last executing test programs: 3m34.68087444s ago: executing program 2 (id=1380): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) connect$unix(r1, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r3) sendmsg$IEEE802154_LIST_PHY(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x95}, 0x40000) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo\x00') r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fcntl$dupfd(0xffffffffffffffff, 0x2, 0xffffffffffffffff) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) write$dsp(r6, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = openat$sequencer2(0xffffff9c, &(0x7f0000000000), 0x20940, 0x0) ioctl$SNDCTL_SEQ_RESET(r8, 0x5100) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000001340)=ANY=[@ANYBLOB="5400000002060104000000000000000005000000050001000600000016000300686173683a6e65742c706f72742c6e657400000009ff010073797a310000000004000780050005000a00000005000449fe000000"], 0x54}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x20000040) syz_usb_connect(0x0, 0x24, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000500)=ANY=[@ANYRES8=r9, @ANYRES8=r2, @ANYRESDEC=r0, @ANYBLOB="fc010000000000000000000000000001000004d46c00000064010101000000000000000000000000000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000b6058e2f0000000000000a0000000000ffffffffffffffff00000000000000001c00000000000000feffffffffffffff0200000059000000000000002abd7000053500000200010020000000480003006465666c61746500"/236, @ANYBLOB, @ANYRES32=r0, @ANYRESDEC=r3], 0x134}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 3m31.337440462s ago: executing program 2 (id=1387): setpgid(0x0, 0x0) r0 = gettid() madvise(&(0x7f00005cf000/0x3000)=nil, 0x3000, 0x16) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r3 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r3, &(0x7f0000000680)=ANY=[@ANYBLOB="7b9ea47ec02f09"], 0x86) r4 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card0/oss_mixer\x00', 0x80, 0x0) dup3(r4, r3, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0x8000f28, 0x5) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, 0x0, 0x0) sendmmsg$inet(r5, &(0x7f0000003240)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4040040) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x3) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000200)=0x2, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "5335572af7aa9ec3", "0bb3bbceae3b6d56e33a5c51cbf284c6", "1363cf10", "5c892ebd183c8c13"}, 0x28) recvmsg(r1, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000380)=""/84, 0x54}], 0x1}, 0x20) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x21) 3m30.885274363s ago: executing program 2 (id=1390): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$DVB_DVR_DMX_DQBUF(0xffffffffffffffff, 0xc0186f40, &(0x7f0000000040)={0x1, 0x20000000, 0x5, 0xb, 0x6, 0x86}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x9}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0x8}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xb, 0x0, 0x3, 0x6, 0x7f, 0x6}, {0x0, 0x0, 0x38, 0xef, 0x84, 0x7, 0x92, 0x54, 0x0, 0x5, 0x4, 0x7, 0x3a}], 0xffffffff}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000003240), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_mgmt(0x0, r3) sendmsg$NLBL_MGMT_C_ADD(r3, &(0x7f0000002c40)={0x0, 0xffffffffffffffd2, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYRES16=0x0, @ANYRES16=r4, @ANYRESDEC=r2], 0x1b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c00000037000501f3fffffffedbd725017c000008000800", @ANYRES32=r5, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8050) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f0000000580)=ANY=[@ANYBLOB="3c0400000002040104000e5419360000071000000000027f09000000000001005e38000098691d239ddb1355685e00c81000565344d992d29a8b8ff30ff3839d2c75dd35aa6a614a0d31c40502f4f38420d2ec005ff9d9"], 0x30) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x4, 0x7fff, 0x3, 0x400000000], 0x80a0000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket(0x2a, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) connect$unix(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x802c550a, &(0x7f0000000540)=@urb_type_interrupt={0x1, {0xf, 0x1}, 0x1, 0x60, &(0x7f0000000300)="c0f286af6239287c9fa1362c295a1e82aae37a8bb15fa2554bed8192303103d30dac80023bebddae1ab5a357a6", 0x2d, 0x0, 0xfffffffb, 0x0, 0xe92d, 0x0, &(0x7f0000000480)}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001c00), 0x0, 0x4000090) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 3m29.966040003s ago: executing program 2 (id=1393): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_emit_ethernet(0xde, 0x0, 0x0) faccessat2(0xffffffffffffffff, 0x0, 0x44, 0x1000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0xfffff5d4}}, './file0\x00'}) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) socket$rxrpc(0x21, 0x2, 0xa) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r2 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x7, 0xd44, 0x6}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='limits\x00') mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x100000) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0x5, 0x3, 0x248, 0x5d92, 0x9, 0x1ce, 0x7fff, 0x2}, 0x0, &(0x7f0000000140)={0x3ff, 0x80, 0x5, 0x0, 0x101, 0xafc2, 0x5, 0x1}, &(0x7f00000001c0)={r3, r4+60000000}, &(0x7f0000000280)={0x0}) fsopen(0x0, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000800000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl(r7, 0x4048aecb, 0x0) 3m28.154155584s ago: executing program 2 (id=1396): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat(0xffffffffffffff9c, 0x0, 0x101242, 0x220) openat(0xffffffffffffff9c, 0x0, 0x36f641, 0xf2) timer_create(0x5, &(0x7f00000002c0)={0x0, 0x25, 0x2}, &(0x7f0000000b80)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x7, 0x0, 0x0}, 0x0) sendmmsg(r1, &(0x7f0000000180), 0x40000000000007b, 0x4004) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r3 = openat$sndseq(0xffffff9c, &(0x7f0000000140), 0x800) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r3, 0xc0105303, &(0x7f0000000180)={0xe, 0xfd, 0xae}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1df) mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./pipefs/gssd/clntXX/gssd\x00', 0x2, 0x0) readv(r4, &(0x7f0000000800)=[{&(0x7f0000000140)=""/58, 0x3a}], 0x1) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, 0x0}, 0x58) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) io_uring_enter(r5, 0x1, 0x1, 0x1, 0x0, 0x0) fsetxattr$trusted_overlay_opaque(r5, &(0x7f0000000040), &(0x7f00000000c0), 0x2, 0x3) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) 3m26.94742479s ago: executing program 2 (id=1398): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000000004026093333400000000001090224000100000000090400000103"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000380), 0x0, &(0x7f00000002c0)=ANY=[]) read$FUSE(r2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_SYNC(r3, 0x5101) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r4) getsockname$packet(r4, 0x0, &(0x7f0000000200)) socket$packet(0x11, 0x3, 0x300) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x1000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, 0x0, 0x0) sendmsg$NFT_BATCH(r5, 0x0, 0x0) r6 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r6, &(0x7f0000000180)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x4}, 0x80, &(0x7f0000000680)=[{0x0}], 0x1, 0x0, 0x0, 0x900}, 0x800) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'ip6gretap0\x00'}) syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) r7 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) ioctl$VIDIOC_S_INPUT(r7, 0xc0045627, &(0x7f0000000080)=0x2) ioctl$VIDIOC_S_SELECTION(r7, 0xc040565f, &(0x7f0000000280)={0x9, 0x100, 0x0, {0xa, 0x3, 0x7, 0x1}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) 3m11.812662929s ago: executing program 32 (id=1398): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000000004026093333400000000001090224000100000000090400000103"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000380), 0x0, &(0x7f00000002c0)=ANY=[]) read$FUSE(r2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_SYNC(r3, 0x5101) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r4) getsockname$packet(r4, 0x0, &(0x7f0000000200)) socket$packet(0x11, 0x3, 0x300) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x1000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, 0x0, 0x0) sendmsg$NFT_BATCH(r5, 0x0, 0x0) r6 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r6, &(0x7f0000000180)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x4}, 0x80, &(0x7f0000000680)=[{0x0}], 0x1, 0x0, 0x0, 0x900}, 0x800) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'ip6gretap0\x00'}) syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) r7 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) ioctl$VIDIOC_S_INPUT(r7, 0xc0045627, &(0x7f0000000080)=0x2) ioctl$VIDIOC_S_SELECTION(r7, 0xc040565f, &(0x7f0000000280)={0x9, 0x100, 0x0, {0xa, 0x3, 0x7, 0x1}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) 4.846132599s ago: executing program 0 (id=2404): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000340), 0x800, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r1, 0x5201) close_range(r0, 0xffffffffffffffff, 0x0) 4.808708633s ago: executing program 0 (id=2405): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$DVB_DVR_DMX_DQBUF(0xffffffffffffffff, 0xc0186f40, &(0x7f0000000040)={0x1, 0x20000000, 0x5, 0xb, 0x6, 0x86}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x9}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0x8}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xb, 0x0, 0x3, 0x6, 0x7f, 0x6}, {0x0, 0x0, 0x38, 0xef, 0x84, 0x7, 0x92, 0x54, 0x0, 0x5, 0x4, 0x7, 0x3a}], 0xffffffff}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000003240), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_mgmt(0x0, r3) sendmsg$NLBL_MGMT_C_ADD(r3, &(0x7f0000002c40)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYRES16=0x0, @ANYRES16=r4], 0x1b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c00000037000501f3fffffffedbd725017c000008000800", @ANYRES32=r5, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8050) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f0000000580)=ANY=[@ANYBLOB="3c0400000002040104000e5419360000071000000000027f09000000000001005e38000098691d239ddb1355685e00c81000565344d992d29a8b8ff30ff3839d2c75dd35aa6a614a0d31c40502f4f38420d2ec005ff9d9"], 0x30) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x4, 0x7fff, 0x3, 0x400000000], 0x80a0000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket(0x2a, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$HIDIOCGRAWNAME(0xffffffffffffffff, 0x80404804, &(0x7f0000000240)) connect$unix(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x802c550a, &(0x7f0000000540)=@urb_type_interrupt={0x1, {0xf, 0x1}, 0x1, 0x60, &(0x7f0000000300)="c0f286af6239287c9fa1362c295a1e82aae37a8bb15fa2554bed8192303103d30dac80023bebddae1ab5a357a6", 0x2d, 0x0, 0xfffffffb, 0x0, 0xe92d, 0x0, &(0x7f0000000480)}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001c00), 0x0, 0x4000090) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 4.432888052s ago: executing program 1 (id=2408): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x102, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000300)=0xf) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001200), 0x101101, 0x0) 4.249428303s ago: executing program 1 (id=2410): mkdir(&(0x7f0000000200)='./my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_sys/bus/pci/devices/0000:00:01.0/config\x00', 0x2, 0x0) write$P9_RREADLINK(r0, 0x0, 0x0) 4.144277356s ago: executing program 1 (id=2411): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000110)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)="2f6465762f7a72616d302c363535cd", 0xf) 4.132135122s ago: executing program 0 (id=2412): mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='\\x01000000 -', 0xc) 4.043178804s ago: executing program 0 (id=2414): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_emit_ethernet(0xde, 0x0, 0x0) faccessat2(0xffffffffffffffff, 0x0, 0x44, 0x1000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0xfffff5d4}}, './file0\x00'}) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpid() sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) socket$rxrpc(0x21, 0x2, 0xa) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r2 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='limits\x00') mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x100000) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0x5, 0x3, 0x248, 0x5d92, 0x9, 0x1ce, 0x7fff, 0x2}, 0x0, &(0x7f0000000140)={0x3ff, 0x80, 0x5, 0x0, 0x101, 0xafc2, 0x5, 0x1}, &(0x7f00000001c0)={r3, r4+60000000}, &(0x7f0000000280)={0x0}) fsopen(0x0, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000800000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl(r7, 0x4048aecb, 0x0) 4.041095274s ago: executing program 1 (id=2415): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000200)='2', 0x1}], 0x1) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x1ec, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x1d8, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x68, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x21}}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x74b9c7924d4830a3}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x26}}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x24}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x90, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x36}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_EXPECT_NAT_TUPLE={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x78, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}]}, 0x1ec}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x8880}, 0x4) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x42}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) syz_emit_vhci(&(0x7f00000006c0)=ANY=[@ANYBLOB="02c90012000e00050017420a008000008200020a004000fde5e64210233096b1d5a6ad6ce14fb110c765c35840461ca80ba09befb3d5313a915100b6a1c9688ed2e5feb0dd0695306a29661c070f3813ebce7504667b984f0323c04664beb433e594c12fddfa3f433b49d932943060be7c43bffff40009126e9b7c4e30f59c0692d83ddde3c6e0055afebb796ad968b3dd5bd2752d33728a394fb5532255a0fdf85f117264e31524c86bd782a4b2f74ecc676bfcfaec"], 0x17) syz_clone3(&(0x7f0000000500)={0x40040000, 0x0, 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x58) fcntl$setsig(0xffffffffffffffff, 0xa, 0x11) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = getpid() fcntl$setownex(r4, 0xf, &(0x7f0000000100)={0x2, r5}) ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f00000001c0)=0x0) fcntl$setown(0xffffffffffffffff, 0x8, r6) truncate(&(0x7f0000000080)='./file0\x00', 0x4) fcntl$setlease(0xffffffffffffffff, 0x400, 0x2) r7 = accept4(r0, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$team(&(0x7f0000000200), r7) 3.085093763s ago: executing program 0 (id=2421): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$cdc_ncm(0x5, 0xf3, &(0x7f00000007c0)=ANY=[@ANYBLOB="12011001020000402505a1a44000010203010902"], 0x0) ioctl$EVIOCRMFF(r0, 0x41015500, 0x0) 1.662852528s ago: executing program 1 (id=2426): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000200)='2', 0x1}], 0x1) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x1ec, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x1d8, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x68, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x21}}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x74b9c7924d4830a3}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x26}}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x24}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x90, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x36}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_EXPECT_NAT_TUPLE={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x78, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}]}, 0x1ec}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x8880}, 0x4) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x42}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) syz_emit_vhci(&(0x7f00000006c0)=ANY=[@ANYBLOB="02c90012000e00050017420a008000008200020a004000fde5e64210233096b1d5a6ad6ce14fb110c765c35840461ca80ba09befb3d5313a915100b6a1c9688ed2e5feb0dd0695306a29661c070f3813ebce7504667b984f0323c04664beb433e594c12fddfa3f433b49d932943060be7c43bffff40009126e9b7c4e30f59c0692d83ddde3c6e0055afebb796ad968b3dd5bd2752d33728a394fb5532255a0fdf85f117264e31524c86bd782a4b2f74ecc676bfcfaec"], 0x17) syz_clone3(&(0x7f0000000500)={0x40040000, 0x0, 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = open(&(0x7f00009e1000)='./file0\x00', 0x149040, 0x40) fcntl$setsig(r4, 0xa, 0x11) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = getpid() fcntl$setownex(r5, 0xf, &(0x7f0000000100)={0x2, r6}) ioctl$sock_FIOGETOWN(r5, 0x8903, &(0x7f00000001c0)=0x0) fcntl$setown(r4, 0x8, r7) truncate(&(0x7f0000000080)='./file0\x00', 0x4) fcntl$setlease(r4, 0x400, 0x2) r8 = accept4(r0, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$team(&(0x7f0000000200), r8) 1.659618959s ago: executing program 3 (id=2427): nanosleep(0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) 1.539258188s ago: executing program 3 (id=2429): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_emit_ethernet(0xde, 0x0, 0x0) faccessat2(0xffffffffffffffff, 0x0, 0x44, 0x1000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0xfffff5d4}}, './file0\x00'}) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpid() sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) socket$rxrpc(0x21, 0x2, 0xa) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r2 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='limits\x00') mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x100000) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0x5, 0x3, 0x248, 0x5d92, 0x9, 0x1ce, 0x7fff, 0x2}, 0x0, &(0x7f0000000140)={0x3ff, 0x80, 0x5, 0x0, 0x101, 0xafc2, 0x5, 0x1}, &(0x7f00000001c0)={r3, r4+60000000}, &(0x7f0000000280)={0x0}) fsopen(0x0, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000800000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl(r7, 0x4048aecb, 0x0) 854.601762ms ago: executing program 4 (id=2433): r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48640) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), 0x0, 0x0, 0x0, 0x1}) 799.800612ms ago: executing program 4 (id=2434): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="4600010002"], 0x8) 766.495421ms ago: executing program 4 (id=2435): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/devices/system/memory/auto_online_blocks\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)='online', 0x6) 729.114645ms ago: executing program 4 (id=2436): io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mysys\x00', 0x1ff) r0 = openat$sndtimer(0xffffff9c, &(0x7f0000000000), 0x800) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f0000000040)) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mysys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, &(0x7f0000000140)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./mysys/class/i2c-dev/i2c-0/device/new_device\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='typec_fusb302 0x22\n\x00', 0x13) r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) write(r2, &(0x7f0000000240)='typec_fusb302 0x22\n\x00', 0x13) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, &(0x7f0000000100)) r5 = socket$netlink(0x10, 0x3, 0x0) add_key(&(0x7f0000000080)='dns_resolver\x00', 0x0, &(0x7f0000000100)="26c2", 0xfffff, 0xffffffffffffffff) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=@newtaction={0x64, 0x30, 0x9e54f29ff072a93b, 0x0, 0x25dfdbfc, {}, [{0x50, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x0, 0x0, 0x8}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) r6 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r6, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0xfd}, 0x809}, {0xa, 0x4ea0, 0xe, @mcast2}, 0x2, {[0x1ff, 0x1, 0xfffffffe, 0x8, 0xffffffff, 0x208, 0xe187]}}, 0x5c) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f00000001c0)={{0x0, 0x6, 0x2, 0xfffffff9, 'syz0\x00', 0x8}, 0x27, 0x30, 0x7, 0x0, 0x0, 0x0, 'syz1\x00', &(0x7f0000000180)}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010000100000000000000000085ff090045000000000000000000000008001c00c9"], 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r8 = gettid() timer_create(0xb, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_open_dev$cec(&(0x7f0000000040), 0x0, 0x123581) 694.203219ms ago: executing program 4 (id=2437): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000480)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000180)=@attr_riscv64=@attr_aplic={0x0, 0x1, @any=0x1, &(0x7f0000000380)=0xfffffffffffffffb}) 615.134968ms ago: executing program 3 (id=2438): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$DVB_DVR_DMX_DQBUF(0xffffffffffffffff, 0xc0186f40, &(0x7f0000000040)={0x1, 0x20000000, 0x5, 0xb, 0x6, 0x86}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x9}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0x8}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xb, 0x0, 0x3, 0x6, 0x7f, 0x6}, {0x0, 0x0, 0x38, 0xef, 0x84, 0x7, 0x92, 0x54, 0x0, 0x5, 0x4, 0x7, 0x3a}], 0xffffffff}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000003240), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_mgmt(0x0, r3) sendmsg$NLBL_MGMT_C_ADD(r3, &(0x7f0000002c40)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYRES16=0x0, @ANYRES16=r4], 0x1b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c00000037000501f3fffffffedbd725017c000008000800", @ANYRES32=r5, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8050) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f0000000580)=ANY=[@ANYBLOB="3c0400000002040104000e5419360000071000000000027f09000000000001005e38000098691d239ddb1355685e00c81000565344d992d29a8b8ff30ff3839d2c75dd35aa6a614a0d31c40502f4f38420d2ec005ff9d9"], 0x30) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x4, 0x7fff, 0x3, 0x400000000], 0x80a0000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket(0x2a, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$HIDIOCGRAWNAME(0xffffffffffffffff, 0x80404804, &(0x7f0000000240)) connect$unix(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x802c550a, &(0x7f0000000540)=@urb_type_interrupt={0x1, {0xf, 0x1}, 0x1, 0x60, &(0x7f0000000300)="c0f286af6239287c9fa1362c295a1e82aae37a8bb15fa2554bed8192303103d30dac80023bebddae1ab5a357a6", 0x2d, 0x0, 0xfffffffb, 0x0, 0xe92d, 0x0, &(0x7f0000000480)}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001c00), 0x0, 0x4000090) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 447.722383ms ago: executing program 4 (id=2439): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_emit_ethernet(0xde, 0x0, 0x0) faccessat2(0xffffffffffffffff, 0x0, 0x44, 0x1000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0xfffff5d4}}, './file0\x00'}) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpid() sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) socket$rxrpc(0x21, 0x2, 0xa) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r2 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x7, 0xd44, 0x6}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='limits\x00') mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x100000) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0x5, 0x3, 0x248, 0x5d92, 0x9, 0x1ce, 0x7fff, 0x2}, 0x0, &(0x7f0000000140)={0x3ff, 0x80, 0x5, 0x0, 0x101, 0xafc2, 0x5, 0x1}, &(0x7f00000001c0)={r3, r4+60000000}, &(0x7f0000000280)={0x0}) fsopen(0x0, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000800000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl(r7, 0x4048aecb, 0x0) 216.226339ms ago: executing program 3 (id=2440): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/lru_gen\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='+ 1 0 1\v)', 0x9) 152.264702ms ago: executing program 3 (id=2441): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0xff2e) r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x3564}, 0x18, 0x0) landlock_restrict_self(r1, 0x8) 7.81948ms ago: executing program 3 (id=2442): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000200)='2', 0x1}], 0x1) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x1ec, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x1d8, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x68, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x21}}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x74b9c7924d4830a3}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x26}}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x24}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x90, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x36}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_EXPECT_NAT_TUPLE={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x78, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}]}, 0x1ec}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x8880}, 0x4) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x42}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) syz_emit_vhci(&(0x7f00000006c0)=ANY=[@ANYBLOB="02c90012000e00050017420a008000008200020a004000fde5e64210233096b1d5a6ad6ce14fb110c765c35840461ca80ba09befb3d5313a915100b6a1c9688ed2e5feb0dd0695306a29661c070f3813ebce7504667b984f0323c04664beb433e594c12fddfa3f433b49d932943060be7c43bffff40009126e9b7c4e30f59c0692d83ddde3c6e0055afebb796ad968b3dd5bd2752d33728a394fb5532255a0fdf85f117264e31524c86bd782a4b2f74ecc676bfcfaec"], 0x17) syz_clone3(&(0x7f0000000500)={0x40040000, 0x0, 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = open(&(0x7f00009e1000)='./file0\x00', 0x149040, 0x40) fcntl$setlease(r4, 0x400, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = getpid() fcntl$setownex(r5, 0xf, &(0x7f0000000100)={0x2, r6}) ioctl$sock_FIOGETOWN(r5, 0x8903, &(0x7f00000001c0)=0x0) fcntl$setown(r4, 0x8, r7) truncate(&(0x7f0000000080)='./file0\x00', 0x4) fcntl$setlease(r4, 0x400, 0x2) r8 = accept4(r0, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$team(&(0x7f0000000200), r8) 1.327117ms ago: executing program 1 (id=2443): r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000300)={&(0x7f00000002c0)=[r2], 0x1}) 0s ago: executing program 0 (id=2444): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbip-host/rebind\x00', 0x1, 0x0) write(r0, &(0x7f0000000940)='1', 0x1) kernel console output (not intermixed with test programs): leasing backup interface [ 555.842799][T12297] bond0: (slave bond_slave_1): Releasing backup interface [ 555.847996][T12297] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 555.848017][T12297] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 555.867108][T12297] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 555.867130][T12297] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 555.869021][T12297] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 555.875695][T12295] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 555.926618][T12295] netlink: 'syz.2.1362': attribute type 8 has an invalid length. [ 556.277111][T12306] syz_tun: entered allmulticast mode [ 556.452222][T12310] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 556.461022][T12310] netlink: 'syz.2.1365': attribute type 8 has an invalid length. [ 557.130760][T12319] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 557.134924][T12319] netlink: 'syz.3.1367': attribute type 8 has an invalid length. [ 557.482272][T12325] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 557.482303][T12325] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 557.482422][T12325] udc dummy_udc.0: failed to start g1: -22 [ 557.482440][T12325] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 557.484279][T12325] UDC core: g1: couldn't find an available UDC or it's busy [ 557.552969][T12327] nvme nvme0: rdma_resolve_addr failed (-19). [ 557.708069][T12330] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 558.223131][T12330] netlink: 'syz.2.1370': attribute type 8 has an invalid length. [ 558.224390][T12338] xt_CT: No such helper "syz1" [ 558.673909][T12346] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 559.176076][T12353] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 559.256556][T12346] rtrs_client L2636: : init_conns() failed: err=-ERESTARTSYS path=@ip:27.0.0.1 [:0] [ 559.694418][T12351] netlink: 'syz.0.1373': attribute type 8 has an invalid length. [ 560.347259][ T6559] usb 6-1: new full-speed USB device number 19 using dummy_hcd [ 560.522025][ T6559] usb 6-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 560.525273][ T6559] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.525298][ T6559] usb 6-1: Product: syz [ 560.525310][ T6559] usb 6-1: Manufacturer: syz [ 560.525322][ T6559] usb 6-1: SerialNumber: syz [ 560.546479][T12372] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 560.549372][T12372] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 560.560975][T12372] Invalid option length (1047276) for dns_resolver key [ 560.631545][T12373] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 560.659844][T12373] netlink: 'syz.3.1377': attribute type 8 has an invalid length. [ 560.783678][ T44] audit: type=1800 audit(1790018085.714:247): pid=12378 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1380" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 561.272410][ T6559] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 19 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 561.660791][T12380] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1380'. [ 561.963993][T12383] block nbd0: not configured, cannot reconfigure [ 562.148546][T12387] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 562.164503][T12387] netlink: 'syz.0.1383': attribute type 8 has an invalid length. [ 562.322078][T12391] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 562.741341][ T1436] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.741484][ T1436] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.093554][T12399] nvme nvme0: rdma_resolve_addr failed (-19). [ 563.443988][ T5836] usb 6-1: USB disconnect, device number 19 [ 563.458774][ T5836] usblp0: removed [ 563.604295][T11750] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 563.643611][T12404] ceph: No mds server is up or the cluster is laggy [ 563.656703][T12409] ceph: No mds server is up or the cluster is laggy [ 563.728997][T12408] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 564.093761][T12421] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 564.109123][T12421] netlink: 'syz.3.1388': attribute type 8 has an invalid length. [ 564.212194][T12419] ALSA: mixer_oss: invalid OSS volume '{ž¤~À/' [ 564.485739][T12428] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 564.498852][T12428] netlink: 'syz.2.1390': attribute type 8 has an invalid length. [ 564.703200][T12433] trusted_key: syz.0.1389 sent an empty control message without MSG_MORE. [ 564.735694][ C0] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 565.100326][T12436] 8021q: adding VLAN 0 to HW filter on device bond0 [ 565.104468][T12436] 8021q: adding VLAN 0 to HW filter on device team0 [ 565.208099][T12436] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 565.208170][T12436] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 565.213192][T12436] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 565.226628][ T5836] lo speed is unknown, defaulting to 1000 [ 565.226653][ T5836] syz0: Port: 1 Link ACTIVE [ 565.573305][T12442] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 565.581662][T12442] netlink: 'syz.0.1394': attribute type 8 has an invalid length. [ 567.319763][ T44] audit: type=1800 audit(1790018092.255:248): pid=12455 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1397" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 567.539920][T12457] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1397'. [ 569.112524][T12471] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(2.1.3), cmd(8) [ 569.444565][T12473] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 569.449564][T12473] netlink: 'syz.1.1401': attribute type 8 has an invalid length. [ 569.536980][T12477] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 569.560854][T12477] netlink: 'syz.0.1402': attribute type 8 has an invalid length. [ 570.030691][T12481] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 570.034418][T12481] netlink: 'syz.0.1403': attribute type 8 has an invalid length. [ 570.697353][T12493] ubi0: attaching mtd0 [ 570.793418][T12493] ubi0: scanning is finished [ 570.793449][T12493] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 571.126530][T12493] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 571.280416][T12497] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 571.292626][T12497] netlink: 'syz.1.1407': attribute type 8 has an invalid length. [ 572.065524][T12514] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1409'. [ 572.261833][ C3] vcan0: j1939_tp_rxtimer: 0xffff88802a6d2000: rx timeout, send abort [ 572.345401][T12514] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1409'. [ 572.655395][T12515] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 572.763207][ C3] vcan0: j1939_tp_rxtimer: 0xffff88802a6d3000: rx timeout, send abort [ 572.764273][ C3] vcan0: j1939_tp_rxtimer: 0xffff88802a6d2000: abort rx timeout. Force session deactivation [ 573.263246][ C3] vcan0: j1939_tp_rxtimer: 0xffff88802a6d3000: abort rx timeout. Force session deactivation [ 574.613154][T12526] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 574.626418][T12526] netlink: 'syz.1.1413': attribute type 8 has an invalid length. [ 574.642570][T12529] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 574.687871][T12529] md: could not open device unknown-block(1,0). [ 578.082493][ T5740] ffs_data_put(): freeing [ 578.232140][T12546] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 578.245363][T12546] netlink: 'syz.3.1419': attribute type 8 has an invalid length. [ 578.849897][T12557] syz_tun: entered allmulticast mode [ 578.876229][T12555] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 578.888237][T12555] netlink: 'syz.0.1428': attribute type 8 has an invalid length. [ 579.243191][T12567] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1421'. [ 580.486768][T12572] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 580.499592][T12572] netlink: 'syz.0.1423': attribute type 8 has an invalid length. [ 580.746326][T12577] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 580.754143][T12577] netlink: 'syz.3.1424': attribute type 8 has an invalid length. [ 581.056796][T11751] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 581.058665][T11878] tipc: Subscription rejected, illegal request [ 581.221012][T11751] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 581.222331][T11751] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 581.222355][T11751] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 581.222376][T11751] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 581.230937][T11751] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.230963][T11751] usb 6-1: Product: syz [ 581.231085][T11751] usb 6-1: Manufacturer: syz [ 581.231102][T11751] usb 6-1: SerialNumber: syz [ 581.251614][T11751] hub 6-1:1.0: bad descriptor, ignoring hub [ 581.251635][T11751] hub 6-1:1.0: probe with driver hub failed with error -5 [ 581.648876][T11751] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 20 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 581.859678][T12593] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 581.875050][T12593] netlink: 'syz.0.1429': attribute type 8 has an invalid length. [ 581.902041][T12599] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 581.902510][T12599] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 582.939854][T12608] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1432'. [ 583.013556][ T6559] usb 6-1: USB disconnect, device number 20 [ 583.018274][ T6559] usblp0: removed [ 584.283827][ T5757] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 584.305711][ T5757] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 584.311456][ T5757] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 584.321617][ T5757] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 584.322799][ T5757] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 584.398147][ T5752] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 584.402082][ T5752] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 584.409986][ T5752] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 584.436292][ T5752] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 584.442905][ T5752] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 584.832658][T12615] lo speed is unknown, defaulting to 1000 [ 584.834168][T12615] lo speed is unknown, defaulting to 1000 [ 585.110075][T12620] sctp_transport_update_pmtu: 44 callbacks suppressed [ 585.110089][T12620] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 585.110366][T12620] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 585.110640][T12620] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 585.111149][T12620] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 585.111608][T12620] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 585.119677][T12620] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 585.120339][T12620] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 585.120792][T12620] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 585.121112][T12620] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 585.121429][T12620] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 585.700815][T12615] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.700944][T12615] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.701041][T12615] bridge_slave_0: entered allmulticast mode [ 585.768337][T12615] bridge_slave_0: entered promiscuous mode [ 585.788535][T12615] bridge0: port 2(bridge_slave_1) entered blocking state [ 585.788611][T12615] bridge0: port 2(bridge_slave_1) entered disabled state [ 585.788917][T12615] bridge_slave_1: entered allmulticast mode [ 585.790247][T12615] bridge_slave_1: entered promiscuous mode [ 585.842022][T12615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 585.849736][T12615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 585.877057][T12615] team0: Port device team_slave_0 added [ 585.878810][T12615] team0: Port device team_slave_1 added [ 585.902076][T12615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 585.902086][T12615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 585.902099][T12615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 585.902923][T12615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 585.902931][T12615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 585.902943][T12615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 585.984032][T12615] hsr_slave_0: entered promiscuous mode [ 585.987555][T12615] hsr_slave_1: entered promiscuous mode [ 585.988087][T12615] debugfs: 'hsr0' already exists in 'hsr' [ 585.988104][T12615] Cannot create hsr debugfs directory [ 586.146745][T12640] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 586.159697][T12640] netlink: 'syz.0.1443': attribute type 8 has an invalid length. [ 586.215248][T12644] i2c i2c-0: Failed to register i2c client slave-24c02 at 0x22 (-16) [ 586.281624][T12642] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input30 [ 586.420435][T12642] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 586.504500][ T5752] Bluetooth: hci2: command tx timeout [ 586.738634][T12652] jffs2: notice: (12652) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 586.819582][T12655] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 586.823688][T12655] netlink: 'syz.1.1438': attribute type 8 has an invalid length. [ 587.269684][T12661] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 587.283077][T12661] netlink: 'syz.0.1439': attribute type 8 has an invalid length. [ 587.692045][T12615] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 587.830232][T12615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 587.831299][T12615] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 587.845988][T12615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 587.847191][T12615] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 587.864754][T12615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 587.865992][T12615] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 587.902020][T12615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 588.056652][T12615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 588.086873][T12615] 8021q: adding VLAN 0 to HW filter on device team0 [ 588.103458][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 588.103544][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 588.120670][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 588.120755][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 588.574462][ T5752] Bluetooth: hci2: command tx timeout [ 588.623797][T12615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 588.921880][T12615] veth0_vlan: entered promiscuous mode [ 588.928324][T12615] veth1_vlan: entered promiscuous mode [ 588.957173][T12615] veth0_macvtap: entered promiscuous mode [ 588.961250][T12615] veth1_macvtap: entered promiscuous mode [ 588.982371][T12615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 588.993383][T12615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 589.040205][T10359] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.040255][T10359] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.040354][T10359] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.040388][T10359] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.127897][ T7034] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 589.127918][ T7034] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 589.153208][ T7034] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 589.153232][ T7034] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 589.259501][T12700] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 589.264157][T12700] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 589.571845][T12705] Console: switching to colour dummy device 80x25 [ 589.849517][T12700] Invalid option length (1047276) for dns_resolver key [ 590.100959][T12707] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 590.278225][T12697] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1451'. [ 590.279348][T12697] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1451'. [ 590.280478][T12697] cgroup: Invalid name [ 590.456141][T12707] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 590.458537][T12707] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 590.460278][T12707] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 590.485789][T12707] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 590.525209][T12707] pci 0000:00:01.0: Adding to iommu group 1 [ 590.545276][T12707] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 590.545299][T12707] pci 0000:00:01.0: vgaarb: bridge control possible [ 590.545310][T12707] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 590.551162][T12707] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 590.551342][T12707] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 590.552844][T12707] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 590.562334][T12707] [drm] Found bochs VGA, ID 0xb0c5. [ 590.562350][T12707] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 590.570870][T12707] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 590.657618][ T5752] Bluetooth: hci2: command tx timeout [ 590.690730][T12707] Console: switching to colour frame buffer device 160x50 [ 590.711998][T12707] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 591.418613][T12718] Bluetooth: MGMT ver 1.23 [ 591.453921][T12719] netlink: 'syz.0.1445': attribute type 4 has an invalid length. [ 591.453943][T12719] netlink: 17 bytes leftover after parsing attributes in process `syz.0.1445'. [ 592.607948][T12730] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 592.613895][T12730] netlink: 'syz.3.1447': attribute type 8 has an invalid length. [ 592.699315][T12732] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1442'. [ 592.739642][ T5752] Bluetooth: hci2: command tx timeout [ 593.556510][T12736] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 593.572104][T12736] netlink: 'syz.3.1449': attribute type 8 has an invalid length. [ 593.999154][T12749] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1454'. [ 594.000859][T12749] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1454'. [ 594.002631][T12749] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1454'. [ 594.173329][T12751] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 594.179535][T12751] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 594.188519][T12751] Invalid option length (1047276) for dns_resolver key [ 594.306189][T12755] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 595.374228][ C0] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 595.606174][T12760] sctp_transport_update_pmtu: 45 callbacks suppressed [ 595.606197][T12760] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 595.606606][T12760] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 595.606991][T12760] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 595.607429][T12760] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 595.608772][T12760] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 595.609192][T12760] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 595.609588][T12760] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 595.609992][T12760] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 595.610389][T12760] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 595.610786][T12760] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 596.014011][T12772] netlink: 84 bytes leftover after parsing attributes in process `syz.3.1460'. [ 596.564596][T12779] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 596.566331][T12779] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 596.605354][T12779] Invalid option length (1047276) for dns_resolver key [ 597.007322][ T43] usb 8-1: new full-speed USB device number 25 using dummy_hcd [ 597.174848][ T43] usb 8-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 597.178066][ T43] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 597.178092][ T43] usb 8-1: Product: syz [ 597.178105][ T43] usb 8-1: Manufacturer: syz [ 597.178118][ T43] usb 8-1: SerialNumber: syz [ 597.626310][ T43] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 25 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 598.435056][T12787] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 598.698730][T12795] jffs2: notice: (12795) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 599.255409][T12805] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1470'. [ 599.845390][ T9] usb 8-1: USB disconnect, device number 25 [ 599.847368][T12811] overlayfs: failed to resolve './file0': -2 [ 599.854543][ T9] usblp0: removed [ 600.069907][T12820] FAULT_INJECTION: forcing a failure. [ 600.069907][T12820] name fail_futex, interval 1, probability 0, space 0, times 0 [ 600.069941][T12820] CPU: 3 UID: 0 PID: 12820 Comm: syz.3.1474 Tainted: G L syzkaller #0 PREEMPT(full) [ 600.069967][T12820] Tainted: [L]=SOFTLOCKUP [ 600.069974][T12820] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 600.069984][T12820] Call Trace: [ 600.069991][T12820] [ 600.069998][T12820] dump_stack_lvl+0x100/0x190 [ 600.070100][T12820] should_fail_ex.cold+0x5/0xa [ 600.070123][T12820] get_futex_key+0x1d0/0x14f0 [ 600.070153][T12820] ? __pfx_get_futex_key+0x10/0x10 [ 600.070208][T12820] futex_wait_setup+0x91/0x540 [ 600.070239][T12820] __futex_wait+0x19f/0x300 [ 600.070262][T12820] ? __pfx___futex_wait+0x10/0x10 [ 600.070282][T12820] ? __pfx_try_to_wake_up+0x10/0x10 [ 600.070317][T12820] ? futex_hash+0x311/0x400 [ 600.070346][T12820] ? __pfx_futex_wake_mark+0x10/0x10 [ 600.070371][T12820] ? find_held_lock+0x2b/0x80 [ 600.070390][T12820] ? futex_wake+0x4ea/0x5e0 [ 600.070415][T12820] futex_wait+0xe6/0x370 [ 600.070436][T12820] ? __pfx_futex_wait+0x10/0x10 [ 600.070463][T12820] ? putname+0xb1/0x110 [ 600.070516][T12820] ? kmem_cache_free+0x127/0x6c0 [ 600.070550][T12820] do_futex+0x265/0x440 [ 600.070569][T12820] ? __pfx_do_futex+0x10/0x10 [ 600.070585][T12820] ? __pfx_do_sys_openat2+0x10/0x10 [ 600.070616][T12820] __ia32_sys_futex_time32+0x2f4/0x470 [ 600.070639][T12820] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 600.070668][T12820] __do_fast_syscall_32+0x13a/0x8b0 [ 600.070728][T12820] do_fast_syscall_32+0x32/0x70 [ 600.070755][T12820] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 600.070777][T12820] RIP: 0023:0xf7f47fec [ 600.070796][T12820] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 600.070805][T12820] RSP: 002b:00000000f53e55bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 600.070824][T12820] RAX: ffffffffffffffda RBX: 00000000f7405020 RCX: 0000000000000080 [ 600.070836][T12820] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7405024 [ 600.070848][T12820] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 600.070859][T12820] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 600.070871][T12820] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 600.070894][T12820] [ 600.455322][T12823] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 600.464678][T12823] netlink: 'syz.1.1475': attribute type 8 has an invalid length. [ 600.640991][T12832] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 603.189361][T12857] netlink: 'syz.0.1481': attribute type 8 has an invalid length. [ 603.317447][T12866] netlink: 'syz.3.1482': attribute type 2 has an invalid length. [ 604.593747][T12883] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 604.620279][T12883] netlink: 'syz.3.1487': attribute type 8 has an invalid length. [ 605.068949][T12891] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 605.087453][T12891] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 605.093032][T12891] Invalid option length (1047276) for dns_resolver key [ 605.598552][T12896] tipc: Enabling of bearer rejected, failed to enable media [ 605.607639][ T7497] Process accounting resumed [ 605.889968][T12902] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 605.902372][T12902] netlink: 'syz.4.1492': attribute type 8 has an invalid length. [ 605.911913][T12906] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1493'. [ 608.652934][T12922] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 608.660346][T12922] netlink: 'syz.3.1497': attribute type 8 has an invalid length. [ 608.703392][T12918] netlink: 200 bytes leftover after parsing attributes in process `syz.4.1496'. [ 609.317573][T12935] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 609.319169][T12935] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 609.323992][T12935] Invalid option length (1047276) for dns_resolver key [ 609.597023][T12943] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1500'. [ 609.912104][T12947] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 611.722246][ T7032] nvmet: connect request for invalid subsystem testsubsys! [ 611.770586][T12959] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 611.879957][T12955] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1502'. [ 612.400666][T12988] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1508'. [ 612.519314][T12972] cgroup: fork rejected by pids controller in /syz0 [ 612.710990][T13006] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 612.719714][T13006] netlink: 'syz.3.1509': attribute type 8 has an invalid length. [ 613.042740][T12972] netlink: 216 bytes leftover after parsing attributes in process `syz.0.1507'. [ 613.050783][T12972] program syz.0.1507 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 613.801765][T13010] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 613.801797][T13010] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 613.804424][T13010] vhci_hcd vhci_hcd.0: Device attached [ 614.054814][ T5836] usb 45-1: new low-speed USB device number 2 using vhci_hcd [ 614.212198][T13028] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 614.218015][T13028] netlink: 'syz.1.1513': attribute type 8 has an invalid length. [ 614.402685][ T9] usb 9-1: new low-speed USB device number 2 using dummy_hcd [ 614.441186][T13031] futex_wake_op: syz.0.1512 tries to shift op by 144; fix this program [ 614.441341][T13031] futex_wake_op: syz.0.1512 tries to shift op by 144; fix this program [ 614.673830][ T9] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 614.674460][ T9] usb 9-1: config 0 has no interfaces? [ 614.674488][ T9] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.677200][ T9] usb 9-1: config 0 descriptor?? [ 614.854625][T13039] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 614.859607][T13039] netlink: 'syz.1.1514': attribute type 8 has an invalid length. [ 614.894055][ T9] usb 9-1: USB disconnect, device number 2 [ 614.901702][T13011] vhci_hcd: connection closed [ 614.904384][T11878] vhci_hcd vhci_hcd.4: stop threads [ 614.904401][T11878] vhci_hcd vhci_hcd.4: release socket [ 614.904428][T11878] vhci_hcd vhci_hcd.4: disconnect device [ 614.963703][ T5836] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 614.998549][T13042] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 615.000668][T13042] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 615.007632][T13042] Invalid option length (1047276) for dns_resolver key [ 615.056532][T13044] jffs2: notice: (13044) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 615.074249][T13044] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 615.151305][T13049] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1517'. [ 615.507948][T13053] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 615.512658][T13053] netlink: 'syz.4.1519': attribute type 8 has an invalid length. [ 615.525048][T13058] tmpfs: Bad value for 'mpol' [ 616.008161][T13072] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 616.261828][T13078] syzkaller0: entered promiscuous mode [ 616.261852][T13078] syzkaller0: entered allmulticast mode [ 616.916438][T13086] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 616.937595][T13086] netlink: 'syz.0.1527': attribute type 8 has an invalid length. [ 617.032248][T13091] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 617.060440][T13091] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 617.091160][T13091] Invalid option length (1047276) for dns_resolver key [ 618.443647][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 618.703319][T13101] netlink: 'syz.3.1530': attribute type 10 has an invalid length. [ 619.145076][T13105] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 619.148960][T13105] netlink: 'syz.0.1532': attribute type 8 has an invalid length. [ 619.267416][ T9] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 619.433678][ T9] usb 9-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 619.437233][ T9] usb 9-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 619.437254][ T9] usb 9-1: Product: syz [ 619.437261][ T9] usb 9-1: Manufacturer: syz [ 619.437268][ T9] usb 9-1: SerialNumber: syz [ 619.466347][ T9] usb 9-1: config 0 descriptor?? [ 619.481226][ T9] ch341 9-1:0.0: ch341-uart converter detected [ 619.569106][T13112] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 619.577539][T13112] netlink: 'syz.1.1534': attribute type 8 has an invalid length. [ 620.065329][T13117] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1531'. [ 620.067453][T13117] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1531'. [ 620.069419][T13117] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1531'. [ 620.083444][T13117] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1531'. [ 620.169544][T13122] futex_wake_op: syz.1.1536 tries to shift op by 144; fix this program [ 620.474705][ T9] usb 9-1: failed to receive control message: -71 [ 620.474749][ T9] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 620.476234][ T9] usb 9-1: USB disconnect, device number 3 [ 620.477441][ T9] ch341 9-1:0.0: device disconnected [ 620.529317][T13119] syz.0.1535 (13119): drop_caches: 2 [ 621.408537][T13119] lo speed is unknown, defaulting to 1000 [ 621.410280][T13119] lo speed is unknown, defaulting to 1000 [ 621.428327][T13131] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 621.439727][T13131] netlink: 'syz.4.1537': attribute type 8 has an invalid length. [ 621.874842][T13138] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1539'. [ 622.548831][T13140] siw: device registration error -23 [ 624.261887][ T1436] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.262162][ T1436] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.037495][T13152] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 625.045485][T13152] netlink: 'syz.4.1543': attribute type 8 has an invalid length. [ 625.196712][T13158] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 625.207208][T13158] netlink: 'syz.3.1544': attribute type 8 has an invalid length. [ 625.981040][T13166] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 627.266180][T13182] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 627.278165][T13182] netlink: 'syz.1.1550': attribute type 8 has an invalid length. [ 627.377426][T13178] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1549'. [ 627.498905][T13189] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 627.499279][T13188] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 627.681719][T13186] Cannot find add_set index 3 as target [ 627.775267][T13198] loop0: detected capacity change from 0 to 204800 [ 627.785443][T13198] loop1: detected capacity change from 0 to 204800 [ 627.823328][T13198] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 627.932314][ T1038] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 627.943949][T12853] usb 8-1: new low-speed USB device number 26 using dummy_hcd [ 627.989712][T13201] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 627.993458][T13201] netlink: 'syz.4.1556': attribute type 8 has an invalid length. [ 628.078372][T13198] md/raid1:md0: active with 1 out of 2 mirrors [ 628.090389][T13198] md0: detected capacity change from 0 to 2048 [ 628.092316][ T1038] usb 6-1: Using ep0 maxpacket: 32 [ 628.101261][ T1038] usb 6-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 628.102906][T13206] md_update_sb: can't update sb for read-only array md0 [ 628.112890][T12853] usb 8-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 628.114260][T12853] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 628.114280][T12853] usb 8-1: config 0 has no interfaces? [ 628.114301][T12853] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 628.119404][T12853] usb 8-1: config 0 descriptor?? [ 628.129698][ T1038] usb 6-1: config 0 has an invalid interface number: 196 but max is 0 [ 628.129723][ T1038] usb 6-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 628.129802][ T1038] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 628.129819][ T1038] usb 6-1: config 0 has no interface number 0 [ 628.129849][ T1038] usb 6-1: config 0 interface 196 altsetting 128 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 628.129870][ T1038] usb 6-1: config 0 interface 196 has no altsetting 0 [ 628.165017][ T1038] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 628.165039][ T1038] usb 6-1: Product: syz [ 628.165049][ T1038] usb 6-1: Manufacturer: syz [ 628.165059][ T1038] usb 6-1: SerialNumber: syz [ 628.182804][ T1038] usb 6-1: config 0 descriptor?? [ 629.597358][ T43] usb 8-1: USB disconnect, device number 26 [ 629.977562][T13222] sctp_transport_update_pmtu: 47 callbacks suppressed [ 629.977582][T13222] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 629.979524][T13222] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 629.980956][T13222] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 629.981547][T13222] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 629.993671][T13222] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 629.998355][T13222] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 630.003909][T13222] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 630.009962][T13222] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 630.014245][T13222] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 630.015061][T13222] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 630.050098][ T1038] usb 6-1: USB disconnect, device number 21 [ 630.165365][T13224] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 630.169715][T13224] netlink: 'syz.3.1561': attribute type 8 has an invalid length. [ 630.275747][T13228] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 630.277778][T13228] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 630.282516][T13228] Invalid option length (1047276) for dns_resolver key [ 630.373407][ T0] NOHZ tick-stop error: local softirq work is pending, handler #242!!! [ 630.720280][T13240] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 630.720302][T13240] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 630.780214][T13242] overlayfs: failed to resolve './file0/file0': -2 [ 630.802194][ T1038] usb 8-1: new high-speed USB device number 27 using dummy_hcd [ 630.953029][ T1038] usb 8-1: Using ep0 maxpacket: 32 [ 630.954447][ T1038] usb 8-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 630.958631][ T1038] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 630.958656][ T1038] usb 8-1: config 0 has no interface number 0 [ 630.977570][ T1038] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 630.977595][ T1038] usb 8-1: Product: syz [ 630.977607][ T1038] usb 8-1: Manufacturer: syz [ 630.977624][ T1038] usb 8-1: SerialNumber: syz [ 631.037324][ T1038] usb 8-1: config 0 descriptor?? [ 631.059512][ T1038] usb 8-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 631.059586][ T1038] usb 8-1: selecting invalid altsetting 1 [ 631.059604][ T1038] usb 8-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 631.093168][T13249] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 631.126083][T13237] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1566'. [ 631.166323][T13247] netlink: 'syz.1.1568': attribute type 8 has an invalid length. [ 631.465494][ T1038] usb 8-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 631.484039][ T1038] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 631.484092][ T1038] usb 8-1: media controller created [ 631.588075][ T1038] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 631.781428][T13232] netlink: 'syz.3.1565': attribute type 1 has an invalid length. [ 631.781499][T13232] netlink: 244 bytes leftover after parsing attributes in process `syz.3.1565'. [ 631.972006][ T1038] usb 8-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 631.972078][ T1038] zl10353_read_register: readreg error (reg=127, ret==-71) [ 631.972491][ T1038] usb 8-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 632.039416][ T1038] usb 8-1: USB disconnect, device number 27 [ 632.226440][T13253] gadgetfs: bound to dummy_udc driver [ 632.640288][T13261] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 632.850044][T13266] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 632.887027][T13266] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 633.618684][T13271] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 633.625903][T13271] netlink: 'syz.0.1574': attribute type 8 has an invalid length. [ 633.954539][T13280] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 633.969047][T13280] netlink: 'syz.3.1577': attribute type 8 has an invalid length. [ 633.994820][T13284] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 634.006007][T13284] netlink: 'syz.4.1578': attribute type 8 has an invalid length. [ 635.001533][T13299] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 635.100738][T13206] md_update_sb: can't update sb for read-only array md0 [ 635.172948][T13299] md: could not open device unknown-block(1,0). [ 635.181146][T13206] md_update_sb: can't update sb for read-only array md0 [ 635.237681][T13206] md_update_sb: can't update sb for read-only array md0 [ 637.124985][T13315] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 637.174264][T13312] netlink: 'syz.3.1587': attribute type 8 has an invalid length. [ 637.525540][T13330] netlink: 'syz.1.1588': attribute type 8 has an invalid length. [ 637.692092][T13327] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 638.204456][T13339] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1591'. [ 639.442940][ T5752] Bluetooth: hci2: link tx timeout [ 639.443110][ T5752] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 639.526235][T13345] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 639.705529][T13336] syz.3.1590 (13336): drop_caches: 2 [ 640.132351][T13356] nvmet: adding nsid 1 to subsystem testsubsys [ 640.160422][T13356] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 640.227950][T13336] lo speed is unknown, defaulting to 1000 [ 640.229912][T13336] lo speed is unknown, defaulting to 1000 [ 640.260847][T13023] nvmet: Created nvm controller 1 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:e7f8b533-274c-4991-b626-a69af7cb5dfa. [ 640.356344][T13356] nvme nvme0: creating 3 I/O queues. [ 640.392150][T13356] nvme nvme0: new ctrl: "testsubsys" [ 640.973411][T13369] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 641.082397][T13369] netlink: 'syz.4.1599': attribute type 8 has an invalid length. [ 641.296245][T13378] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 641.319835][T13378] netlink: 'syz.0.1601': attribute type 8 has an invalid length. [ 641.327269][T13377] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 641.397473][T13377] netlink: 'syz.1.1602': attribute type 8 has an invalid length. [ 641.453693][ T5757] Bluetooth: hci2: command 0x0406 tx timeout [ 642.040042][T13386] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 642.052190][T13386] netlink: 'syz.4.1603': attribute type 8 has an invalid length. [ 643.040757][T13401] gadgetfs: bound to dummy_udc driver [ 643.044899][T13406] futex_wake_op: syz.4.1610 tries to shift op by -1; fix this program [ 643.386255][T13410] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 643.472075][T13206] md_update_sb: can't update sb for read-only array md0 [ 643.632003][T13411] md: could not open device unknown-block(1,0). [ 643.672731][T13411] md: could not open device unknown-block(1,1). [ 643.919404][T13414] netlink: 'syz.1.1613': attribute type 8 has an invalid length. [ 643.961557][T13416] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 644.959810][T13421] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1616'. [ 646.273462][T13438] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 646.303708][T13440] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 646.310847][T13440] netlink: 'syz.4.1618': attribute type 8 has an invalid length. [ 646.608262][T13452] Cannot find add_set index 3 as target [ 646.668751][T13454] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 646.676986][T13454] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 646.687154][T13454] Invalid option length (1047276) for dns_resolver key [ 646.783190][T13456] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 646.796800][T13456] netlink: 'syz.1.1624': attribute type 8 has an invalid length. [ 646.925806][T13460] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 647.106209][T13025] nvmet: Created nvm controller 2 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:e7f8b533-274c-4991-b626-a69af7cb5dfa. [ 647.155168][T13465] nvme nvme1: creating 3 I/O queues. [ 647.166543][T13465] nvme nvme1: new ctrl: "testsubsys" [ 647.439450][T13472] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 648.155392][T13480] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 648.282682][T13481] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1629'. [ 648.840695][T13493] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 648.845854][T13493] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 648.850552][T13493] Invalid option length (1047276) for dns_resolver key [ 648.951009][ T50] usb 8-1: new high-speed USB device number 28 using dummy_hcd [ 648.965191][T13495] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 648.973906][T13495] netlink: 'syz.4.1633': attribute type 8 has an invalid length. [ 649.113053][ T50] usb 8-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 649.117817][ T50] usb 8-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 649.117840][ T50] usb 8-1: Product: syz [ 649.117852][ T50] usb 8-1: Manufacturer: syz [ 649.117864][ T50] usb 8-1: SerialNumber: syz [ 649.120281][ T50] usb 8-1: config 0 descriptor?? [ 649.148563][ T50] ch341 8-1:0.0: ch341-uart converter detected [ 649.459271][T13500] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1631'. [ 649.499792][T13500] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1631'. [ 649.509364][T13500] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1631'. [ 649.512803][T13500] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1631'. [ 649.522192][T13500] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1631'. [ 650.205957][ T50] usb 8-1: failed to receive control message: -110 [ 650.206010][ T50] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -110 [ 650.518793][T13505] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 650.537981][ T9] usb 8-1: USB disconnect, device number 28 [ 651.342506][ T9] ch341 8-1:0.0: device disconnected [ 651.347894][T13507] syz.4.1638 (13507): drop_caches: 2 [ 651.717876][T13518] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 651.743130][T13518] Invalid option length (1047276) for dns_resolver key [ 651.847215][T13524] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 651.856485][T13524] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 651.879679][T13524] Invalid option length (1047276) for dns_resolver key [ 652.027900][T13525] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 653.641619][T13525] rtrs_client L2636: : init_conns() failed: err=-ERESTARTSYS path=@ip:27.0.0.1 [:0] [ 653.978436][T13545] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1646'. [ 653.982054][T13545] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1646'. [ 654.167112][ C2] vcan0: j1939_tp_rxtimer: 0xffff88802afbfc00: rx timeout, send abort [ 654.278238][T13542] FAULT_INJECTION: forcing a failure. [ 654.278238][T13542] name failslab, interval 1, probability 0, space 0, times 0 [ 654.278327][T13542] CPU: 2 UID: 0 PID: 13542 Comm: syz.3.1643 Tainted: G L syzkaller #0 PREEMPT(full) [ 654.278360][T13542] Tainted: [L]=SOFTLOCKUP [ 654.278369][T13542] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 654.278382][T13542] Call Trace: [ 654.278389][T13542] [ 654.278396][T13542] dump_stack_lvl+0x100/0x190 [ 654.278454][T13542] should_fail_ex.cold+0x5/0xa [ 654.278484][T13542] should_failslab+0xc2/0x120 [ 654.278517][T13542] kmem_cache_alloc_noprof+0x92/0x6a0 [ 654.278542][T13542] ? seq_open+0x55/0x170 [ 654.278576][T13542] ? __pfx_snd_info_seq_show+0x10/0x10 [ 654.278659][T13542] seq_open+0x55/0x170 [ 654.278690][T13542] ? __pfx_snd_info_seq_show+0x10/0x10 [ 654.278721][T13542] single_open+0xfc/0x1d0 [ 654.278753][T13542] snd_info_text_entry_open+0x258/0x2d0 [ 654.278783][T13542] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 654.278813][T13542] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 654.278837][T13542] ? proc_reg_open+0x23f/0x5f0 [ 654.278866][T13542] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 654.278893][T13542] proc_reg_open+0x2ab/0x5f0 [ 654.278946][T13542] do_dentry_open+0x6ab/0x14d0 [ 654.278971][T13542] ? __pfx_proc_reg_open+0x10/0x10 [ 654.279003][T13542] vfs_open+0x82/0x3f0 [ 654.279048][T13542] path_openat+0x19fa/0x2440 [ 654.279080][T13542] ? __pfx_path_openat+0x10/0x10 [ 654.279112][T13542] do_file_open+0x20e/0x430 [ 654.279140][T13542] ? __pfx_do_file_open+0x10/0x10 [ 654.279178][T13542] ? _raw_spin_unlock+0x28/0x50 [ 654.279211][T13542] ? alloc_fd+0x471/0x7a0 [ 654.279242][T13542] do_sys_openat2+0x10f/0x1e0 [ 654.279271][T13542] ? __pfx_do_sys_openat2+0x10/0x10 [ 654.279306][T13542] __ia32_compat_sys_openat+0x12d/0x210 [ 654.279337][T13542] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 654.279365][T13542] ? find_held_lock+0x2b/0x80 [ 654.279488][T13542] ? trace_syscall_enter+0xcc/0x120 [ 654.279527][T13542] __do_fast_syscall_32+0x13a/0x8b0 [ 654.279564][T13542] do_fast_syscall_32+0x32/0x70 [ 654.279587][T13542] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 654.279607][T13542] RIP: 0023:0xf7f47fec [ 654.279631][T13542] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 654.279640][T13542] RSP: 002b:00000000f53e550c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 654.279660][T13542] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000340 [ 654.279673][T13542] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 654.279683][T13542] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 654.279695][T13542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 654.279708][T13542] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 654.279732][T13542] [ 654.667247][ C2] vcan0: j1939_tp_rxtimer: 0xffff88802afbfc00: abort rx timeout. Force session deactivation [ 654.667350][ C2] vcan0: j1939_tp_rxtimer: 0xffff888000c6d000: rx timeout, send abort [ 654.718980][T13549] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 655.170946][ C2] vcan0: j1939_tp_rxtimer: 0xffff888000c6d000: abort rx timeout. Force session deactivation [ 655.196278][T13557] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 655.316282][T13557] Invalid option length (1047276) for dns_resolver key [ 655.576490][T13563] overlayfs: failed to resolve './file0': -2 [ 655.821616][T13565] netlink: 'syz.1.1654': attribute type 4 has an invalid length. [ 655.821637][T13565] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1654'. [ 656.412300][T13579] FAULT_INJECTION: forcing a failure. [ 656.412300][T13579] name failslab, interval 1, probability 0, space 0, times 0 [ 656.412343][T13579] CPU: 0 UID: 0 PID: 13579 Comm: syz.4.1656 Tainted: G L syzkaller #0 PREEMPT(full) [ 656.412375][T13579] Tainted: [L]=SOFTLOCKUP [ 656.412384][T13579] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 656.412397][T13579] Call Trace: [ 656.412405][T13579] [ 656.412414][T13579] dump_stack_lvl+0x100/0x190 [ 656.412450][T13579] should_fail_ex.cold+0x5/0xa [ 656.412479][T13579] should_failslab+0xc2/0x120 [ 656.412508][T13579] kmem_cache_alloc_noprof+0x92/0x6a0 [ 656.412534][T13579] ? seq_open+0x55/0x170 [ 656.412569][T13579] ? __pfx_snd_info_seq_show+0x10/0x10 [ 656.412603][T13579] seq_open+0x55/0x170 [ 656.412634][T13579] ? __pfx_snd_info_seq_show+0x10/0x10 [ 656.412665][T13579] single_open+0xfc/0x1d0 [ 656.412698][T13579] snd_info_text_entry_open+0x258/0x2d0 [ 656.412732][T13579] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 656.412764][T13579] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 656.412788][T13579] ? proc_reg_open+0x23f/0x5f0 [ 656.412817][T13579] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 656.412852][T13579] proc_reg_open+0x2ab/0x5f0 [ 656.412882][T13579] do_dentry_open+0x6ab/0x14d0 [ 656.412905][T13579] ? __pfx_proc_reg_open+0x10/0x10 [ 656.412939][T13579] vfs_open+0x82/0x3f0 [ 656.412972][T13579] path_openat+0x19fa/0x2440 [ 656.413003][T13579] ? __pfx_path_openat+0x10/0x10 [ 656.413044][T13579] do_file_open+0x20e/0x430 [ 656.413073][T13579] ? __pfx_do_file_open+0x10/0x10 [ 656.413140][T13579] ? _raw_spin_unlock+0x28/0x50 [ 656.413170][T13579] ? alloc_fd+0x471/0x7a0 [ 656.413203][T13579] do_sys_openat2+0x10f/0x1e0 [ 656.413234][T13579] ? __pfx_do_sys_openat2+0x10/0x10 [ 656.413273][T13579] __ia32_compat_sys_openat+0x12d/0x210 [ 656.413305][T13579] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 656.413335][T13579] ? find_held_lock+0x2b/0x80 [ 656.413358][T13579] ? trace_syscall_enter+0xcc/0x120 [ 656.413399][T13579] __do_fast_syscall_32+0x13a/0x8b0 [ 656.413435][T13579] do_fast_syscall_32+0x32/0x70 [ 656.413467][T13579] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 656.413494][T13579] RIP: 0023:0xf7fe5fec [ 656.413518][T13579] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 656.413527][T13579] RSP: 002b:00000000f548550c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 656.413547][T13579] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000340 [ 656.413562][T13579] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 656.413575][T13579] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 656.413587][T13579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 656.413600][T13579] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 656.413628][T13579] [ 657.628712][T13589] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 658.952748][T13598] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 658.959298][T13598] Invalid option length (1047276) for dns_resolver key [ 659.013339][T13596] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 659.025162][T13603] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 659.078469][T13206] md_update_sb: can't update sb for read-only array md0 [ 659.228118][T13609] md: could not open device unknown-block(1,0). [ 659.229943][T13603] md: could not open device unknown-block(1,1). [ 660.719077][T13626] gadgetfs: bound to dummy_udc driver [ 660.928592][T13636] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 661.247173][T13639] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 661.251705][T13639] netlink: 'syz.4.1671': attribute type 8 has an invalid length. [ 661.646156][T13644] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 661.660879][T13644] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 661.692376][T13644] Invalid option length (1047276) for dns_resolver key [ 662.125180][T12853] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 662.125972][ T43] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 662.155683][T13670] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1676'. [ 662.552779][ T43] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 662.715034][T13663] ceph: No mds server is up or the cluster is laggy [ 662.715197][T13659] ceph: No mds server is up or the cluster is laggy [ 662.723222][ T43] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 663.332279][T12853] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 663.469410][T13682] netlink: 'syz.3.1677': attribute type 8 has an invalid length. [ 664.016720][T13684] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 664.060902][T13684] netlink: 'syz.1.1678': attribute type 8 has an invalid length. [ 664.649060][T13697] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 664.652678][T13697] netlink: 'syz.0.1681': attribute type 8 has an invalid length. [ 664.960974][T13703] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 664.976453][T13703] netlink: 'syz.1.1682': attribute type 8 has an invalid length. [ 665.688544][T13717] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 665.696523][T13717] netlink: 'syz.0.1686': attribute type 8 has an invalid length. [ 666.180910][T13728] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 666.210371][T13728] netlink: 'syz.4.1689': attribute type 8 has an invalid length. [ 666.538281][T13735] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 666.598834][T13737] overlayfs: failed to resolve './file0/file0': -2 [ 666.812500][T13741] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 666.831975][T13741] netlink: 'syz.1.1692': attribute type 8 has an invalid length. [ 667.190840][T13739] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1691'. [ 667.196963][T13739] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1691'. [ 667.213004][T13739] cgroup: Invalid name [ 667.730099][T13756] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 667.734636][T13754] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 668.369678][T13780] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 668.377463][T13780] netlink: 'syz.4.1699': attribute type 8 has an invalid length. [ 668.878166][T13798] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1702'. [ 670.603859][T13804] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 670.608762][T13804] netlink: 'syz.4.1703': attribute type 8 has an invalid length. [ 671.960934][T13826] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 671.971306][T13826] netlink: 'syz.4.1709': attribute type 8 has an invalid length. [ 672.274682][T13844] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 672.980683][T13858] ubi0: attaching mtd0 [ 672.987025][T13858] ubi0: scanning is finished [ 672.987104][T13858] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 673.263805][T13860] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 673.268766][T13860] netlink: 'syz.3.1717': attribute type 8 has an invalid length. [ 673.312859][T13858] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 674.914688][T13891] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 675.026603][T13898] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 675.030637][T13898] netlink: 'syz.1.1723': attribute type 8 has an invalid length. [ 675.728262][T13907] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1726'. [ 675.733709][T13911] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 675.750412][T13911] netlink: 'syz.3.1734': attribute type 8 has an invalid length. [ 676.141638][T11751] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 676.253926][T13919] ceph: No mds server is up or the cluster is laggy [ 676.263449][T13916] ceph: No mds server is up or the cluster is laggy [ 676.354675][ C2] hpet: Lost 1 RTC interrupts [ 676.410619][T11751] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 676.748934][T13927] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 676.855797][T13927] netlink: 'syz.3.1728': attribute type 8 has an invalid length. [ 677.900780][T13956] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 677.906593][T13956] netlink: 'syz.4.1736': attribute type 8 has an invalid length. [ 678.203579][T13964] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 678.208573][T13964] netlink: 'syz.1.1737': attribute type 8 has an invalid length. [ 678.809550][T12853] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 678.969320][T12853] usb 9-1: Using ep0 maxpacket: 32 [ 678.970185][T12853] usb 9-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 678.972652][T12853] usb 9-1: config 0 has an invalid interface number: 196 but max is 0 [ 678.972674][T12853] usb 9-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 678.972688][T12853] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 678.972701][T12853] usb 9-1: config 0 has no interface number 0 [ 678.972729][T12853] usb 9-1: config 0 interface 196 altsetting 128 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 678.972745][T12853] usb 9-1: config 0 interface 196 has no altsetting 0 [ 678.974937][T12853] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 678.974953][T12853] usb 9-1: Product: syz [ 678.974961][T12853] usb 9-1: Manufacturer: syz [ 678.974969][T12853] usb 9-1: SerialNumber: syz [ 678.977593][T12853] usb 9-1: config 0 descriptor?? [ 679.418828][T12853] usb 9-1: USB disconnect, device number 4 [ 680.026442][T13979] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 680.031481][T13979] netlink: 'syz.1.1743': attribute type 8 has an invalid length. [ 680.040157][ T1038] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 680.093738][T11751] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 680.256688][T13987] ceph: No mds server is up or the cluster is laggy [ 680.257418][T13980] ceph: No mds server is up or the cluster is laggy [ 680.312018][ T1038] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 680.508992][ C2] hpet: Lost 1 RTC interrupts [ 680.804254][T14009] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 680.815395][T14009] netlink: 'syz.0.1746': attribute type 8 has an invalid length. [ 681.052349][T14016] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1747'. [ 681.376766][T14015] syz.1.1748 (14015): drop_caches: 2 [ 682.412638][T14023] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 682.435663][T14023] netlink: 'syz.0.1757': attribute type 8 has an invalid length. [ 683.870053][T14039] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 683.875852][T14039] netlink: 'syz.3.1754': attribute type 8 has an invalid length. [ 683.933652][T14034] syz.4.1751 (14034): drop_caches: 2 [ 684.003280][T14045] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1762'. [ 684.145274][T14050] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 685.137626][T14055] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 685.147322][T14055] netlink: 'syz.3.1756': attribute type 8 has an invalid length. [ 685.614638][ T1436] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.614678][ T1436] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.255062][T14082] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 686.260512][T14082] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 686.275556][T14082] Invalid option length (1047276) for dns_resolver key [ 686.483038][T14084] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 686.499098][T14084] netlink: 'syz.1.1767': attribute type 8 has an invalid length. [ 687.706497][T14099] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 687.713635][T14099] netlink: 'syz.0.1771': attribute type 8 has an invalid length. [ 687.848540][T14105] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1768'. [ 688.154517][T14105] sctp_transport_update_pmtu: 101 callbacks suppressed [ 688.154572][T14105] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 688.157597][T14105] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 688.160163][T14105] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 688.161880][T14105] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 688.163420][T14105] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 688.165728][T14105] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 688.167851][T14105] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 688.168120][T14105] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 688.168930][T14105] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 688.169373][T14105] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 689.608678][ C3] e1000e 0000:00:02.0 eth1: NETDEV WATCHDOG: CPU: 3: transmit queue 0 timed out 5560 ms [ 689.788011][T12853] e1000e 0000:00:02.0 eth1: Reset adapter unexpectedly [ 689.930465][T12853] e1000e 0000:00:02.0: Interrupt Throttle Rate off [ 690.287149][T14129] netlink: 'syz.0.1776': attribute type 8 has an invalid length. [ 690.668158][T14138] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 690.681964][T14138] netlink: 'syz.4.1780': attribute type 8 has an invalid length. [ 691.110121][T14141] xt_CT: No such helper "syz1" [ 691.439578][T14151] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1781'. [ 692.824854][T14158] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1783'. [ 694.244828][T14168] syz.0.1787 (14168): drop_caches: 2 [ 696.955066][T12853] e1000e 0000:00:02.0 eth1: Hardware Error [ 697.144951][T12853] e1000e 0000:00:02.0: Some CPU C-states have been disabled in order to enable jumbo frames [ 697.420267][T14171] lo speed is unknown, defaulting to 1000 [ 697.422535][T14171] lo speed is unknown, defaulting to 1000 [ 698.427148][T14215] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1798'. [ 698.444232][T14213] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 698.454439][T14213] netlink: 'syz.0.1797': attribute type 8 has an invalid length. [ 698.512942][T14209] syz.4.1795 (14209): drop_caches: 2 [ 698.727806][ T5752] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 698.857330][T14209] lo speed is unknown, defaulting to 1000 [ 698.879063][T14209] lo speed is unknown, defaulting to 1000 [ 698.910913][T14227] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 698.947717][T14227] netlink: 'syz.0.1802': attribute type 8 has an invalid length. [ 699.576918][T14243] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 699.618489][T14243] netlink: 'syz.0.1806': attribute type 8 has an invalid length. [ 700.290860][T14264] FAULT_INJECTION: forcing a failure. [ 700.290860][T14264] name failslab, interval 1, probability 0, space 0, times 0 [ 700.290893][T14264] CPU: 0 UID: 0 PID: 14264 Comm: syz.1.1812 Tainted: G L syzkaller #0 PREEMPT(full) [ 700.290922][T14264] Tainted: [L]=SOFTLOCKUP [ 700.290930][T14264] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 700.290942][T14264] Call Trace: [ 700.290949][T14264] [ 700.290957][T14264] dump_stack_lvl+0x100/0x190 [ 700.290986][T14264] should_fail_ex.cold+0x5/0xa [ 700.291011][T14264] should_failslab+0xc2/0x120 [ 700.291039][T14264] __kmalloc_cache_noprof+0x91/0x6d0 [ 700.291069][T14264] ? single_open+0x4d/0x1d0 [ 700.291097][T14264] ? __pfx_snd_info_seq_show+0x10/0x10 [ 700.291122][T14264] single_open+0x4d/0x1d0 [ 700.291169][T14264] snd_info_text_entry_open+0x258/0x2d0 [ 700.291197][T14264] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 700.291223][T14264] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 700.291241][T14264] ? proc_reg_open+0x23f/0x5f0 [ 700.291267][T14264] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 700.291295][T14264] proc_reg_open+0x2ab/0x5f0 [ 700.291320][T14264] do_dentry_open+0x6ab/0x14d0 [ 700.291340][T14264] ? __pfx_proc_reg_open+0x10/0x10 [ 700.291366][T14264] vfs_open+0x82/0x3f0 [ 700.291391][T14264] path_openat+0x19fa/0x2440 [ 700.291418][T14264] ? __pfx_path_openat+0x10/0x10 [ 700.291446][T14264] do_file_open+0x20e/0x430 [ 700.291470][T14264] ? __pfx_do_file_open+0x10/0x10 [ 700.291504][T14264] ? _raw_spin_unlock+0x28/0x50 [ 700.291527][T14264] ? alloc_fd+0x471/0x7a0 [ 700.291555][T14264] do_sys_openat2+0x10f/0x1e0 [ 700.291581][T14264] ? __pfx_do_sys_openat2+0x10/0x10 [ 700.291613][T14264] __ia32_compat_sys_openat+0x12d/0x210 [ 700.291639][T14264] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 700.291665][T14264] ? find_held_lock+0x2b/0x80 [ 700.291686][T14264] ? trace_syscall_enter+0xcc/0x120 [ 700.291720][T14264] __do_fast_syscall_32+0x13a/0x8b0 [ 700.291747][T14264] do_fast_syscall_32+0x32/0x70 [ 700.291776][T14264] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 700.291798][T14264] RIP: 0023:0xf7fc7fec [ 700.291819][T14264] Code: Unable to access opcode bytes at 0xf7fc7fc2. [ 700.291836][T14264] RSP: 002b:00000000f546550c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 700.291855][T14264] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000340 [ 700.291868][T14264] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 700.291880][T14264] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 700.291892][T14264] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 700.291905][T14264] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 700.291930][T14264] [ 700.519993][T14269] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 700.531705][T14269] netlink: 'syz.4.1814': attribute type 8 has an invalid length. [ 700.900265][T14278] syz.4.1818 (14278): drop_caches: 2 [ 701.069956][ T5752] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 701.153945][T14278] lo speed is unknown, defaulting to 1000 [ 701.158288][T14278] lo speed is unknown, defaulting to 1000 [ 701.352270][T14289] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 701.373005][T14289] netlink: 'syz.0.1822': attribute type 8 has an invalid length. [ 701.400297][T14284] syz.1.1820 (14284): drop_caches: 2 [ 701.635762][T14294] netlink: 'syz.0.1824': attribute type 8 has an invalid length. [ 701.705776][ C2] hpet: Lost 1 RTC interrupts [ 701.959986][T14284] lo speed is unknown, defaulting to 1000 [ 701.980076][T14284] lo speed is unknown, defaulting to 1000 [ 702.019746][T14298] Invalid option length (1047276) for dns_resolver key [ 702.065412][T14301] netlink: 180 bytes leftover after parsing attributes in process `syz.3.1826'. [ 702.477471][T14310] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 702.485616][T14310] netlink: 'syz.4.1829': attribute type 8 has an invalid length. [ 702.825909][T14317] syz.3.1831 (14317): drop_caches: 2 [ 703.022353][T14321] netlink: 'syz.4.1833': attribute type 8 has an invalid length. [ 703.263536][T14331] Invalid option length (1047276) for dns_resolver key [ 703.401842][T14337] syz.0.1837 (14337): drop_caches: 2 [ 703.636428][T14341] syz.4.1839 (14341): drop_caches: 2 [ 703.803217][ T5752] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 703.831873][T14341] lo speed is unknown, defaulting to 1000 [ 703.833186][T14341] lo speed is unknown, defaulting to 1000 [ 703.918212][T14337] lo speed is unknown, defaulting to 1000 [ 703.958379][T14317] lo speed is unknown, defaulting to 1000 [ 703.960074][T14317] lo speed is unknown, defaulting to 1000 [ 704.013200][T14337] lo speed is unknown, defaulting to 1000 [ 704.804181][T14365] FAULT_INJECTION: forcing a failure. [ 704.804181][T14365] name failslab, interval 1, probability 0, space 0, times 0 [ 704.804216][T14365] CPU: 2 UID: 0 PID: 14365 Comm: syz.4.1845 Tainted: G L syzkaller #0 PREEMPT(full) [ 704.804241][T14365] Tainted: [L]=SOFTLOCKUP [ 704.804249][T14365] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 704.804262][T14365] Call Trace: [ 704.804268][T14365] [ 704.804275][T14365] dump_stack_lvl+0x100/0x190 [ 704.804302][T14365] should_fail_ex.cold+0x5/0xa [ 704.804334][T14365] should_failslab+0xc2/0x120 [ 704.804358][T14365] __kmalloc_cache_noprof+0x91/0x6d0 [ 704.804386][T14365] ? single_open+0x4d/0x1d0 [ 704.804413][T14365] ? __pfx_snd_info_seq_show+0x10/0x10 [ 704.804441][T14365] single_open+0x4d/0x1d0 [ 704.804471][T14365] snd_info_text_entry_open+0x258/0x2d0 [ 704.804503][T14365] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 704.804530][T14365] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 704.804552][T14365] ? proc_reg_open+0x23f/0x5f0 [ 704.804578][T14365] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 704.804607][T14365] proc_reg_open+0x2ab/0x5f0 [ 704.804632][T14365] do_dentry_open+0x6ab/0x14d0 [ 704.804652][T14365] ? __pfx_proc_reg_open+0x10/0x10 [ 704.804735][T14365] vfs_open+0x82/0x3f0 [ 704.804802][T14365] path_openat+0x19fa/0x2440 [ 704.804832][T14365] ? __pfx_path_openat+0x10/0x10 [ 704.804903][T14365] do_file_open+0x20e/0x430 [ 704.804931][T14365] ? __pfx_do_file_open+0x10/0x10 [ 704.805007][T14365] ? _raw_spin_unlock+0x28/0x50 [ 704.805034][T14365] ? alloc_fd+0x471/0x7a0 [ 704.805102][T14365] do_sys_openat2+0x10f/0x1e0 [ 704.805130][T14365] ? __pfx_do_sys_openat2+0x10/0x10 [ 704.805218][T14365] __ia32_compat_sys_openat+0x12d/0x210 [ 704.805246][T14365] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 704.805269][T14365] ? find_held_lock+0x2b/0x80 [ 704.805289][T14365] ? trace_syscall_enter+0xcc/0x120 [ 704.805371][T14365] __do_fast_syscall_32+0x13a/0x8b0 [ 704.805464][T14365] do_fast_syscall_32+0x32/0x70 [ 704.805496][T14365] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 704.805558][T14365] RIP: 0023:0xf7fe5fec [ 704.805581][T14365] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 704.805589][T14365] RSP: 002b:00000000f548550c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 704.805608][T14365] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000340 [ 704.805620][T14365] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 704.805631][T14365] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 704.805641][T14365] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 704.805651][T14365] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 704.805716][T14365] [ 705.187846][T14373] netlink: 'syz.0.1847': attribute type 8 has an invalid length. [ 705.313355][T14379] Invalid option length (1047276) for dns_resolver key [ 705.543553][T14388] syz.3.1853 (14388): drop_caches: 2 [ 705.697060][T14382] syz.1.1850 (14382): drop_caches: 2 [ 705.830529][T14382] lo speed is unknown, defaulting to 1000 [ 705.832657][T14382] lo speed is unknown, defaulting to 1000 [ 706.032065][T14388] lo speed is unknown, defaulting to 1000 [ 706.033284][T14388] lo speed is unknown, defaulting to 1000 [ 706.229519][T14400] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 706.253037][T14400] netlink: 'syz.0.1856': attribute type 8 has an invalid length. [ 706.556842][T14407] Invalid option length (1047276) for dns_resolver key [ 706.768465][T14415] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 706.776078][T14415] netlink: 'syz.0.1862': attribute type 8 has an invalid length. [ 706.849271][T14425] FAULT_INJECTION: forcing a failure. [ 706.849271][T14425] name failslab, interval 1, probability 0, space 0, times 0 [ 706.849377][T14425] CPU: 0 UID: 0 PID: 14425 Comm: syz.1.1863 Tainted: G L syzkaller #0 PREEMPT(full) [ 706.849403][T14425] Tainted: [L]=SOFTLOCKUP [ 706.849410][T14425] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 706.849420][T14425] Call Trace: [ 706.849426][T14425] [ 706.849433][T14425] dump_stack_lvl+0x100/0x190 [ 706.849462][T14425] should_fail_ex.cold+0x5/0xa [ 706.849485][T14425] should_failslab+0xc2/0x120 [ 706.849524][T14425] kmem_cache_alloc_noprof+0x92/0x6a0 [ 706.849545][T14425] ? seq_open+0x55/0x170 [ 706.849569][T14425] ? __pfx_snd_info_seq_show+0x10/0x10 [ 706.849595][T14425] seq_open+0x55/0x170 [ 706.849617][T14425] ? __pfx_snd_info_seq_show+0x10/0x10 [ 706.849639][T14425] single_open+0xfc/0x1d0 [ 706.849664][T14425] snd_info_text_entry_open+0x258/0x2d0 [ 706.849688][T14425] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 706.849711][T14425] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 706.849731][T14425] ? proc_reg_open+0x23f/0x5f0 [ 706.849752][T14425] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 706.849781][T14425] proc_reg_open+0x2ab/0x5f0 [ 706.849802][T14425] do_dentry_open+0x6ab/0x14d0 [ 706.849889][T14425] ? __pfx_proc_reg_open+0x10/0x10 [ 706.849917][T14425] vfs_open+0x82/0x3f0 [ 706.849947][T14425] path_openat+0x19fa/0x2440 [ 706.849971][T14425] ? __pfx_path_openat+0x10/0x10 [ 706.849994][T14425] do_file_open+0x20e/0x430 [ 706.850014][T14425] ? __pfx_do_file_open+0x10/0x10 [ 706.850048][T14425] ? _raw_spin_unlock+0x28/0x50 [ 706.850068][T14425] ? alloc_fd+0x471/0x7a0 [ 706.850092][T14425] do_sys_openat2+0x10f/0x1e0 [ 706.850114][T14425] ? __pfx_do_sys_openat2+0x10/0x10 [ 706.850145][T14425] __ia32_compat_sys_openat+0x12d/0x210 [ 706.850201][T14425] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 706.850223][T14425] ? find_held_lock+0x2b/0x80 [ 706.850247][T14425] ? trace_syscall_enter+0xcc/0x120 [ 706.850279][T14425] __do_fast_syscall_32+0x13a/0x8b0 [ 706.850306][T14425] do_fast_syscall_32+0x32/0x70 [ 706.850331][T14425] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 706.850352][T14425] RIP: 0023:0xf7fc7fec [ 706.850370][T14425] Code: Unable to access opcode bytes at 0xf7fc7fc2. [ 706.850378][T14425] RSP: 002b:00000000f546550c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 706.850398][T14425] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000340 [ 706.850408][T14425] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 706.850418][T14425] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 706.850426][T14425] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 706.850436][T14425] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 706.850458][T14425] [ 707.435428][T14434] syz.3.1865 (14434): drop_caches: 2 [ 707.611444][T14436] netlink: 'syz.0.1866': attribute type 8 has an invalid length. [ 707.826083][T14441] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 707.849090][T14441] netlink: 'syz.1.1867': attribute type 8 has an invalid length. [ 708.150182][T14434] lo speed is unknown, defaulting to 1000 [ 708.151756][T14434] lo speed is unknown, defaulting to 1000 [ 708.413206][T14450] Invalid option length (1047276) for dns_resolver key [ 708.425349][T14447] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 708.437086][T14447] netlink: 'syz.1.1868': attribute type 8 has an invalid length. [ 708.722012][T14452] syz.4.1869 (14452): drop_caches: 2 [ 708.811298][T14460] usb usb8: usbfs: process 14460 (syz.3.1874) did not claim interface 0 before use [ 708.996107][ T5752] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 709.009511][T14465] FAULT_INJECTION: forcing a failure. [ 709.009511][T14465] name failslab, interval 1, probability 0, space 0, times 0 [ 709.009543][T14465] CPU: 0 UID: 0 PID: 14465 Comm: syz.3.1875 Tainted: G L syzkaller #0 PREEMPT(full) [ 709.009565][T14465] Tainted: [L]=SOFTLOCKUP [ 709.009572][T14465] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 709.009581][T14465] Call Trace: [ 709.009586][T14465] [ 709.009592][T14465] dump_stack_lvl+0x100/0x190 [ 709.009617][T14465] should_fail_ex.cold+0x5/0xa [ 709.009637][T14465] should_failslab+0xc2/0x120 [ 709.009656][T14465] __kmalloc_cache_noprof+0x91/0x6d0 [ 709.009679][T14465] ? single_open+0x4d/0x1d0 [ 709.009701][T14465] ? __pfx_snd_info_seq_show+0x10/0x10 [ 709.009722][T14465] single_open+0x4d/0x1d0 [ 709.009751][T14465] snd_info_text_entry_open+0x258/0x2d0 [ 709.009772][T14465] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 709.009791][T14465] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 709.009806][T14465] ? proc_reg_open+0x23f/0x5f0 [ 709.009825][T14465] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 709.009845][T14465] proc_reg_open+0x2ab/0x5f0 [ 709.009863][T14465] do_dentry_open+0x6ab/0x14d0 [ 709.009877][T14465] ? __pfx_proc_reg_open+0x10/0x10 [ 709.009898][T14465] vfs_open+0x82/0x3f0 [ 709.009918][T14465] path_openat+0x19fa/0x2440 [ 709.009936][T14465] ? __pfx_path_openat+0x10/0x10 [ 709.009957][T14465] do_file_open+0x20e/0x430 [ 709.009974][T14465] ? __pfx_do_file_open+0x10/0x10 [ 709.010003][T14465] ? _raw_spin_unlock+0x28/0x50 [ 709.010020][T14465] ? alloc_fd+0x471/0x7a0 [ 709.010040][T14465] do_sys_openat2+0x10f/0x1e0 [ 709.010058][T14465] ? __pfx_do_sys_openat2+0x10/0x10 [ 709.010083][T14465] __ia32_compat_sys_openat+0x12d/0x210 [ 709.010104][T14465] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 709.010128][T14465] ? find_held_lock+0x2b/0x80 [ 709.010148][T14465] ? trace_syscall_enter+0xcc/0x120 [ 709.010181][T14465] __do_fast_syscall_32+0x13a/0x8b0 [ 709.010213][T14465] do_fast_syscall_32+0x32/0x70 [ 709.010239][T14465] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 709.010262][T14465] RIP: 0023:0xf7f47fec [ 709.010282][T14465] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 709.010289][T14465] RSP: 002b:00000000f53e550c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 709.010309][T14465] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000340 [ 709.010322][T14465] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 709.010333][T14465] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 709.010345][T14465] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 709.010356][T14465] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 709.010381][T14465] [ 709.154072][T14452] lo speed is unknown, defaulting to 1000 [ 709.155724][T14452] lo speed is unknown, defaulting to 1000 [ 709.185917][T14469] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 709.205288][T14469] netlink: 'syz.1.1877': attribute type 8 has an invalid length. [ 709.431967][T14475] netlink: 'syz.0.1878': attribute type 8 has an invalid length. [ 709.878582][ T44] audit: type=1400 audit(1790018234.813:249): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=14489 comm="syz.1.1884" [ 710.325322][ T44] audit: type=1400 audit(1790018235.263:250): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=14512 comm="syz.0.1894" [ 710.379961][T14515] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1896'. [ 710.529994][T14521] Invalid option length (1047276) for dns_resolver key [ 710.702071][T14525] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 710.724465][T14525] netlink: 'syz.3.1901': attribute type 8 has an invalid length. [ 711.076321][T14538] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 711.089350][T14538] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 711.113845][T14538] Invalid option length (1047276) for dns_resolver key [ 711.325373][T14546] Invalid option length (1047276) for dns_resolver key [ 711.330330][T14507] syz.4.1891 (14507): drop_caches: 2 [ 711.701153][T14560] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 711.703609][T14560] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 711.709479][T14560] Invalid option length (1047276) for dns_resolver key [ 711.839620][T14559] syz.0.1916 (14559): drop_caches: 2 [ 712.004290][T14562] syz.3.1918 (14562): drop_caches: 2 [ 712.043339][T14566] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 712.052347][T14566] netlink: 'syz.1.1920': attribute type 8 has an invalid length. [ 712.408916][ T5752] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 712.533026][T14507] lo speed is unknown, defaulting to 1000 [ 712.534311][T14507] lo speed is unknown, defaulting to 1000 [ 712.822852][T14574] netlink: 'syz.1.1921': attribute type 8 has an invalid length. [ 713.133969][T14559] lo speed is unknown, defaulting to 1000 [ 713.138888][T14559] lo speed is unknown, defaulting to 1000 [ 713.892864][T14589] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 713.899453][T14589] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 713.926528][T14589] Invalid option length (1047276) for dns_resolver key [ 713.941115][T14562] lo speed is unknown, defaulting to 1000 [ 713.960154][T14562] lo speed is unknown, defaulting to 1000 [ 714.240181][T14582] syz.4.1923 (14582): drop_caches: 2 [ 714.573069][T14603] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 714.600213][T14608] netlink: 'syz.3.1933': attribute type 8 has an invalid length. [ 714.618731][T14603] netlink: 'syz.1.1931': attribute type 8 has an invalid length. [ 714.868926][T14610] syz.0.1934 (14610): drop_caches: 2 [ 715.323201][T14610] lo speed is unknown, defaulting to 1000 [ 715.331764][T14610] lo speed is unknown, defaulting to 1000 [ 715.576768][T14627] netlink: 'syz.1.1939': attribute type 8 has an invalid length. [ 715.730844][ T5752] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 715.814799][T14632] lo speed is unknown, defaulting to 1000 [ 715.816096][T14632] lo speed is unknown, defaulting to 1000 [ 715.997657][T14637] syz.0.1942 (14637): drop_caches: 2 [ 716.071727][T14641] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1943'. [ 716.717109][T14651] netlink: 'syz.1.1947': attribute type 8 has an invalid length. [ 718.195240][T14637] lo speed is unknown, defaulting to 1000 [ 718.204432][T14637] lo speed is unknown, defaulting to 1000 [ 718.745780][T14670] netlink: 'syz.1.1952': attribute type 8 has an invalid length. [ 718.873631][T14673] Invalid option length (1047276) for dns_resolver key [ 718.901695][T14671] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1949'. [ 719.524627][T14663] syz.3.1950 (14663): drop_caches: 2 [ 719.593953][T14693] netlink: 'syz.1.1962': attribute type 8 has an invalid length. [ 719.846019][T14699] netlink: 'syz.1.1965': attribute type 8 has an invalid length. [ 719.997964][T14663] lo speed is unknown, defaulting to 1000 [ 720.004598][T14663] lo speed is unknown, defaulting to 1000 [ 720.049512][T14707] netlink: 'syz.4.1967': attribute type 8 has an invalid length. [ 720.060839][T14703] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 720.092945][T14703] netlink: 'syz.0.1966': attribute type 8 has an invalid length. [ 720.218850][T14715] misc userio: No port type given on /dev/userio [ 720.418861][T14720] netlink: 'syz.4.1972': attribute type 8 has an invalid length. [ 720.897711][T14734] netlink: 'syz.4.1976': attribute type 8 has an invalid length. [ 721.131049][T14740] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 721.136638][T14740] netlink: 'syz.3.1979': attribute type 8 has an invalid length. [ 721.366041][T14752] netlink: 'syz.1.1985': attribute type 8 has an invalid length. [ 721.924639][T14768] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 721.945978][T14768] validate_nla: 2 callbacks suppressed [ 721.946000][T14768] netlink: 'syz.0.1993': attribute type 8 has an invalid length. [ 722.093095][T14777] netlink: 'syz.3.1996': attribute type 8 has an invalid length. [ 722.418880][T14771] syz.1.1994 (14771): drop_caches: 2 [ 722.518683][T14771] lo speed is unknown, defaulting to 1000 [ 722.522746][T14771] lo speed is unknown, defaulting to 1000 [ 722.724513][T14786] nvme_fc: nvme_fc_create_ctrl: nn-0x3333333333333333:pn-0x4444444444444444 - nn-0x1111111111111111:pn-0x2222222222222222 combination not found [ 722.842253][T14791] netlink: 'syz.4.2001': attribute type 8 has an invalid length. [ 722.992258][T14795] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 723.016985][T14795] netlink: 'syz.4.2003': attribute type 8 has an invalid length. [ 723.177530][ C2] hpet: Lost 1 RTC interrupts [ 723.600516][T14799] syz.3.2004 (14799): drop_caches: 2 [ 723.739503][T14784] lo speed is unknown, defaulting to 1000 [ 723.740716][T14784] lo speed is unknown, defaulting to 1000 [ 723.844579][T14804] netlink: 'syz.4.2005': attribute type 8 has an invalid length. [ 723.999896][T14799] lo speed is unknown, defaulting to 1000 [ 724.029911][T14799] lo speed is unknown, defaulting to 1000 [ 724.082305][T14808] Invalid option length (1047276) for dns_resolver key [ 724.493233][ C2] hpet: Lost 1 RTC interrupts [ 725.071289][T14833] netlink: 'syz.3.2011': attribute type 8 has an invalid length. [ 725.253983][T14838] netlink: 'syz.3.2014': attribute type 8 has an invalid length. [ 725.294508][T14840] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 725.296901][T14840] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 725.319861][T14840] Invalid option length (1047276) for dns_resolver key [ 725.693616][T14854] netlink: 'syz.1.2022': attribute type 8 has an invalid length. [ 725.861232][T14860] program syz.1.2025 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 725.921799][T14862] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 725.924268][T14862] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 725.939454][T14862] Invalid option length (1047276) for dns_resolver key [ 726.429653][T14852] syz.0.2018 (14852): drop_caches: 2 [ 726.609890][T14842] syz.4.2016 (14842): drop_caches: 2 [ 726.672482][T14874] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 726.672510][T14874] overlayfs: missing 'lowerdir' [ 726.730243][T14852] lo speed is unknown, defaulting to 1000 [ 726.730969][T14852] lo speed is unknown, defaulting to 1000 [ 727.007380][ T5752] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 727.070770][T14883] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 727.078192][T14883] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 727.091488][T14883] Invalid option length (1047276) for dns_resolver key [ 727.221037][T14842] lo speed is unknown, defaulting to 1000 [ 727.256264][T14842] lo speed is unknown, defaulting to 1000 [ 727.661219][T14899] netlink: 'syz.0.2041': attribute type 8 has an invalid length. [ 728.087953][T14906] netlink: 'syz.1.2044': attribute type 8 has an invalid length. [ 728.226587][T14908] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 728.230786][T14908] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 728.247118][T14908] Invalid option length (1047276) for dns_resolver key [ 728.953896][T14918] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 728.977979][T14918] netlink: 'syz.4.2049': attribute type 8 has an invalid length. [ 729.272376][T14916] syz.0.2048 (14916): drop_caches: 2 [ 729.296581][T14926] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 729.504974][T14916] lo speed is unknown, defaulting to 1000 [ 729.512585][T14916] lo speed is unknown, defaulting to 1000 [ 729.528243][T14934] netlink: 'syz.1.2053': attribute type 8 has an invalid length. [ 729.687236][ T9] usb 8-1: new full-speed USB device number 29 using dummy_hcd [ 729.838797][ T9] usb 8-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 729.840514][ T9] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 729.845448][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 729.845472][ T9] usb 8-1: Product: syz [ 729.845484][ T9] usb 8-1: Manufacturer: syz [ 729.845496][ T9] usb 8-1: SerialNumber: syz [ 729.862237][T14938] syz.1.2054 (14938): drop_caches: 2 [ 729.903111][ T9] usb 8-1: config 0 descriptor?? [ 729.949875][ T9] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 729.952729][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 730.053019][ T9] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 730.053498][ T9] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 730.053524][ T9] usb 8-1: media controller created [ 730.055063][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 730.130081][T14932] dvb-usb: bulk message failed: -22 (2/0) [ 730.159879][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 730.160041][ T9] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 730.172528][T14943] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 730.188505][ T9] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb8/8-1/input/input32 [ 730.189276][T14943] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 730.201825][T14943] Invalid option length (1047276) for dns_resolver key [ 730.213805][ T9] dvb-usb: schedule remote query interval to 150 msecs. [ 730.213851][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 730.236654][ T9] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 730.239287][ T9] usb 8-1: USB disconnect, device number 29 [ 730.312903][ T9] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 730.549020][T14938] lo speed is unknown, defaulting to 1000 [ 730.550348][T14938] lo speed is unknown, defaulting to 1000 [ 730.850325][T14962] netlink: 'syz.4.2062': attribute type 8 has an invalid length. [ 730.960839][ C2] hpet: Lost 1 RTC interrupts [ 731.040776][T14964] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 731.073254][T14964] netlink: 'syz.3.2063': attribute type 8 has an invalid length. [ 731.471465][ T50] usb 9-1: new low-speed USB device number 5 using dummy_hcd [ 731.538849][T14975] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 731.544479][T14975] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 731.550591][T14975] Invalid option length (1047276) for dns_resolver key [ 731.618102][ T50] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 731.623691][ T50] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 731.623745][ T50] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 731.623772][ T50] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 731.623799][ T50] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 731.623825][ T50] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 731.625163][ T50] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 731.625205][ T50] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 731.625225][ T50] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 731.625244][ T50] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 731.625263][ T50] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 731.629923][ T50] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 731.629964][ T50] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 731.629984][ T50] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 731.630001][ T50] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 731.630020][ T50] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 731.642719][ T50] usb 9-1: string descriptor 0 read error: -22 [ 731.648810][ T50] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 731.685454][ T50] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 731.817502][T14981] netlink: 'syz.1.2070': attribute type 8 has an invalid length. [ 731.827838][T14985] netlink: 'syz.0.2072': attribute type 8 has an invalid length. [ 732.026379][T14992] syz.0.2074 (14992): drop_caches: 2 [ 732.114093][T14992] lo speed is unknown, defaulting to 1000 [ 732.119978][T14992] lo speed is unknown, defaulting to 1000 [ 732.989914][T15001] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 732.994877][T14997] syz.1.2076 (14997): drop_caches: 2 [ 733.005005][T15001] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 733.019607][T15001] Invalid option length (1047276) for dns_resolver key [ 733.202002][T15005] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2079'. [ 733.350406][T15007] netlink: 'syz.3.2080': attribute type 8 has an invalid length. [ 733.609222][T14997] lo speed is unknown, defaulting to 1000 [ 733.610580][T14997] lo speed is unknown, defaulting to 1000 [ 733.685347][T15014] netlink: 'syz.3.2082': attribute type 8 has an invalid length. [ 733.766374][ T5752] Bluetooth: hci2: command 0x0406 tx timeout [ 734.044240][T11751] usb 9-1: USB disconnect, device number 5 [ 734.061734][T15024] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 734.066811][T15024] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 734.084016][T15024] Invalid option length (1047276) for dns_resolver key [ 734.454514][T15037] netlink: 'syz.1.2092': attribute type 8 has an invalid length. [ 734.477872][T15035] netlink: 'syz.4.2090': attribute type 8 has an invalid length. [ 734.863627][T15048] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 734.867912][T15048] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 734.872842][T15048] Invalid option length (1047276) for dns_resolver key [ 735.078971][T15058] netlink: 'syz.4.2101': attribute type 8 has an invalid length. [ 735.351401][T15062] netlink: 'syz.1.2103': attribute type 8 has an invalid length. [ 735.402353][T15064] hub 8-0:1.0: USB hub found [ 735.404966][T15064] hub 8-0:1.0: 1 port detected [ 735.731712][T15073] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 735.737275][T15073] netlink: 'syz.4.2107': attribute type 8 has an invalid length. [ 736.010489][T15082] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 736.031787][T15082] netlink: 'syz.1.2110': attribute type 8 has an invalid length. [ 736.591847][T15098] netlink: 'syz.3.2116': attribute type 8 has an invalid length. [ 736.932810][T15107] syz.3.2119 (15107): drop_caches: 2 [ 737.130587][T15107] lo speed is unknown, defaulting to 1000 [ 737.132191][T15107] lo speed is unknown, defaulting to 1000 [ 737.323238][T15113] netlink: 'syz.4.2120': attribute type 8 has an invalid length. [ 737.656695][ C2] hpet: Lost 1 RTC interrupts [ 737.660356][T15117] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 738.619246][T15145] FAULT_INJECTION: forcing a failure. [ 738.619246][T15145] name failslab, interval 1, probability 0, space 0, times 0 [ 738.619280][T15145] CPU: 3 UID: 0 PID: 15145 Comm: syz.3.2130 Tainted: G L syzkaller #0 PREEMPT(full) [ 738.619308][T15145] Tainted: [L]=SOFTLOCKUP [ 738.619315][T15145] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 738.619327][T15145] Call Trace: [ 738.619333][T15145] [ 738.619341][T15145] dump_stack_lvl+0x100/0x190 [ 738.619374][T15145] should_fail_ex.cold+0x5/0xa [ 738.619399][T15145] should_failslab+0xc2/0x120 [ 738.619425][T15145] __kmalloc_cache_noprof+0x91/0x6d0 [ 738.619454][T15145] ? single_open+0x4d/0x1d0 [ 738.619485][T15145] ? __pfx_snd_info_seq_show+0x10/0x10 [ 738.619515][T15145] single_open+0x4d/0x1d0 [ 738.619544][T15145] snd_info_text_entry_open+0x258/0x2d0 [ 738.619574][T15145] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 738.619600][T15145] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 738.619622][T15145] ? proc_reg_open+0x23f/0x5f0 [ 738.619648][T15145] ? __pfx_snd_info_text_entry_open+0x10/0x10 [ 738.619679][T15145] proc_reg_open+0x2ab/0x5f0 [ 738.619705][T15145] do_dentry_open+0x6ab/0x14d0 [ 738.619725][T15145] ? __pfx_proc_reg_open+0x10/0x10 [ 738.619754][T15145] vfs_open+0x82/0x3f0 [ 738.619783][T15145] path_openat+0x19fa/0x2440 [ 738.619811][T15145] ? __pfx_path_openat+0x10/0x10 [ 738.619840][T15145] do_file_open+0x20e/0x430 [ 738.619866][T15145] ? __pfx_do_file_open+0x10/0x10 [ 738.619906][T15145] ? _raw_spin_unlock+0x28/0x50 [ 738.619929][T15145] ? alloc_fd+0x471/0x7a0 [ 738.619960][T15145] do_sys_openat2+0x10f/0x1e0 [ 738.619988][T15145] ? __pfx_do_sys_openat2+0x10/0x10 [ 738.620026][T15145] __ia32_compat_sys_openat+0x12d/0x210 [ 738.620058][T15145] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 738.620086][T15145] ? find_held_lock+0x2b/0x80 [ 738.620119][T15145] ? trace_syscall_enter+0xcc/0x120 [ 738.620159][T15145] __do_fast_syscall_32+0x13a/0x8b0 [ 738.620218][T15145] do_fast_syscall_32+0x32/0x70 [ 738.620251][T15145] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 738.620278][T15145] RIP: 0023:0xf7f47fec [ 738.620301][T15145] Code: Unable to access opcode bytes at 0xf7f47fc2. [ 738.620310][T15145] RSP: 002b:00000000f53e550c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 738.620329][T15145] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000340 [ 738.620340][T15145] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 738.620351][T15145] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 738.620362][T15145] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 738.620373][T15145] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 738.620399][T15145] [ 738.820586][T15147] syz.1.2131 (15147): drop_caches: 2 [ 738.921295][T15147] lo speed is unknown, defaulting to 1000 [ 738.923001][T15147] lo speed is unknown, defaulting to 1000 [ 739.408479][T15155] syz.4.2133 (15155): drop_caches: 2 [ 739.812473][T15166] validate_nla: 2 callbacks suppressed [ 739.812492][T15166] netlink: 'syz.1.2137': attribute type 8 has an invalid length. [ 740.030688][T15162] syz.3.2134 (15162): drop_caches: 2 [ 740.118895][ T5757] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 740.248957][T15155] lo speed is unknown, defaulting to 1000 [ 740.261189][T15155] lo speed is unknown, defaulting to 1000 [ 740.270083][T15162] lo speed is unknown, defaulting to 1000 [ 740.329444][T15162] lo speed is unknown, defaulting to 1000 [ 740.901252][ C2] hpet: Lost 1 RTC interrupts [ 741.397437][T15198] netlink: 'syz.1.2146': attribute type 8 has an invalid length. [ 741.810766][T15207] syz.1.2149 (15207): drop_caches: 2 [ 741.903958][T15210] netlink: 'syz.3.2151': attribute type 8 has an invalid length. [ 742.139190][T15224] Illegal XDP return value 701375872 on prog (id 201) dev N/A, expect packet loss! [ 742.217250][T15228] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2157'. [ 742.295006][T15207] lo speed is unknown, defaulting to 1000 [ 742.299973][T15207] lo speed is unknown, defaulting to 1000 [ 742.982749][T15254] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 742.997164][T15254] netlink: 'syz.0.2168': attribute type 8 has an invalid length. [ 743.278016][T15266] netlink: 'syz.3.2173': attribute type 8 has an invalid length. [ 743.607487][ T1038] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 743.757742][ T1038] usb 6-1: Using ep0 maxpacket: 32 [ 743.758608][ T1038] usb 6-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 743.759762][ T1038] usb 6-1: config 0 has an invalid interface number: 119 but max is 0 [ 743.759780][ T1038] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 743.759793][ T1038] usb 6-1: config 0 has no interface number 0 [ 743.759820][ T1038] usb 6-1: config 0 interface 119 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 743.763082][ T1038] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 743.763102][ T1038] usb 6-1: Product: syz [ 743.763111][ T1038] usb 6-1: Manufacturer: syz [ 743.763122][ T1038] usb 6-1: SerialNumber: syz [ 743.774681][ T1038] usb 6-1: config 0 descriptor?? [ 743.783073][ T1038] input: bcm5974 as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.119/input/input33 [ 743.891451][T15293] f_midi2: Invalid MIDI1 group definitions for block 0:1 [ 743.903419][T15290] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 743.915406][T15290] netlink: 'syz.0.2180': attribute type 8 has an invalid length. [ 743.988110][T12853] usb 6-1: USB disconnect, device number 22 [ 744.810472][T15312] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 744.818289][T15312] netlink: 'syz.3.2188': attribute type 8 has an invalid length. [ 745.148419][T15321] syz.1.2191 (15321): drop_caches: 2 [ 745.434585][T15321] lo speed is unknown, defaulting to 1000 [ 745.440912][T15321] lo speed is unknown, defaulting to 1000 [ 745.564264][T15336] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 745.589345][T15336] netlink: 'syz.4.2194': attribute type 8 has an invalid length. [ 746.190028][T15335] syz.0.2195 (15335): drop_caches: 2 [ 746.429103][ C2] hpet: Lost 1 RTC interrupts [ 746.717774][T15335] lo speed is unknown, defaulting to 1000 [ 746.727143][T15335] lo speed is unknown, defaulting to 1000 [ 746.763890][T15350] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 746.782815][T15350] netlink: 'syz.3.2198': attribute type 8 has an invalid length. [ 747.048332][ T1436] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.048385][ T1436] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.329810][T15373] netlink: 'syz.1.2203': attribute type 8 has an invalid length. [ 748.500327][T15378] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 748.518859][T15378] netlink: 'syz.4.2204': attribute type 8 has an invalid length. [ 748.675469][T15383] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 748.692682][T15383] netlink: 'syz.3.2205': attribute type 8 has an invalid length. [ 749.391381][T15398] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 749.393473][T15398] netlink: 'syz.3.2210': attribute type 8 has an invalid length. [ 749.740800][T15410] netlink: 'syz.0.2214': attribute type 8 has an invalid length. [ 749.910154][T15418] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 749.916914][T15418] netlink: 'syz.1.2216': attribute type 8 has an invalid length. [ 750.028194][T15425] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 750.031704][T15425] netlink: 'syz.0.2218': attribute type 8 has an invalid length. [ 750.411632][T15436] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 750.418922][T15436] netlink: 'syz.4.2222': attribute type 8 has an invalid length. [ 750.555059][T15443] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 750.562842][T15443] netlink: 'syz.1.2224': attribute type 8 has an invalid length. [ 750.844630][T15459] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 750.848804][T15459] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 750.853123][T15459] Invalid option length (1047276) for dns_resolver key [ 751.051127][T15466] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 751.054129][T15466] netlink: 'syz.4.2233': attribute type 8 has an invalid length. [ 751.094410][T15472] ip6gretap0: entered promiscuous mode [ 751.094433][T15472] ip6gretap0: entered allmulticast mode [ 751.368921][T15482] syz.0.2238 (15482): drop_caches: 2 [ 751.393888][T15484] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 751.400983][T15484] Invalid option length (1047276) for dns_resolver key [ 751.588116][T15482] lo speed is unknown, defaulting to 1000 [ 751.589224][T15482] lo speed is unknown, defaulting to 1000 [ 751.785709][ T1523] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 751.935534][ T1523] usb 6-1: Using ep0 maxpacket: 8 [ 751.937919][ T1523] usb 6-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 751.938714][ T1523] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 751.938735][ T1523] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 751.938748][ T1523] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 751.959977][ T1523] usb 6-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 751.959999][ T1523] usb 6-1: Product: syz [ 751.960010][ T1523] usb 6-1: Manufacturer: syz [ 751.960020][ T1523] usb 6-1: SerialNumber: syz [ 751.961341][ T1523] usb 6-1: config 0 descriptor?? [ 752.055534][ T1523] rc_core: IR keymap rc-imon-rsc not found [ 752.055547][ T1523] Registered IR keymap rc-empty [ 752.056629][ T1523] rc rc0: iMON Station as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.0/rc/rc0 [ 752.057805][ T1523] input: iMON Station as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.0/rc/rc0/input34 [ 752.146563][T15519] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 752.179199][T11751] usb 6-1: USB disconnect, device number 23 [ 752.180617][T15519] netlink: 'syz.3.2248': attribute type 8 has an invalid length. [ 752.211117][T15522] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 752.233460][T15522] Invalid option length (1047276) for dns_resolver key [ 752.631419][T15535] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 752.647603][T15535] netlink: 'syz.3.2254': attribute type 8 has an invalid length. [ 752.750469][T15539] netlink: 'syz.0.2255': attribute type 8 has an invalid length. [ 752.818108][T15544] netlink: 'syz.1.2256': attribute type 8 has an invalid length. [ 753.081622][T15551] i2c i2c-1: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 753.086218][T15551] Invalid option length (1047276) for dns_resolver key [ 753.175620][T15555] syz.0.2259 (15555): drop_caches: 2 [ 753.346529][T15555] lo speed is unknown, defaulting to 1000 [ 753.347556][T15555] lo speed is unknown, defaulting to 1000 [ 753.414398][T15561] netlink: 'syz.4.2261': attribute type 8 has an invalid length. [ 753.721990][T15569] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2262'. [ 753.955710][T15577] create_pit_timer: 3 callbacks suppressed [ 753.955722][T15577] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 754.557786][T15573] hid-generic 0003:0627:0001.0001: pid 15573 passed too large report [ 754.825052][T15594] i2c i2c-1: Frontend requested software zigzag, but didn't set the frequency step size [ 755.073077][T15601] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 755.082086][T15601] validate_nla: 1 callbacks suppressed [ 755.082373][T15601] netlink: 'syz.0.2274': attribute type 8 has an invalid length. [ 755.149824][T15609] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 755.152325][T15609] netlink: 'syz.3.2277': attribute type 8 has an invalid length. [ 755.171957][T15604] syz.4.2275 (15604): drop_caches: 2 [ 755.367098][ T5757] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 755.390824][T15604] lo speed is unknown, defaulting to 1000 [ 755.391546][T15604] lo speed is unknown, defaulting to 1000 [ 755.516185][T15620] syz.4.2280 (15620): drop_caches: 2 [ 755.582726][ T5757] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 755.722709][T15620] lo speed is unknown, defaulting to 1000 [ 755.726184][T15620] lo speed is unknown, defaulting to 1000 [ 755.735447][T15635] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 755.749261][T15635] netlink: 'syz.0.2286': attribute type 8 has an invalid length. [ 755.927998][T15646] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 755.934401][T15646] netlink: 'syz.3.2289': attribute type 8 has an invalid length. [ 757.057940][T15654] syz.4.2290 (15654): drop_caches: 2 [ 757.075717][T15663] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2295'. [ 757.075732][T15663] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2295'. [ 757.101718][ T5757] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 757.128449][T15654] lo speed is unknown, defaulting to 1000 [ 757.129285][T15654] lo speed is unknown, defaulting to 1000 [ 757.257612][T15670] syz.1.2298 (15670): drop_caches: 2 [ 757.599610][T15670] lo speed is unknown, defaulting to 1000 [ 757.677222][T15678] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 757.679813][T15678] netlink: 'syz.4.2300': attribute type 8 has an invalid length. [ 757.720571][T15670] lo speed is unknown, defaulting to 1000 [ 758.261702][T15699] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 758.264233][T15699] netlink: 'syz.3.2305': attribute type 8 has an invalid length. [ 758.545170][ T5836] usb 6-1: new full-speed USB device number 24 using dummy_hcd [ 758.601670][T15710] syz.4.2309 (15710): drop_caches: 2 [ 758.629787][ T5757] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 758.652341][T15710] lo speed is unknown, defaulting to 1000 [ 758.653074][T15710] lo speed is unknown, defaulting to 1000 [ 758.698739][ T5836] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 758.700264][ T5836] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 758.700283][ T5836] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 758.701457][ T5836] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=249 [ 758.701476][ T5836] usb 6-1: SerialNumber: syz [ 758.706058][ T5836] usb 6-1: config 0 descriptor?? [ 758.912236][ T5836] usb 6-1: USB disconnect, device number 24 [ 759.219382][T15727] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 759.231905][T15727] netlink: 'syz.3.2317': attribute type 8 has an invalid length. [ 759.516165][T15734] syz.1.2318 (15734): drop_caches: 2 [ 759.642761][T15734] lo speed is unknown, defaulting to 1000 [ 759.643505][T15734] lo speed is unknown, defaulting to 1000 [ 759.758060][T15753] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 759.761377][T15753] netlink: 'syz.4.2328': attribute type 8 has an invalid length. [ 759.767182][T15755] syz.3.2327 (15755): drop_caches: 2 [ 759.975253][T15755] lo speed is unknown, defaulting to 1000 [ 759.981726][T15755] lo speed is unknown, defaulting to 1000 [ 760.164219][T15766] UDC core: g1: couldn't find an available UDC or it's busy [ 760.252547][T15768] md0: detected capacity change from 2048 to 2 [ 760.447140][T15774] syz.4.2334 (15774): drop_caches: 2 [ 760.497587][T15776] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x48000 [ 760.497606][T15776] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 760.497622][T15776] raw: 04fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 760.497632][T15776] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 760.497639][T15776] page dumped because: unmovable page [ 760.497645][T15776] page_owner tracks the page as allocated [ 760.497651][T15776] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 1, tgid 1 (swapper/0), ts 10061608988 [ 760.497668][T15776] post_alloc_hook+0xfd/0x120 [ 760.497686][T15776] get_page_from_freelist+0x110d/0x35d0 [ 760.497696][T15776] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 760.497707][T15776] alloc_pages_mpol+0x201/0x550 [ 760.497719][T15776] alloc_pages_noprof+0x1a/0x160 [ 760.497735][T15776] __vmalloc_node_range_noprof+0x833/0x1420 [ 760.497750][T15776] __vmalloc_node_noprof+0xad/0xf0 [ 760.497765][T15776] tpg_alloc+0x166/0x9b0 [ 760.497781][T15776] vivid_probe.cold+0x2166/0x921e [ 760.497794][T15776] platform_probe+0x106/0x1d0 [ 760.497805][T15776] really_probe+0x241/0xa60 [ 760.497818][T15776] __driver_probe_device+0x210/0x460 [ 760.497831][T15776] driver_probe_device+0x4a/0x140 [ 760.497844][T15776] __driver_attach+0x21f/0x5b0 [ 760.497857][T15776] bus_for_each_dev+0x13e/0x1d0 [ 760.497867][T15776] bus_add_driver+0x305/0x5b0 [ 760.497879][T15776] page_owner free stack trace missing [ 760.644729][ T5757] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 760.675668][T15774] lo speed is unknown, defaulting to 1000 [ 760.676428][T15774] lo speed is unknown, defaulting to 1000 [ 760.682364][T15782] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 760.689501][T15782] netlink: 'syz.1.2338': attribute type 8 has an invalid length. [ 760.759310][T15791] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 760.902745][T15800] syz.4.2343 (15800): drop_caches: 2 [ 761.057801][T15805] syz.3.2346 (15805): drop_caches: 2 [ 761.101398][ T5757] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 761.179019][T15800] lo speed is unknown, defaulting to 1000 [ 761.185327][T15800] lo speed is unknown, defaulting to 1000 [ 761.287588][T15805] lo speed is unknown, defaulting to 1000 [ 761.288299][T15805] lo speed is unknown, defaulting to 1000 [ 761.305078][T15807] syz.1.2347 (15807): drop_caches: 2 [ 761.476882][T15807] lo speed is unknown, defaulting to 1000 [ 761.483431][T15807] lo speed is unknown, defaulting to 1000 [ 761.697348][T15818] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 761.700359][T15818] netlink: 'syz.3.2348': attribute type 8 has an invalid length. [ 761.976128][T15827] syz.4.2351 (15827): drop_caches: 2 [ 762.049950][ T5757] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 762.068383][T15827] lo speed is unknown, defaulting to 1000 [ 762.069161][T15827] lo speed is unknown, defaulting to 1000 [ 762.130636][T15831] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 762.140223][T15831] netlink: 'syz.3.2353': attribute type 8 has an invalid length. [ 762.426912][T15841] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 762.429464][T15841] netlink: 'syz.3.2355': attribute type 8 has an invalid length. [ 762.829577][T15847] syz.3.2356 (15847): drop_caches: 2 [ 762.891585][T15849] syz.4.2357 (15849): drop_caches: 2 [ 762.919549][T15847] lo speed is unknown, defaulting to 1000 [ 762.920858][T15847] lo speed is unknown, defaulting to 1000 [ 762.983853][ T5757] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 763.253750][T15849] lo speed is unknown, defaulting to 1000 [ 763.256962][T15849] lo speed is unknown, defaulting to 1000 [ 763.359939][T15856] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 763.371334][T15856] netlink: 'syz.1.2358': attribute type 8 has an invalid length. [ 763.804984][T15872] netlink: 'syz.4.2363': attribute type 8 has an invalid length. [ 763.928572][T15877] netlink: 'syz.0.2364': attribute type 8 has an invalid length. [ 764.592182][T15865] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 764.648836][T15865] hwrng_fill thread creation failed [ 765.120340][T15892] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 765.125253][T15892] netlink: 'syz.4.2370': attribute type 8 has an invalid length. [ 765.291285][T15898] syz.1.2371 (15898): drop_caches: 2 [ 765.766043][ T5757] Bluetooth: hci2: command 0x0406 tx timeout [ 765.819048][T15907] lo speed is unknown, defaulting to 1000 [ 765.828487][T15907] lo speed is unknown, defaulting to 1000 [ 765.901691][T15910] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 765.964487][T15910] netlink: 'syz.3.2375': attribute type 8 has an invalid length. [ 766.510553][T15917] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 766.527636][T15917] netlink: 'syz.0.2376': attribute type 8 has an invalid length. [ 767.244373][ T1523] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 767.395245][ T1523] usb 6-1: New USB device found, idVendor=0a99, idProduct=0001, bcdDevice= 0.00 [ 767.396194][ T1523] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 767.397661][ T1523] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 767.397673][ T1523] usb 6-1: Product: syz [ 767.397680][ T1523] usb 6-1: Manufacturer: syz [ 767.405164][ T1523] navman 6-1:1.0: navman converter detected [ 767.407165][ T1523] usb 6-1: navman converter now attached to ttyUSB0 [ 767.617059][ T1523] usb 6-1: USB disconnect, device number 25 [ 767.640015][ T1523] navman ttyUSB0: navman converter now disconnected from ttyUSB0 [ 767.641165][ T1523] navman 6-1:1.0: device disconnected [ 768.300559][T15944] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 768.313348][T15944] netlink: 'syz.4.2386': attribute type 8 has an invalid length. [ 768.470723][T15961] CIFS: Attempting to mount //127.0.0.1/share [ 768.471883][T15961] CIFS: VFS: Error connecting to socket. Aborting operation. [ 768.471909][T15961] CIFS: VFS: cifs_mount failed w/return code = -111 [ 768.491666][T15959] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 768.494700][T15957] lo speed is unknown, defaulting to 1000 [ 768.500359][T15957] lo speed is unknown, defaulting to 1000 [ 768.509044][T15959] netlink: 'syz.0.2392': attribute type 8 has an invalid length. [ 768.590560][T15955] syz.1.2389 (15955): drop_caches: 2 [ 768.841388][T15967] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2394'. [ 768.926594][T15970] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 768.930793][T15970] netlink: 'syz.4.2395': attribute type 8 has an invalid length. [ 769.111534][T15974] syz.3.2396 (15974): drop_caches: 2 [ 769.147364][T15955] lo speed is unknown, defaulting to 1000 [ 769.148211][T15955] lo speed is unknown, defaulting to 1000 [ 769.253789][T15974] lo speed is unknown, defaulting to 1000 [ 769.254849][T15974] lo speed is unknown, defaulting to 1000 [ 769.568193][T15980] syz.0.2397 (15980): drop_caches: 2 [ 769.855245][T15993] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 770.042178][ T44] audit: type=1807 audit(1790018294.986:251): UNKNOWN=m™`easuÈìeø^ÏzhVÜ”öre res=0 [ 770.044715][T15980] lo speed is unknown, defaulting to 1000 [ 770.053764][ T44] audit: type=1802 audit(1790018294.986:252): pid=15995 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.4.2402" res=0 errno=0 [ 770.058644][T15980] lo speed is unknown, defaulting to 1000 [ 770.063353][T15994] ima: policy update failed [ 770.063489][ T44] audit: type=1802 audit(1790018294.996:253): pid=15994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.4.2402" res=0 errno=0 [ 770.574719][T15997] syz.4.2403 (15997): drop_caches: 2 [ 770.592810][T16003] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 770.630316][T16003] netlink: 'syz.0.2405': attribute type 8 has an invalid length. [ 771.036175][ T5757] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 771.116722][T15997] lo speed is unknown, defaulting to 1000 [ 771.118057][T15997] lo speed is unknown, defaulting to 1000 [ 771.203790][T16024] block2mtd: illegal erase size [ 771.608275][T16027] syz.3.2413 (16027): drop_caches: 2 [ 772.249190][T16045] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 772.253069][T16045] netlink: 'syz.3.2420': attribute type 8 has an invalid length. [ 772.447748][T16031] syz.1.2415 (16031): drop_caches: 2 [ 772.519231][T16031] lo speed is unknown, defaulting to 1000 [ 772.520723][T16031] lo speed is unknown, defaulting to 1000 [ 773.482303][T16060] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 773.489526][T16060] Invalid option length (1047276) for dns_resolver key [ 773.804613][T16064] syz.1.2426 (16064): drop_caches: 2 [ 774.068051][T16076] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 774.167146][T16064] lo speed is unknown, defaulting to 1000 [ 774.168414][T16064] lo speed is unknown, defaulting to 1000 [ 774.494102][T16086] Bluetooth: hci1: too big key_count value 4608 [ 774.565352][T16090] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 774.568713][T16090] Invalid option length (1047276) for dns_resolver key [ 774.729664][T16094] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 774.732144][T16094] netlink: 'syz.3.2438': attribute type 8 has an invalid length. [ 775.309601][T16107] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001e: 0000 [#1] SMP KASAN NOPTI [ 775.313404][T16107] KASAN: null-ptr-deref in range [0x00000000000000f0-0x00000000000000f7] [ 775.316183][T16107] CPU: 3 UID: 0 PID: 16107 Comm: syz.0.2444 Tainted: G L syzkaller #0 PREEMPT(full) [ 775.319357][T16107] Tainted: [L]=SOFTLOCKUP [ 775.320659][T16107] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 775.323741][T16107] RIP: 0010:rebind_store+0x147/0x2d0 [ 775.325452][T16107] Code: 53 01 00 00 48 89 d8 48 c1 e0 07 4c 8b b0 f0 48 ca 9b 48 b8 00 00 00 00 00 fc ff df 49 8d be f0 00 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 30 01 00 00 4d 8b be f0 00 00 00 4d 85 ff 74 3c [ 775.330942][T16107] RSP: 0018:ffffc900054dfc18 EFLAGS: 00010206 [ 775.332737][T16107] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 775.335303][T16107] RDX: 000000000000001e RSI: 0000000000000004 RDI: 00000000000000f0 [ 775.338004][T16107] RBP: ffffffff9bca48f0 R08: 0000000000000000 R09: fffffbfff3794920 [ 775.340671][T16107] R10: ffffffff9bca4903 R11: 000000000000001f R12: 0000000000000001 [ 775.343488][T16107] R13: ffff888049f043a0 R14: 0000000000000000 R15: ffff888025e74600 [ 775.346243][T16107] FS: 0000000000000000(0000) GS:ffff888096c60000(0063) knlGS:00000000f5476b40 [ 775.349771][T16107] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 775.352260][T16107] CR2: 00000000f74353f0 CR3: 000000004c3c0000 CR4: 0000000000352ef0 [ 775.355334][T16107] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 775.358188][T16107] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 775.361348][T16107] Call Trace: [ 775.362843][T16107] [ 775.364337][T16107] ? __pfx_rebind_store+0x10/0x10 [ 775.366401][T16107] drv_attr_store+0x74/0xb0 [ 775.368956][T16107] ? __pfx_drv_attr_store+0x10/0x10 [ 775.371428][T16107] sysfs_kf_write+0xf2/0x150 [ 775.373222][T16107] kernfs_fop_write_iter+0x3e0/0x5f0 [ 775.375280][T16107] ? __pfx_sysfs_kf_write+0x10/0x10 [ 775.377310][T16107] vfs_write+0x6af/0x1050 [ 775.378986][T16107] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 775.381145][T16107] ? __pfx_vfs_write+0x10/0x10 [ 775.382965][T16107] ? find_held_lock+0x2b/0x80 [ 775.385066][T16107] ksys_write+0x12a/0x250 [ 775.387096][T16107] ? __pfx_ksys_write+0x10/0x10 [ 775.389284][T16107] ? trace_syscall_enter+0xcc/0x120 [ 775.391328][T16107] __do_fast_syscall_32+0x13a/0x8b0 [ 775.393180][T16107] do_fast_syscall_32+0x32/0x70 [ 775.394941][T16107] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 775.397310][T16107] RIP: 0023:0xf7fb6fec [ 775.398676][T16107] Code: Unable to access opcode bytes at 0xf7fb6fc2. [ 775.401240][T16107] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 775.403573][T16107] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000940 [ 775.406025][T16107] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 775.408610][T16107] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 775.411602][T16107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 775.414401][T16107] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 775.416703][T16107] [ 775.417634][T16107] Modules linked in: [ 775.419277][T16107] ---[ end trace 0000000000000000 ]--- [ 775.436750][T16111] syz.3.2442 (16111): drop_caches: 2 [ 775.550066][T16107] RIP: 0010:rebind_store+0x147/0x2d0 [ 775.550201][T16107] Code: 53 01 00 00 48 89 d8 48 c1 e0 07 4c 8b b0 f0 48 ca 9b 48 b8 00 00 00 00 00 fc ff df 49 8d be f0 00 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 30 01 00 00 4d 8b be f0 00 00 00 4d 85 ff 74 3c [ 775.550214][T16107] RSP: 0018:ffffc900054dfc18 EFLAGS: 00010206 [ 775.550225][T16107] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 775.550373][T16107] RDX: 000000000000001e RSI: 0000000000000004 RDI: 00000000000000f0 [ 775.550381][T16107] RBP: ffffffff9bca48f0 R08: 0000000000000000 R09: fffffbfff3794920 [ 775.550464][T16107] R10: ffffffff9bca4903 R11: 000000000000001f R12: 0000000000000001 [ 775.550538][T16107] R13: ffff888049f043a0 R14: 0000000000000000 R15: ffff888025e74600 [ 775.550547][T16107] FS: 0000000000000000(0000) GS:ffff888096c60000(0063) knlGS:00000000f5476b40 [ 775.550705][T16107] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 775.550714][T16107] CR2: 0000000080008000 CR3: 000000004c3c0000 CR4: 0000000000352ef0 [ 775.551234][T16107] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 775.551243][T16107] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 775.551252][T16107] Kernel panic - not syncing: Fatal exception [ 775.586113][T16107] Kernel Offset: disabled [ 775.587322][T16107] Rebooting in 86400 seconds..