2, 0x0, 0x1002000ff) 8m57.195239861s ago: executing program 0 (id=200): bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_open_dev$loop(&(0x7f0000000000), 0xa779, 0x100) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$unix(0x1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) epoll_create1(0x80000) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) 8m56.277337843s ago: executing program 0 (id=205): openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) close(r0) 8m40.702507751s ago: executing program 33 (id=205): openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) close(r0) 16.143763007s ago: executing program 1 (id=4209): capset(&(0x7f00000000c0)={0x20071026}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x81, 0xfffffffb, 0xfffffffe}) openat$comedi(0xffffff9c, &(0x7f0000000280)='/dev/comedi2\x00', 0x80340, 0x0) 15.372282731s ago: executing program 1 (id=4211): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c00000009060500000000000000000006000007140007800600044000080000060005404e20000005000100070000000900020073797a30"], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x804) 11.670081183s ago: executing program 5 (id=4219): fsmount(0xffffffffffffffff, 0x0, 0x2) r0 = openat$rtc(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc01c5869, 0x0) 11.670002222s ago: executing program 5 (id=4220): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a6c000000060a0104000000000000000002000000400004803c0001800a0001006d617463680000002c00028014000300f4f03b02000000b2960003116b61979e090001006c3274700000000008000240000000000900010073797a30000000000900020073797a32"], 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 11.668842455s ago: executing program 5 (id=4221): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x16, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180200000002000000000000040017028500000011000000850000000500000095"], &(0x7f0000000800)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ffffffc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000140)="e02742e8680d85ff9782762f86dd", 0x0, 0xf000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 11.668455885s ago: executing program 5 (id=4222): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x68802, 0x0) io_setup(0x4205, &(0x7f0000000100)=0x0) io_submit(r1, 0x1f, &(0x7f0000000440)=[&(0x7f00000000c0)={0x0, 0x0, 0xa1, 0x1, 0x4, r0, &(0x7f0000000040)="1d", 0xfdef, 0x801}]) 11.62933192s ago: executing program 5 (id=4224): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x4c, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x4c}}, 0x0) 696.563988ms ago: executing program 5 (id=4233): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r3 = dup(r2) r4 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x2a003) r5 = socket(0x2, 0x1, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_emit_ethernet(0x76, &(0x7f0000000100)={@multicast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, '\x00\'$', 0x40, 0x3a, 0xff, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast2, {[], @dest_unreach={0x1, 0xc519ea7f13a9b11e, 0x0, 0x0, '\x00', {0xd, 0x6, "2318d3", 0xf51, 0x0, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, [@fragment={0x3a, 0x0, 0x81, 0x0, 0x0, 0x1, 0x65}], "d2588e45cd1357bc"}}}}}}}, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) r6 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SOCK(r4, 0xab00, r5) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x9) ioctl$NBD_DO_IT(r6, 0xab03) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x100000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/module/acpi/parameters/debug_level\x00', 0x2, 0x0) write(r7, &(0x7f0000000180)='0xffffff', 0x8) r8 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write(r8, &(0x7f0000000200)='0xff', 0x4) r9 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/acpi/devices/QEMU0002:00/status\x00', 0x0, 0x0) read(r9, &(0x7f0000000280)=""/100, 0x64) write(r8, &(0x7f0000000300)="df466fc9be4e579f074bf997df82cabf67bfbf2714da096e38c0ddba7b7166f16c56f7113a0f31eaf04020cd7ce3f13a0db6481afec17bd9cadb68c5fd4cf3eb2cb7d51325590b28c63ba2eb7501497cd1be99838e83ac03669f446c09a3181ea00f8b2e8f494d31d034b93fcf70ef73da08a5d601d78624b043093ca86eb331328306b84d1c6733b9be59711d30b07d8de4564140cb33068587dc84220ee0b8f847b332f30e8659cfd10c21bf8834ecd490f518a91bb1f42cd2f8ec4e2f9306a1d9448c27751b0b1f5962f957a72d22b5850f012a6c474fd1bd52929d0bb50c540b5189fc87", 0xe6) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000040)=@o_path={&(0x7f0000000000)='./sys/module/acpi/parameters/debug_level\x00', r7, 0x4000, r9}, 0x18) r10 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r10, &(0x7f0000000180)='pi3usb30532 0x5', 0xf) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r3, 0x0) 696.490682ms ago: executing program 1 (id=4234): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b0400000000eba1c5620200fffe4c0004802800018007000100637400001c00028008000140000000020800024000000016050003000000000020000180070001006374000014000280080002400000000d080004400000000c0900010073797a30000000000900020073797a320000000014000000110001"], 0xa0}, 0x1, 0x0, 0x0, 0x840}, 0x0) 696.460638ms ago: executing program 2 (id=4235): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000002480)={r0, 0x0, 0x0}, 0x1c) 696.43548ms ago: executing program 4 (id=4236): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000440)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000340)="5d000300010001", 0x7) 643.250986ms ago: executing program 4 (id=4237): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_RANGE_SREG={0x8}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_FROM_DATA={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0) 566.279322ms ago: executing program 1 (id=4238): r0 = socket$inet6(0xa, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x3c}}, 0x0) sendmmsg$inet6(r0, &(0x7f0000007240)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x6, @mcast2, 0x7}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)="1ce02c7a", 0xfe60}], 0x1}}, {{0x0, 0x0, &(0x7f0000000000), 0x1}}], 0x3, 0x1c000) 562.572913ms ago: executing program 2 (id=4239): r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x500, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$CDROMPLAYTRKIND(r0, 0x5304, &(0x7f0000000040)={0x0, 0x89, 0x6, 0xb2}) 368.696151ms ago: executing program 4 (id=4240): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="84010000100013070000000000000000ff"], 0x184}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0) 316.919986ms ago: executing program 2 (id=4241): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x1e, 0x305, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x8000000, 0x0, 0x800}, 0x0) readv(r0, &(0x7f0000001840)=[{&(0x7f0000000100)=""/239, 0xef}], 0x1) 285.31497ms ago: executing program 4 (id=4242): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000540), 0x42101, 0x0) writev(r0, &(0x7f0000000580)=[{&(0x7f00000005c0)='~', 0x1}], 0x1) ioctl$SNAPSHOT_FREE(r0, 0x3305) 244.311543ms ago: executing program 2 (id=4243): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000002200)={&(0x7f0000002240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002300)={&(0x7f0000002340)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a90010000060a0b0400000000000000000200000064010480600101800a0001006d617463680000005001028008000240000000000b000100706f6c696379000038010300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d04a8e3e29360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f50000000900010073797a30000000000900020073797a3200"], 0x1b8}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) 215.630946ms ago: executing program 1 (id=4244): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14, r1, 0x1, 0x70bd27, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x10) 169.742637ms ago: executing program 4 (id=4245): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010400000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_TYPE={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) 158.204732ms ago: executing program 2 (id=4246): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$peekuser(0x3, r0, 0xff) 99.408311ms ago: executing program 1 (id=4247): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) 98.184916ms ago: executing program 4 (id=4248): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') ppoll(&(0x7f0000000040)=[{r0}], 0x1, 0x0, 0x0, 0x0) mount$binderfs(0x0, &(0x7f0000000700)='./binderfs\x00', 0x0, 0x80000, 0x0) 0s ago: executing program 2 (id=4249): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$UBLK_U_CMD_START_DEV(r0, 0xc0207506, &(0x7f0000000780)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) read$FUSE(r0, &(0x7f0000000800)={0x2020}, 0x2020) kernel console output (not intermixed with test programs): ubj=unconfined pid=15461 comm="syz.5.3031" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86fec code=0x7ffc0000 [ 494.642607][ T44] audit: type=1326 audit(1791688262.087:2394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15461 comm="syz.5.3031" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86fec code=0x7ffc0000 [ 494.825756][T15468] 9p: Bad value for 'rfdno' [ 495.277701][ T5839] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 495.421582][T15482] fuse: fd is not a fuse device [ 495.429358][ T5839] usb 7-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00 [ 495.432303][ T5839] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 495.432318][ T5839] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 34493, setting to 1024 [ 495.432331][ T5839] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 495.432364][ T5839] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.436804][T15480] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 495.436922][T15480] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 495.466556][ T5839] cyberjack 7-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 495.481267][ T5839] usb 7-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 495.662633][ T5926] usb 7-1: USB disconnect, device number 18 [ 495.674468][ T5926] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 495.674907][ T5926] cyberjack 7-1:1.0: device disconnected [ 495.775852][T15485] overlayfs: failed to clone upperpath [ 496.657730][ T5926] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 496.746919][T15514] fuse: fd is not a fuse device [ 496.817744][ T5926] usb 9-1: Using ep0 maxpacket: 32 [ 496.818809][ T5926] usb 9-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 496.819289][ T5926] usb 9-1: config 0 has no interfaces? [ 496.819332][ T5926] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.821481][T15517] fuse: fd is not a fuse device [ 496.822142][ T5926] usb 9-1: config 0 descriptor?? [ 497.171598][T15534] fuse: fd is not a fuse device [ 497.468145][T15559] fuse: fd is not a fuse device [ 497.700630][T15580] fuse: fd is not a fuse device [ 499.028665][ T1162] net_ratelimit: 834 callbacks suppressed [ 499.405933][ T5839] usb 9-1: USB disconnect, device number 16 [ 499.671127][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 499.680627][T15643] fuse: fd is not a fuse device [ 499.717808][ T10] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 499.740035][T15648] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3107'. [ 499.868120][ T10] usb 7-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 499.869404][ T10] usb 7-1: config 1 has an invalid interface number: 3 but max is 0 [ 499.869418][ T10] usb 7-1: config 1 has no interface number 0 [ 499.870957][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.870967][ T10] usb 7-1: Product: syz [ 499.870974][ T10] usb 7-1: Manufacturer: syz [ 499.870982][ T10] usb 7-1: SerialNumber: syz [ 499.878357][ T10] usb 7-1: 3:0 : does not exist [ 499.878365][ T10] usb 7-1: 3:0 : does not exist [ 500.089624][ T10] usb 7-1: USB disconnect, device number 19 [ 500.809413][T15684] fuse: fd is not a fuse device [ 500.942660][T15689] FAULT_INJECTION: forcing a failure. [ 500.942660][T15689] name failslab, interval 1, probability 0, space 0, times 0 [ 500.942694][T15689] CPU: 0 UID: 0 PID: 15689 Comm: syz.4.3124 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.942724][T15689] Tainted: [L]=SOFTLOCKUP [ 500.942733][T15689] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 500.942746][T15689] Call Trace: [ 500.942754][T15689] [ 500.942763][T15689] dump_stack_lvl+0x100/0x190 [ 500.942797][T15689] should_fail_ex.cold+0x5/0xa [ 500.942824][T15689] should_failslab+0xc2/0x120 [ 500.942856][T15689] __kmalloc_cache_noprof+0x91/0x6d0 [ 500.942882][T15689] ? bpf_int_jit_compile+0x1304/0x1820 [ 500.942914][T15689] bpf_int_jit_compile+0x1304/0x1820 [ 500.942949][T15689] ? __pfx_bpf_int_jit_compile+0x10/0x10 [ 500.942991][T15689] __bpf_prog_select_runtime+0x3df/0x9f0 [ 500.943017][T15689] ? __asan_memcpy+0x3c/0x60 [ 500.943042][T15689] bpf_prepare_filter+0xd32/0x11e0 [ 500.943071][T15689] ? __pfx_seccomp_check_filter+0x10/0x10 [ 500.943097][T15689] ? __pfx_bpf_prepare_filter+0x10/0x10 [ 500.943122][T15689] ? __asan_memcpy+0x3c/0x60 [ 500.943148][T15689] ? kmemdup_noprof+0x49/0x60 [ 500.943173][T15689] bpf_prog_create_from_user+0x1df/0x2e0 [ 500.943200][T15689] ? __pfx_seccomp_check_filter+0x10/0x10 [ 500.943226][T15689] do_seccomp+0x7f7/0x2730 [ 500.943256][T15689] ? __pfx_do_seccomp+0x10/0x10 [ 500.943282][T15689] ? xfd_validate_state+0x129/0x190 [ 500.943334][T15689] __do_fast_syscall_32+0x13a/0x8b0 [ 500.943361][T15689] do_fast_syscall_32+0x32/0x70 [ 500.943384][T15689] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 500.943411][T15689] RIP: 0023:0xf73cefec [ 500.943435][T15689] Code: Unable to access opcode bytes at 0xf73cefc2. [ 500.943461][T15689] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000162 [ 500.943485][T15689] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000000000a [ 500.943499][T15689] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 500.943512][T15689] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 500.943525][T15689] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 500.943537][T15689] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 500.943567][T15689] [ 501.102331][T15698] FAULT_INJECTION: forcing a failure. [ 501.102331][T15698] name failslab, interval 1, probability 0, space 0, times 0 [ 501.102354][T15698] CPU: 2 UID: 0 PID: 15698 Comm: syz.4.3129 Tainted: G L syzkaller #0 PREEMPT(full) [ 501.102370][T15698] Tainted: [L]=SOFTLOCKUP [ 501.102374][T15698] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 501.102382][T15698] Call Trace: [ 501.102387][T15698] [ 501.102392][T15698] dump_stack_lvl+0x100/0x190 [ 501.102412][T15698] should_fail_ex.cold+0x5/0xa [ 501.102428][T15698] should_failslab+0xc2/0x120 [ 501.102447][T15698] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 501.102464][T15698] ? register_lock_class+0x3f/0x7b0 [ 501.102482][T15698] ? __d_alloc+0x35/0xa50 [ 501.102501][T15698] __d_alloc+0x35/0xa50 [ 501.102518][T15698] ? __lock_acquire+0x5c0/0x1f40 [ 501.102536][T15698] d_alloc_parallel+0x105/0x14c0 [ 501.102554][T15698] ? lock_acquire+0x1d1/0x380 [ 501.102571][T15698] ? lookup_slow+0x42/0x70 [ 501.102583][T15698] ? __pfx_d_alloc_parallel+0x10/0x10 [ 501.102597][T15698] ? __pfx___might_resched+0x10/0x10 [ 501.102625][T15698] ? find_held_lock+0x2b/0x80 [ 501.102644][T15698] ? down_read+0x13b/0x4c0 [ 501.102665][T15698] ? __pfx_down_read+0x10/0x10 [ 501.102680][T15698] __lookup_slow+0x98/0x320 [ 501.102695][T15698] lookup_slow+0x50/0x70 [ 501.102708][T15698] link_path_walk+0x1377/0x1cc0 [ 501.102729][T15698] path_lookupat+0x74/0xc40 [ 501.102747][T15698] filename_lookup+0x202/0x590 [ 501.102765][T15698] ? __pfx_filename_lookup+0x10/0x10 [ 501.102787][T15698] ? __pfx_kfree_link+0x10/0x10 [ 501.102808][T15698] ? strncpy_from_user+0x19d/0x2d0 [ 501.102826][T15698] vfs_open_tree+0x2a4/0xaf0 [ 501.102844][T15698] ? _raw_spin_unlock+0x28/0x50 [ 501.102860][T15698] ? __pfx_vfs_open_tree+0x10/0x10 [ 501.102881][T15698] __ia32_sys_open_tree+0xa3/0x150 [ 501.102894][T15698] __do_fast_syscall_32+0x13a/0x8b0 [ 501.102908][T15698] do_fast_syscall_32+0x32/0x70 [ 501.102920][T15698] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 501.102935][T15698] RIP: 0023:0xf73cefec [ 501.102950][T15698] Code: Unable to access opcode bytes at 0xf73cefc2. [ 501.102955][T15698] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 00000000000001ac [ 501.102967][T15698] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800001c0 [ 501.102974][T15698] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 501.102981][T15698] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 501.102988][T15698] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 501.102995][T15698] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 501.103010][T15698] [ 501.107011][T15701] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3126'. [ 501.313498][T15714] netlink: 'syz.5.3136': attribute type 4 has an invalid length. [ 501.313518][T15714] netlink: 17 bytes leftover after parsing attributes in process `syz.5.3136'. [ 501.457691][ T10] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 501.608536][ T10] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 501.609565][ T10] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 501.609586][ T10] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 501.610580][ T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 501.610597][ T10] usb 9-1: SerialNumber: syz [ 501.613994][T15707] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 501.820681][T15707] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 502.233202][ T10] cdc_ether 9-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.4-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 502.443740][ T10] usb 9-1: USB disconnect, device number 17 [ 502.453239][ T10] cdc_ether 9-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.4-1, CDC Ethernet Device [ 503.005061][T15772] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3155'. [ 503.036667][T15772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 503.076785][T15772] bond0: entered promiscuous mode [ 503.076796][T15772] bond0: entered allmulticast mode [ 503.460351][T15786] device-mapper: ioctl: Invalid ioctl structure: name t, dev f801 [ 503.530428][T15792] loop4: detected capacity change from 0 to 2640 [ 503.540484][T13343] buffer_io_error: 11 callbacks suppressed [ 503.540498][T13343] Buffer I/O error on dev loop4, logical block 0, async page read [ 503.549167][T15792] Buffer I/O error on dev loop4, logical block 0, lost async page write [ 503.549203][T15792] Buffer I/O error on dev loop4, logical block 1, lost async page write [ 503.549227][T15792] Buffer I/O error on dev loop4, logical block 2, lost async page write [ 503.549240][T15792] Buffer I/O error on dev loop4, logical block 3, lost async page write [ 503.549261][T15792] Buffer I/O error on dev loop4, logical block 4, lost async page write [ 503.549274][T15792] Buffer I/O error on dev loop4, logical block 5, lost async page write [ 503.549287][T15792] Buffer I/O error on dev loop4, logical block 6, lost async page write [ 503.549300][T15792] Buffer I/O error on dev loop4, logical block 7, lost async page write [ 503.549321][T15792] Buffer I/O error on dev loop4, logical block 8, lost async page write [ 503.888862][T15802] netlink: 'syz.4.3167': attribute type 4 has an invalid length. [ 503.888874][T15802] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3167'. [ 503.906202][T15802] FAULT_INJECTION: forcing a failure. [ 503.906202][T15802] name fail_futex, interval 1, probability 0, space 0, times 0 [ 503.906219][T15802] CPU: 0 UID: 0 PID: 15802 Comm: syz.4.3167 Tainted: G L syzkaller #0 PREEMPT(full) [ 503.906238][T15802] Tainted: [L]=SOFTLOCKUP [ 503.906243][T15802] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 503.906250][T15802] Call Trace: [ 503.906255][T15802] [ 503.906260][T15802] dump_stack_lvl+0x100/0x190 [ 503.906280][T15802] should_fail_ex.cold+0x5/0xa [ 503.906296][T15802] get_futex_key+0x1d0/0x14f0 [ 503.906311][T15802] ? __pfx_get_futex_key+0x10/0x10 [ 503.906325][T15802] ? ___sys_sendmsg+0x127/0x1e0 [ 503.906352][T15802] futex_wake+0xf4/0x5e0 [ 503.906367][T15802] ? futex_wait+0x11e/0x370 [ 503.906385][T15802] ? __pfx_futex_wake+0x10/0x10 [ 503.906404][T15802] ? find_held_lock+0x2b/0x80 [ 503.906422][T15802] do_futex+0x2b2/0x440 [ 503.906437][T15802] ? __pfx_do_futex+0x10/0x10 [ 503.906452][T15802] ? fput+0x7c/0x100 [ 503.906471][T15802] __ia32_sys_futex_time32+0x2f4/0x470 [ 503.906488][T15802] ? xfd_validate_state+0x129/0x190 [ 503.906505][T15802] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 503.906526][T15802] __do_fast_syscall_32+0x13a/0x8b0 [ 503.906541][T15802] do_fast_syscall_32+0x32/0x70 [ 503.906553][T15802] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 503.906567][T15802] RIP: 0023:0xf73cefec [ 503.906581][T15802] Code: Unable to access opcode bytes at 0xf73cefc2. [ 503.906587][T15802] RSP: 002b:00000000f53e65cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 503.906598][T15802] RAX: ffffffffffffffda RBX: 00000000f73f4f8c RCX: 0000000000000081 [ 503.906606][T15802] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 503.906613][T15802] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 503.906620][T15802] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 503.906627][T15802] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 503.906643][T15802] [ 504.077786][ T38] net_ratelimit: 497 callbacks suppressed [ 504.392812][T15838] fuse: fd is not a fuse device [ 505.287405][T15835] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input25 [ 505.659299][T15900] fuse: fd is not a fuse device [ 505.751718][T15904] overlayfs: failed to clone lowerpath [ 507.945725][T15968] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3237'. [ 508.085658][T15971] af_packet: tpacket_rcv: packet too big, clamped from 112 to 4294967272. macoff=96 [ 508.267258][T15984] fuse: fd is not a fuse device [ 508.317752][ T10] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 508.469472][ T10] usb 7-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 508.470630][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 508.470677][ T10] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 508.470694][ T10] usb 7-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 508.470724][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.575750][T15994] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 508.892194][ T10] cxacru 7-1:1.0: send of cm 0x91 failed (-71) [ 508.892224][ T10] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 508.892231][ T10] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 508.903495][ T10] cxacru 7-1:1.0: probe with driver cxacru failed with error -71 [ 508.906510][ T10] usb 7-1: USB disconnect, device number 20 [ 509.212358][ T44] audit: type=1800 audit(1791688276.657:2395): pid=15997 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3243" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 509.253992][T16001] tipc: Enabling of bearer rejected, failed to enable media [ 509.267818][ T3626] net_ratelimit: 301 callbacks suppressed [ 509.401511][T16013] jffs2: notice: (16013) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 509.427484][T16018] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3251'. [ 509.451449][T16020] comedi comedi2: comedi_test: 320 microvolt, 1616 microsecond waveform attached [ 509.728795][T16045] FAULT_INJECTION: forcing a failure. [ 509.728795][T16045] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 509.728816][T16045] CPU: 2 UID: 0 PID: 16045 Comm: syz.2.3258 Tainted: G L syzkaller #0 PREEMPT(full) [ 509.728832][T16045] Tainted: [L]=SOFTLOCKUP [ 509.728843][T16045] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 509.728851][T16045] Call Trace: [ 509.728856][T16045] [ 509.728861][T16045] dump_stack_lvl+0x100/0x190 [ 509.728882][T16045] should_fail_ex.cold+0x5/0xa [ 509.728896][T16045] ? prepare_alloc_pages+0x16d/0x5b0 [ 509.728917][T16045] should_fail_alloc_page+0xeb/0x140 [ 509.728938][T16045] prepare_alloc_pages+0x1f0/0x5b0 [ 509.728958][T16045] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 509.728975][T16045] ? prepare_alloc_pages+0x111/0x5b0 [ 509.728992][T16045] ? is_bpf_text_address+0x94/0x1a0 [ 509.729012][T16045] ? rcu_is_watching+0x13/0xc0 [ 509.729027][T16045] ? __alloc_frozen_pages_noprof+0x56b/0x3300 [ 509.729049][T16045] ? do_raw_spin_lock+0x128/0x260 [ 509.729068][T16045] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 509.729095][T16045] ? mark_held_locks+0x40/0x70 [ 509.729120][T16045] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 509.729145][T16045] ? lockdep_hardirqs_on+0x7d/0x110 [ 509.729164][T16045] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 509.729181][T16045] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 509.729200][T16045] ? kasan_save_track+0x14/0x30 [ 509.729216][T16045] ? __kasan_slab_alloc+0x89/0x90 [ 509.729231][T16045] ? kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 509.729247][T16045] ? alloc_vmap_area+0x640/0x2bb0 [ 509.729262][T16045] ? __get_vm_area_node+0x1ed/0x350 [ 509.729278][T16045] ? __vmalloc_node_range_noprof+0x268/0x1420 [ 509.729296][T16045] ? __vmalloc_node_noprof+0xad/0xf0 [ 509.729313][T16045] ? packet_set_ring+0xc0c/0x1f00 [ 509.729327][T16045] ? packet_setsockopt+0x11c4/0x2380 [ 509.729343][T16045] ? do_sock_setsockopt+0xf3/0x1d0 [ 509.729359][T16045] ? __sys_setsockopt+0x119/0x190 [ 509.729391][T16045] ? __ia32_sys_setsockopt+0xbc/0x160 [ 509.729405][T16045] ? __do_fast_syscall_32+0x13a/0x8b0 [ 509.729417][T16045] ? do_fast_syscall_32+0x32/0x70 [ 509.729429][T16045] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 509.729449][T16045] alloc_pages_bulk_noprof+0x5e1/0x13c0 [ 509.729470][T16045] ? policy_nodemask+0xed/0x4f0 [ 509.729484][T16045] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 509.729509][T16045] __kasan_populate_vmalloc+0xf0/0x210 [ 509.729528][T16045] alloc_vmap_area+0x95d/0x2bb0 [ 509.729550][T16045] ? kasan_save_track+0x14/0x30 [ 509.729565][T16045] ? __kasan_kmalloc+0xaa/0xb0 [ 509.729582][T16045] ? __pfx_alloc_vmap_area+0x10/0x10 [ 509.729600][T16045] ? __get_vm_area_node+0x124/0x350 [ 509.729619][T16045] __get_vm_area_node+0x1ed/0x350 [ 509.729639][T16045] __vmalloc_node_range_noprof+0x268/0x1420 [ 509.729658][T16045] ? packet_set_ring+0xc0c/0x1f00 [ 509.729676][T16045] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 509.729694][T16045] ? packet_set_ring+0xc0c/0x1f00 [ 509.729712][T16045] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 509.729731][T16045] ? alloc_pages_mpol+0x260/0x550 [ 509.729743][T16045] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 509.729756][T16045] ? packet_set_ring+0xc0c/0x1f00 [ 509.729769][T16045] __vmalloc_node_noprof+0xad/0xf0 [ 509.729787][T16045] ? packet_set_ring+0xc0c/0x1f00 [ 509.729809][T16045] packet_set_ring+0xc0c/0x1f00 [ 509.729832][T16045] packet_setsockopt+0x11c4/0x2380 [ 509.729855][T16045] ? __lock_acquire+0x5c0/0x1f40 [ 509.729875][T16045] ? __pfx_packet_setsockopt+0x10/0x10 [ 509.729890][T16045] ? aa_sk_perm+0x389/0xab0 [ 509.729908][T16045] ? __pfx_aa_sk_perm+0x10/0x10 [ 509.729926][T16045] ? find_held_lock+0x2b/0x80 [ 509.729943][T16045] ? aa_sock_opt_perm+0x114/0x1e0 [ 509.729962][T16045] ? __pfx_packet_setsockopt+0x10/0x10 [ 509.729979][T16045] do_sock_setsockopt+0xf3/0x1d0 [ 509.729997][T16045] __sys_setsockopt+0x119/0x190 [ 509.730014][T16045] __ia32_sys_setsockopt+0xbc/0x160 [ 509.730028][T16045] ? __do_fast_syscall_32+0xb3/0x8b0 [ 509.730040][T16045] ? lockdep_hardirqs_on+0x7d/0x110 [ 509.730057][T16045] __do_fast_syscall_32+0x13a/0x8b0 [ 509.730071][T16045] do_fast_syscall_32+0x32/0x70 [ 509.730083][T16045] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 509.730098][T16045] RIP: 0023:0xf73fefec [ 509.730112][T16045] Code: Unable to access opcode bytes at 0xf73fefc2. [ 509.730118][T16045] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 509.730129][T16045] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000107 [ 509.730137][T16045] RDX: 000000000000000d RSI: 0000000080000040 RDI: 000000000000001c [ 509.730144][T16045] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 509.730151][T16045] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 509.730157][T16045] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 509.730172][T16045] [ 509.732642][T16045] syz.2.3258: vmalloc error: size 8388608, align 0x1, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 509.732700][T16045] CPU: 0 UID: 0 PID: 16045 Comm: syz.2.3258 Tainted: G L syzkaller #0 PREEMPT(full) [ 509.732719][T16045] Tainted: [L]=SOFTLOCKUP [ 509.732723][T16045] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 509.732731][T16045] Call Trace: [ 509.732735][T16045] [ 509.732741][T16045] dump_stack_lvl+0x100/0x190 [ 509.732760][T16045] warn_alloc.cold+0x9e/0xb2 [ 509.732774][T16045] ? __pfx_warn_alloc+0x10/0x10 [ 509.732789][T16045] ? lockdep_hardirqs_on+0x7d/0x110 [ 509.732811][T16045] ? __get_vm_area_node+0x2f0/0x350 [ 509.732833][T16045] ? __get_vm_area_node+0x22b/0x350 [ 509.732854][T16045] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 509.732878][T16045] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 509.732897][T16045] ? packet_set_ring+0xc0c/0x1f00 [ 509.732916][T16045] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 509.732936][T16045] ? alloc_pages_mpol+0x260/0x550 [ 509.732949][T16045] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 509.732963][T16045] ? packet_set_ring+0xc0c/0x1f00 [ 509.732977][T16045] __vmalloc_node_noprof+0xad/0xf0 [ 509.732996][T16045] ? packet_set_ring+0xc0c/0x1f00 [ 509.733013][T16045] packet_set_ring+0xc0c/0x1f00 [ 509.733034][T16045] packet_setsockopt+0x11c4/0x2380 [ 509.733049][T16045] ? __lock_acquire+0x5c0/0x1f40 [ 509.733069][T16045] ? __pfx_packet_setsockopt+0x10/0x10 [ 509.733085][T16045] ? aa_sk_perm+0x389/0xab0 [ 509.733102][T16045] ? __pfx_aa_sk_perm+0x10/0x10 [ 509.733118][T16045] ? find_held_lock+0x2b/0x80 [ 509.733135][T16045] ? aa_sock_opt_perm+0x114/0x1e0 [ 509.733162][T16045] ? __pfx_packet_setsockopt+0x10/0x10 [ 509.733180][T16045] do_sock_setsockopt+0xf3/0x1d0 [ 509.733201][T16045] __sys_setsockopt+0x119/0x190 [ 509.733219][T16045] __ia32_sys_setsockopt+0xbc/0x160 [ 509.733234][T16045] ? __do_fast_syscall_32+0xb3/0x8b0 [ 509.733247][T16045] ? lockdep_hardirqs_on+0x7d/0x110 [ 509.733266][T16045] __do_fast_syscall_32+0x13a/0x8b0 [ 509.733298][T16045] do_fast_syscall_32+0x32/0x70 [ 509.733312][T16045] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 509.733327][T16045] RIP: 0023:0xf73fefec [ 509.733341][T16045] Code: Unable to access opcode bytes at 0xf73fefc2. [ 509.733347][T16045] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 509.733359][T16045] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000107 [ 509.733367][T16045] RDX: 000000000000000d RSI: 0000000080000040 RDI: 000000000000001c [ 509.733374][T16045] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 509.733380][T16045] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 509.733387][T16045] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 509.733402][T16045] [ 509.733480][T16045] Mem-Info: [ 509.733488][T16045] active_anon:1791 inactive_anon:4156 isolated_anon:0 [ 509.733488][T16045] active_file:4329 inactive_file:18687 isolated_file:0 [ 509.733488][T16045] unevictable:1 dirty:181 writeback:0 [ 509.733488][T16045] slab_reclaimable:6357 slab_unreclaimable:62029 [ 509.733488][T16045] mapped:26382 shmem:2925 pagetables:1570 [ 509.733488][T16045] sec_pagetables:331 bounce:0 [ 509.733488][T16045] kernel_misc_reclaimable:0 [ 509.733488][T16045] free:32610 free_pcp:9484 free_cma:0 [ 509.733517][T16045] Node 0 active_anon:8kB inactive_anon:52kB active_file:476kB inactive_file:4364kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:1440kB dirty:8kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7872kB pagetables:1224kB sec_pagetables:1156kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 509.733547][T16045] Node 1 active_anon:7156kB inactive_anon:16572kB active_file:16840kB inactive_file:70384kB unevictable:4kB isolated(anon):0kB isolated(file):0kB mapped:104088kB dirty:716kB writeback:0kB shmem:11700kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5600kB pagetables:5056kB sec_pagetables:168kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 509.733577][T16045] Node 0 DMA free:3844kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 509.733609][T16045] lowmem_reserve[]: 0 259 259 259 259 [ 509.733631][T16045] Node 0 DMA32 free:20780kB boost:26328kB min:38032kB low:40956kB high:43880kB reserved_highatomic:0kB free_highatomic:0kB active_anon:8kB inactive_anon:52kB active_file:476kB inactive_file:4364kB unevictable:0kB writepending:8kB zspages:856kB present:1032196kB managed:265356kB mlocked:0kB bounce:0kB free_pcp:44kB local_pcp:8kB free_cma:0kB [ 509.733664][T16045] lowmem_reserve[]: 0 0 0 0 0 [ 509.733682][T16045] Node 1 DMA32 free:105816kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0kB free_highatomic:0kB active_anon:7156kB inactive_anon:16572kB active_file:16840kB inactive_file:70384kB unevictable:4kB writepending:716kB zspages:4356kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:37892kB local_pcp:7996kB free_cma:0kB [ 509.733717][T16045] lowmem_reserve[]: 0 0 0 0 0 [ 509.733735][T16045] Node 0 DMA: 261*4kB (U) 56*8kB (UE) 17*16kB (U) 17*32kB (UE) 8*64kB (U) 2*128kB (UE) 1*256kB (E) 1*512kB (E) 0*1024kB 0*2048kB 0*4096kB = 3844kB [ 509.733812][T16045] Node 0 DMA32: 731*4kB (UME) 202*8kB (UME) 121*16kB (UME) 205*32kB (UME) 37*64kB (UME) 18*128kB (UM) 4*256kB (UM) 4*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 20780kB [ 509.733889][T16045] Node 1 DMA32: 544*4kB (UM) 1062*8kB (UME) 430*16kB (UME) 561*32kB (UME) 217*64kB (UME) 128*128kB (UME) 40*256kB (UME) 12*512kB (UME) 1*1024kB (U) 9*2048kB (UM) 1*4096kB (U) = 105712kB [ 509.733980][T16045] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 509.733988][T16045] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 509.733997][T16045] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 509.734006][T16045] Node 1 hugepages_total=6 hugepages_free=6 hugepages_surp=0 hugepages_size=2048kB [ 509.734014][T16045] 27729 total pagecache pages [ 509.734018][T16045] 1790 pages in swap cache [ 509.734022][T16045] Free swap = 61848kB [ 509.734027][T16045] Total swap = 124996kB [ 509.734031][T16045] 524155 pages RAM [ 509.734035][T16045] 0 pages HighMem/MovableOnly [ 509.734039][T16045] 216924 pages reserved [ 509.734043][T16045] 0 pages cma reserved [ 510.000448][T16054] fuse: fd is not a fuse device [ 510.210510][ T2129] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 510.378418][ T2129] usb 9-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 510.379538][ T2129] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 510.379776][ T2129] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 510.379801][ T2129] usb 9-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 510.379932][ T2129] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.769597][T16080] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3272'. [ 510.831955][ T2129] cxacru 9-1:1.0: send of cm 0x91 failed (-71) [ 510.831972][ T2129] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 510.831982][ T2129] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 510.890319][ T2129] cxacru 9-1:1.0: probe with driver cxacru failed with error -71 [ 510.909590][ T2129] usb 9-1: USB disconnect, device number 18 [ 511.420121][T16093] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 511.756857][T16114] jffs2: notice: (16114) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 511.786938][T16117] netlink: 'syz.4.3283': attribute type 3 has an invalid length. [ 512.175690][ T44] audit: type=1800 audit(1791688279.617:2396): pid=16142 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3295" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 512.883301][T16155] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3301'. [ 513.117337][T16170] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3309'. [ 513.427757][ T2129] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 513.599169][ T2129] usb 9-1: Using ep0 maxpacket: 32 [ 513.603963][ T2129] usb 9-1: unable to get BOS descriptor or descriptor too short [ 513.604002][ T2129] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 513.607034][ T2129] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 513.607054][ T2129] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 513.607070][ T2129] usb 9-1: config 14 has no interface number 0 [ 513.607099][ T2129] usb 9-1: config 14 has no interface number 1 [ 513.607143][ T2129] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 513.607161][ T2129] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 513.607180][ T2129] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 513.607204][ T2129] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 513.607225][ T2129] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 513.607245][ T2129] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 513.607265][ T2129] usb 9-1: config 14 interface 57 has no altsetting 0 [ 513.607278][ T2129] usb 9-1: config 14 interface 228 has no altsetting 0 [ 513.610179][ T2129] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.610193][ T2129] usb 9-1: Product: syz [ 513.610211][ T2129] usb 9-1: Manufacturer: syz [ 513.610222][ T2129] usb 9-1: SerialNumber: syz [ 513.701243][T16188] netlink: 52 bytes leftover after parsing attributes in process `syz.5.3315'. [ 514.042373][T16210] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3325'. [ 514.049364][ T2129] legousbtower 9-1:14.57: interrupt endpoints not found [ 514.453290][ T2129] legousbtower 9-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 514.457767][ T2129] legousbtower 9-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 514.947681][ C0] net_ratelimit: 415 callbacks suppressed [ 515.020011][T16236] usb 9-1: LEGO USB Tower reset control request failed [ 515.149066][T16243] fuse: fd is not a fuse device [ 515.219501][ T10] usb 9-1: USB disconnect, device number 19 [ 515.246741][ T10] legousbtower 9-1:14.228: LEGO USB Tower #-160 now disconnected [ 515.337746][ T854] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 515.487667][ T854] usb 7-1: Using ep0 maxpacket: 8 [ 515.488104][ T854] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 515.488955][ T854] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 515.488966][ T854] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 515.488997][ T854] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 515.489011][ T854] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 515.489040][ T854] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.497035][ T854] hub 7-1:1.0: bad descriptor, ignoring hub [ 515.497045][ T854] hub 7-1:1.0: probe with driver hub failed with error -5 [ 515.497320][ T854] cdc_wdm 7-1:1.0: skipping garbage [ 515.497328][ T854] cdc_wdm 7-1:1.0: skipping garbage [ 515.531106][ T854] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 515.531115][ T854] cdc_wdm 7-1:1.0: Unknown control protocol [ 516.082219][T16261] virtio-fs: tag not found [ 516.239718][T16264] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3346'. [ 518.136662][ T2129] usb 7-1: USB disconnect, device number 21 [ 518.443862][T16306] fuse: fd is not a fuse device [ 518.579732][T16320] FAULT_INJECTION: forcing a failure. [ 518.579732][T16320] name failslab, interval 1, probability 0, space 0, times 0 [ 518.579752][T16320] CPU: 2 UID: 0 PID: 16320 Comm: syz.4.3370 Tainted: G L syzkaller #0 PREEMPT(full) [ 518.579770][T16320] Tainted: [L]=SOFTLOCKUP [ 518.579775][T16320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 518.579783][T16320] Call Trace: [ 518.579787][T16320] [ 518.579793][T16320] dump_stack_lvl+0x100/0x190 [ 518.579814][T16320] should_fail_ex.cold+0x5/0xa [ 518.579832][T16320] should_failslab+0xc2/0x120 [ 518.579852][T16320] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 518.579871][T16320] ? v9fs_init_fs_context+0x17f/0x5c0 [ 518.579888][T16320] kstrdup+0x51/0xe0 [ 518.579903][T16320] v9fs_init_fs_context+0x17f/0x5c0 [ 518.579917][T16320] alloc_fs_context+0x60c/0xf40 [ 518.579932][T16320] path_mount+0xf59/0x2850 [ 518.579947][T16320] ? __pfx_path_mount+0x10/0x10 [ 518.579958][T16320] ? lockdep_hardirqs_on+0x7d/0x110 [ 518.579979][T16320] ? putname+0xb1/0x110 [ 518.579996][T16320] ? kmem_cache_free+0x127/0x6c0 [ 518.580015][T16320] ? __ia32_sys_mount+0x292/0x310 [ 518.580026][T16320] __ia32_sys_mount+0x292/0x310 [ 518.580038][T16320] ? __pfx___ia32_sys_mount+0x10/0x10 [ 518.580055][T16320] __do_fast_syscall_32+0x13a/0x8b0 [ 518.580070][T16320] do_fast_syscall_32+0x32/0x70 [ 518.580082][T16320] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 518.580098][T16320] RIP: 0023:0xf73cefec [ 518.580112][T16320] Code: Unable to access opcode bytes at 0xf73cefc2. [ 518.580119][T16320] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 518.580131][T16320] RAX: ffffffffffffffda RBX: 00000000800002c0 RCX: 0000000080000300 [ 518.580139][T16320] RDX: 0000000080000340 RSI: 0000000000200800 RDI: 0000000080000500 [ 518.580146][T16320] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 518.580154][T16320] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 518.580161][T16320] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 518.580176][T16320] [ 518.986392][T16357] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3382'. [ 519.105450][T16364] FAULT_INJECTION: forcing a failure. [ 519.105450][T16364] name fail_futex, interval 1, probability 0, space 0, times 0 [ 519.105468][T16364] CPU: 0 UID: 0 PID: 16364 Comm: syz.4.3385 Tainted: G L syzkaller #0 PREEMPT(full) [ 519.105484][T16364] Tainted: [L]=SOFTLOCKUP [ 519.105489][T16364] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 519.105496][T16364] Call Trace: [ 519.105500][T16364] [ 519.105506][T16364] dump_stack_lvl+0x100/0x190 [ 519.105528][T16364] should_fail_ex.cold+0x5/0xa [ 519.105545][T16364] get_futex_key+0x1d0/0x14f0 [ 519.105560][T16364] ? __pfx_get_futex_key+0x10/0x10 [ 519.105578][T16364] futex_wait_setup+0x91/0x540 [ 519.105598][T16364] __futex_wait+0x19f/0x300 [ 519.105615][T16364] ? __pfx___futex_wait+0x10/0x10 [ 519.105630][T16364] ? __pfx_try_to_wake_up+0x10/0x10 [ 519.105647][T16364] ? futex_hash+0x311/0x400 [ 519.105660][T16364] ? __pfx_futex_wake_mark+0x10/0x10 [ 519.105677][T16364] ? find_held_lock+0x2b/0x80 [ 519.105691][T16364] ? futex_wake+0x4ea/0x5e0 [ 519.105710][T16364] futex_wait+0xe6/0x370 [ 519.105725][T16364] ? __pfx_futex_wait+0x10/0x10 [ 519.105744][T16364] ? percpu_counter_add_batch+0xb9/0x230 [ 519.105757][T16364] ? errseq_sample+0x51/0x70 [ 519.105769][T16364] ? file_init_path+0x48e/0x670 [ 519.105789][T16364] do_futex+0x265/0x440 [ 519.105802][T16364] ? __pfx_do_futex+0x10/0x10 [ 519.105815][T16364] ? fd_install+0x223/0x580 [ 519.105833][T16364] __ia32_sys_futex_time32+0x2f4/0x470 [ 519.105849][T16364] ? xfd_validate_state+0x129/0x190 [ 519.105868][T16364] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 519.105888][T16364] __do_fast_syscall_32+0x13a/0x8b0 [ 519.105903][T16364] do_fast_syscall_32+0x32/0x70 [ 519.105915][T16364] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 519.105930][T16364] RIP: 0023:0xf73cefec [ 519.105943][T16364] Code: Unable to access opcode bytes at 0xf73cefc2. [ 519.105948][T16364] RSP: 002b:00000000f53e65bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 519.105961][T16364] RAX: ffffffffffffffda RBX: 00000000f73f4f88 RCX: 0000000000000080 [ 519.105968][T16364] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f73f4f8c [ 519.105975][T16364] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 519.105982][T16364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 519.105989][T16364] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 519.106003][T16364] [ 519.582061][T16382] fuse: fd is not a fuse device [ 519.646535][T16384] 9p: Bad value for 'wfdno' [ 519.733276][T16389] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3396'. [ 519.779741][T16393] overlayfs: failed to clone upperpath [ 519.818045][T16395] fuse: fd is not a fuse device [ 519.894360][T16401] FAULT_INJECTION: forcing a failure. [ 519.894360][T16401] name failslab, interval 1, probability 0, space 0, times 0 [ 519.894382][T16401] CPU: 0 UID: 0 PID: 16401 Comm: syz.4.3401 Tainted: G L syzkaller #0 PREEMPT(full) [ 519.894399][T16401] Tainted: [L]=SOFTLOCKUP [ 519.894403][T16401] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 519.894410][T16401] Call Trace: [ 519.894415][T16401] [ 519.894420][T16401] dump_stack_lvl+0x100/0x190 [ 519.894441][T16401] should_fail_ex.cold+0x5/0xa [ 519.894458][T16401] should_failslab+0xc2/0x120 [ 519.894477][T16401] __kmalloc_noprof+0xfc/0x840 [ 519.894492][T16401] ? __kasan_kmalloc+0xaa/0xb0 [ 519.894508][T16401] ? nla_strdup+0xc3/0x150 [ 519.894527][T16401] nla_strdup+0xc3/0x150 [ 519.894543][T16401] nf_tables_addchain.constprop.0+0x83b/0x1ca0 [ 519.894562][T16401] ? nft_chain_lookup+0x59c/0xa60 [ 519.894579][T16401] ? __pfx_nf_tables_addchain.constprop.0+0x10/0x10 [ 519.894593][T16401] ? __pfx_nft_chain_lookup+0x10/0x10 [ 519.894608][T16401] ? __lock_acquire+0x5c0/0x1f40 [ 519.894638][T16401] ? nla_strcmp+0xff/0x130 [ 519.894655][T16401] ? nft_table_lookup.part.0+0x1e3/0x230 [ 519.894671][T16401] nf_tables_newchain+0x1824/0x2a50 [ 519.894694][T16401] ? __pfx_nf_tables_newchain+0x10/0x10 [ 519.894708][T16401] ? __pfx___nla_validate_parse+0x10/0x10 [ 519.894727][T16401] ? lock_acquire+0x1d1/0x380 [ 519.894743][T16401] ? net_generic+0x25/0x2a0 [ 519.894761][T16401] ? __nla_parse+0x40/0x60 [ 519.894779][T16401] nfnetlink_rcv_batch+0x1410/0x2880 [ 519.894803][T16401] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 519.894818][T16401] ? stack_trace_save+0x8e/0xc0 [ 519.894834][T16401] ? __pfx_stack_trace_save+0x10/0x10 [ 519.894851][T16401] ? kasan_save_stack+0x3f/0x50 [ 519.894866][T16401] ? kasan_save_stack+0x30/0x50 [ 519.894881][T16401] ? kasan_save_track+0x14/0x30 [ 519.894897][T16401] ? __kasan_slab_alloc+0x89/0x90 [ 519.894913][T16401] ? kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 519.894935][T16401] ? __lock_acquire+0x5c0/0x1f40 [ 519.894966][T16401] ? __nla_parse+0x40/0x60 [ 519.894984][T16401] nfnetlink_rcv+0x3bd/0x440 [ 519.894999][T16401] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 519.895018][T16401] netlink_unicast+0x585/0x850 [ 519.895034][T16401] ? __pfx_netlink_unicast+0x10/0x10 [ 519.895050][T16401] netlink_sendmsg+0x8b0/0xda0 [ 519.895065][T16401] ? __pfx_netlink_sendmsg+0x10/0x10 [ 519.895079][T16401] ? apparmor_socket_sendmsg+0x165/0x280 [ 519.895094][T16401] ____sys_sendmsg+0xa4d/0xbe0 [ 519.895110][T16401] ? __pfx_netlink_sendmsg+0x10/0x10 [ 519.895132][T16401] ? __pfx_____sys_sendmsg+0x10/0x10 [ 519.895157][T16401] ___sys_sendmsg+0x190/0x1e0 [ 519.895177][T16401] ? __pfx____sys_sendmsg+0x10/0x10 [ 519.895196][T16401] ? futex_wait+0x11e/0x370 [ 519.895219][T16401] ? find_held_lock+0x2b/0x80 [ 519.895243][T16401] __sys_sendmsg+0x160/0x210 [ 519.895259][T16401] ? __pfx___sys_sendmsg+0x10/0x10 [ 519.895301][T16401] __do_fast_syscall_32+0x13a/0x8b0 [ 519.895318][T16401] do_fast_syscall_32+0x32/0x70 [ 519.895331][T16401] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 519.895348][T16401] RIP: 0023:0xf73cefec [ 519.895363][T16401] Code: Unable to access opcode bytes at 0xf73cefc2. [ 519.895368][T16401] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 519.895381][T16401] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800000c0 [ 519.895388][T16401] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 519.895395][T16401] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 519.895401][T16401] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 519.895408][T16401] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 519.895423][T16401] [ 520.788619][ T3626] net_ratelimit: 907 callbacks suppressed [ 521.235389][T16437] kvm: MWAIT instruction emulated as NOP! [ 521.364256][T16455] jffs2: notice: (16455) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 521.897683][ T854] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 522.048924][ T854] usb 9-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 522.050247][ T854] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 522.050285][ T854] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 522.050303][ T854] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 522.052130][ T854] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 522.052144][ T854] usb 9-1: Product: syz [ 522.052160][ T854] usb 9-1: Manufacturer: syz [ 522.096456][T16472] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 522.100709][ T854] garmin_gps 9-1:1.0: Garmin GPS usb/tty converter detected [ 522.104679][ T854] usb 9-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 522.321332][T16480] overlayfs: failed to clone upperpath [ 522.409655][ T2129] usb 9-1: USB disconnect, device number 20 [ 522.418561][ T2129] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 522.418925][ T2129] garmin_gps 9-1:1.0: device disconnected [ 522.994739][T16507] FAULT_INJECTION: forcing a failure. [ 522.994739][T16507] name failslab, interval 1, probability 0, space 0, times 0 [ 522.994765][T16507] CPU: 0 UID: 0 PID: 16507 Comm: syz.4.3442 Tainted: G L syzkaller #0 PREEMPT(full) [ 522.994793][T16507] Tainted: [L]=SOFTLOCKUP [ 522.994801][T16507] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 522.994813][T16507] Call Trace: [ 522.994821][T16507] [ 522.994829][T16507] dump_stack_lvl+0x100/0x190 [ 522.994860][T16507] should_fail_ex.cold+0x5/0xa [ 522.994886][T16507] should_failslab+0xc2/0x120 [ 522.994920][T16507] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 522.994953][T16507] ? x509_get_sig_params+0xf5/0x6c0 [ 522.994990][T16507] kmemdup_noprof+0x29/0x60 [ 522.995014][T16507] x509_get_sig_params+0xf5/0x6c0 [ 522.995045][T16507] ? __asan_memcpy+0x3c/0x60 [ 522.995073][T16507] x509_cert_parse+0x4e9/0x910 [ 522.995105][T16507] x509_key_preparse+0x65/0x9c0 [ 522.995141][T16507] asymmetric_key_preparse+0xce/0x1d0 [ 522.995168][T16507] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 522.995217][T16507] __key_create_or_update+0x413/0xe30 [ 522.995252][T16507] ? __pfx___key_create_or_update+0x10/0x10 [ 522.995282][T16507] ? lookup_user_key+0x3f3/0x1300 [ 522.995322][T16507] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 522.995354][T16507] key_create_or_update+0x42/0x60 [ 522.995385][T16507] __do_sys_add_key+0x2e8/0x460 [ 522.995417][T16507] ? __pfx___do_sys_add_key+0x10/0x10 [ 522.995458][T16507] __do_fast_syscall_32+0x13a/0x8b0 [ 522.995484][T16507] do_fast_syscall_32+0x32/0x70 [ 522.995547][T16507] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 522.995580][T16507] RIP: 0023:0xf73cefec [ 522.995608][T16507] Code: Unable to access opcode bytes at 0xf73cefc2. [ 522.995619][T16507] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 000000000000011e [ 522.995640][T16507] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000000000 [ 522.995654][T16507] RDX: 0000000080000200 RSI: 0000000000000559 RDI: 00000000ffffffff [ 522.995668][T16507] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 522.995681][T16507] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 522.995695][T16507] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 522.995725][T16507] [ 523.215691][ T8790] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x80 [ 524.250878][T16538] syz_tun: entered allmulticast mode [ 524.253222][T16537] syz_tun: left allmulticast mode [ 524.300972][T16541] fuse: fd is not a fuse device [ 524.512941][T16549] binder: 16548:16549 ioctl c0306201 80002e00 returned -22 [ 524.685453][T16555] 8021q: adding VLAN 0 to HW filter on device eth0 [ 524.703818][T16555] 8021q: adding VLAN 0 to HW filter on device eth1 [ 524.706633][T16555] 8021q: adding VLAN 0 to HW filter on device eth2 [ 524.711634][T16555] 8021q: adding VLAN 0 to HW filter on device eth3 [ 524.827756][ T8790] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 524.827791][ T8790] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 524.827813][ T8790] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 524.827831][ T8790] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 525.076983][T16568] fuse: fd is not a fuse device [ 525.329217][T16583] 9p: Bad value for 'rfdno' [ 525.446293][T16592] overlayfs: failed to clone upperpath [ 525.519435][T16597] fuse: fd is not a fuse device [ 525.910669][ T1176] net_ratelimit: 414 callbacks suppressed [ 526.143534][T16509] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 526.499537][T16641] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3493'. [ 527.048310][T16677] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 527.131563][T16684] netlink: 'syz.5.3501': attribute type 1 has an invalid length. [ 527.170163][T16685] netfs: Cache "CacheFiles" added (type cachefiles) [ 527.170170][T16685] CacheFiles: File cache on CacheFiles registered [ 527.171216][T16683] CacheFiles: File cache on CacheFiles unregistering [ 527.171224][T16683] netfs: Withdrawing cache "CacheFiles" (0 objs) [ 527.289516][T16694] fuse: fd is not a fuse device [ 527.372917][ T44] audit: type=1326 audit(1791688294.817:2397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16700 comm="syz.1.3509" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 527.372950][ T44] audit: type=1326 audit(1791688294.817:2398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16700 comm="syz.1.3509" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 527.372971][ T44] audit: type=1326 audit(1791688294.817:2399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16700 comm="syz.1.3509" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf742efec code=0x7ffc0000 [ 527.372991][ T44] audit: type=1326 audit(1791688294.817:2400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16700 comm="syz.1.3509" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 527.373015][ T44] audit: type=1326 audit(1791688294.817:2401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16700 comm="syz.1.3509" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 527.373036][ T44] audit: type=1326 audit(1791688294.817:2402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16700 comm="syz.1.3509" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf742efec code=0x7ffc0000 [ 527.373056][ T44] audit: type=1326 audit(1791688294.817:2403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16700 comm="syz.1.3509" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 527.373077][ T44] audit: type=1326 audit(1791688294.817:2404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16700 comm="syz.1.3509" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf742efec code=0x7ffc0000 [ 527.373098][ T44] audit: type=1326 audit(1791688294.817:2405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16700 comm="syz.1.3509" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 527.373118][ T44] audit: type=1326 audit(1791688294.817:2406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16700 comm="syz.1.3509" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 527.527969][ T10] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 527.657017][T16716] CIFS: bad ip= option (127®0.0.1) [ 527.657382][T16716] CIFS: Attempting to mount (null) [ 527.665491][T16716] CIFS: VFS: Error connecting to socket. Aborting operation. [ 527.665528][T16716] CIFS: VFS: cifs_mount failed w/return code = -101 [ 527.677668][ T10] usb 9-1: Using ep0 maxpacket: 32 [ 527.679854][ T10] usb 9-1: unable to get BOS descriptor or descriptor too short [ 527.679892][ T10] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 527.681035][ T10] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 527.681054][ T10] usb 9-1: config 14 has an invalid interface number: 81 but max is 1 [ 527.681071][ T10] usb 9-1: config 14 has no interface number 0 [ 527.681084][ T10] usb 9-1: config 14 has no interface number 1 [ 527.681129][ T10] usb 9-1: config 14 interface 81 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 527.681148][ T10] usb 9-1: config 14 interface 81 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 527.681168][ T10] usb 9-1: config 14 interface 81 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 527.681191][ T10] usb 9-1: config 14 interface 81 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 527.681213][ T10] usb 9-1: config 14 interface 81 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 527.681235][ T10] usb 9-1: config 14 interface 81 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 527.681253][ T10] usb 9-1: config 14 interface 81 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 527.681471][ T10] usb 9-1: config 14 interface 57 has no altsetting 0 [ 527.681488][ T10] usb 9-1: config 14 interface 81 has no altsetting 0 [ 527.683738][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.683755][ T10] usb 9-1: Product: syz [ 527.683768][ T10] usb 9-1: Manufacturer: syz [ 527.683783][ T10] usb 9-1: SerialNumber: syz [ 527.847274][T16677] rtrs_client L2644: : init_conns() failed: err=-ERESTARTSYS path=@ip:27.0.0.1 [:0] [ 528.151317][ T10] legousbtower 9-1:14.57: interrupt endpoints not found [ 528.294067][T16752] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3531'. [ 528.498656][T16765] fuse: fd is not a fuse device [ 528.546714][ T10] legousbtower 9-1:14.81: LEGO USB Tower firmware version is 0.0 build 0 [ 528.548565][ T10] legousbtower 9-1:14.81: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 528.671705][T16776] fuse: fd is not a fuse device [ 528.738025][T16780] fuse: fd is not a fuse device [ 528.910816][T16792] overlayfs: failed to clone upperpath [ 529.059853][T16806] futex_wake_op: syz.5.3551 tries to shift op by 144; fix this program [ 529.059940][T16806] futex_wake_op: syz.5.3551 tries to shift op by 144; fix this program [ 529.118683][ T5926] usb 9-1: USB disconnect, device number 21 [ 529.140709][ T5926] legousbtower 9-1:14.81: LEGO USB Tower #-160 now disconnected [ 529.157445][T16813] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3553'. [ 529.327428][T16826] 9p: Bad value for 'rfdno' [ 530.204354][T16878] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3574'. [ 530.327274][T16887] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 530.929438][T16935] fuse: fd is not a fuse device [ 530.947724][ T1176] net_ratelimit: 299 callbacks suppressed [ 531.895105][T16964] dvmrp6: entered allmulticast mode [ 531.960197][T16968] overlayfs: failed to clone upperpath [ 532.354827][T16993] fuse: fd is not a fuse device [ 532.881901][T17026] fuse: fd is not a fuse device [ 533.064918][T17043] binder: 17039:17043 ioctl c0306201 80000080 returned -14 [ 533.151283][T17049] FAULT_INJECTION: forcing a failure. [ 533.151283][T17049] name failslab, interval 1, probability 0, space 0, times 0 [ 533.151300][T17049] CPU: 0 UID: 0 PID: 17049 Comm: syz.2.3621 Tainted: G L syzkaller #0 PREEMPT(full) [ 533.151318][T17049] Tainted: [L]=SOFTLOCKUP [ 533.151323][T17049] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 533.151330][T17049] Call Trace: [ 533.151335][T17049] [ 533.151340][T17049] dump_stack_lvl+0x100/0x190 [ 533.151359][T17049] should_fail_ex.cold+0x5/0xa [ 533.151376][T17049] should_failslab+0xc2/0x120 [ 533.151395][T17049] kmem_cache_alloc_noprof+0x92/0x6a0 [ 533.151412][T17049] ? __pfx_map_id_range_down+0x10/0x10 [ 533.151429][T17049] ? security_inode_alloc+0x3b/0x2c0 [ 533.151445][T17049] security_inode_alloc+0x3b/0x2c0 [ 533.151488][T17049] inode_init_always_gfp+0xc6f/0xfb0 [ 533.151510][T17049] alloc_inode+0x8e/0x250 [ 533.151523][T17049] new_inode+0x22/0x1c0 [ 533.151551][T17049] __debugfs_create_file+0xfb/0x500 [ 533.151564][T17049] ? dentry_kill+0xbf1/0xc20 [ 533.151579][T17049] debugfs_create_file_full+0x41/0x60 [ 533.151594][T17049] bdi_register_va+0x343/0x820 [ 533.151611][T17049] ? __pfx_bdi_register_va+0x10/0x10 [ 533.151628][T17049] ? lockdep_init_map_type+0x5c/0x250 [ 533.151647][T17049] ? bdi_init+0x3f4/0x5b0 [ 533.151665][T17049] super_setup_bdi_name+0xff/0x250 [ 533.151679][T17049] ? __pfx_super_setup_bdi_name+0x10/0x10 [ 533.151694][T17049] ? lockdep_init_map_type+0x5c/0x250 [ 533.151712][T17049] ? fuse_dax_conn_alloc+0x5b9/0x7f0 [ 533.151731][T17049] fuse_fill_super_common+0x5ef/0xfe0 [ 533.151751][T17049] ? __pfx_fuse_fill_super_common+0x10/0x10 [ 533.151769][T17049] ? __pfx_set_anon_super_fc+0x10/0x10 [ 533.151783][T17049] ? __pfx_sget_fc+0x10/0x10 [ 533.151798][T17049] ? lockdep_init_map_type+0x5c/0x250 [ 533.151816][T17049] ? __raw_spin_lock_init+0x3a/0x110 [ 533.151830][T17049] ? __pfx_fuse_fill_super+0x10/0x10 [ 533.151848][T17049] fuse_fill_super+0x100/0x1a0 [ 533.151866][T17049] get_tree_nodev+0xdd/0x190 [ 533.151882][T17049] fuse_get_tree+0x30e/0x490 [ 533.151899][T17049] vfs_get_tree+0x92/0x320 [ 533.151911][T17049] path_mount+0x7d0/0x2850 [ 533.151926][T17049] ? __pfx_path_mount+0x10/0x10 [ 533.151937][T17049] ? lockdep_hardirqs_on+0x7d/0x110 [ 533.151958][T17049] ? putname+0xb1/0x110 [ 533.151974][T17049] ? kmem_cache_free+0x127/0x6c0 [ 533.151993][T17049] ? __ia32_sys_mount+0x292/0x310 [ 533.152004][T17049] __ia32_sys_mount+0x292/0x310 [ 533.152016][T17049] ? __pfx___ia32_sys_mount+0x10/0x10 [ 533.152032][T17049] __do_fast_syscall_32+0x13a/0x8b0 [ 533.152046][T17049] do_fast_syscall_32+0x32/0x70 [ 533.152059][T17049] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 533.152075][T17049] RIP: 0023:0xf73fefec [ 533.152089][T17049] Code: Unable to access opcode bytes at 0xf73fefc2. [ 533.152095][T17049] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 533.152107][T17049] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000800001c0 [ 533.152115][T17049] RDX: 0000000080002100 RSI: 0000000000000080 RDI: 00000000800002c0 [ 533.152122][T17049] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 533.152129][T17049] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 533.152137][T17049] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 533.152153][T17049] [ 533.152351][T17049] debugfs: out of free dentries, can not create file 'wb_stats' [ 533.280451][T17057] fuse: fd is not a fuse device [ 535.026781][T17111] overlayfs: failed to clone upperpath [ 535.217278][T17115] netlink: 64 bytes leftover after parsing attributes in process `syz.5.3646'. [ 535.414573][T17126] fuse: fd is not a fuse device [ 535.573841][T17138] fuse: fd is not a fuse device [ 535.621426][T17136] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 535.628203][T17141] overlayfs: failed to clone upperpath [ 535.805384][T17151] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3663'. [ 536.187660][ T5926] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 536.348707][ T5926] usb 9-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 536.354153][ T5926] usb 9-1: config 1 has an invalid interface number: 7 but max is 0 [ 536.354169][ T5926] usb 9-1: config 1 has no interface number 0 [ 536.354189][ T5926] usb 9-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 536.354203][ T5926] usb 9-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 536.354217][ T5926] usb 9-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 536.358267][ T5926] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.358276][ T5926] usb 9-1: Product: syz [ 536.358284][ T5926] usb 9-1: Manufacturer: syz [ 536.358291][ T5926] usb 9-1: SerialNumber: syz [ 536.364402][T17157] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 536.578548][T17157] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 536.597178][T17184] net_ratelimit: 305 callbacks suppressed [ 536.757244][T17188] team0: left allmulticast mode [ 536.901488][T17188] bond0: left promiscuous mode [ 536.905029][T17188] gretap0: left allmulticast mode [ 536.905129][T17188] macvtap0: left promiscuous mode [ 536.905138][T17188] macvtap0: left allmulticast mode [ 536.906396][ T2129] lo speed is unknown, defaulting to 1000 [ 536.906415][ T2129] syz2: Port: 1 Link DOWN [ 536.935818][ T5926] sierra_net 9-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.4-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:01:07 [ 536.950649][ T5790] netdevsim netdevsim5 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 536.950669][ T5790] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.950738][ T5790] netdevsim netdevsim5 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 536.950753][ T5790] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.950770][ T5790] netdevsim netdevsim5 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 536.950784][ T5790] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.950801][ T5790] netdevsim netdevsim5 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 536.950815][ T5790] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.021565][T17194] fuse: fd is not a fuse device [ 537.171864][ T5926] sierra_net 9-1:1.7 wwan0: Submit SYNC failed -71 [ 537.171876][ T5926] sierra_net 9-1:1.7 wwan0: Send SYNC failed, status -71 [ 537.172284][ T5926] sierra_net 9-1:1.7 wwan0: Submit SYNC failed -71 [ 537.172295][ T5926] sierra_net 9-1:1.7 wwan0: Send SYNC failed, status -71 [ 537.184596][ T5926] usb 9-1: USB disconnect, device number 22 [ 537.192088][ T5926] sierra_net 9-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.4-1, Sierra Wireless USB-to-WWAN Modem [ 537.290065][ T5926] sierra_net 9-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 537.446678][T17215] FAULT_INJECTION: forcing a failure. [ 537.446678][T17215] name failslab, interval 1, probability 0, space 0, times 0 [ 537.446701][T17215] CPU: 0 UID: 0 PID: 17215 Comm: syz.2.3685 Tainted: G L syzkaller #0 PREEMPT(full) [ 537.446719][T17215] Tainted: [L]=SOFTLOCKUP [ 537.446724][T17215] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 537.446732][T17215] Call Trace: [ 537.446737][T17215] [ 537.446742][T17215] dump_stack_lvl+0x100/0x190 [ 537.446767][T17215] should_fail_ex.cold+0x5/0xa [ 537.446791][T17215] should_failslab+0xc2/0x120 [ 537.446823][T17215] __kvmalloc_node_noprof+0x113/0x9b0 [ 537.446852][T17215] ? bpf_compute_postorder+0x6b6/0x860 [ 537.446866][T17215] ? bpf_stack_liveness_init+0x29/0xd0 [ 537.446902][T17215] bpf_stack_liveness_init+0x29/0xd0 [ 537.446919][T17215] bpf_check+0x7d98/0xac70 [ 537.446939][T17215] ? __css_rstat_updated+0x1ce/0x590 [ 537.446951][T17215] ? __lock_acquire+0x5c0/0x1f40 [ 537.446986][T17215] ? __pfx___css_rstat_updated+0x10/0x10 [ 537.447007][T17215] ? __pfx_bpf_check+0x10/0x10 [ 537.447025][T17215] ? lock_acquire+0x1d1/0x380 [ 537.447042][T17215] ? find_held_lock+0x2b/0x80 [ 537.447056][T17215] ? bpf_prog_load+0x1a27/0x2ab0 [ 537.447076][T17215] ? __asan_memset+0x23/0x50 [ 537.447093][T17215] ? bpf_prog_load+0x1ae1/0x2ab0 [ 537.447116][T17215] bpf_prog_load+0x1ae1/0x2ab0 [ 537.447137][T17215] ? __pfx_bpf_prog_load+0x10/0x10 [ 537.447153][T17215] ? lock_acquire+0x1d1/0x380 [ 537.447182][T17215] __sys_bpf+0x1f46/0x4a30 [ 537.447201][T17215] ? __pfx___sys_bpf+0x10/0x10 [ 537.447215][T17215] ? find_held_lock+0x2b/0x80 [ 537.447230][T17215] ? futex_wake+0x4ea/0x5e0 [ 537.447257][T17215] ? rcu_read_lock_any_held+0x6a/0x90 [ 537.447272][T17215] ? find_held_lock+0x2b/0x80 [ 537.447287][T17215] ? ksys_write+0x190/0x250 [ 537.447302][T17215] ? ksys_write+0x190/0x250 [ 537.447325][T17215] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 537.447340][T17215] ? xfd_validate_state+0x129/0x190 [ 537.447361][T17215] ? __ia32_sys_bpf+0xcc/0x170 [ 537.447375][T17215] __ia32_sys_bpf+0xcc/0x170 [ 537.447390][T17215] ? __do_fast_syscall_32+0xb3/0x8b0 [ 537.447403][T17215] __do_fast_syscall_32+0x13a/0x8b0 [ 537.447417][T17215] do_fast_syscall_32+0x32/0x70 [ 537.447429][T17215] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 537.447468][T17215] RIP: 0023:0xf73fefec [ 537.447482][T17215] Code: Unable to access opcode bytes at 0xf73fefc2. [ 537.447488][T17215] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 537.447500][T17215] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000440 [ 537.447509][T17215] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 537.447516][T17215] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 537.447522][T17215] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 537.447530][T17215] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 537.447544][T17215] [ 537.743825][T17225] netlink: 53 bytes leftover after parsing attributes in process `syz.2.3689'. [ 537.819429][T17230] FAULT_INJECTION: forcing a failure. [ 537.819429][T17230] name failslab, interval 1, probability 0, space 0, times 0 [ 537.819481][T17230] CPU: 0 UID: 0 PID: 17230 Comm: syz.2.3691 Tainted: G L syzkaller #0 PREEMPT(full) [ 537.819511][T17230] Tainted: [L]=SOFTLOCKUP [ 537.819520][T17230] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 537.819532][T17230] Call Trace: [ 537.819539][T17230] [ 537.819547][T17230] dump_stack_lvl+0x100/0x190 [ 537.819581][T17230] should_fail_ex.cold+0x5/0xa [ 537.819609][T17230] should_failslab+0xc2/0x120 [ 537.819646][T17230] kmem_cache_alloc_noprof+0x92/0x6a0 [ 537.819673][T17230] ? sctp_get_port_local+0x828/0x1630 [ 537.819697][T17230] sctp_get_port_local+0x828/0x1630 [ 537.819724][T17230] ? __pfx_sctp_get_port_local+0x10/0x10 [ 537.819747][T17230] ? sctp_bind_addr_match+0x19d/0x300 [ 537.819774][T17230] sctp_do_bind+0x2b9/0x760 [ 537.819802][T17230] sctp_inet_listen+0x69b/0x7f0 [ 537.819826][T17230] ? __pfx_sctp_inet_listen+0x10/0x10 [ 537.819857][T17230] ? apparmor_socket_listen+0x149/0x1e0 [ 537.819894][T17230] __sys_listen_socket+0x108/0x150 [ 537.819917][T17230] __sys_listen+0xa7/0x130 [ 537.819938][T17230] __ia32_sys_listen+0x53/0x80 [ 537.819960][T17230] __do_fast_syscall_32+0x13a/0x8b0 [ 537.819988][T17230] do_fast_syscall_32+0x32/0x70 [ 537.820011][T17230] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 537.820055][T17230] RIP: 0023:0xf73fefec [ 537.820079][T17230] Code: Unable to access opcode bytes at 0xf73fefc2. [ 537.820090][T17230] RSP: 002b:00000000f541650c EFLAGS: 00000292 [ 537.820101][T17230] ORIG_RAX: 000000000000016b [ 537.820111][T17230] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000003 [ 537.820125][T17230] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 537.820136][T17230] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 537.820147][T17230] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 537.820160][T17230] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 537.820188][T17230] [ 538.383019][T17244] FAT-fs (loop11): unable to read boot sector [ 538.506205][T17250] netlink: 'syz.2.3697': attribute type 1 has an invalid length. [ 538.583956][T17254] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3699'. [ 538.819653][T17250] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3697'. [ 538.866475][T17252] bond1: (slave veth3): Enslaving as an active interface with a down link [ 538.956181][T17254] ifb0: entered promiscuous mode [ 538.956539][T17254] macvtap0: entered promiscuous mode [ 538.956861][T17254] macvtap0: entered allmulticast mode [ 538.956871][T17254] ifb0: entered allmulticast mode [ 539.011906][T17255] ifb0: left allmulticast mode [ 539.013185][T17255] ifb0: left promiscuous mode [ 539.021154][T17255] macvtap0: left promiscuous mode [ 539.021168][T17255] macvtap0: left allmulticast mode [ 539.024207][T17250] 8021q: adding VLAN 0 to HW filter on device bond1 [ 539.572952][ T5454] ifb0: entered promiscuous mode [ 540.012222][T17298] futex_wake_op: syz.1.3708 tries to shift op by 144; fix this program [ 540.017792][T17297] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3708'. [ 540.023957][T17297] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3708'. [ 540.256442][T17309] lo speed is unknown, defaulting to 1000 [ 540.384448][T17317] syzkaller0: entered promiscuous mode [ 540.384465][T17317] syzkaller0: entered allmulticast mode [ 540.731013][T17334] fuse: fd is not a fuse device [ 540.908694][T17344] binder: 17343:17344 ioctl c0709411 80000200 returned -22 [ 540.915321][T17344] binder: 17343:17344 ioctl c0306201 80000680 returned -22 [ 541.802852][ T5454] net_ratelimit: 186 callbacks suppressed [ 544.707740][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 547.587647][ C0] net_ratelimit: 12 callbacks suppressed [ 548.774782][T17484] qrtr: Invalid version 0 [ 548.801208][T17484] syzkaller1: entered promiscuous mode [ 548.801217][T17484] syzkaller1: entered allmulticast mode [ 550.085942][T17520] ip6gre1: entered allmulticast mode [ 550.117684][ T10] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 550.269825][ T10] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 550.270625][ T10] usb 9-1: config 1 has an invalid descriptor of length 128, skipping remainder of the config [ 550.270649][ T10] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 550.270661][ T10] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 6 [ 550.270691][ T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.273408][T17501] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 550.274371][ T10] keyspan 9-1:1.0: Keyspan 2 port adapter converter detected [ 550.274542][ T10] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 1 [ 550.277774][ T10] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 84 [ 550.277815][ T10] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 2 [ 550.282289][ T10] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 550.283117][ T10] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 88 [ 550.283159][ T10] keyspan 9-1:1.0: found no endpoint descriptor for endpoint 6 [ 550.296117][ T10] usb 9-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 550.503753][ T854] usb 9-1: USB disconnect, device number 23 [ 550.510731][ T854] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 550.524168][ T854] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 550.524624][ T854] keyspan 9-1:1.0: device disconnected [ 550.697672][ T10] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 550.744434][T17544] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3788'. [ 550.784736][T17546] xt_nfacct: accounting object `syz0' does not exist [ 550.847837][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 550.848580][ T10] usb 7-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 550.849550][ T10] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 550.849570][ T10] usb 7-1: config 0 has no interface number 0 [ 550.851726][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 550.851742][ T10] usb 7-1: Product: syz [ 550.851754][ T10] usb 7-1: Manufacturer: syz [ 550.851767][ T10] usb 7-1: SerialNumber: syz [ 550.856970][ T10] usb 7-1: config 0 descriptor?? [ 550.885279][ T10] usb 7-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 550.885339][ T10] usb 7-1: selecting invalid altsetting 1 [ 550.885352][ T10] usb 7-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 550.909241][ T10] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 550.909786][ T10] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 550.909833][ T10] usb 7-1: media controller created [ 550.973981][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 551.171785][T17556] sctp: [Deprecated]: syz.1.3791 (pid 17556) Use of struct sctp_assoc_value in delayed_ack socket option. [ 551.171785][T17556] Use struct sctp_sack_info instead [ 551.423923][T17567] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3793'. [ 551.828850][T17576] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 551.828865][T17576] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 551.829063][T17576] vhci_hcd vhci_hcd.0: Device attached [ 551.951342][T17580] loop5: detected capacity change from 0 to 8191 [ 551.994564][T17538] buffer_io_error: 149 callbacks suppressed [ 551.994575][T17538] Buffer I/O error on dev loop5, logical block 1023, async page read [ 552.067986][ T10] usb 7-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 552.068008][ T10] zl10353_read_register: readreg error (reg=127, ret==-110) [ 552.107759][T17190] usb 42-1: SetAddress Request (6) to port 0 [ 552.107791][T17190] usb 42-1: new SuperSpeed USB device number 6 using vhci_hcd [ 552.286195][T17577] vhci_hcd: connection reset by peer [ 552.287744][ T8790] vhci_hcd vhci_hcd.2: stop threads [ 552.287757][ T8790] vhci_hcd vhci_hcd.2: release socket [ 552.287783][ T8790] vhci_hcd vhci_hcd.2: disconnect device [ 552.618833][ T5926] usb 7-1: USB disconnect, device number 22 [ 552.787701][ C0] net_ratelimit: 27 callbacks suppressed [ 552.787712][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 553.051079][T17609] lo speed is unknown, defaulting to 1000 [ 553.227777][T17617] netlink: 'syz.5.3807': attribute type 7 has an invalid length. [ 553.277961][ T5926] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 553.396968][T17618] ieee80211 phy17: Failed to add default virtual iface [ 553.438704][ T5926] usb 7-1: New USB device found, idVendor=368a, idProduct=0036, bcdDevice= 0.00 [ 553.440331][ T5926] usb 7-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 553.440345][ T5926] usb 7-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 553.440358][ T5926] usb 7-1: config 0 interface 0 has no altsetting 0 [ 553.440383][ T5926] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 553.459018][ T5926] usb 7-1: config 0 descriptor?? [ 553.951247][ T44] kauditd_printk_skb: 8 callbacks suppressed [ 553.951256][ T44] audit: type=1800 audit(1791688322.396:2415): pid=17631 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3809" name="file0" dev="overlay" ino=3637 res=0 errno=0 [ 554.085676][ T5926] usbhid 7-1:0.0: can't add hid device: -71 [ 554.085746][ T5926] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 ** 29431 printk messages dropped ** [ 555.202794][ T5926] usb 7-1: USB disconnect, device number 23 [ 555.645321][ T74] Bluetooth: hci2: Frame reassembly failed (-84) [ 555.645842][ T74] Bluetooth: hci2: Frame reassembly failed (-84) [ 555.645878][ T74] Bluetooth: hci2: Frame reassembly failed (-84) [ 555.645914][ T74] Bluetooth: hci2: Frame reassembly failed (-84) [ 555.645945][ T74] Bluetooth: hci2: Frame reassembly failed (-84) [ 556.925344][T17674] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 557.187739][T17190] usb 42-1: device descriptor read/8, error -110 [ 557.658127][T17190] usb usb42-port1: attempt power cycle [ 557.667681][ T5101] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 558.331548][T17694] IPVS: set_ctl: invalid protocol: 12 224.0.0.1:20001 [ 558.335839][T17190] usb usb42-port1: unable to enumerate USB device [ 558.549496][T17701] net_ratelimit: 45 callbacks suppressed [ 558.549514][T17701] netlink: zone id is out of range [ 558.549521][T17701] netlink: zone id is out of range [ 558.549527][T17701] netlink: zone id is out of range [ 558.549533][T17701] netlink: zone id is out of range [ 558.549539][T17701] netlink: zone id is out of range [ 558.549546][T17701] netlink: zone id is out of range [ 558.551144][T17701] netlink: zone id is out of range [ 558.551154][T17701] netlink: zone id is out of range [ 558.551160][T17701] netlink: zone id is out of range [ 558.551166][T17701] netlink: zone id is out of range [ 558.592164][T17701] FAULT_INJECTION: forcing a failure. [ 558.592164][T17701] name failslab, interval 1, probability 0, space 0, times 0 [ 558.592195][T17701] CPU: 2 UID: 0 PID: 17701 Comm: syz.2.3831 Tainted: G L syzkaller #0 PREEMPT(full) [ 558.592223][T17701] Tainted: [L]=SOFTLOCKUP [ 558.592230][T17701] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 558.592241][T17701] Call Trace: [ 558.592266][T17701] [ 558.592276][T17701] dump_stack_lvl+0x100/0x190 [ 558.592309][T17701] should_fail_ex.cold+0x5/0xa [ 558.592335][T17701] should_failslab+0xc2/0x120 [ 558.592363][T17701] __kmalloc_cache_noprof+0x91/0x6d0 [ 558.592386][T17701] ? snd_seq_pool_new+0x44/0x230 [ 558.592414][T17701] ? __pfx_snd_seq_open+0x10/0x10 [ 558.592434][T17701] snd_seq_pool_new+0x44/0x230 [ 558.592460][T17701] snd_seq_fifo_new+0x5a/0x270 [ 558.592486][T17701] snd_seq_open+0x144/0x530 [ 558.592507][T17701] ? __pfx_snd_seq_open+0x10/0x10 [ 558.592527][T17701] snd_open+0x201/0x450 [ 558.592550][T17701] ? __pfx_snd_open+0x10/0x10 [ 558.592573][T17701] chrdev_open+0x234/0x6a0 [ 558.592597][T17701] ? __pfx_apparmor_file_open+0x10/0x10 [ 558.592623][T17701] ? __pfx_chrdev_open+0x10/0x10 [ 558.592650][T17701] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 558.592675][T17701] do_dentry_open+0x6ab/0x14d0 [ 558.592698][T17701] ? __pfx_chrdev_open+0x10/0x10 [ 558.592729][T17701] vfs_open+0x82/0x3f0 [ 558.592750][T17701] path_openat+0x19fa/0x2440 [ 558.592780][T17701] ? __pfx_path_openat+0x10/0x10 [ 558.592812][T17701] do_file_open+0x20e/0x430 [ 558.592840][T17701] ? __pfx_do_file_open+0x10/0x10 [ 558.592882][T17701] ? _raw_spin_unlock+0x28/0x50 [ 558.592908][T17701] ? alloc_fd+0x471/0x7a0 [ 558.592940][T17701] do_sys_openat2+0x10f/0x1e0 [ 558.592959][T17701] ? __pfx_do_sys_openat2+0x10/0x10 [ 558.592988][T17701] __ia32_compat_sys_openat+0x12d/0x210 [ 558.593009][T17701] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 558.593040][T17701] __do_fast_syscall_32+0x13a/0x8b0 [ 558.593069][T17701] do_fast_syscall_32+0x32/0x70 [ 558.593090][T17701] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 558.593115][T17701] RIP: 0023:0xf73fefec [ 558.593135][T17701] Code: Unable to access opcode bytes at 0xf73fefc2. [ 558.593144][T17701] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 558.593162][T17701] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000180 [ 558.593175][T17701] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 558.593188][T17701] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 558.593200][T17701] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 558.593211][T17701] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 558.593236][T17701] [ 559.682868][T17709] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3833'. [ 559.949749][T17714] binder: 17713:17714 ioctl c0306201 800004c0 returned -22 [ 560.453755][T17734] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3843'. [ 560.471573][T17734] netlink: 'syz.2.3843': attribute type 2 has an invalid length. [ 560.471587][T17734] netlink: 1 bytes leftover after parsing attributes in process `syz.2.3843'. [ 560.471596][T17734] netlink: 'syz.2.3843': attribute type 2 has an invalid length. [ 560.471602][T17734] netlink: 1 bytes leftover after parsing attributes in process `syz.2.3843'. [ 561.229533][T17749] lo speed is unknown, defaulting to 1000 [ 562.394758][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.667600][ C2] net_ratelimit: 542 callbacks suppressed [ 565.027197][T17822] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 565.451860][T17830] netlink: 'syz.2.3867': attribute type 4 has an invalid length. [ 565.525843][T17830] netlink: 'syz.2.3867': attribute type 4 has an invalid length. [ 565.584615][T17834] netlink: 64 bytes leftover after parsing attributes in process `syz.5.3870'. [ 566.209520][T17830] serio: Serial port ptm0 [ 566.561538][T17855] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:20004 [ 566.682961][ T44] audit: type=1800 audit(1791688335.126:2416): pid=17868 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3875" name="nullb0" dev="tmpfs" ino=841 res=0 errno=0 [ 566.766967][T17872] overlayfs: failed to clone lowerpath [ 566.772081][T17872] overlayfs: failed to clone lowerpath [ 568.119266][T17908] jffs2: notice: (17908) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 568.307280][T17915] syz_tun (unregistering): left allmulticast mode [ 568.307311][T17915] syz_tun (unregistering): left promiscuous mode [ 568.307349][T17915] bridge0: port 3(syz_tun) entered disabled state [ 568.709254][T17650] net_ratelimit: 10 callbacks suppressed [ 568.777725][T17190] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 568.938143][T17190] usb 9-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 568.939699][T17190] usb 9-1: config 0 interface 0 altsetting 255 bulk endpoint 0x4 has invalid maxpacket 61 [ 568.939715][T17190] usb 9-1: config 0 interface 0 has no altsetting 0 [ 568.941943][T17190] usb 9-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 568.941954][T17190] usb 9-1: Product: syz [ 568.941961][T17190] usb 9-1: Manufacturer: syz [ 568.941969][T17190] usb 9-1: SerialNumber: syz [ 568.943423][T17190] usb 9-1: config 0 descriptor?? [ 568.944270][T17927] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 569.038484][T17190] usb 9-1: selecting invalid altsetting 0 [ 570.962268][T17985] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3898'. [ 571.132524][T17926] snd-usb-audio 9-1:0.0: Runtime PM usage count underflow! [ 571.133907][ T10] usb 9-1: USB disconnect, device number 24 [ 571.414046][T18004] configfs-gadget.g1 gadget.0: afunc_bind:1251 Error! [ 571.414147][T18004] udc dummy_udc.0: failed to start g1: -19 [ 571.425982][T18004] UDC core: g1: couldn't find an available UDC or it's busy [ 571.839735][T18022] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3904'. [ 571.840953][T18020] ALSA: mixer_oss: invalid OSS volume 'OGAI‹' [ 571.841031][T18020] ALSA: mixer_oss: invalid OSS volume 'Šä:&ÇBŠG¤`TÝoÄD^z¿‡F?!k'' [ 571.841670][T18020] ALSA: mixer_oss: invalid OSS volume '' [ 572.108206][ T10] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 572.258259][ T10] usb 9-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 572.259052][ T10] usb 9-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 572.259069][ T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 572.259083][ T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 572.259094][ T10] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 572.260108][ T10] usb 9-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 572.260118][ T10] usb 9-1: Manufacturer: syz [ 572.284849][ T10] usb 9-1: config 0 descriptor?? [ 572.585773][T18032] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3906'. [ 572.623253][T18032] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3906'. [ 572.737314][T18019] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3903'. [ 572.995875][T18044] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 573.215471][ T10] appleir 0003:05AC:8243.0002: unknown main item tag 0x0 [ 573.480305][ T10] appleir 0003:05AC:8243.0002: hiddev0,hidraw1: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 574.237679][ T10] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 574.387667][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 574.514315][T18063] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3914'. [ 574.522521][T18063] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3914'. [ 574.522539][T18063] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3914'. [ 574.557786][ T3626] net_ratelimit: 12 callbacks suppressed [ 574.584131][ T44] audit: type=1326 audit(1791688343.026:2417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18061 comm="syz.1.3914" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 574.584344][ T44] audit: type=1326 audit(1791688343.026:2418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18061 comm="syz.1.3914" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 574.585787][ T44] audit: type=1326 audit(1791688343.026:2419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18061 comm="syz.1.3914" exe="/syz-executor" sig=0 arch=40000003 syscall=76 compat=1 ip=0xf742efec code=0x7ffc0000 [ 574.585961][ T44] audit: type=1326 audit(1791688343.026:2420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18061 comm="syz.1.3914" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 574.586119][ T44] audit: type=1326 audit(1791688343.026:2421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18061 comm="syz.1.3914" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 574.586582][ T44] audit: type=1326 audit(1791688343.026:2422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18061 comm="syz.1.3914" exe="/syz-executor" sig=0 arch=40000003 syscall=427 compat=1 ip=0xf742efec code=0x7ffc0000 [ 574.587065][ T44] audit: type=1326 audit(1791688343.026:2423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18061 comm="syz.1.3914" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 574.587829][ T44] audit: type=1326 audit(1791688343.026:2424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18061 comm="syz.1.3914" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 574.589080][ T44] audit: type=1326 audit(1791688343.036:2425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18061 comm="syz.1.3914" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf742efec code=0x7ffc0000 [ 574.589531][ T44] audit: type=1326 audit(1791688343.036:2426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18061 comm="syz.1.3914" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 574.743989][ T10] usb 7-1: unable to get BOS descriptor or descriptor too short [ 574.744012][ T10] usb 7-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 574.744036][ T10] usb 7-1: no configurations [ 574.744043][ T10] usb 7-1: can't read configurations, error -22 [ 574.759099][ T854] usb 9-1: USB disconnect, device number 25 [ 574.813831][T18075] fuse: fd is not a fuse device [ 575.058183][T18080] bond0: option slaves: invalid value (-bond_slave_0) [ 576.658165][T18134] bridge0: port 1(syz_tun) entered blocking state [ 576.658329][T18134] bridge0: port 1(syz_tun) entered disabled state [ 576.658437][T18134] syz_tun: entered allmulticast mode [ 576.659424][T18134] syz_tun: entered promiscuous mode [ 576.829413][T18145] fuse: Bad value for 'fd' ** 9275 printk messages dropped ** ** 116 printk messages dropped ** ** 119 printk messages dropped ** ** 110 printk messages dropped ** ** 119 printk messages dropped ** ** 141 printk messages dropped ** ** 115 printk messages dropped ** ** 104 printk messages dropped ** ** 114 printk messages dropped ** ** 113 printk messages dropped ** ** 121 printk messages dropped ** ** 128 printk messages dropped ** ** 134 printk messages dropped ** ** 111 printk messages dropped ** ** 91 printk messages dropped ** ** 107 printk messages dropped ** ** 110 printk messages dropped ** ** 113 printk messages dropped ** ** 128 printk messages dropped ** ** 114 printk messages dropped ** ** 128 printk messages dropped ** ** 349 printk messages dropped ** ** 239 printk messages dropped ** ** 114 printk messages dropped ** ** 68 printk messages dropped ** ** 65 printk messages dropped ** ** 68 printk messages dropped ** ** 97 printk messages dropped ** ** 172 printk messages dropped ** ** 138 printk messages dropped ** ** 108 printk messages dropped ** ** 124 printk messages dropped ** ** 116 printk messages dropped ** ** 117 printk messages dropped ** ** 200 printk messages dropped ** ** 146 printk messages dropped ** ** 119 printk messages dropped ** ** 109 printk messages dropped ** ** 122 printk messages dropped ** ** 322 printk messages dropped ** ** 153 printk messages dropped ** ** 181 printk messages dropped ** ** 268 printk messages dropped ** ** 112 printk messages dropped ** ** 72 printk messages dropped ** ** 83 printk messages dropped ** ** 97 printk messages dropped ** ** 75 printk messages dropped ** ** 62 printk messages dropped ** ** 65 printk messages dropped ** ** 62 printk messages dropped ** ** 62 printk messages dropped ** ** 68 printk messages dropped ** ** 65 printk messages dropped ** ** 62 printk messages dropped ** ** 62 printk messages dropped ** ** 62 printk messages dropped ** ** 62 printk messages dropped ** ** 62 printk messages dropped ** ** 62 printk messages dropped ** ** 62 printk messages dropped ** ** 62 printk messages dropped ** ** 94 printk messages dropped ** ** 121 printk messages dropped ** ** 111 printk messages dropped ** ** 110 printk messages dropped ** ** 107 printk messages dropped ** ** 111 printk messages dropped ** ** 122 printk messages dropped ** ** 171 printk messages dropped ** ** 114 printk messages dropped ** ** 81 printk messages dropped ** ** 88 printk messages dropped ** ** 108 printk messages dropped ** ** 118 printk messages dropped ** ** 113 printk messages dropped ** ** 159 printk messages dropped ** ** 104 printk messages dropped ** ** 65 printk messages dropped ** ** 71 printk messages dropped ** ** 80 printk messages dropped ** ** 318 printk messages dropped ** ** 157 printk messages dropped ** ** 294 printk messages dropped ** ** 129 printk messages dropped ** ** 187 printk messages dropped ** ** 111 printk messages dropped ** ** 107 printk messages dropped ** ** 119 printk messages dropped ** ** 198 printk messages dropped ** ** 114 printk messages dropped ** ** 210 printk messages dropped ** ** 125 printk messages dropped ** ** 113 printk messages dropped ** ** 147 printk messages dropped ** ** 171 printk messages dropped ** ** 120 printk messages dropped ** ** 147 printk messages dropped ** ** 112 printk messages dropped ** ** 114 printk messages dropped ** ** 392 printk messages dropped ** ** 115 printk messages dropped ** ** 116 printk messages dropped ** ** 113 printk messages dropped ** ** 110 printk messages dropped ** ** 108 printk messages dropped ** ** 110 printk messages dropped ** ** 113 printk messages dropped ** ** 118 printk messages dropped ** ** 116 printk messages dropped ** ** 110 printk messages dropped ** ** 110 printk messages dropped ** ** 110 printk messages dropped ** ** 111 printk messages dropped ** ** 113 printk messages dropped ** ** 113 printk messages dropped ** ** 109 printk messages dropped ** ** 107 printk messages dropped ** ** 113 printk messages dropped ** ** 117 printk messages dropped ** ** 112 printk messages dropped ** ** 116 printk messages dropped ** ** 110 printk messages dropped ** ** 248 printk messages dropped ** ** 116 printk messages dropped ** ** 110 printk messages dropped ** ** 107 printk messages dropped ** ** 110 printk messages dropped ** ** 97 printk messages dropped ** ** 200 printk messages dropped ** ** 114 printk messages dropped ** ** 110 printk messages dropped ** ** 107 printk messages dropped ** ** 119 printk messages dropped ** ** 110 printk messages dropped ** ** 123 printk messages dropped ** ** 116 printk messages dropped ** ** 116 printk messages dropped ** ** 103 printk messages dropped ** ** 110 printk messages dropped ** ** 114 printk messages dropped ** ** 113 printk messages dropped ** ** 205 printk messages dropped ** ** 212 printk messages dropped ** ** 120 printk messages dropped ** ** 109 printk messages dropped ** ** 125 printk messages dropped ** ** 138 printk messages dropped ** ** 109 printk messages dropped ** ** 110 printk messages dropped ** ** 114 printk messages dropped ** ** 113 printk messages dropped ** ** 122 printk messages dropped ** ** 155 printk messages dropped ** ** 110 printk messages dropped ** ** 106 printk messages dropped ** ** 101 printk messages dropped ** ** 98 printk messages dropped ** ** 110 printk messages dropped ** ** 110 printk messages dropped ** ** 197 printk messages dropped ** ** 158 printk messages dropped ** ** 105 printk messages dropped ** [ 578.657699][T17190] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 578.928611][T17190] usb 9-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 578.929400][T17190] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 578.929412][T17190] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 578.930615][T17190] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 578.930625][T17190] usb 9-1: Product: syz [ 578.930632][T17190] usb 9-1: Manufacturer: syz [ 579.038406][T18183] fuse: fd is not a fuse device [ 579.332326][T17190] usb 9-1: USB disconnect, device number 26 [ 580.308039][ T52] net_ratelimit: 46 callbacks suppressed [ 580.327833][ T44] kauditd_printk_skb: 173 callbacks suppressed [ 580.327843][ T44] audit: type=1400 audit(1791688348.766:2600): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=18213 comm="syz.4.3952" [ 581.464400][ T44] audit: type=1800 audit(1791688349.906:2601): pid=18221 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3953" name="file1" dev="sda1" ino=2041 res=0 errno=0 [ 582.543164][T18274] overlayfs: failed to clone upperpath [ 583.047833][T18292] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3961'. [ 583.395763][T18307] netlink: 'syz.5.3964': attribute type 10 has an invalid length. [ 583.508868][ T854] usb 7-1: new full-speed USB device number 26 using dummy_hcd [ 583.658150][ T854] usb 7-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 583.659092][ T854] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 583.659107][ T854] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 583.659121][ T854] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 583.660366][T18321] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 583.660736][ T854] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.660746][ T854] usb 7-1: Product: syz [ 583.660753][ T854] usb 7-1: Manufacturer: syz [ 583.660761][ T854] usb 7-1: SerialNumber: syz [ 583.664266][ T854] usb 7-1: config 0 descriptor?? [ 583.673520][T18300] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 583.747926][ T854] rc_core: IR keymap rc-streamzap not found [ 583.747944][ T854] Registered IR keymap rc-empty [ 583.748191][T18321] md: could not open device unknown-block(1,1). [ 583.750449][ T854] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0 [ 583.753162][ T854] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0/input26 [ 583.791040][T18321] md: personality for level is not loaded! [ 583.940553][T18300] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 583.944797][T18300] FAULT_INJECTION: forcing a failure. [ 583.944797][T18300] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 583.944816][T18300] CPU: 0 UID: 0 PID: 18300 Comm: syz.2.3963 Tainted: G L syzkaller #0 PREEMPT(full) [ 583.944832][T18300] Tainted: [L]=SOFTLOCKUP [ 583.944836][T18300] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 583.944843][T18300] Call Trace: [ 583.944848][T18300] [ 583.944853][T18300] dump_stack_lvl+0x100/0x190 [ 583.944873][T18300] should_fail_ex.cold+0x5/0xa [ 583.944901][T18300] _copy_from_user+0x2e/0xd0 [ 583.944916][T18300] do_seccomp+0x622/0x2730 [ 583.944931][T18300] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 583.944948][T18300] ? __pfx_do_seccomp+0x10/0x10 [ 583.944963][T18300] ? xfd_validate_state+0x129/0x190 [ 583.944988][T18300] __do_fast_syscall_32+0x13a/0x8b0 [ 583.945000][T18300] ? lockdep_hardirqs_on+0x7d/0x110 [ 583.945021][T18300] do_fast_syscall_32+0x32/0x70 [ 583.945034][T18300] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 583.945049][T18300] RIP: 0023:0xf73fefec [ 583.945064][T18300] Code: Unable to access opcode bytes at 0xf73fefc2. [ 583.945069][T18300] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000162 [ 583.945080][T18300] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000000001 [ 583.945088][T18300] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 583.945095][T18300] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 583.945101][T18300] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 583.945108][T18300] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 583.945123][T18300] [ 583.951984][ T5926] usb 7-1: USB disconnect, device number 26 [ 584.283544][T18334] 9p: Bad value for 'version' [ 584.852589][T18347] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3972'. [ 584.852609][T18347] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3972'. [ 584.890005][T18347] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3972'. [ 585.050507][T18353] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3974'. [ 585.054775][T18353] Line length is too long: Should be less than 4094 [ 585.787687][T18366] net_ratelimit: 29 callbacks suppressed [ 587.068815][T18386] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3981'. [ 587.068828][T18386] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3981'. [ 587.068838][T18386] netlink: 1 bytes leftover after parsing attributes in process `syz.1.3981'. [ 587.802497][T18393] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3982'. [ 587.980455][T18398] team0: entered allmulticast mode [ 587.981042][T18398] 8021q: adding VLAN 0 to HW filter on device team0 [ 587.981248][T18398] tipc: Resetting bearer [ 588.124517][T18400] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 588.256252][T18408] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3987'. [ 589.752584][T18434] dvmrp16: entered allmulticast mode [ 589.922564][T18436] CUSE: info not properly terminated [ 590.013153][ T44] audit: type=1804 audit(1791688358.456:2602): pid=18439 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.3996" name="bus" dev="ramfs" ino=54490 res=1 errno=0 [ 590.014069][ T44] audit: type=1804 audit(1791688358.456:2603): pid=18439 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.3996" name="bus" dev="ramfs" ino=54490 res=1 errno=0 [ 590.091659][T18437] team0: left allmulticast mode [ 590.091669][T18437] team_slave_0: left allmulticast mode [ 590.091678][T18437] team_slave_1: left allmulticast mode [ 590.093441][T18437] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 590.120802][T18437] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 590.121978][T18437] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 590.151847][ T74] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.152037][ T74] bridge0: port 1(bridge_slave_0) entered listening state [ 590.170504][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.170548][ T74] bridge0: port 2(bridge_slave_1) entered listening state [ 590.863790][T18456] ptrace attach of "/syz-executor exec"[18457] was attempted by "/syz-executor exec"[18456] [ 590.872944][T18456] fuse: fd is not a fuse device [ 590.978970][ T1162] IPVS: starting estimator thread 0... [ 591.068392][T18461] IPVS: using max 43 ests per chain, 103200 per kthread [ 591.075242][T18463] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 591.075255][T18463] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 591.076114][T18463] vhci_hcd vhci_hcd.0: Device attached [ 591.079419][T18463] binder: 18462:18463 ioctl 84009422 80000500 returned -22 [ 591.080407][T18463] binder: 18462:18463 ioctl 50009403 80000900 returned -22 [ 591.111135][T18465] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4003'. [ 591.247646][ T5926] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 591.317712][ T5926] usb 45-1: new full-speed USB device number 3 using vhci_hcd [ 591.651045][T18466] vhci_hcd: connection reset by peer [ 591.651368][ T5832] vhci_hcd vhci_hcd.4: stop threads [ 591.651379][ T5832] vhci_hcd vhci_hcd.4: release socket [ 591.651433][ T5832] vhci_hcd vhci_hcd.4: disconnect device [ 591.925676][ T74] net_ratelimit: 89 callbacks suppressed [ 592.050135][T18483] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4008'. [ 592.167695][ T25] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 592.261515][T18485] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4009'. [ 592.261867][T18485] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4009'. [ 592.262015][T18485] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4009'. [ 592.262159][T18485] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4009'. [ 592.315704][T18487] fuse: fd is not a fuse device [ 592.327891][ T25] usb 9-1: Using ep0 maxpacket: 8 [ 592.328590][ T25] usb 9-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 592.329701][ T25] usb 9-1: config 2 has an invalid interface number: 31 but max is 0 [ 592.329721][ T25] usb 9-1: config 2 has no interface number 0 [ 592.329752][ T25] usb 9-1: config 2 interface 31 has no altsetting 0 [ 592.333370][ T25] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.333380][ T25] usb 9-1: Product: syz [ 592.333388][ T25] usb 9-1: Manufacturer: syz [ 592.333400][ T25] usb 9-1: SerialNumber: syz [ 592.430536][T18492] sctp: [Deprecated]: syz.5.4012 (pid 18492) Use of int in max_burst socket option. [ 592.430536][T18492] Use struct sctp_assoc_value instead [ 592.613012][T18500] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4014'. [ 592.628334][ T44] audit: type=1107 audit(1791688361.066:2604): pid=18495 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ÌçG'3š•lÕ¨‹K>uwIh$ô 0R ˜1L¾ÙñM6‘¢Ã"?À#êò0y' [ 592.630348][T18496] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4013'. [ 593.490405][T18511] jffs2: notice: (18511) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 594.052210][ T25] ch9200 9-1:2.31: probe with driver ch9200 failed with error -22 [ 594.117171][T18522] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 594.241930][T18524] 9pnet_virtio: no channels available for device c::: [ 594.550961][T18526] syz.2.4023 (18526): drop_caches: 2 [ 594.741261][ T854] usb 9-1: USB disconnect, device number 27 [ 594.815533][T18535] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 594.932738][T18531] netlink: 'syz.1.4025': attribute type 2 has an invalid length. [ 595.202865][T18554] CIFS mount error: No usable UNC path provided in device string! [ 595.202865][T18554] [ 595.202878][T18554] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 595.377882][T18557] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4030'. [ 596.457742][ T5926] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 597.592944][T17650] net_ratelimit: 327 callbacks suppressed [ 599.203649][T18576] Bluetooth: hci2: Frame reassembly failed (-84) [ 599.217443][ T1162] Bluetooth: hci2: Frame reassembly failed (-84) [ 599.277189][ T44] audit: type=1326 audit(1791688367.716:2605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18569 comm="syz.1.4033" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 599.291836][ T44] audit: type=1326 audit(1791688367.716:2606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18569 comm="syz.1.4033" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 599.291904][ T44] audit: type=1326 audit(1791688367.726:2607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18569 comm="syz.1.4033" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf718762b code=0x7ffc0000 [ 599.292168][ T44] audit: type=1326 audit(1791688367.726:2608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18569 comm="syz.1.4033" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 599.292229][ T44] audit: type=1326 audit(1791688367.726:2609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18569 comm="syz.1.4033" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 599.292396][ T44] audit: type=1326 audit(1791688367.736:2610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18569 comm="syz.1.4033" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf742efec code=0x7ffc0000 [ 599.292593][ T44] audit: type=1326 audit(1791688367.736:2611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18569 comm="syz.1.4033" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 599.292653][ T44] audit: type=1326 audit(1791688367.736:2612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18569 comm="syz.1.4033" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 599.292788][ T44] audit: type=1326 audit(1791688367.736:2613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18569 comm="syz.1.4033" exe="/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf742efec code=0x7ffc0000 [ 599.293085][ T44] audit: type=1326 audit(1791688367.736:2614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18569 comm="syz.1.4033" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742efec code=0x7ffc0000 [ 601.267777][ T5744] Bluetooth: hci2: command 0x1003 tx timeout [ 601.271319][ T5101] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 601.802200][T18623] tipc: Enabling of bearer rejected, failed to enable media [ 603.361520][ T3626] net_ratelimit: 180 callbacks suppressed [ 604.301490][T18654] netlink: 14 bytes leftover after parsing attributes in process `syz.5.4052'. [ 604.545746][T18649] kAFS: No cell specified ** 130 printk messages dropped ** ** 77 printk messages dropped ** ** 146 printk messages dropped ** ** 191 printk messages dropped ** ** 71 printk messages dropped ** ** 286 printk messages dropped ** ** 617 printk messages dropped ** ** 23 printk messages dropped ** ** 297 printk messages dropped ** ** 245 printk messages dropped ** ** 7716 printk messages dropped ** [ 606.615675][T18676] fuse: fd is not a fuse device [ 608.472810][ T38] net_ratelimit: 169 callbacks suppressed [ 608.496590][T18680] fuse: fd is not a fuse device [ 608.618752][T18678] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4062'. [ 608.735545][T18687] tps6598x 1-0003: failed to read vendor ID: -5, vid: 0x0 [ 608.747717][T18691] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4067'. [ 608.753844][T18691] xt_ecn: cannot match TCP bits for non-tcp packets [ 608.773453][T18687] i2c i2c-1: new_device: Instantiated device tps6598x at 0x03 [ 608.985035][ T5790] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 608.985279][ T5817] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 609.000807][ T5817] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 609.011786][ T5817] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 609.184897][ T44] kauditd_printk_skb: 3 callbacks suppressed [ 609.185024][ T44] audit: type=1326 audit(1791688377.626:2618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18703 comm="syz.2.4070" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73fefec code=0x7ffc0000 [ 609.185224][ T44] audit: type=1326 audit(1791688377.626:2619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18703 comm="syz.2.4070" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73fefec code=0x7ffc0000 [ 609.185456][ T44] audit: type=1326 audit(1791688377.626:2620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18703 comm="syz.2.4070" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73fefec code=0x7ffc0000 [ 609.185849][ T44] audit: type=1326 audit(1791688377.626:2621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18703 comm="syz.2.4070" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73fefec code=0x7ffc0000 [ 609.185909][ T44] audit: type=1326 audit(1791688377.626:2622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18703 comm="syz.2.4070" exe="/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf73fefec code=0x7ffc0000 [ 609.186077][ T44] audit: type=1326 audit(1791688377.626:2623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18703 comm="syz.2.4070" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73fefec code=0x7ffc0000 [ 609.186859][ T44] audit: type=1326 audit(1791688377.626:2624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18703 comm="syz.2.4070" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73fefec code=0x7ffc0000 [ 609.187190][ T44] audit: type=1326 audit(1791688377.626:2625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18703 comm="syz.2.4070" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73fefec code=0x7ffc0000 [ 609.187420][ T44] audit: type=1326 audit(1791688377.626:2626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18703 comm="syz.2.4070" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73fefec code=0x7ffc0000 [ 609.242254][ T44] audit: type=1326 audit(1791688377.686:2628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18703 comm="syz.2.4070" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73fefec code=0x7ffc0000 [ 610.303130][T18703] ima: policy update completed [ 610.607405][T18721] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4076'. [ 610.989512][T18725] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4075'. [ 611.228998][T18729] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4078'. [ 612.205626][T18765] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4096'. [ 612.361676][T18767] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4088'. [ 613.593382][ C2] net_ratelimit: 422 callbacks suppressed [ 615.811269][T18816] ip6gre1: entered allmulticast mode [ 617.608555][ T44] kauditd_printk_skb: 144 callbacks suppressed [ 617.608567][ T44] audit: type=1800 audit(1791688385.986:2772): pid=18827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34480 res=0 errno=0 [ 617.608591][ T44] audit: type=1800 audit(1791688385.996:2773): pid=18828 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34503 res=0 errno=0 [ 617.737747][ T5926] usb 7-1: new full-speed USB device number 27 using dummy_hcd [ 618.736926][T18241] net_ratelimit: 51 callbacks suppressed [ 618.791407][ T5926] usb 7-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 618.794563][ T5926] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 618.794580][ T5926] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 618.794593][ T5926] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 618.796200][ T5926] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.796210][ T5926] usb 7-1: Product: syz [ 618.796217][ T5926] usb 7-1: Manufacturer: syz [ 618.796224][ T5926] usb 7-1: SerialNumber: syz [ 618.797523][ T5926] usb 7-1: config 0 descriptor?? [ 618.799237][ T44] audit: type=1800 audit(1791688387.246:2774): pid=18827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=209069 res=0 errno=0 [ 618.800416][T18825] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 618.803292][ T44] audit: type=1800 audit(1791688387.246:2775): pid=18827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=209101 res=0 errno=0 [ 618.805209][ T44] audit: type=1800 audit(1791688387.246:2776): pid=18827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=209076 res=0 errno=0 [ 618.805653][ T44] audit: type=1800 audit(1791688387.246:2777): pid=18827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=209077 res=0 errno=0 [ 620.627956][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 620.628054][ C0] bridge0: topology change detected, propagating [ 620.629265][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 620.629299][ C0] bridge0: topology change detected, propagating [ 620.899759][ T5926] rc_core: IR keymap rc-streamzap not found [ 620.899772][ T5926] Registered IR keymap rc-empty [ 620.900376][ T5926] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0 [ 620.906370][ T5926] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0/input29 [ 621.032093][ T44] audit: type=1800 audit(1791688389.476:2778): pid=18827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="manufacturer" dev="sysfs" ino=209098 res=0 errno=0 [ 621.032120][ T44] audit: type=1800 audit(1791688389.476:2779): pid=18827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="product" dev="sysfs" ino=209099 res=0 errno=0 [ 621.032139][ T44] audit: type=1800 audit(1791688389.476:2780): pid=18827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=209078 res=0 errno=0 [ 621.036181][ T44] audit: type=1800 audit(1791688389.476:2781): pid=18827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="serial" dev="sysfs" ino=209100 res=0 errno=0 [ 621.036608][ T5926] usb 7-1: USB disconnect, device number 27 [ 622.432579][T18861] input: syz0 as /devices/virtual/input/input30 [ 622.624660][ T44] kauditd_printk_skb: 2520 callbacks suppressed [ 622.624669][ T44] audit: type=1800 audit(1791688391.066:5302): pid=5151 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=4814 res=0 errno=0 [ 622.845056][T18861] xt_nfacct: accounting object `syz0' does not exist [ 623.286017][T18877] No source specified [ 623.828441][ T1176] net_ratelimit: 176 callbacks suppressed [ 623.849615][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.020965][T18887] kvm_do_msr_access: 3 callbacks suppressed [ 624.051407][T18871] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4118'. [ 624.593664][T18899] netlink: 'syz.5.4132': attribute type 1 has an invalid length. [ 624.593763][T18899] netlink: 'syz.5.4132': attribute type 2 has an invalid length. [ 624.593830][T18899] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4132'. [ 624.645804][T18903] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4133'. [ 625.133885][T18936] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4149'. [ 625.599021][T18962] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4160'. [ 625.686348][T18966] vivid-000: ================= START STATUS ================= [ 625.686358][T18966] vivid-000: Test Pattern: 75% Colorbar [ 625.686372][T18966] vivid-000: Fill Percentage of Frame: 100 [ 625.686384][T18966] vivid-000: Horizontal Movement: No Movement [ 625.686396][T18966] vivid-000: Vertical Movement: No Movement [ 625.686407][T18966] vivid-000: OSD Text Mode: All [ 625.686418][T18966] vivid-000: Show Border: false [ 625.686429][T18966] vivid-000: Show Square: false [ 625.686439][T18966] vivid-000: Sensor Flipped Horizontally: false [ 625.686449][T18966] vivid-000: Sensor Flipped Vertically: false [ 625.686460][T18966] vivid-000: Insert SAV Code in Image: false [ 625.686471][T18966] vivid-000: Insert EAV Code in Image: false [ 625.686481][T18966] vivid-000: Insert Video Guard Band: false [ 625.686492][T18966] vivid-000: Reduced Framerate: false [ 625.686503][T18966] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 625.686515][T18966] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 625.686527][T18966] vivid-000: Enable Capture Cropping: false [ 625.686537][T18966] vivid-000: Enable Capture Composing: true [ 625.686547][T18966] vivid-000: Enable Capture Scaler: true [ 625.686570][T18966] vivid-000: Timestamp Source: End of Frame [ 625.686581][T18966] vivid-000: Colorspace: sRGB [ 625.686590][T18966] vivid-000: Transfer Function: Default [ 625.686600][T18966] vivid-000: Y'CbCr Encoding: Default [ 625.686615][T18966] vivid-000: HSV Encoding: Hue 0-179 [ 625.686625][T18966] vivid-000: Quantization: Default [ 625.686636][T18966] vivid-000: Apply Alpha To Red Only: false [ 625.686646][T18966] vivid-000: Standard Aspect Ratio: 4x3 [ 625.686656][T18966] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 625.686669][T18966] vivid-000: DV Timings: 4096x2160p60 inactive [ 625.686683][T18966] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 625.686694][T18966] vivid-000: Maximum EDID Blocks: 2 [ 625.686705][T18966] vivid-000: Limited RGB Range (16-235): false [ 625.686716][T18966] vivid-000: Rx RGB Quantization Range: Automatic [ 625.686727][T18966] vivid-000: Power Present: 0x00000001 [ 625.686739][T18966] tpg source WxH: 320x180 (Luma) [ 625.686747][T18966] tpg field: 1 [ 625.686751][T18966] tpg crop: (0,0)/320x180 [ 625.686759][T18966] tpg compose: (0,0)/320x180 [ 625.686766][T18966] tpg colorspace: 8 [ 625.686771][T18966] tpg transfer function: 0/0 [ 625.686776][T18966] tpg quantization: 0/0 [ 625.686781][T18966] tpg RGB range: 0/2 [ 625.686786][T18966] vivid-000: ================== END STATUS ================== [ 626.025193][ T44] audit: type=1326 audit(2000000002.829:5303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18983 comm="syz.5.4171" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86fec code=0x7ffc0000 [ 626.025299][ T44] audit: type=1326 audit(2000000002.829:5304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18983 comm="syz.5.4171" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86fec code=0x7ffc0000 [ 626.026568][ T44] audit: type=1326 audit(2000000002.829:5305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18983 comm="syz.5.4171" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86fec code=0x7ffc0000 [ 626.026593][ T44] audit: type=1326 audit(2000000002.829:5306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18983 comm="syz.5.4171" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86fec code=0x7ffc0000 [ 626.026618][ T44] audit: type=1326 audit(2000000002.829:5307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18983 comm="syz.5.4171" exe="/syz-executor" sig=0 arch=40000003 syscall=228 compat=1 ip=0xf7f86fec code=0x7ffc0000 [ 626.026761][ T44] audit: type=1326 audit(2000000002.829:5308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18983 comm="syz.5.4171" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86fec code=0x7ffc0000 [ 626.026783][ T44] audit: type=1326 audit(2000000002.829:5309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18983 comm="syz.5.4171" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86fec code=0x7ffc0000 [ 626.026963][ T44] audit: type=1326 audit(2000000002.829:5310): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18983 comm="syz.5.4171" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf7f86fec code=0x7ffc0000 [ 626.027079][ T44] audit: type=1326 audit(2000000002.829:5311): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18983 comm="syz.5.4171" exe="/syz-executor" sig=0 arch=40000003 syscall=252 compat=1 ip=0xf7f86fec code=0x7ffc0000 [ 626.546104][T19005] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4179'. [ 626.546120][T19005] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4179'. [ 628.246766][T19032] ublk5: read batch cmd buffer failed [ 628.246857][T19032] ublk5: read batch cmd buffer failed [ 628.255951][T19032] ublk5: read batch cmd buffer failed [ 628.256038][T19032] ublk5: read batch cmd buffer failed [ 628.378677][ T44] audit: type=1800 audit(2000000005.189:5312): pid=19035 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=209664 res=0 errno=0 [ 628.950404][ T38] net_ratelimit: 171 callbacks suppressed [ 629.287652][T19045] libceph: resolve '1' (ret=-3): failed [ 629.495379][T19056] netlink: 'syz.1.4195': attribute type 4 has an invalid length. [ 629.496776][T19056] netlink: 'syz.1.4195': attribute type 4 has an invalid length. [ 630.439099][T19073] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4200'. [ 631.075312][T19088] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 633.987985][ T1176] net_ratelimit: 183 callbacks suppressed [ 635.320142][T17190] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 638.472657][ T44] audit: type=1804 audit(2000000015.279:5313): pid=19162 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.4231" name="bus" dev="ramfs" ino=57805 res=1 errno=0 [ 638.473199][ T44] audit: type=1804 audit(2000000015.279:5314): pid=19162 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.4231" name="bus" dev="ramfs" ino=57805 res=1 errno=0 [ 639.111429][ T600] net_ratelimit: 265 callbacks suppressed ** 19 printk messages dropped ** ** 128 printk messages dropped ** ** 135 printk messages dropped ** ** 129 printk messages dropped ** ** 190 printk messages dropped ** ** 135 printk messages dropped ** ** 126 printk messages dropped ** ** 128 printk messages dropped ** ** 128 printk messages dropped ** ** 136 printk messages dropped ** ** 126 printk messages dropped ** ** 136 printk messages dropped ** ** 152 printk messages dropped ** ** 118 printk messages dropped ** ** 127 printk messages dropped ** ** 179 printk messages dropped ** ** 129 printk messages dropped ** ** 150 printk messages dropped ** ** 127 printk messages dropped ** ** 126 printk messages dropped ** ** 314 printk messages dropped ** ** 132 printk messages dropped ** ** 127 printk messages dropped ** ** 131 printk messages dropped ** ** 132 printk messages dropped ** ** 127 printk messages dropped ** ** 127 printk messages dropped ** ** 66 printk messages dropped ** ** 121 printk messages dropped ** ** 129 printk messages dropped ** ** 129 printk messages dropped ** ** 126 printk messages dropped ** ** 132 printk messages dropped ** ** 129 printk messages dropped ** ** 124 printk messages dropped ** ** 173 printk messages dropped ** ** 118 printk messages dropped ** ** 127 printk messages dropped ** ** 127 printk messages dropped ** ** 130 printk messages dropped ** ** 147 printk messages dropped ** ** 126 printk messages dropped ** ** 136 printk messages dropped ** ** 58 printk messages dropped ** ** 23 printk messages dropped ** ** 135 printk messages dropped ** ** 127 printk messages dropped ** ** 61 printk messages dropped ** ** 11 printk messages dropped ** ** 16 printk messages dropped ** ** 119 printk messages dropped ** ** 29 printk messages dropped ** ** 1 printk messages dropped ** ** 47 printk messages dropped ** ** 14 printk messages dropped ** ** 19 printk messages dropped ** ** 10 printk messages dropped ** ** 102 printk messages dropped ** ** 4 printk messages dropped ** ** 33 printk messages dropped ** ** 4 printk messages dropped ** ** 106 printk messages dropped ** ** 9 printk messages dropped ** ** 11 printk messages dropped ** ** 157 printk messages dropped ** ** 162 printk messages dropped ** ** 130 printk messages dropped ** ** 145 printk messages dropped ** ** 127 printk messages dropped ** ** 128 printk messages dropped ** ** 134 printk messages dropped ** ** 129 printk messages dropped ** ** 444 printk messages dropped ** ** 130 printk messages dropped ** ** 139 printk messages dropped ** ** 127 printk messages dropped ** ** 128 printk messages dropped ** ** 140 printk messages dropped ** ** 246 printk messages dropped ** ** 127 printk messages dropped ** ** 157 printk messages dropped ** ** 128 printk messages dropped ** ** 129 printk messages dropped ** ** 128 printk messages dropped ** ** 127 printk messages dropped ** ** 127 printk messages dropped ** ** 35 printk messages dropped ** [ 644.313210][ T3626] net_ratelimit: 192 callbacks suppressed [ 647.979808][T19219] kcov: kcov_start: t = ffff8880253ecb00, size = 524288, area = ffffc9000d1d1000 [ 647.982094][T19219] [ 647.985809][T19219] ====================================================== [ 647.988050][T19219] WARNING: possible circular locking dependency detected [ 647.990242][T19219] syzkaller #0 Tainted: G L [ 647.992207][T19219] ------------------------------------------------------ [ 647.994597][T19219] syz.2.4249/19219 is trying to acquire lock: [ 647.996543][T19219] ffffffff90f54ae0 (nvmf_dev_mutex){+.+.}-{4:4}, at: nvmf_dev_show+0x26/0x210 [ 647.999404][T19219] [ 647.999404][T19219] but task is already holding lock: [ 648.001713][T19219] ffff888022e3d3b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 [ 648.004373][T19219] [ 648.004373][T19219] which lock already depends on the new lock. [ 648.004373][T19219] [ 648.007624][T19219] [ 648.007624][T19219] the existing dependency chain (in reverse order) is: [ 648.010439][T19219] [ 648.010439][T19219] -> #4 (&p->lock){+.+.}-{4:4}: [ 648.012691][T19219] lock_acquire+0x1d1/0x380 [ 648.014321][T19219] __mutex_lock+0x1a4/0x1bd0 [ 648.015953][T19219] seq_read_iter+0xe1/0x1270 [ 648.017567][T19219] kernfs_fop_read_iter+0x46c/0x610 [ 648.019388][T19219] __kernel_read+0x397/0xad0 [ 648.020989][T19219] integrity_kernel_read+0x7e/0xb0 [ 648.022773][T19219] ima_calc_file_hash_tfm+0x25e/0x350 [ 648.024754][T19219] ima_calc_file_hash+0x1e3/0x380 [ 648.026517][T19219] ima_collect_measurement+0x94f/0xb30 [ 648.028428][T19219] process_measurement+0xdfe/0x2350 [ 648.030222][T19219] ima_file_check+0xcc/0x120 [ 648.031850][T19219] security_file_post_open+0xc4/0x210 [ 648.033706][T19219] path_openat+0x5cd/0x2440 [ 648.035288][T19219] do_file_open+0x20e/0x430 [ 648.036876][T19219] do_sys_openat2+0x10f/0x1e0 [ 648.038528][T19219] __x64_sys_openat+0x12d/0x210 [ 648.040213][T19219] do_syscall_64+0x121/0x770 [ 648.041819][T19219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.042591][T19221] kcov: kcov_start: t = ffff8880262fa580, size = 524288, area = ffffc9000c6c1000 [ 648.046623][T19219] [ 648.046623][T19219] -> #3 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 648.048991][T19221] kcov: kcov_task_exit: t = ffff8880262fa580, kcov->t = ffff8880262fa580 [ 648.051887][T19219] lock_acquire+0x1d1/0x380 [ 648.053489][T19219] __mutex_lock+0x1a4/0x1bd0 [ 648.055111][T19219] process_measurement+0x5ab/0x2350 [ 648.056905][T19219] ima_file_check+0xcc/0x120 [ 648.058574][T19219] security_file_post_open+0xc4/0x210 [ 648.060445][T19219] path_openat+0x5cd/0x2440 [ 648.062041][T19219] do_file_open+0x20e/0x430 [ 648.063698][T19219] file_open_name+0x1c3/0x3e0 [ 648.065295][T19219] filp_open+0x2e/0x50 [ 648.066677][T19219] kernel_read_file_from_path_initns+0xec/0x240 [ 648.068855][T19219] _request_firmware+0x733/0x13c0 [ 648.070600][T19219] request_firmware+0x35/0x50 [ 648.072252][T19219] reg_reload_regdb+0x85/0x460 [ 648.073926][T19219] genl_family_rcv_msg_doit+0x214/0x300 [ 648.075889][T19219] genl_rcv_msg+0x560/0x800 [ 648.077487][T19219] netlink_rcv_skb+0x159/0x420 [ 648.079178][T19219] genl_rcv+0x28/0x40 [ 648.080627][T19219] netlink_unicast+0x585/0x850 [ 648.082288][T19219] netlink_sendmsg+0x8b0/0xda0 [ 648.083953][T19219] ____sys_sendmsg+0xa4d/0xbe0 [ 648.085637][T19219] ___sys_sendmsg+0x190/0x1e0 [ 648.087298][T19219] __sys_sendmsg+0x160/0x210 [ 648.088929][T19219] __do_fast_syscall_32+0x13a/0x8b0 [ 648.090714][T19219] do_fast_syscall_32+0x32/0x70 [ 648.092410][T19219] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 648.094578][T19219] [ 648.094578][T19219] -> #2 (cb_lock){++++}-{4:4}: [ 648.096756][T19219] lock_acquire+0x1d1/0x380 [ 648.098368][T19219] down_read+0x99/0x4c0 [ 648.099873][T19219] genl_release+0x7e/0x1d0 [ 648.101445][T19219] netlink_release+0x105e/0x2000 [ 648.103168][T19219] __sock_release+0xb3/0x260 [ 648.104829][T19219] sock_close+0x1c/0x30 [ 648.106350][T19219] __fput+0x400/0xb60 [ 648.107819][T19219] fput_close_sync+0x118/0x250 [ 648.109535][T19219] __x64_sys_close+0x8b/0x120 [ 648.111198][T19219] do_syscall_64+0x121/0x770 [ 648.112824][T19219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.114853][T19219] [ 648.114853][T19219] -> #1 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}: [ 648.117576][T19219] lock_acquire+0x1d1/0x380 [ 648.119198][T19219] down_write+0x8b/0x1f0 [ 648.120716][T19219] __sock_release+0x86/0x260 [ 648.122343][T19219] sock_close+0x1c/0x30 [ 648.123466][T19223] kcov: kcov_start: t = ffff888025212580, size = 524288, area = ffffc9000c6c1000 [ 648.126767][T19219] __fput+0x400/0xb60 [ 648.128226][T19219] __fput_sync+0xd7/0x100 [ 648.129639][T19223] nfc: nfc_genl_rcv_nl_event: NETLINK_URELEASE event from id 3498 [ 648.129831][T19030] nfc: nfc_urelease_event_work: portid 3498 [ 648.134114][T19219] nvme_tcp_alloc_queue.isra.0+0xd89/0x1630 [ 648.135598][T19222] nfc: nfc_genl_rcv_nl_event: NETLINK_URELEASE event from id 3498 [ 648.135827][T19030] nfc: nfc_urelease_event_work: portid 3498 [ 648.136652][T19223] kcov: kcov_task_exit: t = ffff888025212580, kcov->t = ffff888025212580 [ 648.143150][T19219] nvme_tcp_configure_admin_queue+0x26/0x530 [ 648.145194][T19219] nvme_tcp_setup_ctrl+0xa4/0xa20 [ 648.146960][T19219] nvme_tcp_create_ctrl+0x970/0xd90 [ 648.148764][T19219] nvmf_dev_write+0x4ee/0xb60 [ 648.150409][T19219] vfs_write+0x2aa/0x1050 [ 648.152007][T19219] ksys_write+0x12a/0x250 [ 648.153561][T19219] __do_fast_syscall_32+0x13a/0x8b0 [ 648.155355][T19219] do_fast_syscall_32+0x32/0x70 [ 648.157053][T19219] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 648.159238][T19219] [ 648.159238][T19219] -> #0 (nvmf_dev_mutex){+.+.}-{4:4}: [ 648.161594][T19219] check_prev_add+0xeb/0xe60 [ 648.163221][T19219] __lock_acquire+0x1528/0x1f40 [ 648.164915][T19219] lock_acquire+0x1d1/0x380 [ 648.166523][T19219] __mutex_lock+0x1a4/0x1bd0 [ 648.168157][T19219] nvmf_dev_show+0x26/0x210 [ 648.169794][T19219] seq_read_iter+0x32f/0x1270 [ 648.171460][T19219] seq_read+0x344/0x4d0 [ 648.172949][T19219] vfs_read+0x1e4/0xb40 [ 648.174752][T19219] ksys_read+0x12a/0x250 [ 648.176287][T19219] __do_fast_syscall_32+0x13a/0x8b0 [ 648.178084][T19219] do_fast_syscall_32+0x32/0x70 [ 648.179817][T19219] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 648.181972][T19219] [ 648.181972][T19219] other info that might help us debug this: [ 648.181972][T19219] [ 648.185053][T19219] Chain exists of: [ 648.185053][T19219] nvmf_dev_mutex --> &ima_iint_mutex_key[depth] --> &p->lock [ 648.185053][T19219] [ 648.189196][T19219] Possible unsafe locking scenario: [ 648.189196][T19219] [ 648.191543][T19219] CPU0 CPU1 [ 648.193269][T19219] ---- ---- [ 648.194962][T19219] lock(&p->lock); [ 648.196190][T19219] lock(&ima_iint_mutex_key[depth]); [ 648.198632][T19219] lock(&p->lock); [ 648.200614][T19219] lock(nvmf_dev_mutex); [ 648.201985][T19219] [ 648.201985][T19219] *** DEADLOCK *** [ 648.201985][T19219] [ 648.204506][T19219] locks held by syz.2.4249/19219: 1, last CPU#2: [ 648.206491][T19219] #0: ffff888022e3d3b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 [ 648.209279][T19219] [ 648.209279][T19219] stack backtrace: [ 648.211144][T19219] CPU: 2 UID: 0 PID: 19219 Comm: syz.2.4249 Tainted: G L syzkaller #0 PREEMPT(full) [ 648.214537][T19219] Tainted: [L]=SOFTLOCKUP [ 648.215937][T19219] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 648.219105][T19219] Call Trace: [ 648.220170][T19219] [ 648.221117][T19219] dump_stack_lvl+0x100/0x190 [ 648.221590][T19194] kcov: kcov_task_exit: t = ffff88802a98a580, kcov->t = ffff88802a98a580 [ 648.225201][T19219] print_circular_bug.cold+0x178/0x1be [ 648.226962][T19219] check_noncircular+0x146/0x160 [ 648.228554][T19219] check_prev_add+0xeb/0xe60 [ 648.230062][T19219] ? __lock_acquire+0x5c0/0x1f40 [ 648.231647][T19219] __lock_acquire+0x1528/0x1f40 [ 648.233204][T19219] ? seq_read+0x344/0x4d0 [ 648.234594][T19219] ? vfs_read+0x1e4/0xb40 [ 648.235974][T19219] lock_acquire+0x1d1/0x380 [ 648.237481][T19219] ? nvmf_dev_show+0x26/0x210 [ 648.238986][T19219] ? __pfx___might_resched+0x10/0x10 [ 648.240662][T19219] __mutex_lock+0x1a4/0x1bd0 [ 648.241464][T19225] kcov: kcov_start: t = ffff88801df84b00, size = 524288, area = ffffc9000c6c1000 [ 648.244952][T19219] ? nvmf_dev_show+0x26/0x210 [ 648.246474][T19219] ? nvmf_dev_show+0x26/0x210 [ 648.247992][T19219] ? __pfx___mutex_lock+0x10/0x10 [ 648.249599][T19219] ? __kasan_kmalloc+0xaa/0xb0 [ 648.251141][T19219] ? __kvmalloc_node_noprof+0x377/0x9b0 [ 648.252877][T19219] ? nvmf_dev_show+0x26/0x210 [ 648.254371][T19219] nvmf_dev_show+0x26/0x210 [ 648.255822][T19219] seq_read_iter+0x32f/0x1270 [ 648.257315][T19219] ? __pfx_try_to_wake_up+0x10/0x10 [ 648.258982][T19219] seq_read+0x344/0x4d0 [ 648.260355][T19219] ? __pfx_seq_read+0x10/0x10 [ 648.261861][T19219] ? common_file_perm+0x266/0x500 [ 648.263458][T19219] ? bpf_lsm_file_permission+0x9/0x10 [ 648.265085][T19219] ? security_file_permission+0x76/0x210 [ 648.266885][T19219] ? rw_verify_area+0xce/0x6d0 [ 648.268439][T19219] ? __pfx_seq_read+0x10/0x10 [ 648.269928][T19219] vfs_read+0x1e4/0xb40 [ 648.271148][T19187] kcov: kcov_task_exit: t = ffff88802a094b00, kcov->t = ffff88802a094b00 [ 648.271493][T19190] kcov: kcov_task_exit: t = ffff888025204b00, kcov->t = ffff888025204b00 [ 648.276497][T19219] ? lock_acquire+0x1d1/0x380 [ 648.277993][T19219] ? __fget_files+0x34/0x3d0 [ 648.279516][T19219] ? __pfx_vfs_read+0x10/0x10 [ 648.281028][T19219] ? find_held_lock+0x2b/0x80 [ 648.282531][T19219] ? __fget_files+0x215/0x3d0 [ 648.284037][T19219] ? __fget_files+0x215/0x3d0 [ 648.285541][T19219] ? __fget_files+0x21f/0x3d0 [ 648.287078][T19219] ksys_read+0x12a/0x250 [ 648.288459][T19219] ? __pfx_ksys_read+0x10/0x10 [ 648.289997][T19219] __do_fast_syscall_32+0x13a/0x8b0 [ 648.291650][T19219] do_fast_syscall_32+0x32/0x70 [ 648.293142][T19219] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 648.295177][T19219] RIP: 0023:0xf73fefec [ 648.296488][T19219] Code: Unable to access opcode bytes at 0xf73fefc2. [ 648.298574][T19219] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 648.301193][T19219] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000800 [ 648.303661][T19219] RDX: 0000000000002020 RSI: 0000000000000000 RDI: 0000000000000000 [ 648.306121][T19219] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 648.308602][T19219] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 648.311060][T19219] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 648.313552][T19219] [ 648.315026][ C2] wireguard: wg2: Handshake for peer 18 (127.0.0.1:20002) did not complete after 5 seconds, retrying (try 5) [ 648.315274][ C2] bridge0: hello timer expired [ 648.350135][T19227] kcov: kcov_start: t = ffff888025334b00, size = 524288, area = ffffc9000d5d2000 [ 648.350184][T19227] MPTCP: sched=default [ 648.351067][T19227] MPTCP: subflow=ffff88802557cc00 [ 648.351077][T19227] MPTCP: subflow=ffff88802557cc00, family=10 [ 648.351085][T19227] MPTCP: subflow=ffff88802557cc00 [ 648.351115][T19227] MPTCP: ssk=ffff888070cdb600, local_key=14262943405051038092, token=3969168540, idsn=17490901175811042048 [ 648.351917][T19226] MPTCP: msk=ffff88807693f2c0 state=7 [ 648.351927][T19226] MPTCP: msk=ffff88807693f2c0 [ 648.351934][T19226] MPTCP: msk=ffff88807693f2c0 [ 648.351980][T19226] MPTCP: msk=ffff88807693f2c0 [ 648.352094][T19227] kcov: kcov_task_exit: t = ffff888025334b00, kcov->t = ffff888025334b00 [ 648.502570][T19219] kcov: kcov_task_exit: t = ffff8880253ecb00, kcov->t = ffff8880253ecb00 [ 648.732977][T19217] kcov: kcov_task_exit: t = ffff888024d6cb00, kcov->t = ffff888024d6cb00 [ 648.733144][T19214] kcov: kcov_task_exit: t = ffff88802a58cb00, kcov->t = ffff88802a58cb00 [ 648.787599][ C2] wireguard: wg0: Handshake for peer 25 ([::1]:20002/0%0) did not complete after 5 seconds, retrying (try 2) [ 648.787672][ C2] wireguard: wg2: Handshake for peer 17 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 7) [ 648.821882][T19225] kcov: kcov_task_exit: t = ffff88801df84b00, kcov->t = ffff88801df84b00 [ 648.868051][ C0] syzkaller0: no route to 127.0.0.1 [ 649.097821][ T5790] bond1: (slave veth3): Send learning packet: mac 32:40:ab:b3:81:45 vlan 0 [ 649.267634][ C2] bridge0: port 1(bridge_slave_0) hold timer expired [ 649.267663][ C2] bridge0: port 2(bridge_slave_1) hold timer expired [ 649.908209][ C0] syzkaller0: no route to 127.0.0.1 [ 650.067556][ C0] wireguard: wg0: Handshake for peer 13 ([::1]:20002/0%0) did not complete after 5 seconds, retrying (try 2) [ 650.067904][ T38] net_ratelimit: 196 callbacks suppressed [ 650.067957][ T38] wireguard: wg0: Sending handshake initiation to peer 13 ([::1]:20002/0%0) [ 650.068514][ T38] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:0000:0001, type=16, ifindex=8) => 00000000 [ 650.068606][ T38] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:ac14:14aa, type=128, ifindex=8) => 00000003 [ 650.068673][ T38] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:ac14:140b, type=128, ifindex=8) => 00000003 [ 650.068742][ T38] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:ac14:140a, type=128, ifindex=8) => 00000003 [ 650.068811][ T38] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:7f00:0001, type=128, ifindex=8) => 00000003 [ 650.197698][ T8788] bond1: (slave veth3): Send learning packet: mac 32:40:ab:b3:81:45 vlan 0 [ 650.307586][ C2] bridge0: hello timer expired [ 650.707575][ C2] wireguard: wg2: Handshake for peer 29 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 12) [ 650.707642][ C2] wireguard: wg2: Handshake for peer 30 (127.0.0.1:20002) did not complete after 5 seconds, retrying (try 12) [ 650.707805][ T3626] wireguard: wg2: Sending handshake initiation to peer 29 ([::1]:20001/0%0) [ 650.707909][ T600] wireguard: wg2: Sending handshake initiation to peer 30 (127.0.0.1:20002) [ 650.708045][ T600] wireguard: wg2: No route to 127.0.0.1:20002, error -101 [ 650.708290][ T3626] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:0000:0001, type=16, ifindex=0) => 00000000 [ 650.947832][ C0] syzkaller0: no route to 127.0.0.1 [ 651.267570][ C2] bridge0: port 1(bridge_slave_0) hold timer expired [ 651.267588][ C2] bridge0: port 2(bridge_slave_1) hold timer expired [ 651.297724][T18789] bond1: (slave veth3): Send learning packet: mac 32:40:ab:b3:81:45 vlan 0 [ 651.987591][ C2] wireguard: wg1: Handshake for peer 28 ([::1]:52458/0%0) did not complete after 5 seconds, retrying (try 12) [ 651.987719][ C2] wireguard: wg0: Handshake for peer 14 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 2) [ 651.987919][ C0] syzkaller0: no route to 127.0.0.1 [ 652.307617][ C2] bridge0: hello timer expired [ 652.399312][ T8788] bond1: (slave veth3): Send learning packet: mac 32:40:ab:b3:81:45 vlan 0 [ 652.627572][ C2] wireguard: wg1: Handshake for peer 27 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 12) [ 653.028211][ C0] syzkaller0: no route to 127.0.0.1 [ 653.267876][ C2] bridge0: port 1(bridge_slave_0) hold timer expired [ 653.267902][ C2] bridge0: port 2(bridge_slave_1) hold timer expired [ 653.498643][ T5790] bond1: (slave veth3): Send learning packet: mac 32:40:ab:b3:81:45 vlan 0 [ 653.907605][ C2] wireguard: wg2: Handshake for peer 18 (127.0.0.1:20002) did not complete after 5 seconds, retrying (try 6) [ 654.067801][ C0] syzkaller0: no route to 127.0.0.1 [ 654.307614][ C2] bridge0: hello timer expired [ 654.547574][ C2] wireguard: wg0: Handshake for peer 25 ([::1]:20002/0%0) did not complete after 5 seconds, retrying (try 2) [ 654.547625][ C2] wireguard: wg2: Handshake for peer 17 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 8) [ 654.598093][ T8788] bond1: (slave veth3): Send learning packet: mac 32:40:ab:b3:81:45 vlan 0 [ 655.107893][ C0] syzkaller0: no route to 127.0.0.1 [ 655.187557][ C0] wireguard: wg0: Handshake for peer 13 ([::1]:20002/0%0) did not complete after 5 seconds, retrying (try 2) [ 655.188748][ T1176] net_ratelimit: 183 callbacks suppressed [ 655.188802][ T1176] wireguard: wg0: Sending handshake initiation to peer 13 ([::1]:20002/0%0) [ 655.189319][ T1176] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:0000:0001, type=16, ifindex=8) => 00000000 [ 655.189390][ T1176] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:ac14:14aa, type=128, ifindex=8) => 00000003 [ 655.189481][ T1176] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:ac14:140b, type=128, ifindex=8) => 00000003 [ 655.189550][ T1176] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:ac14:140a, type=128, ifindex=8) => 00000003 [ 655.189619][ T1176] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:7f00:0001, type=128, ifindex=8) => 00000003 [ 655.267610][ C2] bridge0: port 1(bridge_slave_0) hold timer expired [ 655.267630][ C2] bridge0: port 2(bridge_slave_1) hold timer expired [ 655.699547][ T5790] bond1: (slave veth3): Send learning packet: mac 32:40:ab:b3:81:45 vlan 0 [ 655.827561][ C0] bridge0: topo change timer expired [ 655.827690][ C0] bridge0: restoring ageing time to 30000 [ 656.148207][ C0] syzkaller0: no route to 127.0.0.1 [ 656.307578][ C2] bridge0: hello timer expired [ 656.467568][ C2] wireguard: wg2: Handshake for peer 30 (127.0.0.1:20002) did not complete after 5 seconds, retrying (try 13) [ 656.467577][ C0] wireguard: wg2: Handshake for peer 29 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 13) [ 656.468096][ T600] wireguard: wg2: Sending handshake initiation to peer 30 (127.0.0.1:20002) [ 656.468621][ T600] wireguard: wg2: No route to 127.0.0.1:20002, error -101 [ 656.468726][ T600] wireguard: wg2: Sending handshake initiation to peer 29 ([::1]:20001/0%0) [ 656.469176][ T600] ipv6_addr_label(addr=0000:0000:0000:0000:0000:0000:0000:0001, type=16, ifindex=0) => 00000000 [ 656.798184][ T12] bond1: (slave veth3): Send learning packet: mac 32:40:ab:b3:81:45 vlan 0 [ 657.187744][ C0] syzkaller0: no route to 127.0.0.1 [ 657.267674][ C2] bridge0: port 1(bridge_slave_0) hold timer expired [ 657.267701][ C2] bridge0: port 2(bridge_slave_1) hold timer expired [ 657.747564][ C0] wireguard: wg1: Handshake for peer 28 ([::1]:52458/0%0) did not complete after 5 seconds, retrying (try 13) [ 657.747591][ C2] wireguard: wg0: Handshake for peer 14 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 2) [ 657.897947][ T12] bond1: (slave veth3): Send learning packet: mac 32:40:ab:b3:81:45 vlan 0