last executing test programs: 29.002387223s ago: executing program 3 (id=53): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) preadv2(r1, &(0x7f0000000200)=[{&(0x7f0000000500)=""/61, 0x3d}], 0x1, 0x40, 0x4, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000002280)=[{{&(0x7f00000001c0)=@un=@file={0x1, './file0\x00'}, 0x80, 0x0, 0x0, 0x0, 0x38}}], 0x1, 0xc000) 28.744091324s ago: executing program 3 (id=56): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040), 0x10) listen(r0, 0x0) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) shutdown(r1, 0x1) accept4$vsock_stream(r0, &(0x7f0000000400)={0x28, 0x0, 0x2710, @host}, 0x10, 0x80000) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f, 0xfffffffffffffffe, 0xe, 0x0, 0x7, 0x4, 0x0, 0xfffffffffffffffc}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) 28.594662662s ago: executing program 3 (id=58): r0 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x8001, @empty, 0xffffff5d}, 0x1c) listen(r0, 0x50) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0xe23, 0x5, @empty, 0x4}, 0x1c) listen(r1, 0x50) close(0x4) 28.515277391s ago: executing program 3 (id=60): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0x3, 0x7fff0001}]}) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket(0xa, 0x5, 0x0) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @rand_addr=0x64010100}, 0x10) ptrace(0x10, r0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r0, 0xffffffffffffffa8, &(0x7f0000000040)={0x1}) 27.634135094s ago: executing program 3 (id=68): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = open(&(0x7f00000002c0)='.\x00', 0x101800, 0x1d2) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 27.538973694s ago: executing program 3 (id=71): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @rand_addr=0x64010100}, 0x10) listen(r0, 0x6) r1 = accept4(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000040)="00af", 0x2) sendto$inet6(r1, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x2}, 0x8) close(r1) 12.285010089s ago: executing program 32 (id=71): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @rand_addr=0x64010100}, 0x10) listen(r0, 0x6) r1 = accept4(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000040)="00af", 0x2) sendto$inet6(r1, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x2}, 0x8) close(r1) 4.121820309s ago: executing program 4 (id=344): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {}, {0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x8ba4, 0x3, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x31, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 3.938120083s ago: executing program 4 (id=347): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000640)='\xf0\x891\xb8R\xe6\x8d\x12\xe5\xe3+\xcd24\x01\x80\x1a\xc9A\x93\xb1@\xbf\x89K\xd0\x86\xd9\x86\x18\xc4:\xc3\xe0\xac\xed~\x97\a\xbe\xfb\v1d\xbe\xa1\xc1N\xd2p\xf0\xc6\xf3\x8eD\x1b\xc7q\x99?9\xf1\xe6\f\xa9\x90\xec:\x037\xe8\x0f\rX6\xf2\x88\x8d\r\xd2\xfc+\x19\x9a}\x9c\xd9\x1a\xef\xf1\x16d>ah\xa2\xa7\x02U\x06\xe1\xe1PY\x90\x17\xf0p\x01*!I\xd3$\xd00C\x88*NA\xc3\x95`\xb2\xf1\xb1\xed\x91\xe4\x87\xcf_9\x1eIpAfN\x99\xa9\v)\x98p\xea[\xc5&D\xe7\xf3\xba/\xcd\xdb\x9dz\xb2\xbf\xc6\xea?\x13(\x15\xc1\tm\xe7t,[\x14|bM\xfa\xeb\x91\xb0\xdfAR\xf3\xe2', &(0x7f0000000300)='\x01\x0e!5\xd8\xf2\x92\x97\x86\xf9\xa8\xe7;\xdff3\x83\xb1a\xc9\xe1\x90\x10@\x1chOK\x98\xae\xd6>\xbaN\x1d_N\xcbdIP2$\xbc\xc9\x89\xb5\n\x90-i%\xe2\x94\fH\xf1\xed\r\b\x17\x81>\t\xc30-\xe2\xb3\xb00x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) 3.614539196s ago: executing program 4 (id=352): r0 = open(0x0, 0x0, 0x109) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) fremovexattr(r0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0) 2.820742618s ago: executing program 1 (id=364): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) ftruncate(r0, 0x4000000) r1 = syz_open_dev$loop(&(0x7f0000000100), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) pwrite64(r1, &(0x7f0000001000)="50146fe097739d2d08000000000000000000000000000000c68573f64e1a45ca8265f57f48ba6d8101010101010101010101010101010101020202020202020202020202020202020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000080080000100000000000000010001000100000000000000", 0xd8, 0x1000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/fs/bcache/register\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='/dev/loop0\x00', 0xb) 2.729349069s ago: executing program 1 (id=366): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r2 = accept4(r0, 0x0, 0x0, 0x0) sendto(r2, &(0x7f0000000180)='+', 0x1, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000005cc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004400)=""/211, 0xd3}}, {{0x0, 0x0, &(0x7f0000004600), 0x2}}, {{0x0, 0x0, &(0x7f0000005c40)=[{0x0, 0x7}], 0x1}}], 0x3, 0x0, &(0x7f0000005ec0)={0x0, 0x3938700}) recvfrom(r1, &(0x7f0000000000)=""/44, 0x2c, 0x0, 0x0, 0x0) 2.703447125s ago: executing program 1 (id=367): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r2, &(0x7f0000000080)='system.posix_acl_default\x00', 0x0, 0x0, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 2.680673741s ago: executing program 0 (id=368): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x9801}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}]}, 0x34}}, 0x0) sendto$packet(r0, &(0x7f0000000400)="05d936277c6f5422007f83477ca1", 0x5ea, 0x40880, &(0x7f0000000200)={0x11, 0x86dd, r3, 0x1, 0x4, 0x6, @local}, 0x14) 2.590126584s ago: executing program 0 (id=369): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, 0x0, 0x50) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3", 0x8}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {0x0}], 0x3, &(0x7f0000000380)=[@op={0x10, 0x117, 0x3, 0x1}], 0x10}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8923, &(0x7f00000000c0)={'lo\x00', @random="01320136b1ff"}) 2.54671631s ago: executing program 1 (id=371): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r1 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r1, 0xe) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000002, 0x401, 0x4}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x18c6}, 0x0, 0x0) 2.483430073s ago: executing program 0 (id=373): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000040)={0x6, "152a44e3112c0000f5a82d86c200000000000000000000000000000800"}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000080), 0x8100, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x8, 0x4, 0x8b, 0xfffa}, 0x1d, [0x7ffe, 0xc95a, 0x1, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x6, 0x4, 0x8, 0x4, 0x3c5b, 0x1, 0x3, 0x9, 0x1, 0x1f461e2c, 0xf, 0xe660, 0x4, 0x7, 0x101, 0x7fff, 0x1, 0x80000000, 0x4, 0x3, 0xe, 0xfffffffb, 0x71, 0xfffffff8, 0x7, 0x0, 0x0, 0x4, 0x80003e, 0x8f, 0x4, 0x10000006, 0x0, 0x5, 0x4, 0x8, 0x0, 0x2, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x1, 0xffff, 0x134, 0x7ffe, 0x9, 0xfffffff3, 0x129432e6, 0xcb, 0x6, 0xd, 0x2bf, 0x6c9, 0x9, 0x6, 0x3, 0x0, 0x7, 0x5, 0x0, 0xe, 0x312, 0x74, 0xea4, 0x0, 0x4, 0x4, 0x8000, 0x3, 0x400, 0x5, 0x6, 0x7, 0xff, 0x5, 0x5, 0x5f31, 0x4, 0x0, 0x2, 0x100002, 0xb, 0x4, 0x9, 0x8, 0x800, 0x6, 0x7, 0x8002, 0x1, 0xfe000000, 0xff7f, 0x2, 0x7f, 0x9, 0x2, 0xffffffff, 0x9, 0x1, 0x7, 0x80000003, 0x9, 0x48c93690, 0x42, 0x7], [0x400, 0x4, 0x0, 0x5, 0xfffffffe, 0xfffff76b, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x83, 0x80000003, 0x200009, 0x100003e7, 0x9, 0x5, 0x3, 0x2, 0xf38, 0x8, 0x4, 0x6d01, 0x5, 0x38, 0x800003, 0x200, 0x80, 0xf, 0xd, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0x4, 0x6, 0xac8, 0x5, 0x2, 0x3, 0x7ff, 0xfffffffc, 0x2, 0x4, 0xffff, 0x0, 0x1a, 0x1c, 0x120000, 0x3, 0x808, 0x8aaed, 0x4, 0x7], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0x20000ce7, 0x1ff, 0x2, 0xf58, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7ffe, 0x80000000, 0x200a620, 0x2, 0xc, 0x1, 0x4, 0x14c, 0x60a7, 0xe, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0x5, 0xee1, 0xfffff000, 0xffff, 0x3, 0x7f, 0x104, 0x9606, 0x7, 0x2, 0x4, 0x8006, 0x1, 0x0, 0x4, 0x8, 0x30b1d693, 0xa1f, 0x8, 0x7, 0x1, 0x6c1b, 0x2, 0x4, 0xb0b2748, 0x1, 0x1, 0x200, 0xffbf2441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 2.483078737s ago: executing program 0 (id=374): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000a80)={'syz1\x00', {0x5, 0x1, 0x0, 0x1000}, 0x0, [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x4001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x6, 0xd127, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x816, 0x8, 0x0, 0xfffffffc, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x5, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x1001f, 0x0, 0x4, 0x0, 0x4, 0x0, 0x42ac, 0x10, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xe43, 0x0, 0xfffffffd, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4], [0xfffffffe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x400000, 0x0, 0x4, 0x0, 0x7c45, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x81, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x526d, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0xfffffffe, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x1, 0xfffffffd, 0x0, 0x0, 0x0, 0xff, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffff7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x956, 0x0, 0x1]}, 0x45c) ioctl$UI_SET_RELBIT(r1, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x2) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_DEV_CREATE(r1, 0x5501) close_range(r0, 0xffffffffffffffff, 0x0) 2.304593019s ago: executing program 4 (id=376): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, 0x0, 0x4000) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x8000, 0x6, 0x300, 0xfc}, 0x10) mmap(&(0x7f0000000000/0x30000)=nil, 0x30000, 0x3, 0x11, r0, 0x0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r3, &(0x7f0000000210)="01", 0x1) read(r2, &(0x7f0000000000)=""/8, 0x8) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x11, 0x0, 0x1, 0x1, 0x0, 0x0}, 0x14) 2.241740787s ago: executing program 0 (id=378): bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000092870000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70200001400a400b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000084000000b70000000000000095"], &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x3a, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r3, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000005c0)={r4, r0, 0x3a, 0x0, @val=@tcx={@void, @value=r0}}, 0x1c) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0800}]}) close_range(r5, 0xffffffffffffffff, 0x0) 2.241525752s ago: executing program 4 (id=379): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x2, 0x0) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000800)=0x3) 2.174543853s ago: executing program 0 (id=382): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0xfffffe14) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f0000000400)='./file0\x00', 0xc02) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x8, 0xffffffffd24b2432, 0x83, 0xffff, 0x0, 0xabe6, 0x0, 0x0, 0x80, 0x8001}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) 1.620183285s ago: executing program 1 (id=384): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a40)={0x14, 0x21, 0x9, 0x2, 0x25dfdbff, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x48, r4, 0x1, 0x70bd2b, 0x1000, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x122}]}, 0x48}}, 0x400400c) write$char_usb(r0, 0x0, 0x0) 1.154320397s ago: executing program 2 (id=385): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a000000050000000200000004"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70200000100000085000000a000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x41, 0x0}, 0x10) 1.127038702s ago: executing program 2 (id=386): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000240), 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mbind(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x4, 0x3) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x12, &(0x7f00000001c0)=0x2, 0x1) 783.59872ms ago: executing program 2 (id=387): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x400c6314, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 702.748247ms ago: executing program 2 (id=388): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r4 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0x6}, {0xffe0, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x48800}, 0x4050) 555.159006ms ago: executing program 2 (id=389): r0 = socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) vmsplice(r3, &(0x7f0000000540)=[{&(0x7f00000003c0)="16", 0x1}], 0x1, 0x5) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r2, 0x0, r4, 0x0, 0x6, 0xc) ioctl$FIONREAD(r3, 0x541b, &(0x7f00000002c0)) close_range(r0, 0xffffffffffffffff, 0x0) 304.814759ms ago: executing program 2 (id=390): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1a33d6355871a5dd}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r1) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) 0s ago: executing program 1 (id=391): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_configfs/usb_gadget/g1\x00', 0x3b) mkdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000400)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000240)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1f7) openat(0xffffffffffffff9c, &(0x7f0000001500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x800, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:37736' (ED25519) to the list of known hosts. [ 48.667848][ T5722] cgroup: Unknown subsys name 'net' [ 48.820137][ T5722] cgroup: Unknown subsys name 'cpuset' [ 48.826846][ T5722] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 49.933054][ T5722] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 54.251680][ T5739] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 54.259737][ T5748] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 54.263212][ T5747] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 54.267603][ T5747] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 54.272462][ T5747] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 54.273505][ T5748] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 54.276621][ T5747] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 54.276999][ T5750] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 54.277572][ T5750] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 54.278322][ T5750] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 54.278666][ T5750] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 54.282324][ T5751] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 54.288513][ T5748] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 54.290776][ T5751] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 54.293558][ T63] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 54.294153][ T5748] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 54.295038][ T5748] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 54.296436][ T5751] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 54.297292][ T5748] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 54.302218][ T63] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 55.058900][ T5740] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.063239][ T5740] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.066923][ T5740] bridge_slave_0: entered allmulticast mode [ 55.071512][ T5740] bridge_slave_0: entered promiscuous mode [ 55.107638][ T5740] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.110420][ T5740] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.113402][ T5740] bridge_slave_1: entered allmulticast mode [ 55.117272][ T5740] bridge_slave_1: entered promiscuous mode [ 55.196665][ T5740] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.214111][ T5745] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.217374][ T5745] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.220512][ T5745] bridge_slave_0: entered allmulticast mode [ 55.224460][ T5745] bridge_slave_0: entered promiscuous mode [ 55.230518][ T5740] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.260578][ T5745] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.263250][ T5745] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.267112][ T5745] bridge_slave_1: entered allmulticast mode [ 55.270125][ T5745] bridge_slave_1: entered promiscuous mode [ 55.345638][ T5737] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.348582][ T5737] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.351394][ T5737] bridge_slave_0: entered allmulticast mode [ 55.355926][ T5737] bridge_slave_0: entered promiscuous mode [ 55.362019][ T5740] team0: Port device team_slave_0 added [ 55.365978][ T5740] team0: Port device team_slave_1 added [ 55.374521][ T5745] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.378281][ T5737] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.380640][ T5737] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.383181][ T5737] bridge_slave_1: entered allmulticast mode [ 55.386147][ T5737] bridge_slave_1: entered promiscuous mode [ 55.415746][ T5745] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.446702][ T5737] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.450885][ T5740] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.454340][ T5740] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 55.462749][ T5740] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.467450][ T5736] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.470891][ T5736] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.474188][ T5736] bridge_slave_0: entered allmulticast mode [ 55.478181][ T5736] bridge_slave_0: entered promiscuous mode [ 55.483067][ T5736] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.486306][ T5736] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.489529][ T5736] bridge_slave_1: entered allmulticast mode [ 55.493781][ T5736] bridge_slave_1: entered promiscuous mode [ 55.498614][ T5745] team0: Port device team_slave_0 added [ 55.509897][ T5737] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.513822][ T5740] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.516755][ T5740] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 55.526246][ T5740] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 55.545301][ T5745] team0: Port device team_slave_1 added [ 55.603274][ T5736] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.608443][ T5737] team0: Port device team_slave_0 added [ 55.611948][ T5737] team0: Port device team_slave_1 added [ 55.614395][ T5745] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.617082][ T5745] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 55.627006][ T5745] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.632672][ T5736] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.676350][ T5745] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.679188][ T5745] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 55.689005][ T5745] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 55.709201][ T5740] hsr_slave_0: entered promiscuous mode [ 55.712373][ T5740] hsr_slave_1: entered promiscuous mode [ 55.722250][ T5736] team0: Port device team_slave_0 added [ 55.724739][ T5737] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.727035][ T5737] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 55.736736][ T5737] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.742320][ T5737] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.744617][ T5737] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 55.753825][ T5737] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 55.773082][ T5736] team0: Port device team_slave_1 added [ 55.847658][ T5745] hsr_slave_0: entered promiscuous mode [ 55.850327][ T5745] hsr_slave_1: entered promiscuous mode [ 55.852900][ T5745] debugfs: 'hsr0' already exists in 'hsr' [ 55.855108][ T5745] Cannot create hsr debugfs directory [ 55.858084][ T5736] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.860531][ T5736] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 55.869838][ T5736] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.895054][ T5737] hsr_slave_0: entered promiscuous mode [ 55.897733][ T5737] hsr_slave_1: entered promiscuous mode [ 55.900400][ T5737] debugfs: 'hsr0' already exists in 'hsr' [ 55.902927][ T5737] Cannot create hsr debugfs directory [ 55.906025][ T5736] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.908831][ T5736] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 55.919244][ T5736] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.114602][ T5736] hsr_slave_0: entered promiscuous mode [ 56.118258][ T5736] hsr_slave_1: entered promiscuous mode [ 56.121226][ T5736] debugfs: 'hsr0' already exists in 'hsr' [ 56.123609][ T5736] Cannot create hsr debugfs directory [ 56.321044][ T5740] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 56.330639][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 56.336856][ T5739] Bluetooth: hci2: command tx timeout [ 56.336987][ T5744] Bluetooth: hci3: command tx timeout [ 56.337297][ T5748] Bluetooth: hci0: command tx timeout [ 56.341282][ T5740] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 56.342405][ T63] Bluetooth: hci1: command tx timeout [ 56.350498][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 56.353295][ T5740] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 56.359137][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 56.372342][ T5740] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 56.380593][ T5740] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 56.451348][ T5745] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 56.456372][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 56.459912][ T5745] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 56.466801][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 56.474688][ T5745] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 56.482006][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 56.485751][ T5745] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 56.494650][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 56.554765][ T5736] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 56.561582][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 56.565515][ T5736] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 56.572511][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 56.576470][ T5736] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 56.583140][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 56.589597][ T5736] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 56.595509][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 56.672622][ T5740] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.676691][ T5737] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 56.684089][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 56.688162][ T5737] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 56.694441][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 56.701732][ T5737] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 56.708027][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 56.712670][ T5737] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 56.719615][ T5737] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 56.760170][ T5740] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.785791][ T173] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.788672][ T173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.793015][ T173] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.795328][ T173] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.815643][ T5745] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.873040][ T5736] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.880189][ T5745] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.897404][ T173] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.900048][ T173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.914204][ T173] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.916790][ T173] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.933345][ T5736] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.946670][ T173] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.948976][ T173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.967291][ T5737] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.979068][ T173] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.982265][ T173] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.034679][ T5737] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.046036][ T173] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.049413][ T173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.067132][ T173] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.069656][ T173] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.429764][ T5740] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.471376][ T5745] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.488422][ T5736] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.515465][ T5740] veth0_vlan: entered promiscuous mode [ 57.531456][ T5740] veth1_vlan: entered promiscuous mode [ 57.567347][ T5737] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.599131][ T5745] veth0_vlan: entered promiscuous mode [ 57.608887][ T5736] veth0_vlan: entered promiscuous mode [ 57.623048][ T5736] veth1_vlan: entered promiscuous mode [ 57.628114][ T5745] veth1_vlan: entered promiscuous mode [ 57.651436][ T5740] veth0_macvtap: entered promiscuous mode [ 57.658068][ T5740] veth1_macvtap: entered promiscuous mode [ 57.690376][ T5740] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.706904][ T5736] veth0_macvtap: entered promiscuous mode [ 57.711259][ T5745] veth0_macvtap: entered promiscuous mode [ 57.719334][ T5737] veth0_vlan: entered promiscuous mode [ 57.726690][ T5740] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.736126][ T5736] veth1_macvtap: entered promiscuous mode [ 57.747476][ T5745] veth1_macvtap: entered promiscuous mode [ 57.778235][ T5737] veth1_vlan: entered promiscuous mode [ 57.795000][ T5745] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.813005][ T5736] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.820144][ T5745] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.832885][ T5736] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.863740][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.866231][ T5788] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.867148][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.871198][ T5788] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.926533][ T5788] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.932099][ T1169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.934407][ T5737] veth0_macvtap: entered promiscuous mode [ 57.935797][ T1169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.989260][ T5737] veth1_macvtap: entered promiscuous mode [ 58.007525][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.031188][ T1169] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.034544][ T1169] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.042127][ T5737] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 58.051056][ T5740] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 58.062756][ T231] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.064389][ T5737] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 58.065695][ T231] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.084800][ T5740] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 58.086188][ T5815] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.094061][ T5740] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 58.104497][ T5740] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 58.119351][ T5740] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 58.119866][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.128626][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.161490][ T103] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.166110][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.171437][ T103] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.216117][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.276221][ T5815] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.283062][ T1169] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.288556][ T1169] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.313076][ T173] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.322385][ T173] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.366052][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.369230][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.386516][ T5788] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.391423][ T5788] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.406262][ T63] Bluetooth: hci3: command tx timeout [ 58.408083][ T63] Bluetooth: hci2: command tx timeout [ 58.410067][ T5744] Bluetooth: hci0: command tx timeout [ 58.410090][ T5744] Bluetooth: hci1: command tx timeout [ 58.426924][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.436507][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.439727][ T5893] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2'. [ 58.443453][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.453643][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.520559][ T5898] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7'. [ 58.728872][ T5911] syz.3.11 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 58.733106][ T5911] CPU: 2 UID: 0 PID: 5911 Comm: syz.3.11 Not tainted syzkaller #0 PREEMPT(full) [ 58.733132][ T5911] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 58.733143][ T5911] Call Trace: [ 58.733163][ T5911] [ 58.733171][ T5911] dump_stack_lvl+0x100/0x190 [ 58.733205][ T5911] dump_header+0xfb/0x606 [ 58.733228][ T5911] oom_kill_process.cold+0xd/0x330 [ 58.733250][ T5911] out_of_memory+0x340/0x14f0 [ 58.733276][ T5911] ? __pfx_out_of_memory+0x10/0x10 [ 58.733329][ T5911] mem_cgroup_out_of_memory+0xc6/0x130 [ 58.733354][ T5911] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 58.733375][ T5911] ? find_held_lock+0x2b/0x80 [ 58.733405][ T5911] ? do_raw_spin_unlock+0x145/0x1e0 [ 58.733426][ T5911] ? _raw_spin_unlock+0x28/0x50 [ 58.733451][ T5911] try_charge_memcg+0x6e5/0xdf0 [ 58.733480][ T5911] ? __pfx_try_charge_memcg+0x10/0x10 [ 58.733502][ T5911] ? find_held_lock+0x2b/0x80 [ 58.733521][ T5911] ? rcu_read_unlock+0x17/0x60 [ 58.733543][ T5911] ? rcu_read_unlock+0x17/0x60 [ 58.733573][ T5911] __memcg_slab_post_alloc_hook+0x469/0x1160 [ 58.733604][ T5911] ? kasan_save_track+0x14/0x30 [ 58.733628][ T5911] kmem_cache_alloc_lru_noprof+0x583/0x6a0 [ 58.733651][ T5911] ? hugetlbfs_alloc_inode+0x8c/0x1d0 [ 58.733678][ T5911] hugetlbfs_alloc_inode+0x8c/0x1d0 [ 58.733698][ T5911] ? __pfx_hugetlbfs_alloc_inode+0x10/0x10 [ 58.733717][ T5911] alloc_inode+0x68/0x250 [ 58.733740][ T5911] new_inode+0x22/0x1c0 [ 58.733763][ T5911] hugetlbfs_get_inode+0x39a/0x700 [ 58.733782][ T5911] ? security_capable+0x80/0x260 [ 58.733806][ T5911] hugetlb_file_setup+0x3cc/0x5b0 [ 58.733831][ T5911] newseg+0xaf0/0xed0 [ 58.733858][ T5911] ? __pfx_newseg+0x10/0x10 [ 58.733879][ T5911] ? down_write+0x146/0x1f0 [ 58.733907][ T5911] ? putname+0xb1/0x110 [ 58.733936][ T5911] ipcget+0xee/0xf50 [ 58.733960][ T5911] ? __pfx_do_futex+0x10/0x10 [ 58.733985][ T5911] ? do_sys_openat2+0x159/0x1e0 [ 58.734011][ T5911] ? __pfx_do_sys_openat2+0x10/0x10 [ 58.734031][ T5911] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 58.734057][ T5911] ? __pfx_ipcget+0x10/0x10 [ 58.734081][ T5911] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 58.734107][ T5911] __ia32_sys_shmget+0x13b/0x1b0 [ 58.734131][ T5911] ? __pfx___ia32_sys_shmget+0x10/0x10 [ 58.734163][ T5911] __do_fast_syscall_32+0xe7/0x970 [ 58.734187][ T5911] ? lockdep_hardirqs_on+0x78/0x100 [ 58.734210][ T5911] do_fast_syscall_32+0x32/0x70 [ 58.734233][ T5911] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 58.734257][ T5911] RIP: 0023:0xf7f48fec [ 58.734276][ T5911] Code: Unable to access opcode bytes at 0xf7f48fc2. [ 58.734296][ T5911] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 000000000000018b [ 58.734313][ T5911] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000013000 [ 58.734325][ T5911] RDX: 000000000000fffe RSI: 0000000080feb000 RDI: 0000000000000000 [ 58.734335][ T5911] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 58.734345][ T5911] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 58.734354][ T5911] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 58.734377][ T5911] [ 58.734384][ T5911] memory: usage 8kB, limit 8kB, failcnt 21 [ 58.865403][ T5911] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 58.868220][ T5911] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 58.870378][ T5911] Memory cgroup stats for /syz3/test: [ 58.871011][ T5911] cache 0 [ 58.873736][ T5911] rss 0 [ 58.874634][ T5911] rss_huge 0 [ 58.875691][ T5911] shmem 0 [ 58.877088][ T5911] mapped_file 0 [ 58.878241][ T5911] dirty 0 [ 58.879243][ T5911] writeback 0 [ 58.880297][ T5911] workingset_refault_anon 0 [ 58.881693][ T5911] workingset_refault_file 0 [ 58.883121][ T5911] swap 0 [ 58.884044][ T5911] swapcached 0 [ 58.885137][ T5911] pgpgin 0 [ 58.886384][ T5911] pgpgout 0 [ 58.887398][ T5911] pgfault 0 [ 58.888412][ T5911] pgmajfault 0 [ 58.889505][ T5911] inactive_anon 0 [ 58.890666][ T5911] active_anon 0 [ 58.891750][ T5911] inactive_file 0 [ 58.892836][ T5911] active_file 0 [ 58.893963][ T5911] unevictable 0 [ 58.895042][ T5911] hierarchical_memory_limit 8192 [ 58.897080][ T5911] hierarchical_memsw_limit 9223372036854771712 [ 58.899199][ T5911] total_cache 0 [ 58.900278][ T5911] total_rss 0 [ 58.902104][ T5911] total_rss_huge 0 [ 58.903338][ T5911] total_shmem 0 [ 58.904463][ T5911] total_mapped_file 0 [ 58.906229][ T5911] total_dirty 0 [ 58.907459][ T5911] total_writeback 0 [ 58.909582][ T5911] total_workingset_refault_anon 0 [ 58.911241][ T5911] total_workingset_refault_file 0 [ 58.912778][ T5911] total_swap 0 [ 58.914249][ T5911] total_swapcached 0 [ 58.915511][ T5911] total_pgpgin 0 [ 58.916838][ T5911] total_pgpgout 0 [ 58.920630][ T5911] total_pgfault 0 [ 58.921766][ T5911] total_pgmajfault 0 [ 58.922982][ T5911] total_inactive_anon 0 [ 58.924314][ T5911] total_active_anon 0 [ 58.925585][ T5911] total_inactive_file 0 [ 58.927018][ T5911] total_active_file 0 [ 58.928277][ T5911] total_unevictable 0 [ 58.929543][ T5911] anon_cost 0 [ 58.930601][ T5911] file_cost 0 [ 58.931680][ T5911] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.11,pid=5910,uid=0 [ 58.943375][ T5911] Memory cgroup out of memory: Killed process 5910 (syz.3.11) total-vm:104072kB, anon-rss:1288kB, file-rss:23080kB, shmem-rss:0kB, UID:0 pgtables:116kB oom_score_adj:1000 [ 59.004627][ T5922] syz.2.15 uses obsolete (PF_INET,SOCK_PACKET) [ 59.094156][ T5931] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19'. [ 59.291744][ T5938] netlink: 24 bytes leftover after parsing attributes in process `syz.3.21'. [ 59.444543][ T5944] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 59.449659][ T5944] block device autoloading is deprecated and will be removed. [ 59.779497][ T5960] netlink: 4 bytes leftover after parsing attributes in process `syz.0.28'. [ 59.785733][ T5960] netlink: 4 bytes leftover after parsing attributes in process `syz.0.28'. [ 59.792793][ T5960] netlink: 240 bytes leftover after parsing attributes in process `syz.0.28'. [ 59.803172][ T5960] netlink: 240 bytes leftover after parsing attributes in process `syz.0.28'. [ 59.992655][ T5969] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 60.003946][ T5971] netlink: 24 bytes leftover after parsing attributes in process `syz.3.33'. [ 60.208272][ T5983] tipc: Failed to remove unknown binding: 66,1,1/0:1965720208/1965720210 [ 60.389404][ T34] IPVS: starting estimator thread 0... [ 60.396846][ T5997] IPVS: sync thread started: state = BACKUP, mcast_ifn = syz_tun, syncid = 0, id = 0 [ 60.437893][ T5999] netlink: 32 bytes leftover after parsing attributes in process `syz.1.46'. [ 60.475941][ T5996] IPVS: using max 43 ests per chain, 103200 per kthread [ 60.486148][ T63] Bluetooth: hci0: command tx timeout [ 60.486227][ T5739] Bluetooth: hci2: command tx timeout [ 60.486267][ T5744] Bluetooth: hci3: command tx timeout [ 60.486297][ T5739] Bluetooth: hci1: command tx timeout [ 60.884087][ T5969] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.072110][ T5969] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.196853][ T5969] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 61.376074][ T5788] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.386261][ T5788] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.392879][ T5788] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.401379][ T5788] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.464979][ T6025] binder: 6024:6025 ioctl c0306201 0 returned -14 [ 61.593353][ T6032] binder: 6024:6032 ioctl c0306201 0 returned -14 [ 62.566917][ T63] Bluetooth: hci2: command tx timeout [ 62.569423][ T5744] Bluetooth: hci3: command tx timeout [ 62.571949][ T5748] Bluetooth: hci1: command tx timeout [ 62.576040][ T5748] Bluetooth: hci0: command tx timeout [ 62.609842][ T6061] evm: overlay not supported [ 63.039595][ T3262] IPVS: starting estimator thread 0... [ 63.047072][ T6079] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 63.085416][ T6087] loop0: detected capacity change from 0 to 5056 [ 63.097127][ T6087] (syz.1.77,6087,0):ocfs2_get_sector:1713 ERROR: status = -5 [ 63.101300][ T6087] (syz.1.77,6087,0):ocfs2_sb_probe:753 ERROR: status = -5 [ 63.104432][ T6087] (syz.1.77,6087,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 63.113144][ T6087] (syz.1.77,6087,1):ocfs2_fill_super:1177 ERROR: status = -5 [ 63.155952][ T6084] IPVS: using max 27 ests per chain, 64800 per kthread [ 63.423367][ T6099] ahci 0000:00:03.0: probe with driver ahci failed with error -12 [ 63.911860][ T6128] __nla_validate_parse: 2 callbacks suppressed [ 63.911879][ T6128] netlink: 24 bytes leftover after parsing attributes in process `syz.0.91'. [ 63.988838][ T6131] device-mapper: table: 248:0: 1:0 1:1 1:2 128 0 smq 0: unknown target type [ 63.995964][ T6131] device-mapper: ioctl: error adding target to table [ 64.003828][ T6136] netlink: 24 bytes leftover after parsing attributes in process `syz.0.93'. [ 65.179924][ T6174] ath9k serial8250: error -EINVAL: invalid resource (null) [ 65.188703][ T6174] ath9k serial8250: ioremap failed [ 65.190965][ T6174] ath9k serial8250: probe with driver ath9k failed with error -22 [ 65.393014][ T6226] netlink: 24 bytes leftover after parsing attributes in process `syz.2.107'. [ 66.340818][ T6247] ======================================================= [ 66.340818][ T6247] WARNING: The mand mount option has been deprecated and [ 66.340818][ T6247] and is ignored by this kernel. Remove the mand [ 66.340818][ T6247] option from the mount to silence this warning. [ 66.340818][ T6247] ======================================================= [ 66.356627][ T6247] overlayfs: fs on './file1/file0' does not support file handles, falling back to index=off,nfs_export=off. [ 66.501749][ T6255] netlink: 'syz.1.114': attribute type 10 has an invalid length. [ 66.507953][ T6255] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.511404][ T6255] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.521025][ T6255] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.523840][ T6255] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.527256][ T6255] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.529480][ T6255] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.537466][ T6255] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 66.561175][ T6255] __ib_cache_gid_add: unable to add gid fe80:0000:0000:0000:9812:78ff:feb9:8ab6 error=-28 [ 66.672622][ T6255] infiniband syz1: set active [ 66.675000][ T6255] infiniband syz1: added bridge_slave_1 [ 66.687279][ T6255] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 66.693327][ T6255] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 66.701307][ T6255] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 66.727454][ T6255] RDS/IB: syz1: added [ 66.729544][ T6255] smc: adding ib device syz1 with port count 1 [ 66.731840][ T6255] smc: ib device syz1 port 1 has no pnetid [ 67.294745][ T6279] netlink: 'syz.2.118': attribute type 5 has an invalid length. [ 67.347518][ T852] IPVS: starting estimator thread 0... [ 67.427666][ T6290] block device autoloading is deprecated and will be removed. [ 67.427690][ T6295] block device autoloading is deprecated and will be removed. [ 67.437771][ T6289] IPVS: using max 43 ests per chain, 103200 per kthread [ 67.604589][ T6313] binder: 6312:6313 ioctl c0306201 80000040 returned -14 [ 67.863129][ T6339] netlink: 4 bytes leftover after parsing attributes in process `syz.1.131'. [ 67.866560][ T6339] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 67.877924][ T6339] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 68.032629][ T6362] bond0: (slave bond_slave_1): Releasing backup interface [ 68.253459][ T6376] netlink: 24 bytes leftover after parsing attributes in process `syz.0.138'. [ 68.772385][ T6457] netlink: 12 bytes leftover after parsing attributes in process `syz.1.143'. [ 68.834301][ T42] audit: type=1326 audit(1786102965.855:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6461 comm="syz.0.152" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x0 [ 69.707422][ T6478] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 69.757400][ T6481] netlink: 'syz.1.148': attribute type 2 has an invalid length. [ 69.762502][ T6481] netlink: 'syz.1.148': attribute type 2 has an invalid length. [ 69.765716][ T6481] netlink: 'syz.1.148': attribute type 2 has an invalid length. [ 69.772088][ T6481] netlink: 1279 bytes leftover after parsing attributes in process `syz.1.148'. [ 69.831865][ T6496] netlink: 'syz.0.153': attribute type 1 has an invalid length. [ 69.864128][ T6496] 8021q: adding VLAN 0 to HW filter on device bond1 [ 69.903012][ T6496] 8021q: adding VLAN 0 to HW filter on device bond1 [ 69.908728][ T6496] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 69.915514][ T6496] bond1: (slave wireguard0): Error -95 calling set_mac_address [ 69.924117][ T6536] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 69.927684][ T6536] IPv6: NLM_F_CREATE should be set when creating new route [ 69.968250][ T6539] mac80211_hwsim hwsim7 wlan1: entered promiscuous mode [ 69.978342][ T6539] bond1: (slave wlan1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 70.038164][ T6545] tipc: Started in network mode [ 70.040576][ T6545] tipc: Node identity 22f1638e5873, cluster identity 4711 [ 70.043133][ T6545] tipc: Enabled bearer , priority 10 [ 70.053567][ T6544] tipc: Resetting bearer [ 70.081853][ T6544] tipc: Disabling bearer [ 70.338773][ T6573] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 70.341935][ T6573] IPv6: NLM_F_CREATE should be set when creating new route [ 70.515550][ T6592] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 70.745334][ T6611] kvm: pic: non byte read [ 70.748949][ T6611] kvm: pic: level sensitive irq not supported [ 70.749322][ T6611] kvm: pic: non byte read [ 70.755246][ T6611] kvm: pic: level sensitive irq not supported [ 70.755578][ T6611] kvm: pic: non byte read [ 70.762095][ T6611] kvm: pic: level sensitive irq not supported [ 70.762415][ T6611] kvm: pic: non byte read [ 70.769288][ T6611] kvm: pic: level sensitive irq not supported [ 70.769636][ T6611] kvm: pic: non byte read [ 70.775571][ T6611] kvm: pic: level sensitive irq not supported [ 70.776631][ T6611] kvm: pic: non byte read [ 70.782258][ T6611] kvm: pic: level sensitive irq not supported [ 70.782555][ T6611] kvm: pic: non byte read [ 71.131842][ T1434] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.136600][ T1434] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.222078][ T6655] netlink: 8 bytes leftover after parsing attributes in process `syz.1.179'. [ 71.225989][ T6655] netlink: 8 bytes leftover after parsing attributes in process `syz.1.179'. [ 71.236358][ T6657] netlink: 12 bytes leftover after parsing attributes in process `syz.0.181'. [ 71.635176][ T6673] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 71.653608][ T6673] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 71.864017][ T6689] fuse: root generation should be zero [ 71.955284][ T6696] netlink: 4 bytes leftover after parsing attributes in process `syz.1.191'. [ 72.032688][ T6704] Zero length message leads to an empty skb [ 72.095975][ T6710] geneve1: entered promiscuous mode [ 72.332233][ T6743] loop5: detected capacity change from 0 to 6 [ 72.344871][ T6743] loop5: [POWERTEC] p1 p2 p3 [ 72.350978][ T6743] loop5: p1 start 2738982409 is beyond EOD, truncated [ 72.354298][ T6743] loop5: p2 start 3318134482 is beyond EOD, truncated [ 72.361177][ T6743] loop5: p3 start 3832978868 is beyond EOD, truncated [ 73.055982][ T42] audit: type=1326 audit(1786102970.075:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6803 comm="syz.0.210" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70befec code=0x0 [ 73.411223][ T6809] netlink: 24 bytes leftover after parsing attributes in process `syz.2.211'. [ 74.961826][ T6937] bond0: entered promiscuous mode [ 74.963601][ T6937] bond_slave_0: entered promiscuous mode [ 74.965633][ T6937] bond_slave_1: entered promiscuous mode [ 74.970543][ T6937] batadv0: entered promiscuous mode [ 74.975506][ T6937] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 74.997021][ T6937] netlink: 'syz.2.226': attribute type 10 has an invalid length. [ 75.000296][ T6937] syz_tun: entered promiscuous mode [ 75.006557][ T6937] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 75.430594][ T6953] kvm: vcpu 1: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 75.481189][ T6961] warning: `syz.1.231' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 76.959703][ T6999] Bluetooth: MGMT ver 1.23 [ 78.048815][ T5744] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 78.054062][ T5744] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 78.057906][ T5744] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 78.061293][ T5744] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 78.067008][ T5744] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 78.106521][ T7053] netlink: 36 bytes leftover after parsing attributes in process `syz.1.248'. [ 78.619780][ T7042] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.622340][ T7042] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.624726][ T7042] bridge_slave_0: entered allmulticast mode [ 78.629463][ T7042] bridge_slave_0: entered promiscuous mode [ 78.633291][ T7042] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.635761][ T7042] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.639160][ T7042] bridge_slave_1: entered allmulticast mode [ 78.644923][ T7042] bridge_slave_1: entered promiscuous mode [ 78.689937][ T7042] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.696751][ T7042] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.731810][ T7209] netlink: 12 bytes leftover after parsing attributes in process `syz.2.252'. [ 78.744300][ T7042] team0: Port device team_slave_0 added [ 78.749062][ T7042] team0: Port device team_slave_1 added [ 78.766461][ T7042] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.768683][ T7042] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.777615][ T7042] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.783696][ T7042] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.786829][ T7042] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.799027][ T7042] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.847271][ T7042] hsr_slave_0: entered promiscuous mode [ 78.852158][ T7042] hsr_slave_1: entered promiscuous mode [ 78.856826][ T7042] debugfs: 'hsr0' already exists in 'hsr' [ 78.860971][ T7042] Cannot create hsr debugfs directory [ 79.100460][ T7042] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 79.110651][ T7350] i801_smbus 0000:00:03.0: SMBus using polling [ 79.114609][ T7042] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.121275][ T7042] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 79.137744][ T7042] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.149198][ T7042] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 79.153658][ T7042] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.158814][ T7350] i2c i2c-2: Memory type 0x07 not supported yet, not instantiating SPD [ 79.159056][ T7042] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 79.161751][ T7366] netlink: 4 bytes leftover after parsing attributes in process `syz.2.261'. [ 79.171349][ T7042] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.199107][ T7042] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.201802][ T7042] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.204830][ T7042] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.207775][ T7042] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.218614][ T173] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.227896][ T173] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.315026][ T7042] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.327967][ T7042] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.333503][ T173] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.336744][ T173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.349522][ T173] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.352641][ T173] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.678872][ T7042] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.723400][ T7434] netlink: 'syz.1.271': attribute type 1 has an invalid length. [ 79.743187][ T7434] 8021q: adding VLAN 0 to HW filter on device bond1 [ 79.789372][ T7434] bond1: (slave geneve2): making interface the new active one [ 79.793830][ T7434] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 79.904620][ T7042] veth0_vlan: entered promiscuous mode [ 79.912262][ T7042] veth1_vlan: entered promiscuous mode [ 79.931822][ T7042] veth0_macvtap: entered promiscuous mode [ 79.942478][ T7042] veth1_macvtap: entered promiscuous mode [ 79.952974][ T7042] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.968497][ T7042] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.991209][ T7486] kvm: Disabled LAPIC found during irq injection [ 80.016594][ T5815] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.029702][ T5815] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.035351][ T5815] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.044107][ T5815] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.075609][ T786] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.079029][ T786] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.123830][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.127222][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.176636][ T5748] Bluetooth: hci4: command tx timeout [ 80.181354][ T42] audit: type=1800 audit(1786102977.205:4): pid=7513 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.277" name="file0" dev="overlay" ino=482 res=0 errno=0 [ 80.226476][ T7510] ptrace attach of ""[7511] was attempted by "/syz-executor exec"[7510] [ 80.571222][ T7553] Illegal XDP return value 4294967294 on prog (id 31) dev syz_tun, expect packet loss! [ 80.718573][ T5817] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 80.878074][ T7572] IPVS: set_ctl: invalid protocol: 47 172.20.20.170:20003 [ 80.892324][ T5817] usb 7-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 80.896005][ T5817] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.898693][ T5817] usb 7-1: Product: syz [ 80.900254][ T5817] usb 7-1: Manufacturer: syz [ 80.909281][ T5817] usb 7-1: SerialNumber: syz [ 81.341281][ T5817] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 81.367639][ T71] cfg80211: failed to load regulatory.db [ 82.256012][ T5748] Bluetooth: hci4: command tx timeout [ 83.208044][ C0] usblp0: nonzero write bulk status received: -71 [ 83.214172][ T40] usb 7-1: USB disconnect, device number 2 [ 83.222920][ T40] usblp0: removed [ 83.435210][ T7670] bridge_slave_0: left allmulticast mode [ 83.437598][ T7670] bridge_slave_0: left promiscuous mode [ 83.440068][ T7670] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.447817][ T7670] bridge_slave_1: left allmulticast mode [ 83.450160][ T7670] bridge_slave_1: left promiscuous mode [ 83.452499][ T7670] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.463165][ T7670] bond0: (slave bond_slave_0): Releasing backup interface [ 83.475518][ T7670] team0: Port device team_slave_0 removed [ 83.484528][ T7670] team0: Port device team_slave_1 removed [ 83.487566][ T7670] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 83.498722][ T7670] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 83.503675][ T7670] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 83.508759][ T7670] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 83.515076][ T7670] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 83.543018][ T7674] team0: Mode changed to "loadbalance" [ 83.589403][ T7670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.313'. [ 83.593858][ T7670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.313'. [ 83.900801][ T7715] netlink: 20 bytes leftover after parsing attributes in process `syz.2.312'. [ 83.905652][ T7715] netlink: 144 bytes leftover after parsing attributes in process `syz.2.312'. [ 84.003826][ T7725] kvm: pic: single mode not supported [ 84.144950][ T7742] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 84.325893][ T5748] Bluetooth: hci4: command tx timeout [ 84.401320][ T7765] netlink: 64 bytes leftover after parsing attributes in process `syz.4.325'. [ 84.406228][ T3262] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 84.425000][ T7765] syzkaller1: entered promiscuous mode [ 84.427525][ T7765] syzkaller1: entered allmulticast mode [ 84.533851][ T7774] input: syz1 as /devices/virtual/input/input5 [ 84.585950][ T3262] usb 7-1: Using ep0 maxpacket: 8 [ 84.591305][ T3262] usb 7-1: config 0 has an invalid interface number: 143 but max is 0 [ 84.594901][ T3262] usb 7-1: config 0 has no interface number 0 [ 84.598416][ T3262] usb 7-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 84.602324][ T3262] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.619121][ T3262] usb 7-1: config 0 descriptor?? [ 84.738227][ T3262] viperboard 7-1:0.143: version 0.00 found at bus 007 address 003 [ 84.759633][ T3262] viperboard-i2c viperboard-i2c.3.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 84.763466][ T3262] viperboard-i2c viperboard-i2c.3.auto: probe with driver viperboard-i2c failed with error -5 [ 84.844171][ T7745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.855249][ T7745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.921169][ T3262] usb 7-1: USB disconnect, device number 3 [ 85.065558][ T42] audit: type=1804 audit(1786102982.085:5): pid=7830 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.330" name="/newroot/95/file0" dev="tmpfs" ino=539 res=1 errno=0 [ 85.682985][ T7856] netlink: 8 bytes leftover after parsing attributes in process `syz.0.336'. [ 85.701147][ T7858] dvmrp1: entered allmulticast mode [ 86.352337][ T5814] libceph: connect (1)[c::]:6789 error -101 [ 86.359244][ T5814] libceph: mon0 (1)[c::]:6789 connect error [ 86.367611][ T5814] libceph: connect (1)[c::]:6789 error -101 [ 86.371533][ T5814] libceph: mon0 (1)[c::]:6789 connect error [ 86.387396][ T7914] netlink: 8 bytes leftover after parsing attributes in process `syz.0.348'. [ 86.405981][ T5748] Bluetooth: hci4: command tx timeout [ 86.427535][ T7907] ceph: No mds server is up or the cluster is laggy [ 87.181266][ T7964] netlink: 4 bytes leftover after parsing attributes in process `syz.1.361'. [ 87.189266][ T7964] batadv0: entered promiscuous mode [ 87.195681][ T7964] macsec1: entered promiscuous mode [ 87.198297][ T7964] macsec1: entered allmulticast mode [ 87.200494][ T7964] batadv0: entered allmulticast mode [ 87.204192][ T7964] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 87.206149][ T42] audit: type=1804 audit(1786102984.225:6): pid=7956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.359" name="/newroot/99/file0" dev="fuse" ino=1 res=1 errno=0 [ 87.216522][ T7964] batadv0: left allmulticast mode [ 87.218837][ T7964] batadv0: left promiscuous mode [ 87.341405][ T7980] netlink: 8 bytes leftover after parsing attributes in process `syz.0.363'. [ 87.384793][ T7985] loop0: detected capacity change from 0 to 131072 [ 87.417855][ T7985] bcache: register_bcache() error : Bad checksum [ 87.471033][ T7991] netlink: 24 bytes leftover after parsing attributes in process `syz.2.365'. [ 87.482131][ T5742] udevd[5742]: incorrect bcache checksum on /dev/loop0 [ 87.663090][ T8068] ±ÿ…d7Š²‰Ûo: renamed from lo (while UP) [ 87.809131][ T8079] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 87.816134][ T8079] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 87.832391][ T8079] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 87.840771][ T8079] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 87.844552][ T8079] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 87.851284][ T8079] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 87.857977][ T8079] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 87.861256][ T8079] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 87.871871][ T8079] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 87.880436][ T8079] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 87.882917][ T8079] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 87.894564][ T8079] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 87.895279][ T8097] fuse: Bad value for 'fd' [ 88.236016][ T5697] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 88.412061][ T5697] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 88.415435][ T5697] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 88.419902][ T5697] usb 9-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 88.422954][ T5697] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.440334][ T5697] spcp8x5 9-1:1.0: SPCP8x5 converter detected [ 88.448374][ T5697] usb 9-1: SPCP8x5 converter now attached to ttyUSB0 [ 88.896029][ T55] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 89.057394][ T55] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 89.061313][ T55] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.065007][ T55] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.069149][ T55] usb 6-1: config 0 interface 0 has no altsetting 0 [ 89.074995][ T55] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.080627][ T55] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.084309][ T55] usb 6-1: config 0 interface 0 has no altsetting 0 [ 89.088197][ T55] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.091387][ T55] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.095446][ T55] usb 6-1: config 0 interface 0 has no altsetting 0 [ 89.099773][ T55] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.109696][ T55] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.113492][ T55] usb 6-1: config 0 interface 0 has no altsetting 0 [ 89.117090][ T55] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.120525][ T55] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.124320][ T55] usb 6-1: config 0 interface 0 has no altsetting 0 [ 89.128238][ T55] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.131407][ T55] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.135273][ T55] usb 6-1: config 0 interface 0 has no altsetting 0 [ 89.139059][ T55] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.142060][ T55] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.146512][ T55] usb 6-1: config 0 interface 0 has no altsetting 0 [ 89.149511][ T55] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.152870][ T55] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.157755][ T55] usb 6-1: config 0 interface 0 has no altsetting 0 [ 89.161627][ T55] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 89.164917][ T55] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 89.168341][ T55] usb 6-1: Product: syz [ 89.170101][ T55] usb 6-1: Manufacturer: syz [ 89.171663][ T55] usb 6-1: SerialNumber: syz [ 89.177310][ T55] usb 6-1: config 0 descriptor?? [ 89.192227][ T55] yurex 6-1:0.0: USB YUREX device now attached to Yurex #0 [ 89.510813][ T8161] binder: 8160:8161 ioctl c0306201 80000480 returned -22 [ 89.679753][ T8170] block nbd0: Receive control failed (result -32) [ 89.679795][ T64] block nbd0: Receive control failed (result -32) [ 89.682604][ T3262] usb 6-1: USB disconnect, device number 2 [ 89.700183][ T3262] yurex 6-1:0.0: USB YUREX #0 now disconnected [ 89.856071][ T5744] Bluetooth: hci1: command 0x0c1a tx timeout [ 89.856433][ T5748] Bluetooth: hci0: command 0x0c1a tx timeout [ 89.925986][ T5748] Bluetooth: hci4: command 0x0c1a tx timeout [ 89.926032][ T5744] Bluetooth: hci3: command 0x0c1a tx timeout [ 90.216247][ T8199] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 90.298546][ T8204] [ 90.299629][ T8204] ====================================================== [ 90.302596][ T8204] WARNING: possible circular locking dependency detected [ 90.305414][ T8204] syzkaller #0 Tainted: G L SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 90.307886][ T8204] ------------------------------------------------------ [ 90.310613][ T8204] syz.1.391/8204 is trying to acquire lock: [ 90.312723][ T8204] ffff88801e4dbf00 (&sb->s_type->i_mutex_key#31){+.+.}-{4:4}, at: configfs_depend_item_unlocked+0xf3/0x6a0 [ 90.317136][ T8204] [ 90.317136][ T8204] but task is already holding lock: [ 90.320050][ T8204] ffff88804d26bd18 (&opts->dep_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x1a4/0x620 [ 90.323741][ T8204] [ 90.323741][ T8204] which lock already depends on the new lock. [ 90.323741][ T8204] [ 90.327789][ T8204] [ 90.327789][ T8204] the existing dependency chain (in reverse order) is: [ 90.331510][ T8204] [ 90.331510][ T8204] -> #3 (&opts->dep_lock){+.+.}-{4:4}: [ 90.334674][ T8204] lock_acquire+0x1b9/0x370 [ 90.336793][ T8204] __mutex_lock+0x1a4/0x1bd0 [ 90.338948][ T8204] usbg_make_tpg+0x1a4/0x620 [ 90.341062][ T8204] target_fabric_make_tpg+0xab/0x8c0 [ 90.343490][ T8204] configfs_mkdir+0x51e/0xb70 [ 90.345670][ T8204] vfs_mkdir+0x361/0x850 [ 90.347751][ T8204] filename_mkdirat+0x48b/0x5e0 [ 90.350043][ T8204] __ia32_sys_mkdir+0x6a/0x90 [ 90.352270][ T8204] __do_fast_syscall_32+0xe7/0x970 [ 90.354642][ T8204] do_fast_syscall_32+0x32/0x70 [ 90.356913][ T8204] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.359760][ T8204] [ 90.359760][ T8204] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 90.362938][ T8204] lock_acquire+0x1b9/0x370 [ 90.365070][ T8204] __mutex_lock+0x1a4/0x1bd0 [ 90.367240][ T8204] tcm_alloc+0x20/0x440 [ 90.369234][ T8204] usb_get_function+0x5e/0xd0 [ 90.371437][ T8204] config_usb_cfg_link+0x1ed/0x3a0 [ 90.373834][ T8204] configfs_symlink+0x540/0x11f0 [ 90.376154][ T8204] vfs_symlink+0x178/0x4d0 [ 90.378303][ T8204] filename_symlinkat+0x2a6/0x560 [ 90.380614][ T8204] __ia32_sys_symlinkat+0x9b/0xe0 [ 90.382923][ T8204] __do_fast_syscall_32+0xe7/0x970 [ 90.385293][ T8204] do_fast_syscall_32+0x32/0x70 [ 90.387543][ T8204] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.390368][ T8204] [ 90.390368][ T8204] -> #1 (&gi->lock){+.+.}-{4:4}: [ 90.393328][ T8204] lock_acquire+0x1b9/0x370 [ 90.395442][ T8204] __mutex_lock+0x1a4/0x1bd0 [ 90.397604][ T8204] config_usb_cfg_link+0x57/0x3a0 [ 90.399979][ T8204] configfs_symlink+0x540/0x11f0 [ 90.402306][ T8204] vfs_symlink+0x178/0x4d0 [ 90.404382][ T8204] filename_symlinkat+0x2a6/0x560 [ 90.406541][ T8204] __ia32_sys_symlinkat+0x9b/0xe0 [ 90.408324][ T8111] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 90.408822][ T8204] __do_fast_syscall_32+0xe7/0x970 [ 90.408858][ T8204] do_fast_syscall_32+0x32/0x70 [ 90.412909][ T55] usb 9-1: USB disconnect, device number 2 [ 90.414042][ T8204] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.421078][ T8204] [ 90.421078][ T8204] -> #0 (&sb->s_type->i_mutex_key#31){+.+.}-{4:4}: [ 90.421534][ T55] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 90.424551][ T8204] check_prev_add+0xeb/0xe60 [ 90.424586][ T8204] __lock_acquire+0x136c/0x1a40 [ 90.424611][ T8204] lock_acquire+0x1b9/0x370 [ 90.428819][ T55] spcp8x5 9-1:1.0: device disconnected [ 90.429557][ T8204] down_write+0x8b/0x1f0 [ 90.437744][ T8204] configfs_depend_item_unlocked+0xf3/0x6a0 [ 90.440243][ T8204] usbg_make_tpg+0x261/0x620 [ 90.442273][ T8204] target_fabric_make_tpg+0xab/0x8c0 [ 90.444562][ T8204] configfs_mkdir+0x51e/0xb70 [ 90.446729][ T8204] vfs_mkdir+0x361/0x850 [ 90.448611][ T8204] filename_mkdirat+0x48b/0x5e0 [ 90.450760][ T8204] __ia32_sys_mkdir+0x6a/0x90 [ 90.452796][ T8204] __do_fast_syscall_32+0xe7/0x970 [ 90.455097][ T8204] do_fast_syscall_32+0x32/0x70 [ 90.457269][ T8204] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.460025][ T8204] [ 90.460025][ T8204] other info that might help us debug this: [ 90.460025][ T8204] [ 90.463819][ T8204] Chain exists of: [ 90.463819][ T8204] &sb->s_type->i_mutex_key#31 --> tpg_instances_lock --> &opts->dep_lock [ 90.463819][ T8204] [ 90.469205][ T8204] Possible unsafe locking scenario: [ 90.469205][ T8204] [ 90.471522][ T8204] CPU0 CPU1 [ 90.473231][ T8204] ---- ---- [ 90.474857][ T8204] lock(&opts->dep_lock); [ 90.476371][ T8204] lock(tpg_instances_lock); [ 90.478644][ T8204] lock(&opts->dep_lock); [ 90.480837][ T8204] lock(&sb->s_type->i_mutex_key#31); [ 90.482840][ T8204] [ 90.482840][ T8204] *** DEADLOCK *** [ 90.482840][ T8204] [ 90.485774][ T8204] 5 locks held by syz.1.391/8204: [ 90.487903][ T8204] #0: ffff888021fc0450 (sb_writers#20){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 90.491755][ T8204] #1: ffff8880132c5b80 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 [ 90.496072][ T8204] #2: ffffffff8fd83428 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4b5/0xb70 [ 90.500090][ T8204] #3: ffffffff9024e740 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x10b/0x620 [ 90.504022][ T8204] #4: ffff88804d26bd18 (&opts->dep_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x1a4/0x620 [ 90.507915][ T8204] [ 90.507915][ T8204] stack backtrace: [ 90.510360][ T8204] CPU: 1 UID: 0 PID: 8204 Comm: syz.1.391 Tainted: G L syzkaller #0 PREEMPT(full) [ 90.510389][ T8204] Tainted: [L]=SOFTLOCKUP [ 90.510395][ T8204] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.510407][ T8204] Call Trace: [ 90.510414][ T8204] [ 90.510421][ T8204] dump_stack_lvl+0x100/0x190 [ 90.510446][ T8204] print_circular_bug.cold+0x178/0x1c7 [ 90.510476][ T8204] check_noncircular+0x146/0x160 [ 90.510507][ T8204] check_prev_add+0xeb/0xe60 [ 90.510534][ T8204] __lock_acquire+0x136c/0x1a40 [ 90.510564][ T8204] lock_acquire+0x1b9/0x370 [ 90.510590][ T8204] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 90.510615][ T8204] ? __pfx___might_resched+0x10/0x10 [ 90.510645][ T8204] down_write+0x8b/0x1f0 [ 90.510672][ T8204] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 90.510692][ T8204] ? __pfx_down_write+0x10/0x10 [ 90.510716][ T8204] configfs_depend_item_unlocked+0xf3/0x6a0 [ 90.510737][ T8204] ? __lock_acquire+0x49f/0x1a40 [ 90.510780][ T8204] usbg_make_tpg+0x261/0x620 [ 90.510804][ T8204] ? __pfx_usbg_make_tpg+0x10/0x10 [ 90.510824][ T8204] ? find_held_lock+0x2b/0x80 [ 90.510844][ T8204] ? __pfx_usbg_make_tpg+0x10/0x10 [ 90.510866][ T8204] target_fabric_make_tpg+0xab/0x8c0 [ 90.510895][ T8204] configfs_mkdir+0x51e/0xb70 [ 90.510917][ T8204] ? __pfx_target_fabric_make_tpg+0x10/0x10 [ 90.510950][ T8204] ? __pfx_configfs_mkdir+0x10/0x10 [ 90.510976][ T8204] vfs_mkdir+0x361/0x850 [ 90.511001][ T8204] filename_mkdirat+0x48b/0x5e0 [ 90.511021][ T8204] ? __pfx_filename_mkdirat+0x10/0x10 [ 90.511040][ T8204] ? strncpy_from_user+0x19d/0x2d0 [ 90.511083][ T8204] ? do_getname+0x191/0x390 [ 90.511104][ T8204] __ia32_sys_mkdir+0x6a/0x90 [ 90.511122][ T8204] __do_fast_syscall_32+0xe7/0x970 [ 90.511149][ T8204] do_fast_syscall_32+0x32/0x70 [ 90.511171][ T8204] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 90.511192][ T8204] RIP: 0023:0xf705efec [ 90.511212][ T8204] Code: Unable to access opcode bytes at 0xf705efc2. [ 90.511221][ T8204] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000027 [ 90.511237][ T8204] RAX: ffffffffffffffda RBX: 0000000080000600 RCX: 00000000000001ff [ 90.511248][ T8204] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 90.511258][ T8204] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 90.511268][ T8204] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 90.511278][ T8204] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 90.511293][ T8204] [ 91.630020][ T8190] bond0: (slave syz_tun): Releasing backup interface [ 91.642688][ T5815] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.740585][ T5815] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.800976][ T5815] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.880618][ T5815] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.926031][ T5748] Bluetooth: hci0: command 0x0c1a tx timeout [ 91.972179][ T5815] bridge_slave_1: left allmulticast mode [ 91.974760][ T5815] bridge_slave_1: left promiscuous mode [ 91.977595][ T5815] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.982072][ T5815] bridge_slave_0: left allmulticast mode [ 91.984121][ T5815] bridge_slave_0: left promiscuous mode [ 91.986528][ T5815] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.043525][ T5815] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 92.048943][ T5815] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 92.053652][ T5815] bond0 (unregistering): Released all slaves [ 92.065977][ T12] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.069573][ T12] netdevsim netdevsim4 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.074548][ T12] netdevsim netdevsim4 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.077857][ T12] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.180394][ T5448] 8021q: adding VLAN 0 to HW filter on device eth2 [ 92.298917][ T5448] 8021q: adding VLAN 0 to HW filter on device eth3 [ 92.338877][ T5815] hsr_slave_0: left promiscuous mode [ 92.341879][ T5815] hsr_slave_1: left promiscuous mode [ 92.344609][ T5815] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 92.349008][ T5815] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 92.352598][ T5815] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 92.355742][ T5815] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 92.362782][ T5815] veth1_macvtap: left promiscuous mode [ 92.365206][ T5815] veth0_macvtap: left promiscuous mode [ 92.367882][ T5815] veth1_vlan: left promiscuous mode [ 92.370224][ T5815] veth0_vlan: left promiscuous mode [ 92.432914][ T5815] team0 (unregistering): Port device team_slave_1 removed [ 92.449309][ T5815] team0 (unregistering): Port device team_slave_0 removed [ 92.504955][ T5448] 8021q: adding VLAN 0 to HW filter on device eth4 [ 92.647194][ T5448] 8021q: adding VLAN 0 to HW filter on device eth5 [ 94.006044][ T5748] Bluetooth: hci0: command 0x0c1a tx timeout