last executing test programs: 9m48.08406011s ago: executing program 2 (id=3935): socket$netlink(0x10, 0x3, 0x4) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1a4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000d40), 0xffffffffffffffff) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x4) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/fcloop/ctl/del_target_port\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='wwnn=0x3333333333333333,', 0x18) 9m48.009193671s ago: executing program 2 (id=3936): r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x200, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x3}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x1000000, 0xfffffffc}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r1, 0x2000012, 0xeff, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b9", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) move_mount(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, &(0x7f0000000000)='./sys_mount\x00', 0x102) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x7d, &(0x7f0000000640)=@assoc_value, &(0x7f0000000200)=0x8) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setrlimit(0x0, &(0x7f0000000280)={0xc800, 0xfffffffe}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0xc0, 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x886022, &(0x7f0000000300)=ANY=[@ANYBLOB="6e725f696eecfb55c03d352c6e72b454e52ecd4028032a674a5e973ac3f75f627c6f636b733d322c00"]) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYRES32=r3], 0xec}, 0x1, 0x0, 0x0, 0x1}, 0x0) madvise(&(0x7f00002d9000/0x2000)=nil, 0x2000, 0x70) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r4, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f0000000780)=ANY=[@ANYBLOB="500000000102030000000000000000000a0000003c0001802c00018014000300ff02000000000000000000000000000114000400fc2f938c0252fd4a010000000000"], 0x50}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES16], 0x48) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r5, 0x0, 0x41, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x44) getsockopt$EBT_SO_GET_ENTRIES(r5, 0x0, 0x81, &(0x7f0000000500)={'nat\x00', 0x0, 0x4, 0x97, [0x0, 0x7, 0x2, 0x0, 0x6, 0x5], 0x0, &(0x7f00000002c0), &(0x7f0000000400)=""/151}, &(0x7f0000000580)=0x50) set_mempolicy(0x2, &(0x7f0000000140)=0x58, 0x5) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRES8, @ANYRESHEX, @ANYRES16], 0x48) 9m46.716781438s ago: executing program 2 (id=3939): socket$igmp6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_io_uring_setup(0xf04, &(0x7f0000000400)={0x0, 0x595f, 0x1000, 0x0, 0x10000051}, &(0x7f0000000200)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000480)=@IORING_OP_SOCKET={0x2d, 0x40, 0x0, 0x8, 0x9, 0x0, 0x5, 0x0, 0x8286ca8cebed636a, {0x0, 0x0, 0x4a05}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(0x0, 0x0, 0x0, 0x0) r7 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r7, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffff", 0xb) connect$inet6(r7, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r8, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x3ff}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7c, &(0x7f00000000c0), 0x0) sendmmsg$inet6(r7, &(0x7f0000002940), 0x40000000000017d, 0x811) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$FBIOPUT_VSCREENINFO(r9, 0x4601, &(0x7f0000000380)={0x3c0, 0x78, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x8, 0x3, 0x1ff, 0x3d, 0x5, 0x3, 0x53, 0x202, 0x1, 0xc}) 9m45.439756727s ago: executing program 2 (id=3944): socket$netlink(0x10, 0x3, 0x4) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1a4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000d40), 0xffffffffffffffff) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x4) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/fcloop/ctl/del_target_port\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='wwnn=0x3333333333333333,wwpn=0x44444', 0x24) 9m45.267013943s ago: executing program 2 (id=3946): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r1, 0x400c4d02, &(0x7f0000000900)) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_io_uring_setup(0x1420, &(0x7f0000000480)={0x0, 0x35, 0x1, 0x2, 0x1000213}, &(0x7f00000001c0)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000000)=0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r6, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x2, 0x1, 0x201, 0x0, 0x0, {0xa, 0x0, 0x8}, [@CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x4}, @CTA_NAT_DST={0xc, 0xd, 0x0, 0x1, [@CTA_NAT_V4_MAXIP={0x8, 0x2, @empty}]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x1}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x4) r7 = openat$ublk_ctrl(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_io_uring_submit$UBLK(r3, r4, r5, &(0x7f0000000500)=@ublk_get_features_sqe={0x2e, 0x0, 0x0, r7, 0x80207513, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, '\x00', {0x0, 0xffff, 0x0, 0x0}}) io_uring_enter(r2, 0x20, 0xd9db, 0x8, 0x0, 0x0) timer_create(0x3, 0x0, &(0x7f0000000300)) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004400000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x240048d0}, 0x40) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40004000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0027"], 0xb4}}, 0x8044) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) write$vga_arbiter(r0, &(0x7f0000000300)=@unlock_all, 0xb) 9m44.293205524s ago: executing program 2 (id=3954): socket$netlink(0x10, 0x3, 0x4) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1a4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000d40), 0xffffffffffffffff) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x4) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/fcloop/ctl/del_target_port\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='wwnn=0x3333333333333333,wwpn=0x44444', 0x24) 9m27.857667987s ago: executing program 32 (id=3954): socket$netlink(0x10, 0x3, 0x4) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1a4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x10, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000d40), 0xffffffffffffffff) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x4) write(r0, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/fcloop/ctl/del_target_port\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='wwnn=0x3333333333333333,wwpn=0x44444', 0x24) 8m33.248566703s ago: executing program 3 (id=4232): ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0xb3b54c18e0590239, 0x0, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x1, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x28e}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x10, 0x2100, 0x11c, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x15c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf930, 0x0, 0x0, 0x1f0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x4000, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) socket(0x10, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 8m32.642701283s ago: executing program 3 (id=4234): userfaultfd(0x80001) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c000780180001800800"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) 8m32.642182317s ago: executing program 3 (id=4235): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpu.stat\x00', 0x0, 0x0) r1 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000100), 0x3, 0x400280) ioctl$SOUND_MIXER_READ_CAPS(r1, 0x80044dfc, &(0x7f00000000c0)) recvmsg$kcm(r0, &(0x7f0000002940)={0x0, 0x0, &(0x7f0000002840)=[{&(0x7f0000000300)=""/244, 0xf4}, {&(0x7f0000000400)=""/205, 0xcd}, {&(0x7f0000000500)=""/143, 0x8f}, {&(0x7f0000001400)=""/4096, 0x1000}, {&(0x7f0000002400)=""/245, 0xf5}, {&(0x7f0000002500)=""/143, 0x8f}, {&(0x7f00000025c0)=""/99, 0x63}, {&(0x7f0000002640)=""/244, 0xf4}, {&(0x7f0000002740)=""/192, 0xc0}, {&(0x7f0000002800)=""/8, 0x8}], 0xa, &(0x7f00000028c0)=""/109, 0x6d}, 0x22120) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000040)='stat\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_POWER_SAVE(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB='$\x00\x00', @ANYRES16=r4, @ANYBLOB="01002abd7000ff", @ANYRES32=r6, @ANYBLOB='\b\x00]'], 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x88c0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000011c0), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f40600", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}, 0x1, 0x0, 0x0, 0x4}, 0x0) 8m32.512427454s ago: executing program 3 (id=4236): r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x200, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x3}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x1000000, 0xfffffffc}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r1, 0x2000012, 0xeff, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b9", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) move_mount(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, &(0x7f0000000000)='./sys_mount\x00', 0x102) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x7d, &(0x7f0000000640)=@assoc_value, &(0x7f0000000200)=0x8) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setrlimit(0x0, &(0x7f0000000280)={0xc800, 0xfffffffe}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0xc0, 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x886022, &(0x7f0000000300)=ANY=[@ANYBLOB="6e725f696eecfb55c03d352c6e72b454e52ecd4028032a674a5e973ac3f75f627c6f636b733d322c00"]) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYRES32=r3], 0xec}, 0x1, 0x0, 0x0, 0x1}, 0x0) madvise(&(0x7f00002d9000/0x2000)=nil, 0x2000, 0x70) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r4, &(0x7f0000006680)={0x0, 0x0, &(0x7f0000006640)={&(0x7f0000000780)=ANY=[@ANYBLOB="500000000102030000000000000000000a0000003c0001802c00018014000300ff02000000000000000000000000000114000400fc2f938c0252fd4a0100000000000000000000000000010c0002800500010000000000"], 0x50}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES16], 0x48) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r5, 0x0, 0x41, &(0x7f00000000c0)=ANY=[], 0x44) getsockopt$EBT_SO_GET_ENTRIES(r5, 0x0, 0x81, &(0x7f0000000500)={'nat\x00', 0x0, 0x4, 0x97, [0x0, 0x7, 0x2, 0x0, 0x6, 0x5], 0x0, &(0x7f00000002c0), &(0x7f0000000400)=""/151}, &(0x7f0000000580)=0x50) set_mempolicy(0x2, &(0x7f0000000140)=0x58, 0x5) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRES8, @ANYRESHEX, @ANYRES16], 0x48) 8m32.51211288s ago: executing program 3 (id=4237): ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, 0x0) mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000020000000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') read$FUSE(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0) write(r3, &(0x7f0000000100)='1', 0x1) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000140)={&(0x7f0000001680)=[{0x7, 0x0, 0x1, &(0x7f00000001c0)="ce"}], 0x1}) syz_clone(0x40000000, &(0x7f0000000200)="8706f6cf28445287a7d3165c35651fea9a22edefef45996058a566e81cb010c52d550f21338c01600c4665ebf1be16b5367d323d39932bed6d54e875d813c2d29caabc5853c276f1897843c255d1e2d50dff2ddea3e3aaad38356a456b4dd16a797e678f656a16d376a54ecf1d2098c0e7594130b62760bf8ed6723761b45c223f9efcc26f74c4da4d0a77d4e89bd9e3a54630e17a49396f304b7a6ce84149b9d582f52bf8a1227ad6c179627439b48749d68e205034350b97fadf3496ffb357a63661224f4f450963b51eb6b0e6682c1109b2eb820226daf8f2422dc927c2d950d0efe5e8dcfd68b997", 0xea, &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)="95659072c17271704929d7db6a0cf2d0153017b380148c4c2ab17e9a468f7eb9f97398488be8e52ea255904b713298ebad637499c47076a77fed2d649c1dc564fb3ecefa6c494ce9e76fb6bc3aa5b737eccd16a37e0198ad4ab861adb4f0953fca4338de91b01cb01e1db1196f30c39c4affb344a90f952184bd98e07faed510615c7736893838b5577d69bcf339cfef56829437831bb5c50f") 8m31.380801891s ago: executing program 3 (id=4242): ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0xb3b54c18e0590239, 0x0, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x1, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x28e}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x10, 0x2100, 0x11c, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x15c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf930, 0x0, 0x0, 0x1f0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x4000, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) socket(0x10, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 8m14.90098898s ago: executing program 33 (id=4242): ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0xb3b54c18e0590239, 0x0, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x1, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x28e}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x10, 0x2100, 0x11c, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x15c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf930, 0x0, 0x0, 0x1f0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x4000, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) socket(0x10, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 7m54.093603719s ago: executing program 1 (id=4352): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) (async) process_vm_readv(r1, &(0x7f0000002140)=[{&(0x7f0000001140)=""/4096, 0x1000}], 0x1, &(0x7f0000002380)=[{&(0x7f0000002180)=""/123, 0x7b}], 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_DEL_PMK(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20050200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) (async) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r2, 0x890b, 0x0) (async) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) (async, rerun: 64) syz_clone(0x8000, &(0x7f0000000400)="b1f5674da5b890977227c08d49d76393f2933198fc922bfd7d925204637fd22099772ceaa2f6977cebac", 0x2a, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000002140)="a29ba348b2a30fc53daecb02fb295896e92699b4207daa44882724864292e484f5cce128591ba797b998b99091b51536235361d12648336ab21fb58488c41cf98f0367fd2bf558c9b6b90d6521e265ba14d36cd29b52ddf655bc1522b4c682e52bff73b63da55dfbfb6b42cdb601eb5f66b31729d92ba2861b01a2e66829241ad60213c67469a86d0908bde83f9518c49fac1f2dac4938447717d86c3fc3f5e4baa8117a294b2a2c440d6038864634edfaa48a5301b9d38a83639775fa364a8dd3b655de11961ecc2c5b1db388cec5afdd9706172c6eb2a0091a937b0f58f6cce1a88522c72939668964fd3099478a3a722924dcbb5b9a47774e480afc478357bf121a04c2f312e3e1e73741a9cca6cad8c875cd6d309b196bf09f18313f44c6d8f150a5b30eda5e637e540dae2d7260eea2e5430e0c97e549aa6d0b560b17de262e0ad84de33b7dfcde4dca58a91c33cc51457947b4533f2506855fe3b87d4342e7a34fdd580020ea69767002f721c175d63d3b71221cc3ab404f3afb107cc96a0ca0e76bdbc1864a550b27881a343680b64736220d9e94f0592c3f9ea5f9dcff45cb31b411fb6db99432af1d9856c4e528f729a86625769643fd6127bf2d1cfb80efe1839593721fd91602ab9f12c0d4f4f891b749058751ca54b66ea875ea2089a5c9e097180e20cee1b4619788859c79d98d2fd38718292261d1eb6f703eb1bb86fe5f65ae4b3cdf9cedc38cdff67e80a064db26870576138033d3d5ca245c2bccd84c4051349097db420fc8bb2f72654c5f0294c8a87c1b0a095ad91db190ebd2e0cff4306ce8622da06b06e0dade0af2b5fe5307959f204f21798b60bfce709af81d577a91edf00880893c4f666adb9cc4cc879d89480ff0b802e77c178d57ff975618bad65b65d1e0ef1147a01ccbdec72f9e4573a500da94eca513c439e8b3732c7ad7554efebf4d22035f0eb06b18668392075029cfb7e675a07d82c458df35ce066221e1d910b463131f94d012a9c90c251baf73c1bf7e2ccfbae9c3e8bb6dfa60b60f8f0eb3944b876d159740b6511218db8f25f83a2078567b422eadf403d959ffcb268a5ae8171f5d6ae23b0f88b833ef31afd45596230d1ab2acd45fb1faf9f2b36194c709029884a7bc6342f947fee05a4f2312eb9a05949dd7f78713893bfa510c794ca451e51490dbb5c88d3b693ba8ba306c2ae8ee5da0edf90eb4a91137e97dd762f9ed20563987433d0729b870e5828d093ac0cd022858ba804fd2a7e601089c1d9ee675486ab9739a0ea4eefe0380c97127ec07ef6ecf26a32bab6b1c4252f2ca323d09d8e0167f61fb277fbafc5bd35da3069f47a2f653baf5bf84b2f2b99f3fb9de9761f35902935058ebca0e6230130cc4e0dc8aa171fa15a4cdac66047ee9489860063ba00b1edd7a99f4a769bc4d513945646c5b62716b630d86942458a858b9ce1a616b26d79d6affd0960e23ec81a7453c59ead11c921e4ba50f0bc5d7003636ceefa7a56617fa0081437eb64a36b27883a431622c22915f0d012830d87482238b3016b185b7e6105424746e4b3714c123c54c62b427f3e9b57887571d2fb6c7e5dc208d5deadb3016aefdfe0a35ceb844b264541c8a487aed017d5dd018027bfc748da41a83e49a4f631c12a577780427d8568c536a02d45ae666ae6adc2dcce2cd78c1dca27fb301bb63a21344be9dc8a750b0777f52a211a7ec6453e6df5606b17d9317877d5d0dfa02aa5842a15aaeef4b5899ea6912c125733311031d0c80f9567f392ab4ea415167df12d5edac253f23547f4a5851ee42a5280a7055995414d773c9f5fd6a5daf64db3f1ef93751deb94a5ba6a3cc20b16f1fd75094c6d90c6b949a29b73afa19d0ca4403d0f01f91d762126077b10f1152314a96bd1f8e1ae4e7b33f3b6cef33fa635150cafe66b9de0bb45e10e6db7aafce566257712b05015beb6c5be21b644ddded413dd17a91b17f3e58e4cde47842c4070dcd535f0116a74d648829d53c2490486b1d9718d46c15b7a3bfdeec5cdc69b7f65c8d95038d1e1a8ed33e7d1517d2d852cb8b6ccfc7877685b3b69d7f92c59b016414d74feb8eb8a137c3879435f59e13b4e27e5e6cfee2e92e635e15961f483fb8e9c46862e5673dd8671642eee45afd0b0d7a4f20faaae496d02c9344311150dec68d3bbe844fa7ca124d4a1503cc10109c3b4b6892698979af5d174fa3951db65a2aaae04d9ab3916dda82e2832b9c3071507a7e66a93ff763a0ff98b913dd64d62bc09df63f8dfa6b5878cda08384dc218be97c5653164dc101148ba2bc0a1fe45fd1dfb6a81f5de17ce99e9b50fda894ca16d71eed09b800f1262a24dd23770bc02137179639586611622e8dfbb98550f7906342cadfc3962afe6dfd04cb8ea8c82f85f1cc9eb4130360ca28a0cbb77f53e16542460d7889b6056c35028f1ab0678c5d247251b5c9659a7d9dfa6ab9a9c73ba30818001b24c405f1050da18fb0560b038681c7847dc67b283c97c143e0c21af5b54f6912334e7cf058c188c9eddbf310fc9c2998988c8f365876cfeea76edeeb3604a249dcba3aae69e9ac66164db9de7f19e6e687a95fc1a8e63677654a7503793703c653934eb5f38749a8b06aa6fab7915e2a38b507deab8f008a89164f141c4197dee8aefea1d710d81d3136635d464b5081ab7165efcac1b54171c2191b3a5c4ceb7e92ec0876ebe4c481a136aa7147a443b31ac2f16e27ad14979d98834a780deb687863947824b8d9136bdc781681054bb3c92561be4ecec9f462a73a3a50dd848f8eb22f208bf83ce385543d51aea1f093ed03e259763f609442190b9c7c571f9941a75f85abc8bd19aadde2f16ca129f061e9963a702b38a784c220bb2a40a671d9a3e4df32f44ed8e350390f4423a78f48654fc9ab8c1336bda27b87814fe035171f54d159dae4c5f7596ca4d73b66d170ef2f4d7d9d8ee475bab7c169474a459d407f0ae79f203ccdac5b6ab7106add95823310f1925623008ba0a49c272f56ccf939f0fb6ec617c5d4d463c30ca92c33c3016ee82074597d9ef5c7d0c4ffdfc2c10985e777106c1ba366b6eeeebac600747034121c5615fc1f9d54b13e08e4b2b27c044c8c8440573a8ec3d7727944e0460317fd01da64fde732cc2dcfc74dc755c81dc96eb329c6425de359aebe01792c4e7f1e338c07f95c732a5a67a2e1ba1827bf7ded4a21b57a30a2d5d5be30fb6f355a3f3019b5aa0d1fadd0303854efcee79a06ffd401d70ab4ed59de54a9d2a3cc85abea73a1ba4992801cbcac5e95b59a5158c53d7bc21ac7edd8371846cf95bd4f3b1383ab019b6285a5f3602ad662f43dee0c4ee5f078413988eec411c0c67c16cb2b7fe256c262abd4ca44b95a86dbf498bb80311611873cce34bfbbe60252afc0ea1534f6b10bd8060ce86366e22ceb1a4f36c2125b1e0eadb64ca93f8469f0bc5fdc5ae21f1d9eb9b5424e14b668f77dbbccc0bcf6d62eb2db77bdec915d0c05d6169a8f6b56cf5ab65b2742821e13ef1b3211c75b2e7d1caf7a38b2b71f89d20bdf7642e17dba30452c50ee82a23a63e3b42d3ea4cebbcf9e1abda4ac864f6d9184e7b938c5a9b0c13d36948fe85913184484912324a1b31ce30179508d3569d0f436a8114504cade6ee25c01c4577de7cdf9f5f79a41220c509a62770f1090b9598094ceb64445f8d05aee2f1a6817f92c2d88e48dce27cfe4c1146d9d656827b4d3a811336b7a2f5f9eb5a4a6af0b1a03623290d2a7cf7b5a8d1ea94f8781acf13dd49298098caf69d7db3bd4ac8aa4af0d8e6355e2136cdd5953952fa989a933ac7cca1d8755f8fbe9eabe8f508fdc9baa073e8ad4af2492d8d047c75a8ad4decd4b5d9b7356e13244b72582597acbeedb6f63ce19dc04e28eea43f006346374afb0bc22fe421b8e3dfabc3d0701e277fb19a9986ba9ea0c2dc55eb7b456baf8b14cdbf87ffad882cd6f20b1d3dcf1d1dc2148fc9d1b29051e7c97a7e55aee7c426cc4ef52707a69ab57416e56a31cf9ba7806f59eb388dfe80eaa80e28a09efc7556922f4a8c5ee0bb28a378cfedbda0ffac5708c190329ccca23895a9931aed73ba7915dff5f23d390fb07a3643c288bdd5cfe8d4aced832418129519a7ebbbeabc410ee647cdaef42b9fba74cbf28b4589b7f7140a4f5396c998a10bf0d4fb1a8f0e8fad67397b4bb48d31db6d78e2424be03a5761a09bcb066d55a7b0ebff26d6ae95e9ef3ddec5eac3c60150a06f5ded39a6aa7159d19470ad542439000e58c7a3bd526c4684870172e0b556b26870bcecbd0b58fc5cec163acf966dd3d5a1b36475120eb3820e42e563470237ab4a82309ab5b71956e5fcd2cb6aaf28c604778185653775047a19bab96018d00449d9a420b01ebb31c6376cb416183923c9cf5c025e4e0d9ce6bb1e4e4c53f372d6b2324f193c38293b739daa51d83c29448c06e204d5739bd5cb37d9d72deb540fa5f49447ae3619d231d3171735873d19d2261c96bb9b1353306d8a7396878b1b5460633fbb5163c6751ca8b60a63fbc820fdfc46910ffe4688701a209ec3bd79535bf10c9ba35ab2159ad3b456bab363658297ed5d6b8be605616e0747f71f2823f11b8daf880fc96ad33bd0d0648da8776dc261a10ed79541bb65fe6f39d8e48e25d4e41031dbbdea0c1b7b48917a352285621c8b179af8c51b43cd601884498a50bf676b2c30968ac88e0094ff0c6124397608d8db64d94e126a78199cefbc31691f45b36063b8b92a1dffa753db001bf9985279028add8a07ecc24d97face53461690ff00d9f2c22663b9ebef0840964a31ec91591f1b4680db696ef5fe4dd445d8a4a5375b6540398d88cef202105e9b1babfe48eb8df9274d58e6d13ecd793c115514ba2c0dfb3e862b0282fcd1ad73aaef8eac0c9c79edec8663bb53a82f39cf9c892dcc907f2e19bd4b8c3767f2793be6fed8dc6a729fc12786ef6889334e5744cad08fa408aa7b15f303e1db7932d7534b4e8c3b69155807c35baa07507e81ccb104a5912df2b766d35a4457f31dc33c2d8b8d904b2be788f42ae3c6156cecc3bd16d291662ab304a95f3f5ae8104a9ea549f21b6a50c9deb0f44ce9aacae3e752ba6fd5769246a38827e5a76feebb8b9c37e7753b99df74a20fd487ecc8f4e14ec5eea118599e4aa61339ae22d8682544811f2cd8257d65e197398a8130ffe905f84f0bfe01eb7a9234fa75cf59bb0019b9a1652009999658c34bdbc47f5b3a57200f12eaad3d65821a9afe297b8a6f52b190d71c497aea1e8569bf13fc9ce727a7d7802a143fc4c29d0fefaf014ea50024f387c8590547989f9bed5c86b0da1d08ab1e4d89b706beb3f94abf5fd512efee23b001831e019d7e1f463bdc6292a4bf14f15801db626bcf23daf55cc512ccaf4b2e114823563a80d397a3f41a6eef884d933b2ee03e33a79e4958bd4a3a2f490cd7f2d4320b0bc887634bf3adea26b5135cfe96219a433e9cc4576d2c84f63a4fb180dc90a5dd511c73cd34d2dbbd77f5d171571518162c35070d4ed58ff8e9ceb3bc5c170e632a5cc40ed24fc3518527a9e556360254edf85dc3f739d8c46ac18d2e688a050771e13bdeeeaf6e608d725a8f4df930fa23c357d55cd1c43cd20d991ad76f7b0d8cd8ee34301c89603ca4630d7ff356d926c5fff955d92e3036c31e00f57daebac0dad42577a5e3dc6b9a43c155d1c449aabfea887832bf230886a4359ad29dd7fd817276d") (rerun: 64) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0xfffffff6, 0x0, 0x1, "0062007d82000000000000002240f7ffffff00"}) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) (async, rerun: 64) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x15, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000000000000079100000000000007b0a00ff"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xed8}, 0x94) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x515d02, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x6, 0x9}) (async, rerun: 32) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000180)={0x9, {"a2e3ad214fc752f91b2909094bf70e0dd038e7ff7fc6e5539b324c078b089b3b373b6d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5d38300d106d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df0784c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d618e462071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af44863c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000510b00", 0x1000}}, 0x1006) (rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r5, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="e86364e0a3991ae0faffb982", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x33) (async) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x1b0}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 7m49.299468334s ago: executing program 1 (id=4358): ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='status\x00') setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a80)={0x2020}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) socket$inet_smc(0x2b, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0xb3b54c18e0590239, 0x0, 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x1, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x28e}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x10, 0x2100, 0x11c, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x15c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf930, 0x0, 0x0, 0x1f0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x4000, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 7m47.611113618s ago: executing program 1 (id=4363): mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) write$binfmt_format(r0, &(0x7f0000000100)='0\x00', 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x78, '\x00', 0x0, @fallback=0x30, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) write$qrtrtun(r0, &(0x7f0000000340)="ca0e808b935b", 0x6) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x7], &(0x7f0000000240), 0x0, 0x1}}, 0x40) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="00000000e785a9d70a8937605b2aaded53d9ba60a4c2f792273c08db5ee77fd6708527db94aabc5514095f06fd24824c3d702d4df8d3a3f36f1df1c14cece81bfae88ae9f2adf74bb3c9f023134558fbb79c472c0368a9c6762d1886ceb39982221e1004b848ee0bb08afc", @ANYRES16=0x0, @ANYBLOB="040025bd7000fbdbdf25010000002c00018008000300ac1414aa060005004e200000080006000800000008000300ffffffff0500020000000000080003000400000008000300060000000500050040000000040006800800030001000000"], 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x40) 7m46.456407836s ago: executing program 1 (id=4365): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) socket$kcm(0x10, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, 0x0, 0xc000) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000850}, 0x0) setrlimit(0xd, &(0x7f0000000280)={0xc800, 0x10000}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$vga_arbiter(r2, &(0x7f0000000000)=@other={'decodes', ' ', 'io'}, 0xb) setpriority(0x1, 0x0, 0x80000000) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(0xffffffffffffffff, 0x40505330, &(0x7f0000000c40)={{0x2, 0x1}, {0x7f, 0xff}, 0x9, 0x5, 0xc}) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r3, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='./gadget/ep1in-bulk\x00', &(0x7f0000000240), 0x4000, &(0x7f0000000cc0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[], [{@dont_appraise}, {@appraise}]}}) write(r4, 0x0, 0x0) futex_waitv(&(0x7f0000000a40)=[{0x30a, &(0x7f0000000080)=0x100000001, 0x2}, {0xffffffffffffffdd, &(0x7f0000000340)=0x6, 0x82}, {0x3736, &(0x7f0000000540)=0x5, 0x2}, {0xa6, &(0x7f0000000580)=0x8, 0x2}, {0x7, &(0x7f00000005c0)=0x1, 0x2}, {0xb38, &(0x7f0000000640)=0x101, 0x82}, {0x7, &(0x7f0000000680)=0x8000, 0x2}, {0x2, &(0x7f00000006c0)=0x6, 0x2}, {0x1000, &(0x7f00000000c0)=0x2, 0x82}, {0x2, &(0x7f0000000740)=0x100, 0x2}, {0x33c0000000000000, &(0x7f0000000780)=0xa6, 0x2}, {0x9, &(0x7f00000007c0)=0x8, 0x82}, {0x1, &(0x7f0000000800)=0x2, 0x2}, {0x5, &(0x7f0000000880)=0x7, 0x2}, {0x7000000000000, &(0x7f00000008c0)=0xfffffffffffffff7, 0x2}, {0x200, &(0x7f0000000900)=0x52, 0x82}, {0x0, &(0x7f0000000940)=0x6b, 0x82}, {0x94, &(0x7f0000000980)=0x2d328a0f, 0x2}, {0xfffffffffffffffe, &(0x7f0000000440)=0xb385, 0x82}, {0x6, &(0x7f0000000a00)=0x8, 0x82}], 0x14, 0x0, 0x0, 0x1) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000480), 0x482, 0x0) syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @hci_ev_keypress_notify={{0x3c, 0x7}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x2}}}, 0xa) 7m43.95198668s ago: executing program 1 (id=4377): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYRES8], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1f9) r0 = open(&(0x7f00000000c0)='./file1\x00', 0x14da7e, 0x20) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000240)=0x10) copy_file_range(r0, 0x0, r0, 0x0, 0xb51, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r2 = geteuid() mount$pvfs2(&(0x7f0000000040), &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0), 0x808004, &(0x7f0000000280)=ANY=[@ANYBLOB="5e23262a25a82a262c242c70726f63002c252c285c232c657569643d", @ANYRESDEC=r2, @ANYBLOB="2c7063723d3030303030303030303030e0df303032301036302c61707043616973655f747970653d696d617369672c00"]) write(r1, &(0x7f0000000000)='3', 0x4e) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x24}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) socket(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x260201, 0x0) ioctl$BLKZEROOUT(r4, 0x127f, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000140)={'wlan0\x00'}) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000140), 0xa0040, 0x0) ioctl$SOUND_MIXER_READ_DEVMASK(r5, 0x80044dfe, &(0x7f0000000180)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x325000, 0x800}, 0x1c) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x14) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) 7m43.461002806s ago: executing program 1 (id=4380): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r2) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x14, r3, 0x701, 0x70bd2d, 0x25dfdbef}, 0x14}}, 0x10044890) syz_emit_vhci(&(0x7f0000001840)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x6, 0x1, 0x407}}}, 0x7) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000200)={'wpan3\x00'}) sendmsg$NFC_CMD_LLC_SET_PARAMS(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="020729bdc6ffba5cde70b51d85ed2081068c7000ffdb"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x40005) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="3c0000001000010800000000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="000000000110000008001b000000000014002b8008000100", @ANYRES32, @ANYBLOB="860dea8a53411ffd99eaad000005000000"], 0x3c}}, 0x0) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), r1) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000041000701fefeffff00000000017c0000040042802000018006000600800a00000c001500faffffffffffffff08000900", @ANYRES32=r5, @ANYBLOB="040002"], 0x3c}, 0x1, 0x0, 0x0, 0x48815}, 0xc010) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r4, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 7m26.704656883s ago: executing program 34 (id=4380): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r2) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x14, r3, 0x701, 0x70bd2d, 0x25dfdbef}, 0x14}}, 0x10044890) syz_emit_vhci(&(0x7f0000001840)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x6, 0x1, 0x407}}}, 0x7) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000200)={'wpan3\x00'}) sendmsg$NFC_CMD_LLC_SET_PARAMS(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="020729bdc6ffba5cde70b51d85ed2081068c7000ffdb"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x40005) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="3c0000001000010800000000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="000000000110000008001b000000000014002b8008000100", @ANYRES32, @ANYBLOB="860dea8a53411ffd99eaad000005000000"], 0x3c}}, 0x0) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), r1) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000041000701fefeffff00000000017c0000040042802000018006000600800a00000c001500faffffffffffffff08000900", @ANYRES32=r5, @ANYBLOB="040002"], 0x3c}, 0x1, 0x0, 0x0, 0x48815}, 0xc010) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r4, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 1m9.525284723s ago: executing program 5 (id=6169): sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x8000) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) socket$nl_generic(0x10, 0x3, 0x10) eventfd2(0x50, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x44050) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000100)='cpuset.mems\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f00000004c0)=ANY=[], 0x28) 1m9.452175393s ago: executing program 5 (id=6171): r0 = syz_open_dev$loop(&(0x7f0000000080), 0x9, 0x103000) ioctl$XFS_IOC_READLINK_BY_HANDLE(r0, 0xc038586c, 0x0) 1m9.451942442s ago: executing program 5 (id=6172): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0xf0, 0x10, 0x1, 0xfffffffe, 0x100, {{@in=@loopback, @in=@rand_addr=0x64010100, 0x1, 0x7fff, 0x4a23, 0x25, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@mcast1, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xe73c}, 0x70bd2a, 0x40003504, 0x2, 0x1, 0xa, 0x20}}, 0xf0}, 0x1, 0x0, 0x0, 0x20048041}, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0x7, 0xd, 0x0, 0xffdffffc, 0x6, "00001000"}) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0x2, 0x0, 0x83, "00000000000000000000ffff00000000000002"}) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0x0, 0xfffffffd, 0x0, 0x6, 0x12, "e315bc1cc24ff7b7cdb242e1ff0aa6905446b3"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f0000003f80)={0x2020}, 0x2020) read$watch_queue(r2, &(0x7f0000000200)=""/148, 0xffffffc0) 1m9.265366405s ago: executing program 5 (id=6176): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/midi.usb0/out_ports\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)='2', 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r4 = inotify_init1(0x800) inotify_add_watch(r4, &(0x7f0000000240)='.\x00', 0x60000526) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x3, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x11, 0xd8}, [], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f00000003c0)='dummy_udc.0', 0xb) 1m7.937191733s ago: executing program 5 (id=6185): syz_open_dev$sndctrl(&(0x7f0000004e80), 0x0, 0x750561da6408ea23) 1m6.104304828s ago: executing program 5 (id=6199): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x5031, 0xffffffffffffffff, 0xc2dcc000) r0 = gettid() ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$packet(0x11, 0x2, 0x300) timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x3}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) r1 = inotify_init() read$FUSE(r1, 0x0, 0x0) 1m5.781887663s ago: executing program 35 (id=6199): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x5031, 0xffffffffffffffff, 0xc2dcc000) r0 = gettid() ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$packet(0x11, 0x2, 0x300) timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x3}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) r1 = inotify_init() read$FUSE(r1, 0x0, 0x0) 4.897581161s ago: executing program 6 (id=6756): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/uac1.usb0/c_srate\x00', 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') write$uinput_user_dev(r0, &(0x7f00000004c0)={'syz0\x00', {0x7fff, 0x6, 0x9, 0x401}, 0x51, [0x2, 0x2, 0x5, 0x2ed5, 0x2, 0x40, 0x2, 0x7fffffff, 0x2, 0x7, 0x1ff, 0xbca, 0x9, 0x215, 0x7fff, 0xf, 0x6e, 0x3, 0xfffffff7, 0x95, 0x76f7, 0x1, 0x0, 0xd, 0x604d, 0x5, 0x5, 0x3, 0x2fc0000, 0x8, 0x10, 0x1912, 0x8, 0x0, 0x80000000, 0xba, 0x401, 0x9, 0x9, 0x7fffffff, 0xcf15, 0x384, 0x1, 0x7, 0x5, 0x7, 0x8, 0x80000000, 0xad, 0xb2c, 0x8, 0x7db, 0x6, 0x81, 0xf6, 0x8, 0x8, 0x55, 0x7, 0x8000, 0x80000000, 0xfffffffc, 0x4, 0xd], [0x854, 0x3, 0x4d, 0xa7, 0x0, 0x1, 0x0, 0xf73f, 0x5, 0x9, 0x3, 0x7, 0xa, 0x2, 0x6, 0x9, 0xe41, 0x5, 0x5, 0x7, 0x72b00000, 0x6, 0x1ff, 0x400, 0xfffffffa, 0x9, 0x1000, 0xa, 0xd, 0x2, 0x5, 0xad, 0xb2, 0x9, 0x5, 0x0, 0x486f, 0x1, 0x4, 0x81, 0xe, 0x6, 0x4, 0xfffffffa, 0x7, 0x4, 0x5, 0x3, 0x5, 0xf02e, 0x0, 0xfffffffd, 0x9, 0x10001, 0x101, 0x9, 0x1ba, 0x9, 0x400, 0x7, 0x4, 0x4, 0xffffffff, 0x7f], [0x2, 0x9, 0x1, 0x3, 0x9, 0x0, 0x7, 0x2d39, 0xc9c, 0x4, 0x8, 0x2, 0x4, 0x5, 0xf2, 0x392, 0x2, 0x5, 0x71, 0xfff, 0xa, 0x7, 0x4, 0xad, 0x8b, 0x4, 0x6, 0x3d, 0x9, 0x3, 0x8, 0x9, 0x9, 0x8000, 0xffffff37, 0x4, 0x6, 0x5, 0xd9, 0xfffffff8, 0x0, 0x1, 0x1, 0x2, 0xd, 0x80, 0x2, 0xb8ec, 0x42, 0x2, 0x6, 0x7, 0x0, 0x1, 0x40, 0x2, 0xe, 0x4, 0x0, 0x10001, 0x8001, 0x0, 0x7, 0x2], [0x2, 0x1, 0x3, 0xdf, 0x9, 0x40, 0xa555, 0x7, 0x23, 0x0, 0x7fffffff, 0x3, 0x10c1, 0xc00, 0x4, 0x7ff, 0x8001, 0x6, 0x10001, 0x3, 0x9, 0x7, 0x4, 0x0, 0x3, 0x1, 0x7ff, 0x8, 0x8, 0x4, 0x0, 0x1, 0xe7, 0x4, 0x0, 0x0, 0x1, 0x1, 0x5, 0x3, 0x5f, 0x101, 0x20, 0x6, 0xfffffffe, 0x5, 0x9, 0x4, 0x9, 0xc, 0x4, 0xc2, 0xc, 0xe, 0xfff, 0x3, 0x1, 0x5, 0x1f8a3775, 0x5, 0x1000, 0x9, 0x2, 0x1]}, 0x45c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0xa6000) setsockopt$inet6_group_source_req(r2, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) socket(0x80000000000000a, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f03fe7feee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c642b4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x3}, {0xb}}}, 0x24}}, 0x0) 4.744943227s ago: executing program 6 (id=6757): sendmsg$DEVLINK_CMD_SB_POOL_SET(0xffffffffffffffff, 0x0, 0x4010) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000005c0)='westwood', 0x8) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x515002, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f00000017c0)=@raw={'raw\x00', 0x4001, 0x3, 0x1240, 0x10f0, 0x700001b, 0x148, 0x0, 0x148, 0x11d0, 0x206, 0x240, 0x11d0, 0x240, 0x7fffffe, 0x0, {[{{@ip={@multicast1, @empty, 0xffffff00, 0xffffffff, 'veth0_to_hsr\x00', 'sit0\x00', {0xff}, {0xff}, 0x2f, 0x1, 0x46}, 0x1ea, 0x10d0, 0x10f0, 0x0, {0x390, 0x8f00}, [@common=@addrtype={{0x30}, {0x158, 0x202}}, @common=@unspec=@cgroup1={{0x1030}, {0x1, 0x0, 0x1, 0x0, './cgroup.net/syz1\x00', 0x5, {0xffffffffffffff03}}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0xd4, 'syz1\x00', {0x9e2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x12a0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket(0x2b, 0x80003, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r2}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x7, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x62, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r3 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) getdents(r3, &(0x7f0000001fc0)=""/177, 0xb1) getdents(r3, 0x0, 0x0) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) r4 = fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 4.744710654s ago: executing program 6 (id=6758): r0 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000200)={&(0x7f0000000400)={0xa, 0x1234, 0x0, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=[@hoplimit={{0x14, 0x29, 0x34, 0x40}}], 0x18}, 0x0) 4.66073881s ago: executing program 6 (id=6759): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) close(r2) listen(0xffffffffffffffff, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0xff32, 0x8fc, &(0x7f0000000480)={0xa, 0x3a, 0x9, @loopback={0xff00000000000000}, 0x2}, 0x1c) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040), 0x4) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='dummy_udc.0', 0xb) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x6, 0x0, 0x0, 0x500, 0x0, 0x71, 0x11, 0x24}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x6, 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="85000800000000029500000000000000"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x90}, 0x94) 3.717959039s ago: executing program 6 (id=6766): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x845c5000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) 2.81652433s ago: executing program 6 (id=6777): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c0000001000ffff23bd7000fb5bdf2500000000", @ANYRES32=0x0, @ANYBLOB="1414000021600200240012800c0001006d6163766c616e00140002800800010010000000080003000000000008000500", @ANYRES32=r1], 0x4c}}, 0x0) 1.883881114s ago: executing program 0 (id=6780): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/dev_snmp6\x00') close(0x3) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e04, 0x3, @dev={0xfe, 0x80, '\x00', 0x25}, 0x23}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000001980)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x64}, 0x10}, 0x1c, 0x0}}], 0x40000000000024e, 0x20002040) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)=0x0) fcntl$lock(0xffffffffffffffff, 0x22, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) sendto$inet(r0, 0x0, 0x0, 0x404c000, 0x0, 0x0) 1.68046694s ago: executing program 0 (id=6781): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) read(r0, &(0x7f0000000900), 0x100) read(r0, 0x0, 0x0) read(r0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x400, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x3f00000000000000) 1.29996435s ago: executing program 7 (id=6784): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/uac1.usb0/c_srate\x00', 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') write$uinput_user_dev(r0, &(0x7f00000004c0)={'syz0\x00', {0x7fff, 0x6, 0x9, 0x401}, 0x51, [0x2, 0x2, 0x5, 0x2ed5, 0x2, 0x40, 0x2, 0x7fffffff, 0x2, 0x7, 0x1ff, 0xbca, 0x9, 0x215, 0x7fff, 0xf, 0x6e, 0x3, 0xfffffff7, 0x95, 0x76f7, 0x1, 0x0, 0xd, 0x604d, 0x5, 0x5, 0x3, 0x2fc0000, 0x8, 0x10, 0x1912, 0x8, 0x0, 0x80000000, 0xba, 0x401, 0x9, 0x9, 0x7fffffff, 0xcf15, 0x384, 0x1, 0x7, 0x5, 0x7, 0x8, 0x80000000, 0xad, 0xb2c, 0x8, 0x7db, 0x6, 0x81, 0xf6, 0x8, 0x8, 0x55, 0x7, 0x8000, 0x80000000, 0xfffffffc, 0x4, 0xd], [0x854, 0x3, 0x4d, 0xa7, 0x0, 0x1, 0x0, 0xf73f, 0x5, 0x9, 0x3, 0x7, 0xa, 0x2, 0x6, 0x9, 0xe41, 0x5, 0x5, 0x7, 0x72b00000, 0x6, 0x1ff, 0x400, 0xfffffffa, 0x9, 0x1000, 0xa, 0xd, 0x2, 0x5, 0xad, 0xb2, 0x9, 0x5, 0x0, 0x486f, 0x1, 0x4, 0x81, 0xe, 0x6, 0x4, 0xfffffffa, 0x7, 0x4, 0x5, 0x3, 0x5, 0xf02e, 0x0, 0xfffffffd, 0x9, 0x10001, 0x101, 0x9, 0x1ba, 0x9, 0x400, 0x7, 0x4, 0x4, 0xffffffff, 0x7f], [0x2, 0x9, 0x1, 0x3, 0x9, 0x0, 0x7, 0x2d39, 0xc9c, 0x4, 0x8, 0x2, 0x4, 0x5, 0xf2, 0x392, 0x2, 0x5, 0x71, 0xfff, 0xa, 0x7, 0x4, 0xad, 0x8b, 0x4, 0x6, 0x3d, 0x9, 0x3, 0x8, 0x9, 0x9, 0x8000, 0xffffff37, 0x4, 0x6, 0x5, 0xd9, 0xfffffff8, 0x0, 0x1, 0x1, 0x2, 0xd, 0x80, 0x2, 0xb8ec, 0x42, 0x2, 0x6, 0x7, 0x0, 0x1, 0x40, 0x2, 0xe, 0x4, 0x0, 0x10001, 0x8001, 0x0, 0x7, 0x2], [0x2, 0x1, 0x3, 0xdf, 0x9, 0x40, 0xa555, 0x7, 0x23, 0x0, 0x7fffffff, 0x3, 0x10c1, 0xc00, 0x4, 0x7ff, 0x8001, 0x6, 0x10001, 0x3, 0x9, 0x7, 0x4, 0x0, 0x3, 0x1, 0x7ff, 0x8, 0x8, 0x4, 0x0, 0x1, 0xe7, 0x4, 0x0, 0x0, 0x1, 0x1, 0x5, 0x3, 0x5f, 0x101, 0x20, 0x6, 0xfffffffe, 0x5, 0x9, 0x4, 0x9, 0xc, 0x4, 0xc2, 0xc, 0xe, 0xfff, 0x3, 0x1, 0x5, 0x1f8a3775, 0x5, 0x1000, 0x9, 0x2, 0x1]}, 0x45c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0xa6000) setsockopt$inet6_group_source_req(r2, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f03fe7feee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c642b4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x3}, {0xb}}}, 0x24}}, 0x0) 1.299459838s ago: executing program 4 (id=6785): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r0, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="018dffffffff"}) 1.246632221s ago: executing program 4 (id=6786): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000540)={0x2, @sliced={0x2, [0x9, 0x5, 0x0, 0x2, 0x7, 0x7, 0xe1c2, 0x6a, 0x2, 0x7, 0x1, 0x9, 0x7, 0x9, 0x2, 0xfff4, 0x0, 0x10, 0x4, 0x8001, 0xf9a, 0x7, 0x2, 0x8000, 0x2, 0x7, 0x6, 0x5, 0x2000, 0x7fff, 0xc, 0x8, 0x0, 0x10, 0xfffa, 0x800, 0x3f6a, 0xfff5, 0x4, 0x6, 0x1ff, 0x0, 0x3, 0x4, 0x400, 0x8, 0x7f, 0x5], 0x7}}) 1.246420208s ago: executing program 4 (id=6787): socket$can_raw(0x1d, 0x3, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x3f00) r2 = syz_create_resource$binfmt(0x0) openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) sendmmsg(r0, &(0x7f0000007fc0), 0x0, 0x4000010) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r3, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 1.170601747s ago: executing program 7 (id=6788): socket$inet(0x2, 0x2, 0x1) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x40002, 0x0) ioctl$RTC_AIE_OFF(r0, 0x7002) 1.17015059s ago: executing program 7 (id=6789): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xaf}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) 683.213567ms ago: executing program 0 (id=6790): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x300000a, 0x16d132, 0xffffffffffffffff, 0x0) 682.85751ms ago: executing program 0 (id=6791): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0x6, 0xa2b9, 0x6, 0x7, 0x3, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x4, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0x8, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x80002, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x403, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x0, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463d, 0x5, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$video(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000080)={0x1, 0x1, 0x2}) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)=@userptr={0x0, 0x1, 0x400000, 0x0, 0x0, {}, {}, 0x0, 0x2, {&(0x7f0000401000)}, 0x400000}) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000200)=0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48090}, 0x1) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="6400000002090101000000000000000001000001200002001400018008000100ac14141d080002007f000001"], 0x64}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0xb, 0xfff, 0x2e8, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x8000000}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 445.028385ms ago: executing program 0 (id=6792): socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl(r2, 0x4048aecb, &(0x7f0000000240)) 357.719145ms ago: executing program 0 (id=6793): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000340)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = socket$unix(0x1, 0x1, 0x0) connect$unix(r2, &(0x7f0000000640)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 313.871103ms ago: executing program 4 (id=6794): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='sys_mnt\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='sys_mnt/block/zram0/algorithm_params\x00', 0x1, 0x0) write(r0, &(0x7f0000000780)="224243083db0b3c186073e13be498e770295714a264b08b6bcaaf1a5613d806a6cde2af218751653e9a2f3e23398d8f7a8ae30aea8baf25fb204c783e698aa307676b0462d652529db9cc9eee6635de66f27bcec6241ac2e01b2ed3f69b8998fb651abd652830fac933b2b6978d54d59f30e1d25a64f8495672499fa7692c83c3dadb4b694d3a98c66edeb5c7606aece04046fc05c224d97", 0x98) 249.835278ms ago: executing program 4 (id=6795): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/uac1.usb0/c_srate\x00', 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') write$uinput_user_dev(r0, &(0x7f00000004c0)={'syz0\x00', {0x7fff, 0x6, 0x9, 0x401}, 0x51, [0x2, 0x2, 0x5, 0x2ed5, 0x2, 0x40, 0x2, 0x7fffffff, 0x2, 0x7, 0x1ff, 0xbca, 0x9, 0x215, 0x7fff, 0xf, 0x6e, 0x3, 0xfffffff7, 0x95, 0x76f7, 0x1, 0x0, 0xd, 0x604d, 0x5, 0x5, 0x3, 0x2fc0000, 0x8, 0x10, 0x1912, 0x8, 0x0, 0x80000000, 0xba, 0x401, 0x9, 0x9, 0x7fffffff, 0xcf15, 0x384, 0x1, 0x7, 0x5, 0x7, 0x8, 0x80000000, 0xad, 0xb2c, 0x8, 0x7db, 0x6, 0x81, 0xf6, 0x8, 0x8, 0x55, 0x7, 0x8000, 0x80000000, 0xfffffffc, 0x4, 0xd], [0x854, 0x3, 0x4d, 0xa7, 0x0, 0x1, 0x0, 0xf73f, 0x5, 0x9, 0x3, 0x7, 0xa, 0x2, 0x6, 0x9, 0xe41, 0x5, 0x5, 0x7, 0x72b00000, 0x6, 0x1ff, 0x400, 0xfffffffa, 0x9, 0x1000, 0xa, 0xd, 0x2, 0x5, 0xad, 0xb2, 0x9, 0x5, 0x0, 0x486f, 0x1, 0x4, 0x81, 0xe, 0x6, 0x4, 0xfffffffa, 0x7, 0x4, 0x5, 0x3, 0x5, 0xf02e, 0x0, 0xfffffffd, 0x9, 0x10001, 0x101, 0x9, 0x1ba, 0x9, 0x400, 0x7, 0x4, 0x4, 0xffffffff, 0x7f], [0x2, 0x9, 0x1, 0x3, 0x9, 0x0, 0x7, 0x2d39, 0xc9c, 0x4, 0x8, 0x2, 0x4, 0x5, 0xf2, 0x392, 0x2, 0x5, 0x71, 0xfff, 0xa, 0x7, 0x4, 0xad, 0x8b, 0x4, 0x6, 0x3d, 0x9, 0x3, 0x8, 0x9, 0x9, 0x8000, 0xffffff37, 0x4, 0x6, 0x5, 0xd9, 0xfffffff8, 0x0, 0x1, 0x1, 0x2, 0xd, 0x80, 0x2, 0xb8ec, 0x42, 0x2, 0x6, 0x7, 0x0, 0x1, 0x40, 0x2, 0xe, 0x4, 0x0, 0x10001, 0x8001, 0x0, 0x7, 0x2], [0x2, 0x1, 0x3, 0xdf, 0x9, 0x40, 0xa555, 0x7, 0x23, 0x0, 0x7fffffff, 0x3, 0x10c1, 0xc00, 0x4, 0x7ff, 0x8001, 0x6, 0x10001, 0x3, 0x9, 0x7, 0x4, 0x0, 0x3, 0x1, 0x7ff, 0x8, 0x8, 0x4, 0x0, 0x1, 0xe7, 0x4, 0x0, 0x0, 0x1, 0x1, 0x5, 0x3, 0x5f, 0x101, 0x20, 0x6, 0xfffffffe, 0x5, 0x9, 0x4, 0x9, 0xc, 0x4, 0xc2, 0xc, 0xe, 0xfff, 0x3, 0x1, 0x5, 0x1f8a3775, 0x5, 0x1000, 0x9, 0x2, 0x1]}, 0x45c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0xa6000) setsockopt$inet6_group_source_req(r2, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f03fe7feee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c642b4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x3}, {0xb}}}, 0x24}}, 0x0) 86.102223ms ago: executing program 7 (id=6796): r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f0000000100)={0x0, 0x400, 0x9, 0xfffffff7, 0x1, [], [0xffffffff, 0xd8, 0xfffffffe, 0x2], [0x1, 0xc, 0x3, 0xa5b], [0x7, 0x9, 0xfff, 0x2]}) 85.913905ms ago: executing program 7 (id=6797): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)={0x34, r1, 0x1, 0x70bd2a, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="6394bc11539d"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) 303.417µs ago: executing program 4 (id=6798): r0 = io_uring_setup(0x666, &(0x7f00000002c0)={0x0, 0x284f, 0x40, 0xfffffffe, 0x235}) io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x11, 0x0, 0x0) 0s ago: executing program 7 (id=6799): syz_usb_connect(0x5, 0x2d, 0x0, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f00000002c0)=[0x12, 0x2]) 0s ago: executing program 4 (id=6800): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x0) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x4, &(0x7f0000000000)=""/152, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1, 0x0) write(r2, &(0x7f00000000c0)='usbip-vudc\x00', 0xa) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00') symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, 0x0) symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0) symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, 0x0) symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00') write(0xffffffffffffffff, &(0x7f0000000780)='pcspkr\x00', 0x6) r4 = syz_open_dev$video(&(0x7f0000000800), 0x11, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559}) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x28, 0x0, 0x1, 0xffffffff, 0x0, {{0x2}, {@val={0x8}, @val={0xc, 0x99, {0x1}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x20048000}, 0x48) kernel console output (not intermixed with test programs): cess `syz.5.5836'. [ 1043.020929][T25856] can: request_module (can-proto-0) failed. [ 1043.094615][T25859] netlink: 28 bytes leftover after parsing attributes in process `syz.6.5842'. [ 1043.301018][T25865] FAULT_INJECTION: forcing a failure. [ 1043.301018][T25865] name failslab, interval 1, probability 0, space 0, times 0 [ 1043.301041][T25865] CPU: 2 UID: 0 PID: 25865 Comm: syz.4.5845 Tainted: G L syzkaller #0 PREEMPT(full) [ 1043.301057][T25865] Tainted: [L]=SOFTLOCKUP [ 1043.301061][T25865] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1043.301069][T25865] Call Trace: [ 1043.301074][T25865] [ 1043.301078][T25865] dump_stack_lvl+0x100/0x190 [ 1043.301099][T25865] should_fail_ex.cold+0x5/0xa [ 1043.301115][T25865] should_failslab+0xc2/0x120 [ 1043.301132][T25865] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1043.301147][T25865] ? __pfx_map_id_range_down+0x10/0x10 [ 1043.301164][T25865] ? security_inode_alloc+0x3b/0x2c0 [ 1043.301184][T25865] security_inode_alloc+0x3b/0x2c0 [ 1043.301202][T25865] inode_init_always_gfp+0xc6f/0xfb0 [ 1043.301219][T25865] alloc_inode+0x8e/0x250 [ 1043.301237][T25865] new_inode+0x22/0x1c0 [ 1043.301255][T25865] proc_pid_make_inode+0x22/0x160 [ 1043.301272][T25865] proc_pid_make_base_inode.constprop.0+0x25/0x180 [ 1043.301290][T25865] proc_task_instantiate+0x51/0x1e0 [ 1043.301307][T25865] proc_task_lookup+0x4c2/0x5c0 [ 1043.301323][T25865] __lookup_slow+0x155/0x320 [ 1043.301343][T25865] lookup_slow+0x50/0x70 [ 1043.301360][T25865] link_path_walk+0x1712/0x1cc0 [ 1043.301379][T25865] path_openat+0x1ac/0x2440 [ 1043.301396][T25865] ? __pfx_path_openat+0x10/0x10 [ 1043.301415][T25865] do_file_open+0x20e/0x430 [ 1043.301430][T25865] ? __pfx_do_file_open+0x10/0x10 [ 1043.301455][T25865] ? __pfx_kfree_link+0x10/0x10 [ 1043.301479][T25865] ? _raw_spin_unlock+0x28/0x50 [ 1043.301507][T25865] ? alloc_fd+0x471/0x7a0 [ 1043.301538][T25865] do_sys_openat2+0x10f/0x1e0 [ 1043.301558][T25865] ? __pfx_do_sys_openat2+0x10/0x10 [ 1043.301578][T25865] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 1043.301594][T25865] __ia32_compat_sys_openat+0x12d/0x210 [ 1043.301613][T25865] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 1043.301637][T25865] do_int80_emulation+0x166/0x650 [ 1043.301652][T25865] asm_int80_emulation+0x1a/0x20 [ 1043.301665][T25865] RIP: 0023:0xf71375ab [ 1043.301675][T25865] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1043.301687][T25865] RSP: 002b:00000000f53ed4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 1043.301699][T25865] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f7201b71 [ 1043.301706][T25865] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 1043.301714][T25865] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1043.301720][T25865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1043.301727][T25865] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1043.301741][T25865] [ 1043.366672][T25869] netlink: 'syz.5.5846': attribute type 3 has an invalid length. [ 1043.513200][T25880] FAULT_INJECTION: forcing a failure. [ 1043.513200][T25880] name failslab, interval 1, probability 0, space 0, times 0 [ 1043.513226][T25880] CPU: 2 UID: 0 PID: 25880 Comm: syz.4.5848 Tainted: G L syzkaller #0 PREEMPT(full) [ 1043.513246][T25880] Tainted: [L]=SOFTLOCKUP [ 1043.513251][T25880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1043.513260][T25880] Call Trace: [ 1043.513265][T25880] [ 1043.513272][T25880] dump_stack_lvl+0x100/0x190 [ 1043.513295][T25880] should_fail_ex.cold+0x5/0xa [ 1043.513314][T25880] should_failslab+0xc2/0x120 [ 1043.513334][T25880] __kvmalloc_node_noprof+0x113/0x9b0 [ 1043.513352][T25880] ? ksys_write+0x190/0x250 [ 1043.513367][T25880] ? traverse.part.0.constprop.0+0x397/0x650 [ 1043.513388][T25880] traverse.part.0.constprop.0+0x397/0x650 [ 1043.513409][T25880] seq_lseek+0x2fb/0x430 [ 1043.513428][T25880] proc_reg_llseek+0x208/0x2f0 [ 1043.513450][T25880] ksys_lseek+0xf3/0x1b0 [ 1043.513464][T25880] __do_fast_syscall_32+0x13a/0x8b0 [ 1043.513481][T25880] ? lockdep_hardirqs_on+0x7d/0x110 [ 1043.513513][T25880] do_fast_syscall_32+0x32/0x70 [ 1043.513530][T25880] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1043.513547][T25880] RIP: 0023:0xf6ffefec [ 1043.513563][T25880] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 1043.513569][T25880] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000013 [ 1043.513583][T25880] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000800 [ 1043.513592][T25880] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1043.513600][T25880] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1043.513608][T25880] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1043.513616][T25880] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1043.513634][T25880] [ 1043.779036][T25892] sd 0:0:0:0: PR command failed: 1026 [ 1043.779061][T25892] sd 0:0:0:0: Sense Key : Illegal Request [current] [ 1043.779083][T25892] sd 0:0:0:0: Add. Sense: Invalid command operation code [ 1044.437047][T25900] FAULT_INJECTION: forcing a failure. [ 1044.437047][T25900] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1044.437069][T25900] CPU: 2 UID: 0 PID: 25900 Comm: syz.4.5855 Tainted: G L syzkaller #0 PREEMPT(full) [ 1044.437085][T25900] Tainted: [L]=SOFTLOCKUP [ 1044.437090][T25900] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1044.437097][T25900] Call Trace: [ 1044.437101][T25900] [ 1044.437106][T25900] dump_stack_lvl+0x100/0x190 [ 1044.437127][T25900] should_fail_ex.cold+0x5/0xa [ 1044.437142][T25900] _copy_to_user+0x32/0xd0 [ 1044.437159][T25900] simple_read_from_buffer+0xcb/0x170 [ 1044.437174][T25900] proc_fail_nth_read+0x1af/0x230 [ 1044.437189][T25900] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1044.437202][T25900] ? rw_verify_area+0xce/0x6d0 [ 1044.437213][T25900] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1044.437225][T25900] vfs_read+0x1e4/0xb40 [ 1044.437238][T25900] ? lock_acquire+0x1d1/0x380 [ 1044.437255][T25900] ? __fget_files+0x34/0x3d0 [ 1044.437268][T25900] ? __pfx_vfs_read+0x10/0x10 [ 1044.437279][T25900] ? find_held_lock+0x2b/0x80 [ 1044.437292][T25900] ? __fget_files+0x215/0x3d0 [ 1044.437308][T25900] ? __fget_files+0x21f/0x3d0 [ 1044.437325][T25900] ksys_read+0x12a/0x250 [ 1044.437337][T25900] ? __pfx_ksys_read+0x10/0x10 [ 1044.437353][T25900] do_int80_emulation+0x166/0x650 [ 1044.437369][T25900] asm_int80_emulation+0x1a/0x20 [ 1044.437380][T25900] RIP: 0023:0xf71375ab [ 1044.437390][T25900] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1044.437401][T25900] RSP: 002b:00000000f53ed4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1044.437413][T25900] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53ed5d0 [ 1044.437420][T25900] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1044.437427][T25900] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1044.437434][T25900] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1044.437441][T25900] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1044.437455][T25900] [ 1044.574949][T25906] random: crng reseeded on system resumption [ 1046.788332][T25938] FAULT_INJECTION: forcing a failure. [ 1046.788332][T25938] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1046.788424][T25938] CPU: 3 UID: 0 PID: 25938 Comm: syz.5.5865 Tainted: G L syzkaller #0 PREEMPT(full) [ 1046.788454][T25938] Tainted: [L]=SOFTLOCKUP [ 1046.788459][T25938] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1046.788466][T25938] Call Trace: [ 1046.788471][T25938] [ 1046.788475][T25938] dump_stack_lvl+0x100/0x190 [ 1046.788494][T25938] should_fail_ex.cold+0x5/0xa [ 1046.788510][T25938] _copy_from_user+0x2e/0xd0 [ 1046.788527][T25938] get_compat_msghdr+0xb3/0x480 [ 1046.788541][T25938] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1046.788555][T25938] ? _kstrtoull+0x144/0x200 [ 1046.788566][T25938] ? __pfx__kstrtoull+0x10/0x10 [ 1046.788578][T25938] ___sys_sendmsg+0x1b6/0x1e0 [ 1046.788593][T25938] ? __pfx____sys_sendmsg+0x10/0x10 [ 1046.788607][T25938] ? __lock_acquire+0x5c0/0x1f40 [ 1046.788628][T25938] ? __fget_files+0x34/0x3d0 [ 1046.788651][T25938] __sys_sendmmsg+0x309/0x440 [ 1046.788671][T25938] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1046.788688][T25938] ? find_held_lock+0x2b/0x80 [ 1046.788704][T25938] ? __mutex_unlock_slowpath+0x35d/0x930 [ 1046.788735][T25938] ? fput+0x7c/0x100 [ 1046.788753][T25938] ? ksys_write+0x1ac/0x250 [ 1046.788767][T25938] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 1046.788781][T25938] ? lockdep_hardirqs_on+0x7d/0x110 [ 1046.788793][T25938] __do_fast_syscall_32+0x13a/0x8b0 [ 1046.788805][T25938] ? lockdep_hardirqs_on+0x7d/0x110 [ 1046.788818][T25938] do_fast_syscall_32+0x32/0x70 [ 1046.788831][T25938] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1046.788846][T25938] RIP: 0023:0xf7fa5fec [ 1046.788860][T25938] Code: Unable to access opcode bytes at 0xf7fa5fc2. [ 1046.788865][T25938] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 1046.788877][T25938] RAX: ffffffffffffffda RBX: 0000000000000011 RCX: 0000000080000440 [ 1046.788885][T25938] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1046.788891][T25938] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1046.788898][T25938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1046.788905][T25938] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1046.788919][T25938] [ 1048.410646][T25960] jffs2: notice: (25960) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 1048.433355][T25963] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5872'. [ 1048.576729][T25963] sit0: entered promiscuous mode [ 1048.576747][T25963] sit0: entered allmulticast mode [ 1048.690769][T25960] netlink: 36 bytes leftover after parsing attributes in process `syz.5.5873'. [ 1048.691584][T25960] jffs2: warning: (25960) do_jffs2_setxattr: jffs2_reserve_space()=-28, request=28 [ 1049.430494][T25975] binder: 25974:25975 ioctl c0306201 80000640 returned -22 [ 1049.734334][T25979] FAULT_INJECTION: forcing a failure. [ 1049.734334][T25979] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1049.734357][T25979] CPU: 0 UID: 0 PID: 25979 Comm: syz.5.5877 Tainted: G L syzkaller #0 PREEMPT(full) [ 1049.734374][T25979] Tainted: [L]=SOFTLOCKUP [ 1049.734379][T25979] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1049.734386][T25979] Call Trace: [ 1049.734390][T25979] [ 1049.734396][T25979] dump_stack_lvl+0x100/0x190 [ 1049.734416][T25979] should_fail_ex.cold+0x5/0xa [ 1049.734433][T25979] _copy_from_user+0x2e/0xd0 [ 1049.734450][T25979] get_compat_msghdr+0xb3/0x480 [ 1049.734465][T25979] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1049.734484][T25979] ___sys_sendmsg+0x1b6/0x1e0 [ 1049.734501][T25979] ? __pfx____sys_sendmsg+0x10/0x10 [ 1049.734522][T25979] ? find_held_lock+0x2b/0x80 [ 1049.734546][T25979] __sys_sendmsg+0x160/0x210 [ 1049.734567][T25979] ? __pfx___sys_sendmsg+0x10/0x10 [ 1049.734590][T25979] ? __pfx_ksys_write+0x10/0x10 [ 1049.734607][T25979] __do_fast_syscall_32+0x13a/0x8b0 [ 1049.734621][T25979] ? lockdep_hardirqs_on+0x7d/0x110 [ 1049.734635][T25979] do_fast_syscall_32+0x32/0x70 [ 1049.734649][T25979] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1049.734665][T25979] RIP: 0023:0xf7fa5fec [ 1049.734679][T25979] Code: Unable to access opcode bytes at 0xf7fa5fc2. [ 1049.734685][T25979] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1049.734697][T25979] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 1049.734705][T25979] RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 1049.734712][T25979] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1049.734719][T25979] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1049.734726][T25979] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1049.734741][T25979] [ 1050.146244][T25990] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1053.529643][T26040] syzkaller0: entered promiscuous mode [ 1053.529666][T26040] syzkaller0: entered allmulticast mode [ 1053.558797][T26040] netlink: 'syz.0.5897': attribute type 1 has an invalid length. [ 1053.558822][T26040] netlink: 'syz.0.5897': attribute type 2 has an invalid length. [ 1054.052102][T26052] pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 1054.058982][T26052] gadgetfs: bound to dummy_udc driver [ 1055.632248][T26066] netlink: 4776 bytes leftover after parsing attributes in process `syz.6.5902'. [ 1055.787120][T26068] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1055.787702][T26068] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1055.984827][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888050880400: rx timeout, send abort [ 1056.525597][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888050881c00: rx timeout, send abort [ 1056.526862][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888050880400: abort rx timeout. Force session deactivation [ 1056.618751][T26082] syzkaller0: entered promiscuous mode [ 1056.618765][T26082] syzkaller0: entered allmulticast mode [ 1056.620149][T26082] tipc: Started in network mode [ 1056.620164][T26082] tipc: Node identity 5e208e7b211b, cluster identity 4711 [ 1056.621323][T26082] tipc: Enabled bearer , priority 0 [ 1056.622201][T26082] FAULT_INJECTION: forcing a failure. [ 1056.622201][T26082] name failslab, interval 1, probability 0, space 0, times 0 [ 1056.622223][T26082] CPU: 2 UID: 0 PID: 26082 Comm: syz.4.5906 Tainted: G L syzkaller #0 PREEMPT(full) [ 1056.622239][T26082] Tainted: [L]=SOFTLOCKUP [ 1056.622244][T26082] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1056.622251][T26082] Call Trace: [ 1056.622255][T26082] [ 1056.622260][T26082] dump_stack_lvl+0x100/0x190 [ 1056.622279][T26082] should_fail_ex.cold+0x5/0xa [ 1056.622295][T26082] should_failslab+0xc2/0x120 [ 1056.622311][T26082] __kmalloc_noprof+0xfc/0x840 [ 1056.622324][T26082] ? rcu_is_watching+0x13/0xc0 [ 1056.622337][T26082] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1056.622354][T26082] tomoyo_realpath_from_path+0xb6/0x690 [ 1056.622370][T26082] tomoyo_path_number_perm+0x23c/0x580 [ 1056.622387][T26082] ? tomoyo_path_number_perm+0x22e/0x580 [ 1056.622405][T26082] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1056.622424][T26082] ? get_pid_task+0x106/0x250 [ 1056.622440][T26082] ? __lock_acquire+0x5c0/0x1f40 [ 1056.622462][T26082] ? __fget_files+0x34/0x3d0 [ 1056.622476][T26082] ? find_held_lock+0x2b/0x80 [ 1056.622488][T26082] ? __fget_files+0x215/0x3d0 [ 1056.622500][T26082] ? hook_file_ioctl_common+0x140/0x440 [ 1056.622511][T26082] ? __fget_files+0x215/0x3d0 [ 1056.622528][T26082] ? __fget_files+0x21f/0x3d0 [ 1056.622543][T26082] security_file_ioctl_compat+0xd3/0x230 [ 1056.622562][T26082] __ia32_compat_sys_ioctl+0xc2/0x360 [ 1056.622576][T26082] __do_fast_syscall_32+0x13a/0x8b0 [ 1056.622589][T26082] ? lockdep_hardirqs_on+0x7d/0x110 [ 1056.622602][T26082] do_fast_syscall_32+0x32/0x70 [ 1056.622620][T26082] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1056.622641][T26082] RIP: 0023:0xf6ffefec [ 1056.622661][T26082] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 1056.622670][T26082] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1056.622689][T26082] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000008922 [ 1056.622702][T26082] RDX: 0000000080002280 RSI: 0000000000000000 RDI: 0000000000000000 [ 1056.622713][T26082] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1056.622726][T26082] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1056.622736][T26082] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1056.622753][T26082] [ 1056.622759][T26082] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1056.623851][T26082] tipc: Resetting bearer [ 1056.625237][T26081] tipc: Resetting bearer [ 1056.657272][T26081] tipc: Disabling bearer [ 1057.067567][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888050881c00: abort rx timeout. Force session deactivation [ 1058.155776][T26114] netlink: 'syz.0.5913': attribute type 4 has an invalid length. [ 1058.896399][T26122] FAULT_INJECTION: forcing a failure. [ 1058.896399][T26122] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1058.896441][T26122] CPU: 3 UID: 0 PID: 26122 Comm: syz.6.5916 Tainted: G L syzkaller #0 PREEMPT(full) [ 1058.896467][T26122] Tainted: [L]=SOFTLOCKUP [ 1058.896473][T26122] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1058.896483][T26122] Call Trace: [ 1058.896491][T26122] [ 1058.896499][T26122] dump_stack_lvl+0x100/0x190 [ 1058.896530][T26122] should_fail_ex.cold+0x5/0xa [ 1058.896556][T26122] _copy_to_iter+0x1f3/0x1720 [ 1058.896600][T26122] ? lock_acquire+0x1d1/0x380 [ 1058.896629][T26122] ? __pfx__copy_to_iter+0x10/0x10 [ 1058.896654][T26122] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1058.896680][T26122] ? __local_bh_enable_ip+0xa5/0x120 [ 1058.896721][T26122] tls_getsockopt+0x407/0xad0 [ 1058.896752][T26122] ? __pfx_tls_getsockopt+0x10/0x10 [ 1058.896796][T26122] ? aa_sock_opt_perm+0x114/0x1e0 [ 1058.896828][T26122] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1058.896851][T26122] do_sock_getsockopt+0x50a/0x6e0 [ 1058.896881][T26122] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1058.896912][T26122] ? __fget_files+0x34/0x3d0 [ 1058.896934][T26122] ? find_held_lock+0x2b/0x80 [ 1058.896960][T26122] ? __fget_files+0x21f/0x3d0 [ 1058.896987][T26122] __sys_getsockopt+0x133/0x1d0 [ 1058.897022][T26122] ? __ia32_sys_getsockopt+0xbc/0x160 [ 1058.897048][T26122] __ia32_sys_getsockopt+0xbc/0x160 [ 1058.897074][T26122] ? __do_fast_syscall_32+0xb3/0x8b0 [ 1058.897095][T26122] ? lockdep_hardirqs_on+0x7d/0x110 [ 1058.897114][T26122] __do_fast_syscall_32+0x13a/0x8b0 [ 1058.897131][T26122] ? lockdep_hardirqs_on+0x7d/0x110 [ 1058.897153][T26122] do_fast_syscall_32+0x32/0x70 [ 1058.897171][T26122] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1058.897195][T26122] RIP: 0023:0xf7fc2fec [ 1058.897214][T26122] Code: Unable to access opcode bytes at 0xf7fc2fc2. [ 1058.897223][T26122] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 000000000000016d [ 1058.897242][T26122] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000000011a [ 1058.897252][T26122] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000080000040 [ 1058.897263][T26122] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1058.897274][T26122] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1058.897284][T26122] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1058.897310][T26122] [ 1059.313837][T26133] netlink: 52 bytes leftover after parsing attributes in process `syz.5.5922'. [ 1059.329409][T26135] jffs2: notice: (26135) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 1059.633097][T26148] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5923'. [ 1059.633766][T26148] jffs2: warning: (26148) do_jffs2_setxattr: jffs2_reserve_space()=-28, request=28 [ 1060.879356][T26161] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5930'. [ 1062.991235][T26202] jffs2: notice: (26202) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 1063.091531][T26200] pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 1063.094585][T26200] gadgetfs: bound to dummy_udc driver [ 1063.463183][T26202] netlink: 36 bytes leftover after parsing attributes in process `syz.6.5941'. [ 1063.469262][T26202] jffs2: warning: (26202) do_jffs2_setxattr: jffs2_reserve_space()=-28, request=28 [ 1063.855692][T26214] cgroup2: Unknown parameter 'fowner<00000000000000000000' [ 1063.857791][T26214] devtmpfs: Unknown parameter '{]' [ 1064.134857][T26212] pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 1064.219956][T26212] 9p: Bad value for 'rfdno' [ 1064.331917][T26218] netlink: 28 bytes leftover after parsing attributes in process `syz.6.5945'. [ 1064.344482][ T5818] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 1064.394254][ T5818] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 1064.624182][ T5818] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 1064.744697][ T5818] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 1065.174549][T19084] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 1065.232854][T26218] ceph: No mds server is up or the cluster is laggy [ 1065.233247][T26221] ceph: No mds server is up or the cluster is laggy [ 1065.325322][T19084] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 1065.626604][T26248] FAULT_INJECTION: forcing a failure. [ 1065.626604][T26248] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1065.626628][T26248] CPU: 3 UID: 0 PID: 26248 Comm: syz.6.5951 Tainted: G L syzkaller #0 PREEMPT(full) [ 1065.626644][T26248] Tainted: [L]=SOFTLOCKUP [ 1065.626648][T26248] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1065.626655][T26248] Call Trace: [ 1065.626659][T26248] [ 1065.626664][T26248] dump_stack_lvl+0x100/0x190 [ 1065.626684][T26248] should_fail_ex.cold+0x5/0xa [ 1065.626700][T26248] _copy_from_user+0x2e/0xd0 [ 1065.626715][T26248] get_compat_msghdr+0xb3/0x480 [ 1065.626730][T26248] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1065.626744][T26248] ? _kstrtoull+0x144/0x200 [ 1065.626754][T26248] ? __pfx__kstrtoull+0x10/0x10 [ 1065.626766][T26248] ___sys_sendmsg+0x1b6/0x1e0 [ 1065.626781][T26248] ? __pfx____sys_sendmsg+0x10/0x10 [ 1065.626794][T26248] ? __lock_acquire+0x5c0/0x1f40 [ 1065.626816][T26248] ? __fget_files+0x34/0x3d0 [ 1065.626839][T26248] __sys_sendmmsg+0x309/0x440 [ 1065.626858][T26248] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1065.626875][T26248] ? find_held_lock+0x2b/0x80 [ 1065.626892][T26248] ? __mutex_unlock_slowpath+0x35d/0x930 [ 1065.626911][T26248] ? fput+0x7c/0x100 [ 1065.626939][T26248] ? ksys_write+0x1ac/0x250 [ 1065.626954][T26248] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 1065.626967][T26248] ? lockdep_hardirqs_on+0x7d/0x110 [ 1065.626979][T26248] __do_fast_syscall_32+0x13a/0x8b0 [ 1065.627003][T26248] ? lockdep_hardirqs_on+0x7d/0x110 [ 1065.627017][T26248] do_fast_syscall_32+0x32/0x70 [ 1065.627029][T26248] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1065.627044][T26248] RIP: 0023:0xf7fc2fec [ 1065.627061][T26248] Code: Unable to access opcode bytes at 0xf7fc2fc2. [ 1065.627067][T26248] RSP: 002b:00000000f544450c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 1065.627079][T26248] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080004100 [ 1065.627086][T26248] RDX: 00000000ffffff80 RSI: 0000000000000000 RDI: 0000000000000000 [ 1065.627093][T26248] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1065.627100][T26248] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1065.627107][T26248] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1065.627121][T26248] [ 1066.462107][T26250] jffs2: notice: (26250) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 1066.464501][T26253] FAULT_INJECTION: forcing a failure. [ 1066.464501][T26253] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1066.464522][T26253] CPU: 0 UID: 0 PID: 26253 Comm: syz.5.5953 Tainted: G L syzkaller #0 PREEMPT(full) [ 1066.464538][T26253] Tainted: [L]=SOFTLOCKUP [ 1066.464542][T26253] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1066.464549][T26253] Call Trace: [ 1066.464554][T26253] [ 1066.464559][T26253] dump_stack_lvl+0x100/0x190 [ 1066.464579][T26253] should_fail_ex.cold+0x5/0xa [ 1066.464601][T26253] _copy_to_user+0x32/0xd0 [ 1066.464618][T26253] simple_read_from_buffer+0xcb/0x170 [ 1066.464634][T26253] proc_fail_nth_read+0x1af/0x230 [ 1066.464647][T26253] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1066.464661][T26253] ? rw_verify_area+0xce/0x6d0 [ 1066.464672][T26253] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1066.464685][T26253] vfs_read+0x1e4/0xb40 [ 1066.464697][T26253] ? lock_acquire+0x1d1/0x380 [ 1066.464713][T26253] ? __fget_files+0x34/0x3d0 [ 1066.464726][T26253] ? __pfx_vfs_read+0x10/0x10 [ 1066.464737][T26253] ? find_held_lock+0x2b/0x80 [ 1066.464750][T26253] ? __fget_files+0x215/0x3d0 [ 1066.464765][T26253] ? __fget_files+0x21f/0x3d0 [ 1066.464781][T26253] ksys_read+0x12a/0x250 [ 1066.464793][T26253] ? __pfx_ksys_read+0x10/0x10 [ 1066.464821][T26253] do_int80_emulation+0x166/0x650 [ 1066.464839][T26253] asm_int80_emulation+0x1a/0x20 [ 1066.464851][T26253] RIP: 0023:0xf71a75ab [ 1066.464861][T26253] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1066.464873][T26253] RSP: 002b:00000000f54664bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1066.464884][T26253] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54665d0 [ 1066.464891][T26253] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1066.464898][T26253] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1066.464904][T26253] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1066.464911][T26253] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1066.464925][T26253] [ 1066.697264][T26250] netlink: 36 bytes leftover after parsing attributes in process `syz.6.5952'. [ 1066.698373][T26250] jffs2: warning: (26250) do_jffs2_setxattr: jffs2_reserve_space()=-28, request=28 [ 1067.003720][T26273] pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 1067.008005][T26274] pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 1067.025507][T26274] gadgetfs: bound to dummy_udc driver [ 1067.046153][T26273] 9p: Bad value for 'wfdno' [ 1067.047224][T26274] 9p: Bad value for 'rfdno' [ 1067.717353][T26278] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1067.718491][T26278] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1067.902451][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888013977c00: rx timeout, send abort [ 1068.444405][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888013977c00: abort rx timeout. Force session deactivation [ 1068.444484][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888029c38400: rx timeout, send abort [ 1068.682277][T26280] jffs2: notice: (26280) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 1068.833515][T26280] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5959'. [ 1068.834012][T26280] jffs2: warning: (26280) do_jffs2_setxattr: jffs2_reserve_space()=-28, request=28 [ 1068.986463][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888029c38400: abort rx timeout. Force session deactivation [ 1069.062257][T26291] netlink: 8752 bytes leftover after parsing attributes in process `syz.4.5961'. [ 1069.066041][T26291] afs: Unknown parameter 'dyné1SØn_±£8Õ›¸ñåÀø\ƒ©µLoèz´7#dÈŸ¬.^ƒTrªò6ÞfÔOڀز‡éä0ðO [ 1069.066041][T26291] ' [ 1069.209409][T26300] ip6erspan0: entered allmulticast mode [ 1069.783594][ T43] audit: type=1326 audit(1790199490.159:6811): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26326 comm="syz.5.5968" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fa5fec code=0x0 [ 1070.059056][T26330] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5969'. [ 1070.835300][T26343] pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 1070.865300][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 1070.865335][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 1071.755051][T26351] pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 1071.910535][T26355] loop9: detected capacity change from 0 to 255852544 [ 1072.589805][T26357] sctp: [Deprecated]: syz.0.5976 (pid 26357) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1072.589805][T26357] Use struct sctp_sack_info instead [ 1073.548869][T26369] FAULT_INJECTION: forcing a failure. [ 1073.548869][T26369] name failslab, interval 1, probability 0, space 0, times 0 [ 1073.548892][T26369] CPU: 0 UID: 0 PID: 26369 Comm: syz.6.5979 Tainted: G L syzkaller #0 PREEMPT(full) [ 1073.548908][T26369] Tainted: [L]=SOFTLOCKUP [ 1073.548914][T26369] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1073.548922][T26369] Call Trace: [ 1073.548927][T26369] [ 1073.548933][T26369] dump_stack_lvl+0x100/0x190 [ 1073.548953][T26369] should_fail_ex.cold+0x5/0xa [ 1073.548970][T26369] should_failslab+0xc2/0x120 [ 1073.548989][T26369] __kmalloc_cache_node_noprof+0x94/0x720 [ 1073.549004][T26369] ? kfree+0x22b/0x6d0 [ 1073.549015][T26369] ? blk_mq_init_tags+0x8c/0x300 [ 1073.549031][T26369] blk_mq_init_tags+0x8c/0x300 [ 1073.549044][T26369] blk_mq_alloc_map_and_rqs+0x244/0xe30 [ 1073.549066][T26369] ? blk_mq_update_queue_map+0x227/0x3a0 [ 1073.549080][T26369] blk_mq_alloc_tag_set+0x848/0x1330 [ 1073.549104][T26369] loop_add+0x3b7/0xb60 [ 1073.549120][T26369] ? __pfx_loop_add+0x10/0x10 [ 1073.549142][T26369] ? __fget_files+0x34/0x3d0 [ 1073.549156][T26369] ? find_held_lock+0x2b/0x80 [ 1073.549169][T26369] ? __fget_files+0x215/0x3d0 [ 1073.549184][T26369] loop_control_ioctl+0xae/0x620 [ 1073.549200][T26369] ? __pfx_loop_control_ioctl+0x10/0x10 [ 1073.549219][T26369] ? __pfx_loop_control_ioctl+0x10/0x10 [ 1073.549236][T26369] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1073.549251][T26369] __do_fast_syscall_32+0x13a/0x8b0 [ 1073.549265][T26369] ? lockdep_hardirqs_on+0x7d/0x110 [ 1073.549278][T26369] do_fast_syscall_32+0x32/0x70 [ 1073.549291][T26369] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1073.549306][T26369] RIP: 0023:0xf7fc2fec [ 1073.549320][T26369] Code: Unable to access opcode bytes at 0xf7fc2fc2. [ 1073.549327][T26369] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1073.549339][T26369] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000004c80 [ 1073.549347][T26369] RDX: 00000000ffffffe4 RSI: 0000000000000000 RDI: 0000000000000000 [ 1073.549355][T26369] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1073.549361][T26369] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1073.549368][T26369] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1073.549384][T26369] [ 1073.549462][T26369] blk-mq: reduced tag depth (128 -> 64) [ 1074.086352][T26392] netlink: 'syz.6.5985': attribute type 61 has an invalid length. [ 1075.424013][T26411] pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 1075.460345][T26411] gadgetfs: bound to dummy_udc driver [ 1083.156223][T26471] jffs2: notice: (26471) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 1083.290094][T26475] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6008'. [ 1083.293094][T26475] jffs2: warning: (26475) do_jffs2_setxattr: jffs2_reserve_space()=-28, request=28 [ 1083.608200][T26480] netlink: 36 bytes leftover after parsing attributes in process `syz.5.6010'. [ 1083.608691][T26480] jffs2: warning: (26480) do_jffs2_setxattr: jffs2_reserve_space()=-28, request=4040 [ 1084.362320][T26517] tipc: Started in network mode [ 1084.362334][T26517] tipc: Node identity 4, cluster identity 4711 [ 1084.362341][T26517] tipc: Node number set to 4 [ 1084.543890][ C3] vxcan1: j1939_tp_rxtimer: 0xffff88804b690c00: rx timeout, send abort [ 1084.977857][T26523] pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 1084.981029][T26523] gadgetfs: bound to dummy_udc driver [ 1085.085862][ C3] vxcan1: j1939_tp_rxtimer: 0xffff88804b690c00: abort rx timeout. Force session deactivation [ 1085.086056][ C3] vxcan1: j1939_tp_rxtimer: 0xffff88804b692400: rx timeout, send abort [ 1085.486734][T26533] comedi comedi0: comedi_config --init_data is deprecated [ 1085.600234][T26535] FAULT_INJECTION: forcing a failure. [ 1085.600234][T26535] name failslab, interval 1, probability 0, space 0, times 0 [ 1085.600267][T26535] CPU: 3 UID: 0 PID: 26535 Comm: syz.5.6029 Tainted: G L syzkaller #0 PREEMPT(full) [ 1085.600296][T26535] Tainted: [L]=SOFTLOCKUP [ 1085.600304][T26535] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1085.600320][T26535] Call Trace: [ 1085.600329][T26535] [ 1085.600338][T26535] dump_stack_lvl+0x100/0x190 [ 1085.600370][T26535] should_fail_ex.cold+0x5/0xa [ 1085.600397][T26535] should_failslab+0xc2/0x120 [ 1085.600425][T26535] __kmalloc_noprof+0xfc/0x840 [ 1085.600455][T26535] ? group_cpus_evenly+0x195/0x660 [ 1085.600489][T26535] group_cpus_evenly+0x195/0x660 [ 1085.600519][T26535] ? __pfx_group_cpus_evenly+0x10/0x10 [ 1085.600554][T26535] blk_mq_map_queues+0x9d/0x430 [ 1085.600584][T26535] ? __pfx_blk_mq_map_queues+0x10/0x10 [ 1085.600609][T26535] ? trace_kmalloc+0xeb/0x110 [ 1085.600636][T26535] ? __kasan_kmalloc+0xaa/0xb0 [ 1085.600664][T26535] ? __kmalloc_node_noprof+0x360/0x880 [ 1085.600690][T26535] blk_mq_update_queue_map+0x305/0x3a0 [ 1085.600715][T26535] blk_mq_alloc_tag_set+0x660/0x1330 [ 1085.600743][T26535] ? idr_alloc+0x77/0x130 [ 1085.600772][T26535] loop_add+0x3b7/0xb60 [ 1085.600798][T26535] ? __pfx_loop_add+0x10/0x10 [ 1085.600854][T26535] ? __fget_files+0x34/0x3d0 [ 1085.600876][T26535] ? find_held_lock+0x2b/0x80 [ 1085.600897][T26535] ? __fget_files+0x215/0x3d0 [ 1085.600921][T26535] loop_control_ioctl+0xae/0x620 [ 1085.600948][T26535] ? __pfx_loop_control_ioctl+0x10/0x10 [ 1085.600980][T26535] ? __pfx_loop_control_ioctl+0x10/0x10 [ 1085.601006][T26535] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1085.601029][T26535] __do_fast_syscall_32+0x13a/0x8b0 [ 1085.601050][T26535] ? lockdep_hardirqs_on+0x7d/0x110 [ 1085.601070][T26535] do_fast_syscall_32+0x32/0x70 [ 1085.601091][T26535] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1085.601116][T26535] RIP: 0023:0xf7fa5fec [ 1085.601140][T26535] Code: Unable to access opcode bytes at 0xf7fa5fc2. [ 1085.601149][T26535] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1085.601178][T26535] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000004c80 [ 1085.601192][T26535] RDX: 00000000ffffffe4 RSI: 0000000000000000 RDI: 0000000000000000 [ 1085.601204][T26535] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1085.601216][T26535] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1085.601228][T26535] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1085.601255][T26535] [ 1085.630302][ C3] vxcan1: j1939_tp_rxtimer: 0xffff88804b692400: abort rx timeout. Force session deactivation [ 1086.005282][T26541] pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 1086.021081][T26541] 9p: Bad value for 'rfdno' [ 1086.782020][T26551] FAULT_INJECTION: forcing a failure. [ 1086.782020][T26551] name failslab, interval 1, probability 0, space 0, times 0 [ 1086.782045][T26551] CPU: 0 UID: 0 PID: 26551 Comm: syz.0.6034 Tainted: G L syzkaller #0 PREEMPT(full) [ 1086.782062][T26551] Tainted: [L]=SOFTLOCKUP [ 1086.782066][T26551] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1086.782074][T26551] Call Trace: [ 1086.782079][T26551] [ 1086.782084][T26551] dump_stack_lvl+0x100/0x190 [ 1086.782105][T26551] should_fail_ex.cold+0x5/0xa [ 1086.782120][T26551] should_failslab+0xc2/0x120 [ 1086.782138][T26551] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 1086.782155][T26551] ? alloc_vmap_area+0x1814/0x2bb0 [ 1086.782173][T26551] alloc_vmap_area+0x1814/0x2bb0 [ 1086.782192][T26551] ? kasan_save_track+0x14/0x30 [ 1086.782206][T26551] ? __kasan_kmalloc+0xaa/0xb0 [ 1086.782220][T26551] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1086.782235][T26551] ? __get_vm_area_node+0x124/0x350 [ 1086.782253][T26551] __get_vm_area_node+0x1ed/0x350 [ 1086.782273][T26551] __vmalloc_node_range_noprof+0x268/0x1420 [ 1086.782290][T26551] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1086.782310][T26551] ? __do_fast_syscall_32+0x13a/0x8b0 [ 1086.782323][T26551] ? do_fast_syscall_32+0x32/0x70 [ 1086.782335][T26551] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1086.782351][T26551] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1086.782369][T26551] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1086.782393][T26551] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1086.782409][T26551] __vmalloc_node_noprof+0xad/0xf0 [ 1086.782427][T26551] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1086.782444][T26551] __vmalloc_noprof+0xa3/0x120 [ 1086.782461][T26551] ? __pfx___vmalloc_noprof+0x10/0x10 [ 1086.782478][T26551] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 1086.782503][T26551] ? rcu_is_watching+0x13/0xc0 [ 1086.782521][T26551] ? apparmor_capable+0x1d7/0x4d0 [ 1086.782545][T26551] ? trace_sched_exit_tp+0x120/0x160 [ 1086.782566][T26551] bpf_prog_alloc_no_stats+0x58/0x690 [ 1086.782589][T26551] ? security_capable+0x80/0x260 [ 1086.782614][T26551] bpf_prog_alloc+0x3b/0x200 [ 1086.782635][T26551] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1086.782663][T26551] bpf_prog_load+0x49e/0x2a80 [ 1086.782687][T26551] ? __lock_acquire+0x5c0/0x1f40 [ 1086.782718][T26551] ? __pfx_bpf_prog_load+0x10/0x10 [ 1086.782801][T26551] __sys_bpf+0x1f46/0x4a30 [ 1086.782817][T26551] ? plist_check_list+0x1b8/0x280 [ 1086.782835][T26551] ? plist_check_list+0x190/0x280 [ 1086.782851][T26551] ? __pfx___sys_bpf+0x10/0x10 [ 1086.782863][T26551] ? find_held_lock+0x2b/0x80 [ 1086.782876][T26551] ? futex_wake+0x4ea/0x5e0 [ 1086.782898][T26551] ? futex_private_hash_put.part.0+0xdc/0x180 [ 1086.782916][T26551] ? futex_private_hash_put+0x24/0x30 [ 1086.782938][T26551] ? __pfx_futex_wake+0x10/0x10 [ 1086.782956][T26551] ? vfs_write+0x15d/0x1050 [ 1086.782980][T26551] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 1086.782995][T26551] ? xfd_validate_state+0x129/0x190 [ 1086.783018][T26551] ? __ia32_sys_bpf+0xcc/0x170 [ 1086.783031][T26551] __ia32_sys_bpf+0xcc/0x170 [ 1086.783045][T26551] ? __do_fast_syscall_32+0xb3/0x8b0 [ 1086.783059][T26551] __do_fast_syscall_32+0x13a/0x8b0 [ 1086.783074][T26551] do_fast_syscall_32+0x32/0x70 [ 1086.783087][T26551] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1086.783102][T26551] RIP: 0023:0xf7fd3fec [ 1086.783118][T26551] Code: Unable to access opcode bytes at 0xf7fd3fc2. [ 1086.783123][T26551] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1086.783135][T26551] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000840 [ 1086.783143][T26551] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 1086.783150][T26551] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1086.783157][T26551] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1086.783164][T26551] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1086.783178][T26551] [ 1087.743020][T26553] FAULT_INJECTION: forcing a failure. [ 1087.743020][T26553] name failslab, interval 1, probability 0, space 0, times 0 [ 1087.743059][T26553] CPU: 0 UID: 0 PID: 26553 Comm: syz.0.6035 Tainted: G L syzkaller #0 PREEMPT(full) [ 1087.743091][T26553] Tainted: [L]=SOFTLOCKUP [ 1087.743100][T26553] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1087.743114][T26553] Call Trace: [ 1087.743121][T26553] [ 1087.743130][T26553] dump_stack_lvl+0x100/0x190 [ 1087.743162][T26553] should_fail_ex.cold+0x5/0xa [ 1087.743189][T26553] should_failslab+0xc2/0x120 [ 1087.743220][T26553] __kmalloc_cache_noprof+0x91/0x6d0 [ 1087.743275][T26553] ? mpi_alloc+0x46/0x230 [ 1087.743314][T26553] mpi_alloc+0x46/0x230 [ 1087.743344][T26553] ? __virt_addr_valid+0x22a/0x430 [ 1087.743375][T26553] rsa_enc+0x88/0x3b0 [ 1087.743405][T26553] ? __pfx_rsa_enc+0x10/0x10 [ 1087.743433][T26553] ? __virt_addr_valid+0x239/0x430 [ 1087.743464][T26553] ? sg_init_one+0xf5/0x1b0 [ 1087.743489][T26553] rsassa_pkcs1_verify+0x4eb/0xc20 [ 1087.743529][T26553] ? __pfx_rsassa_pkcs1_verify+0x10/0x10 [ 1087.743574][T26553] ? rsa_max_size+0xd/0x70 [ 1087.743600][T26553] ? rsassa_pkcs1_set_pub_key+0x17d/0x1f0 [ 1087.743635][T26553] public_key_verify_signature+0x5ee/0x910 [ 1087.743667][T26553] ? __pfx_public_key_verify_signature+0x10/0x10 [ 1087.743704][T26553] ? asymmetric_key_generate_id+0x7e/0x180 [ 1087.743736][T26553] x509_check_for_self_signed+0x325/0x510 [ 1087.743766][T26553] x509_cert_parse+0x60c/0x910 [ 1087.743793][T26553] x509_key_preparse+0x65/0x9c0 [ 1087.743825][T26553] asymmetric_key_preparse+0xce/0x1d0 [ 1087.743845][T26553] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 1087.743868][T26553] __key_create_or_update+0x463/0xe30 [ 1087.743895][T26553] ? __pfx___key_create_or_update+0x10/0x10 [ 1087.743920][T26553] ? lookup_user_key+0x3f3/0x1300 [ 1087.743974][T26553] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 1087.744015][T26553] ? __pfx_keyring_search_iterator+0x10/0x10 [ 1087.744045][T26553] key_create_or_update+0x42/0x60 [ 1087.744072][T26553] __do_sys_add_key+0x2e8/0x460 [ 1087.744101][T26553] ? __pfx___do_sys_add_key+0x10/0x10 [ 1087.744138][T26553] __do_fast_syscall_32+0x13a/0x8b0 [ 1087.744167][T26553] do_fast_syscall_32+0x32/0x70 [ 1087.744187][T26553] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1087.744213][T26553] RIP: 0023:0xf7fd3fec [ 1087.744237][T26553] Code: Unable to access opcode bytes at 0xf7fd3fc2. [ 1087.744247][T26553] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 000000000000011e [ 1087.744269][T26553] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000000000 [ 1087.744285][T26553] RDX: 0000000080000200 RSI: 0000000000000559 RDI: 00000000253b1b3a [ 1087.744301][T26553] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1087.744315][T26553] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1087.744327][T26553] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1087.744356][T26553] [ 1087.808306][T26557] FAULT_INJECTION: forcing a failure. [ 1087.808306][T26557] name failslab, interval 1, probability 0, space 0, times 0 [ 1087.808332][T26557] CPU: 2 UID: 0 PID: 26557 Comm: syz.6.6036 Tainted: G L syzkaller #0 PREEMPT(full) [ 1087.808352][T26557] Tainted: [L]=SOFTLOCKUP [ 1087.808356][T26557] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1087.808366][T26557] Call Trace: [ 1087.808371][T26557] [ 1087.808377][T26557] dump_stack_lvl+0x100/0x190 [ 1087.808399][T26557] should_fail_ex.cold+0x5/0xa [ 1087.808419][T26557] should_failslab+0xc2/0x120 [ 1087.808438][T26557] __kmalloc_noprof+0xfc/0x840 [ 1087.808454][T26557] ? rcu_is_watching+0x13/0xc0 [ 1087.808468][T26557] ? tomoyo_encode2+0xfb/0x3c0 [ 1087.808487][T26557] tomoyo_encode2+0xfb/0x3c0 [ 1087.808505][T26557] tomoyo_encode+0x29/0x50 [ 1087.808518][T26557] tomoyo_realpath_from_path+0x18c/0x690 [ 1087.808537][T26557] tomoyo_check_open_permission+0x2af/0x3c0 [ 1087.808558][T26557] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 1087.808577][T26557] ? __do_fast_syscall_32+0x13a/0x8b0 [ 1087.808596][T26557] ? hook_file_open+0x248/0x8e0 [ 1087.808622][T26557] ? path_get+0x61/0x80 [ 1087.808643][T26557] tomoyo_file_open+0x6b/0x90 [ 1087.808660][T26557] security_file_open+0xb5/0x1e0 [ 1087.808673][T26557] do_dentry_open+0x588/0x14d0 [ 1087.808692][T26557] vfs_open+0x82/0x3f0 [ 1087.808712][T26557] path_openat+0x19fa/0x2440 [ 1087.808731][T26557] ? __pfx_path_openat+0x10/0x10 [ 1087.808751][T26557] do_file_open+0x20e/0x430 [ 1087.808768][T26557] ? __pfx_do_file_open+0x10/0x10 [ 1087.808795][T26557] ? _raw_spin_unlock+0x28/0x50 [ 1087.808813][T26557] ? alloc_fd+0x471/0x7a0 [ 1087.808832][T26557] do_sys_openat2+0x10f/0x1e0 [ 1087.808851][T26557] ? __pfx_do_sys_openat2+0x10/0x10 [ 1087.808875][T26557] __ia32_compat_sys_openat+0x12d/0x210 [ 1087.808896][T26557] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 1087.808930][T26557] __do_fast_syscall_32+0x13a/0x8b0 [ 1087.808945][T26557] ? lockdep_hardirqs_on+0x7d/0x110 [ 1087.808959][T26557] do_fast_syscall_32+0x32/0x70 [ 1087.808974][T26557] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1087.808991][T26557] RIP: 0023:0xf7fc2fec [ 1087.809008][T26557] Code: Unable to access opcode bytes at 0xf7fc2fc2. [ 1087.809014][T26557] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 1087.809028][T26557] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000580 [ 1087.809036][T26557] RDX: 0000000000008880 RSI: 0000000000000085 RDI: 0000000000000000 [ 1087.809044][T26557] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1087.809051][T26557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1087.809059][T26557] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1087.809075][T26557] [ 1087.809090][T26557] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1088.102499][ T43] audit: type=1326 audit(1790199507.072:6812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26560 comm="syz.0.6038" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fd3fec code=0x0 [ 1088.244949][ T43] audit: type=1326 audit(1790199507.201:6813): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26555 comm="syz.5.6037" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fa5fec code=0x7ffc0000 [ 1088.245042][ T43] audit: type=1326 audit(1790199507.201:6814): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26555 comm="syz.5.6037" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fa6017 code=0x7ffc0000 [ 1088.245185][ T43] audit: type=1326 audit(1790199507.201:6815): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26555 comm="syz.5.6037" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fa5fec code=0x7ffc0000 [ 1088.245308][ T43] audit: type=1326 audit(1790199507.201:6816): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26555 comm="syz.5.6037" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fa6017 code=0x7ffc0000 [ 1088.245487][ T43] audit: type=1326 audit(1790199507.201:6817): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26555 comm="syz.5.6037" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fa5fec code=0x7ffc0000 [ 1088.245648][ T43] audit: type=1326 audit(1790199507.201:6818): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26555 comm="syz.5.6037" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fa6017 code=0x7ffc0000 [ 1088.245837][ T43] audit: type=1326 audit(1790199507.201:6819): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26555 comm="syz.5.6037" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fa5fec code=0x7ffc0000 [ 1088.246001][ T43] audit: type=1326 audit(1790199507.201:6820): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26555 comm="syz.5.6037" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7fa6017 code=0x7ffc0000 [ 1088.246123][ T43] audit: type=1326 audit(1790199507.201:6821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26555 comm="syz.5.6037" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa5fec code=0x7ffc0000 [ 1091.181076][T26679] syzkaller0: entered promiscuous mode [ 1091.181093][T26679] syzkaller0: entered allmulticast mode [ 1091.641679][T26708] binder: 26706:26708 ioctl c0306201 0 returned -14 [ 1091.730454][T26721] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1091.849795][T20789] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 1092.012226][T20789] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1092.013173][T20789] usb 10-1: config 1 has an invalid interface number: 72 but max is 1 [ 1092.013195][T20789] usb 10-1: config 1 has an invalid descriptor of length 184, skipping remainder of the config [ 1092.013211][T20789] usb 10-1: config 1 has no interface number 1 [ 1092.013250][T20789] usb 10-1: too many endpoints for config 1 interface 72 altsetting 3: 89, using maximum allowed: 30 [ 1092.013283][T20789] usb 10-1: config 1 interface 72 altsetting 3 has 0 endpoint descriptors, different from the interface descriptor's value: 89 [ 1092.013306][T20789] usb 10-1: config 1 interface 72 has no altsetting 0 [ 1092.017619][T20789] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.017634][T20789] usb 10-1: Product: syz [ 1092.017642][T20789] usb 10-1: Manufacturer: syz [ 1092.017650][T20789] usb 10-1: SerialNumber: syz [ 1092.030936][T20789] cdc_ncm 10-1:1.0: CDC Union missing and no IAD found [ 1092.030964][T20789] cdc_ncm 10-1:1.0: bind() failure [ 1092.468993][T20789] usb 10-1: USB disconnect, device number 13 [ 1092.846002][T26735] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6117'. [ 1093.111919][T26751] 9pnet: p9_errstr2errno: server reported unknown error 0x000 [ 1093.975032][T26809] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6150'. [ 1093.978322][T26807] syz_tun: entered allmulticast mode [ 1093.981373][T26806] syz_tun: left allmulticast mode [ 1094.444966][T26828] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6158'. [ 1094.772652][T26836] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6162'. [ 1095.087752][T26843] WARNING! power/level is deprecated; use power/control instead [ 1095.126740][T26845] bridge0: port 1(bridge_slave_0) entered disabled state [ 1095.476993][T20789] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 1095.684725][T20789] usb 9-1: New USB device found, idVendor=0a12, idProduct=0001, bcdDevice= 0.00 [ 1095.685832][T20789] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1095.685846][T20789] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1095.687807][T20789] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1095.687821][T20789] usb 9-1: Product: syz [ 1095.687828][T20789] usb 9-1: Manufacturer: syz [ 1095.687836][T20789] usb 9-1: SerialNumber: syz [ 1095.925791][T26854] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1095.926364][T26854] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1095.933013][ C2] Bluetooth: hci1: corrupted ACL packet [ 1095.980246][T26875] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 1095.980360][T26875] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 1095.980459][T26875] udc dummy_udc.0: failed to start g1: -22 [ 1095.982074][T26875] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 1095.984972][T26875] UDC core: g1: couldn't find an available UDC or it's busy [ 1096.158024][T24693] Bluetooth: hci1: CSR: Local version failed (-71) [ 1096.158040][ T65] usb 9-1: USB disconnect, device number 15 [ 1096.883624][T26893] kvm: requested 74590 ns i8254 timer period limited to 200000 ns [ 1096.916738][T26893] kvm: requested 78781 ns i8254 timer period limited to 200000 ns [ 1096.920424][T26893] kvm: requested 175162 ns i8254 timer period limited to 200000 ns [ 1096.923513][T26893] kvm: requested 18438 ns i8254 timer period limited to 200000 ns [ 1096.925465][T26893] kvm: requested 41066 ns i8254 timer period limited to 200000 ns [ 1096.929889][T26893] kvm: requested 25142 ns i8254 timer period limited to 200000 ns [ 1096.931868][T26893] kvm: requested 27657 ns i8254 timer period limited to 200000 ns [ 1096.933618][T26893] kvm: requested 152533 ns i8254 timer period limited to 200000 ns [ 1096.938068][T26893] kvm: requested 27657 ns i8254 timer period limited to 200000 ns [ 1096.943402][T26893] kvm: requested 58666 ns i8254 timer period limited to 200000 ns [ 1097.448982][ T5887] usb 11-1: new high-speed USB device number 24 using dummy_hcd [ 1097.561063][ T5837] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1097.612250][ T5887] usb 11-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 1097.615239][ T5887] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1098.584153][ T5887] cdc_acm 11-1:1.0: ttyACM0: USB ACM device [ 1098.651240][ T5837] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1098.781211][ T5837] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1098.911408][ T5837] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1099.084352][ T5745] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1099.090314][ T5745] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1099.092170][ T5745] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1099.106408][ T5745] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1099.111484][ T5745] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1099.256575][ T5837] bridge_slave_1: left allmulticast mode [ 1099.256606][ T5837] bridge_slave_1: left promiscuous mode [ 1099.256906][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 1099.261722][ T5837] bridge_slave_0: left allmulticast mode [ 1099.261740][ T5837] bridge_slave_0: left promiscuous mode [ 1099.261985][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 1099.300648][T26936] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6202'. [ 1099.970277][ T5837] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1099.978285][ T5837] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1099.979915][ T5837] bond0 (unregistering): Released all slaves [ 1099.993211][ T5837] bond1 (unregistering): Released all slaves [ 1100.009048][ T5837] bond2 (unregistering): Released all slaves [ 1100.020615][ T5837] bond3 (unregistering): Released all slaves [ 1100.034497][ T5837] bond4 (unregistering): Released all slaves [ 1100.049641][ T5837] bond5 (unregistering): Released all slaves [ 1100.068125][ T5837] bond6 (unregistering): Released all slaves [ 1100.078845][ T5837] bond7 (unregistering): Released all slaves [ 1100.095246][ T5837] bond8 (unregistering): Released all slaves [ 1100.116799][ T5837] bond9 (unregistering): Released all slaves [ 1100.132225][ T5837] bond10 (unregistering): Released all slaves [ 1100.150367][ T5837] bond11 (unregistering): Released all slaves [ 1100.166451][ T5837] bond12 (unregistering): Released all slaves [ 1100.185927][ T5837] bond13 (unregistering): Released all slaves [ 1100.204953][ T5837] bond14 (unregistering): Released all slaves [ 1100.221102][ T5837] bond15 (unregistering): Released all slaves [ 1100.463403][ T5837] tipc: Left network mode [ 1100.763370][ T5450] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1101.382620][T24693] Bluetooth: hci1: command tx timeout [ 1101.488564][ T5450] 8021q: adding VLAN 0 to HW filter on device eth14 [ 1101.866220][T26929] bridge0: port 1(bridge_slave_0) entered blocking state [ 1101.866372][T26929] bridge0: port 1(bridge_slave_0) entered disabled state [ 1101.866497][T26929] bridge_slave_0: entered allmulticast mode [ 1101.885654][T26929] bridge_slave_0: entered promiscuous mode [ 1101.931279][ T5450] 8021q: adding VLAN 0 to HW filter on device eth15 [ 1101.931890][T26929] bridge0: port 2(bridge_slave_1) entered blocking state [ 1101.932731][T26929] bridge0: port 2(bridge_slave_1) entered disabled state [ 1101.932851][T26929] bridge_slave_1: entered allmulticast mode [ 1101.944237][T26929] bridge_slave_1: entered promiscuous mode [ 1102.179115][T26929] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1102.253030][ T5837] hsr_slave_0: left promiscuous mode [ 1102.254483][ T5837] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1102.254558][ T5837] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1102.256091][ T5837] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1102.256112][ T5837] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1102.307753][ T5837] veth1_macvtap: left promiscuous mode [ 1102.308745][ T5837] veth0_macvtap: left promiscuous mode [ 1102.309731][ T5837] veth1_vlan: left promiscuous mode [ 1102.309893][ T5837] veth0_vlan: left promiscuous mode [ 1102.672181][T27011] program syz.4.6221 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1102.841227][T26929] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1102.883435][T26929] team0: Port device team_slave_0 added [ 1102.887941][T26929] team0: Port device team_slave_1 added [ 1102.923821][T26929] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1102.923836][T26929] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1102.923851][T26929] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1102.924906][T26929] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1102.924915][T26929] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1102.924930][T26929] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1103.019586][T26929] hsr_slave_0: entered promiscuous mode [ 1103.020443][T26929] hsr_slave_1: entered promiscuous mode [ 1103.020981][T26929] debugfs: 'hsr0' already exists in 'hsr' [ 1103.021001][T26929] Cannot create hsr debugfs directory [ 1103.358281][ T5450] 8021q: adding VLAN 0 to HW filter on device eth16 [ 1103.412088][T26929] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1103.459531][T26929] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1103.460729][T26929] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1103.562367][T26929] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1103.564634][T26929] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1103.603553][T26929] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1103.609866][T26929] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1103.612533][ T5837] IPVS: stop unused estimator thread 0... [ 1103.621202][T26929] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1103.636549][T24693] Bluetooth: hci1: command tx timeout [ 1103.792643][T26929] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1103.890849][T26929] 8021q: adding VLAN 0 to HW filter on device team0 [ 1103.912467][T15710] bridge0: port 1(bridge_slave_0) entered blocking state [ 1103.912637][T15710] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1103.932610][T15710] bridge0: port 2(bridge_slave_1) entered blocking state [ 1103.932683][T15710] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1104.336943][ T5887] usb 11-1: USB disconnect, device number 24 [ 1104.811145][T26929] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1105.226922][T27072] cgroup: Unknown subsys name 'cpuset' [ 1105.261046][T26929] veth0_vlan: entered promiscuous mode [ 1105.273472][T26929] veth1_vlan: entered promiscuous mode [ 1105.313077][T26929] veth0_macvtap: entered promiscuous mode [ 1105.318234][T26929] veth1_macvtap: entered promiscuous mode [ 1105.331329][T26929] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1105.337113][T26929] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1105.446256][T20723] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1105.446287][T20723] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1105.446306][T20723] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1105.446323][T20723] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1105.545552][T15710] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1105.545568][T15710] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1105.634173][T15710] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1105.634189][T15710] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1105.859460][T27092] pimreg: tun_chr_ioctl cmd 2147767519 [ 1105.890458][T24693] Bluetooth: hci1: command tx timeout [ 1108.144393][T24693] Bluetooth: hci1: command tx timeout [ 1108.184698][T27205] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6288'. [ 1108.492266][ T9] usb 11-1: new high-speed USB device number 25 using dummy_hcd [ 1108.654753][ T9] usb 11-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1108.655268][ T9] usb 11-1: config 0 has no interfaces? [ 1108.656950][ T9] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1108.656964][ T9] usb 11-1: Product: syz [ 1108.656972][ T9] usb 11-1: Manufacturer: syz [ 1108.656980][ T9] usb 11-1: SerialNumber: syz [ 1108.658299][ T9] usb 11-1: config 0 descriptor?? [ 1108.678642][ T5745] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1108.683031][ T5745] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1108.683871][ T5745] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1108.685760][ T5745] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1108.686295][ T5745] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1108.932489][T27203] mmap: syz.6.6287 (27203): VmData 37564416 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 1109.036758][ T5845] usb 11-1: USB disconnect, device number 25 [ 1109.461821][ T5837] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1109.780203][ T5837] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1110.011456][ T5837] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1110.102540][T27239] bridge0: port 1(bridge_slave_0) entered blocking state [ 1110.111518][T27239] bridge0: port 1(bridge_slave_0) entered disabled state [ 1110.114267][T27239] bridge_slave_0: entered allmulticast mode [ 1110.115457][T27239] bridge_slave_0: entered promiscuous mode [ 1110.119832][T27239] bridge0: port 2(bridge_slave_1) entered blocking state [ 1110.119896][T27239] bridge0: port 2(bridge_slave_1) entered disabled state [ 1110.119994][T27239] bridge_slave_1: entered allmulticast mode [ 1110.121217][T27239] bridge_slave_1: entered promiscuous mode [ 1110.156398][ T5837] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1110.167992][T27239] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1110.173993][T27239] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1110.236240][T21852] usb 11-1: new high-speed USB device number 26 using dummy_hcd [ 1110.236285][T27239] team0: Port device team_slave_0 added [ 1110.240156][T27239] team0: Port device team_slave_1 added [ 1110.282833][T27239] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1110.282845][T27239] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1110.282859][T27239] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1110.320603][T27239] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1110.320620][T27239] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1110.320643][T27239] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1110.406493][T21852] usb 11-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1110.410097][T21852] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1110.410116][T21852] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1110.410128][T21852] usb 11-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1110.410148][T21852] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1110.411884][T21852] usb 11-1: config 0 descriptor?? [ 1110.490129][T27239] hsr_slave_0: entered promiscuous mode [ 1110.490902][T27239] hsr_slave_1: entered promiscuous mode [ 1110.491810][T27239] debugfs: 'hsr0' already exists in 'hsr' [ 1110.491828][T27239] Cannot create hsr debugfs directory [ 1110.594601][ T5837] bridge_slave_1: left allmulticast mode [ 1110.594666][ T5837] bridge_slave_1: left promiscuous mode [ 1110.594818][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 1110.611828][ T5837] bridge_slave_0: left allmulticast mode [ 1110.611852][ T5837] bridge_slave_0: left promiscuous mode [ 1110.613751][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 1110.935917][T24693] Bluetooth: hci4: command tx timeout [ 1110.942547][T21852] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw1: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 1111.194662][ T5845] usb 11-1: USB disconnect, device number 26 [ 1111.259814][ T5837] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1111.262622][ T5837] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1111.263606][ T5837] bond0 (unregistering): Released all slaves [ 1111.269956][ T5837] bond1 (unregistering): Released all slaves [ 1111.281082][ T5837] bond2 (unregistering): Released all slaves [ 1111.288915][ T5837] bond3 (unregistering): Released all slaves [ 1111.299617][ T5837] bond4 (unregistering): Released all slaves [ 1111.310142][ T5837] bond5 (unregistering): Released all slaves [ 1111.319103][ T5837] bond6 (unregistering): Released all slaves [ 1111.336144][ T5837] bond7 (unregistering): Released all slaves [ 1111.344867][ T5837] bond8 (unregistering): Released all slaves [ 1111.354655][ T5837] bond9 (unregistering): Released all slaves [ 1111.367513][ T5837] bond10 (unregistering): Released all slaves [ 1111.378341][ T5837] bond11 (unregistering): Released all slaves [ 1111.394048][ T5837] bond12 (unregistering): Released all slaves [ 1111.403105][ T5837] bond13 (unregistering): Released all slaves [ 1111.418323][ T5837] bond14 (unregistering): Released all slaves [ 1111.434942][ T5837] bond15 (unregistering): Released all slaves [ 1111.457773][ T5450] 8021q: adding VLAN 0 to HW filter on device eth18 [ 1111.457990][T27326] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1111.621119][ T5837] tipc: Left network mode [ 1112.050665][ T5450] 8021q: adding VLAN 0 to HW filter on device eth19 [ 1112.294826][ T9] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 1112.403059][ T5887] usb 11-1: new high-speed USB device number 27 using dummy_hcd [ 1112.430927][T27239] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1112.433071][T27239] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1112.433722][T27239] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1112.439861][T27239] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1112.441025][T27239] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1112.449985][T27239] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1112.450611][T27239] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1112.452708][T27239] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1112.460532][ T9] usb 12-1: New USB device found, idVendor=0403, idProduct=ee18, bcdDevice= 4.ca [ 1112.461422][ T9] usb 12-1: config 8 has an invalid interface number: 154 but max is 0 [ 1112.461436][ T9] usb 12-1: config 8 has no interface number 0 [ 1112.463203][ T9] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1112.463216][ T9] usb 12-1: Product: syz [ 1112.463223][ T9] usb 12-1: Manufacturer: syz [ 1112.463231][ T9] usb 12-1: SerialNumber: syz [ 1112.554359][T27239] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1112.577027][ T5887] usb 11-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1112.578721][ T5887] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1112.578744][ T5887] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1112.578755][ T5887] usb 11-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1112.580639][ T5887] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1112.580643][ T5837] hsr_slave_0: left promiscuous mode [ 1112.580652][ T5887] usb 11-1: Product: syz [ 1112.580660][ T5887] usb 11-1: Manufacturer: syz [ 1112.580668][ T5887] usb 11-1: SerialNumber: syz [ 1112.581068][ T5837] hsr_slave_1: left promiscuous mode [ 1112.581451][ T5837] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1112.581463][ T5837] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1112.582065][ T5837] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1112.582381][ T5837] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1112.582587][ T5887] usb 11-1: config 0 descriptor?? [ 1112.591368][ T5837] veth1_macvtap: left promiscuous mode [ 1112.591397][ T5837] veth0_macvtap: left allmulticast mode [ 1112.591511][ T5837] veth0_macvtap: left promiscuous mode [ 1112.591559][ T5837] veth1_vlan: left promiscuous mode [ 1112.715587][ T9] ftdi_sio 12-1:8.154: FTDI USB Serial Device converter detected [ 1112.716313][ T9] ftdi_sio ttyUSB0: unknown device type: 0x4ca [ 1112.726145][ T9] usb 12-1: USB disconnect, device number 2 [ 1112.727224][ T9] ftdi_sio 12-1:8.154: device disconnected [ 1112.830609][ T5837] team0 (unregistering): Port device team_slave_1 removed [ 1112.844020][ T5837] team0 (unregistering): Port device team_slave_0 removed [ 1112.950783][T27239] 8021q: adding VLAN 0 to HW filter on device team0 [ 1112.953569][T15727] bridge0: port 1(bridge_slave_0) entered blocking state [ 1112.953615][T15727] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1112.961304][T15727] bridge0: port 2(bridge_slave_1) entered blocking state [ 1112.961350][T15727] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1112.995548][T27239] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1113.183327][T24693] Bluetooth: hci4: command tx timeout [ 1113.245214][T27239] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1113.355939][ T9] usb 11-1: USB disconnect, device number 27 [ 1113.462768][T27239] veth0_vlan: entered promiscuous mode [ 1113.469537][T27239] veth1_vlan: entered promiscuous mode [ 1113.483005][T27239] veth0_macvtap: entered promiscuous mode [ 1113.491014][T27239] veth1_macvtap: entered promiscuous mode [ 1113.499053][T27239] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1113.501901][T27239] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1113.534371][T20723] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1113.534399][T20723] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1113.534417][T20723] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1113.617732][T15710] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1113.617745][T15710] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1113.636889][T15726] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1113.636905][T15726] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1113.639783][ T5837] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1114.237027][T27441] input: PS/2 BYD TouchPad as /devices/platform/i8042/serio1/input/input22 [ 1114.521073][T27464] ptrace attach of "/syz-executor exec"[27239] was attempted by "/syz-executor exec"[27464] [ 1114.555135][T27465] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6366'. syzkaller syzkaller login: [ 1115.333286][T27486] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6373'. [ 1115.426480][T24693] Bluetooth: hci4: command tx timeout [ 1115.561726][T27497] binfmt_misc: register: failed to install interpreter ./file0 [ 1115.604973][T27499] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 1115.615142][T27501] device-mapper: table: 248:2: thin: Invalid argument count (-EINVAL) [ 1115.615160][T27501] device-mapper: ioctl: error adding target to table [ 1115.652311][T27504] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6381'. [ 1115.652918][T27504] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6381'. [ 1116.206761][ T5845] usb 11-1: new high-speed USB device number 28 using dummy_hcd [ 1116.575080][T27080] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 1116.749132][T27080] usb 9-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 1116.750314][T27080] usb 9-1: config 0 has an invalid interface number: 64 but max is 0 [ 1116.750335][T27080] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1116.750350][T27080] usb 9-1: config 0 has no interface number 0 [ 1116.755465][T27080] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1116.755486][T27080] usb 9-1: Product: syz [ 1116.755498][T27080] usb 9-1: Manufacturer: syz [ 1116.755510][T27080] usb 9-1: SerialNumber: syz [ 1116.758257][T27080] usb 9-1: config 0 descriptor?? [ 1116.763414][T27080] uvcvideo 9-1:0.64: probe with driver uvcvideo failed with error -22 [ 1117.398177][T27541] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input24 [ 1117.615802][T27080] usb 9-1: USB disconnect, device number 16 [ 1117.680891][T24693] Bluetooth: hci4: command tx timeout [ 1118.133725][T27581] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6406'. [ 1118.517267][T27601] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 1118.676735][T27609] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1119.212659][T27638] binder: 27637:27638 ioctl 4018620d 0 returned -22 [ 1120.814340][T27668] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1120.904648][T27668] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1120.986675][T27668] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1121.092571][T27668] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1121.429837][ T5837] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1121.429867][ T5837] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1121.429887][ T5837] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1121.451587][ T5837] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1121.492971][T27673] input: syz0 as /devices/virtual/input/input25 [ 1121.710464][T27679] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(20.1.36), cmd(3) [ 1121.962196][T27689] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6446'. [ 1122.326631][T27700] netlink: 'syz.4.6451': attribute type 2 has an invalid length. [ 1122.326653][T27700] netlink: 'syz.4.6451': attribute type 2 has an invalid length. [ 1122.708145][T27707] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6453'. [ 1123.190700][T27711] loop0: detected capacity change from 0 to 32768 [ 1123.540082][T27723] random: crng reseeded on system resumption [ 1125.623612][T23479] usb 12-1: new high-speed USB device number 3 using dummy_hcd [ 1125.786442][T23479] usb 12-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 1125.787473][T23479] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1125.787490][T23479] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1125.787501][T23479] usb 12-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1125.787521][T23479] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1125.788945][T23479] usb 12-1: config 0 descriptor?? [ 1126.303323][T23479] steelseries 0003:1038:1410.0006: item fetching failed at offset 3/7 [ 1126.303630][T23479] steelseries 0003:1038:1410.0006: parse failed [ 1126.303671][T23479] steelseries 0003:1038:1410.0006: probe with driver steelseries failed with error -22 [ 1126.459627][ T5887] usb 12-1: USB disconnect, device number 3 [ 1126.957890][ T5887] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 1127.129852][ T5887] usb 9-1: Using ep0 maxpacket: 32 [ 1127.133071][ T5887] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1127.133102][ T5887] usb 9-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1127.133942][ T5887] usb 9-1: config 14 has an invalid interface number: 57 but max is 1 [ 1127.133956][ T5887] usb 9-1: config 14 has an invalid interface number: 228 but max is 1 [ 1127.133967][ T5887] usb 9-1: config 14 has no interface number 0 [ 1127.133975][ T5887] usb 9-1: config 14 has no interface number 1 [ 1127.134001][ T5887] usb 9-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1127.134013][ T5887] usb 9-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1127.134026][ T5887] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 1127.134039][ T5887] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 1127.134052][ T5887] usb 9-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 1127.134065][ T5887] usb 9-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1127.134078][ T5887] usb 9-1: config 14 interface 57 has no altsetting 0 [ 1127.134087][ T5887] usb 9-1: config 14 interface 228 has no altsetting 0 [ 1127.135824][ T5887] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1127.135837][ T5887] usb 9-1: Product: syz [ 1127.135845][ T5887] usb 9-1: Manufacturer: syz [ 1127.135852][ T5887] usb 9-1: SerialNumber: syz [ 1127.581636][ T5887] legousbtower 9-1:14.57: interrupt endpoints not found [ 1128.021283][ T5887] legousbtower 9-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 1128.024553][ T5887] legousbtower 9-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 1128.618743][T27789] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6481'. [ 1128.658955][T27789] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1128.672389][T27789] macvlan2: entered promiscuous mode [ 1128.672403][T27789] macvlan2: entered allmulticast mode [ 1128.672641][T27789] bond6: entered allmulticast mode [ 1128.672678][T27789] bond6: entered promiscuous mode [ 1128.673017][T27789] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1128.674063][T27789] team0: Port device macvlan2 added [ 1128.857072][ C0] usb 9-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 1128.859220][T27080] usb 9-1: USB disconnect, device number 17 [ 1128.867268][T27080] legousbtower 9-1:14.228: LEGO USB Tower #-160 now disconnected [ 1129.120732][T27809] FAULT_INJECTION: forcing a failure. [ 1129.120732][T27809] name failslab, interval 1, probability 0, space 0, times 0 [ 1129.120758][T27809] CPU: 0 UID: 0 PID: 27809 Comm: syz.6.6487 Tainted: G L syzkaller #0 PREEMPT(full) [ 1129.120775][T27809] Tainted: [L]=SOFTLOCKUP [ 1129.120780][T27809] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1129.120789][T27809] Call Trace: [ 1129.120794][T27809] [ 1129.120799][T27809] dump_stack_lvl+0x100/0x190 [ 1129.120820][T27809] should_fail_ex.cold+0x5/0xa [ 1129.120839][T27809] should_failslab+0xc2/0x120 [ 1129.120856][T27809] __kmalloc_node_noprof+0xff/0x880 [ 1129.120871][T27809] ? __get_vm_area_node+0x1ff/0x350 [ 1129.120886][T27809] ? __get_vm_area_node+0x22b/0x350 [ 1129.120901][T27809] ? __vmalloc_node_range_noprof+0x3d4/0x1420 [ 1129.120921][T27809] __vmalloc_node_range_noprof+0x3d4/0x1420 [ 1129.120942][T27809] ? n_tty_open+0x1a/0x170 [ 1129.120957][T27809] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1129.120974][T27809] ? do_raw_spin_lock+0x128/0x260 [ 1129.120987][T27809] ? find_held_lock+0x2b/0x80 [ 1129.121000][T27809] ? n_tty_open+0x12b/0x170 [ 1129.121011][T27809] ? n_tty_open+0x12b/0x170 [ 1129.121023][T27809] ? n_tty_open+0x1a/0x170 [ 1129.121034][T27809] __vmalloc_node_noprof+0xad/0xf0 [ 1129.121050][T27809] ? n_tty_open+0x1a/0x170 [ 1129.121063][T27809] ? __pfx_n_tty_open+0x10/0x10 [ 1129.121075][T27809] n_tty_open+0x1a/0x170 [ 1129.121087][T27809] tty_ldisc_open+0xa2/0x120 [ 1129.121105][T27809] tty_ldisc_setup+0x87/0xf0 [ 1129.121127][T27809] tty_init_dev.part.0+0x1b5/0x470 [ 1129.121155][T27809] tty_init_dev+0x60/0x80 [ 1129.121179][T27809] ? __pfx_ptmx_open+0x10/0x10 [ 1129.121198][T27809] ptmx_open+0x128/0x360 [ 1129.121214][T27809] ? __pfx_ptmx_open+0x10/0x10 [ 1129.121229][T27809] chrdev_open+0x234/0x6a0 [ 1129.121243][T27809] ? __pfx_apparmor_file_open+0x10/0x10 [ 1129.121256][T27809] ? __pfx_chrdev_open+0x10/0x10 [ 1129.121278][T27809] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 1129.121299][T27809] do_dentry_open+0x6ab/0x14d0 [ 1129.121314][T27809] ? __pfx_chrdev_open+0x10/0x10 [ 1129.121334][T27809] vfs_open+0x82/0x3f0 [ 1129.121352][T27809] path_openat+0x19fa/0x2440 [ 1129.121371][T27809] ? __pfx_path_openat+0x10/0x10 [ 1129.121391][T27809] do_file_open+0x20e/0x430 [ 1129.121410][T27809] ? __pfx_do_file_open+0x10/0x10 [ 1129.121434][T27809] ? _raw_spin_unlock+0x28/0x50 [ 1129.121452][T27809] ? alloc_fd+0x471/0x7a0 [ 1129.121470][T27809] do_sys_openat2+0x10f/0x1e0 [ 1129.121487][T27809] ? __pfx_do_sys_openat2+0x10/0x10 [ 1129.121505][T27809] ? find_held_lock+0x2b/0x80 [ 1129.121518][T27809] ? __fget_files+0x215/0x3d0 [ 1129.121534][T27809] __ia32_compat_sys_openat+0x12d/0x210 [ 1129.121554][T27809] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 1129.121579][T27809] __do_fast_syscall_32+0x13a/0x8b0 [ 1129.121595][T27809] do_fast_syscall_32+0x32/0x70 [ 1129.121608][T27809] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1129.121623][T27809] RIP: 0023:0xf7fc2fec [ 1129.121637][T27809] Code: Unable to access opcode bytes at 0xf7fc2fc2. [ 1129.121643][T27809] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 1129.121656][T27809] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 1129.121663][T27809] RDX: 0000000000060081 RSI: 0000000000000000 RDI: 0000000000000000 [ 1129.121671][T27809] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1129.121678][T27809] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1129.121687][T27809] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1129.121702][T27809] [ 1129.121709][T27809] syz.6.6487: vmalloc error: size 12288, failed to allocated page array size 24, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1129.121747][T27809] CPU: 0 UID: 0 PID: 27809 Comm: syz.6.6487 Tainted: G L syzkaller #0 PREEMPT(full) [ 1129.121764][T27809] Tainted: [L]=SOFTLOCKUP [ 1129.121768][T27809] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1129.121776][T27809] Call Trace: [ 1129.121782][T27809] [ 1129.121789][T27809] dump_stack_lvl+0x100/0x190 [ 1129.121806][T27809] warn_alloc.cold+0x9e/0xb2 [ 1129.121820][T27809] ? __pfx_warn_alloc+0x10/0x10 [ 1129.121831][T27809] ? dump_stack_lvl+0x17c/0x190 [ 1129.121847][T27809] ? rcu_is_watching+0x13/0xc0 [ 1129.121861][T27809] ? __kasan_kmalloc+0x8a/0xb0 [ 1129.121875][T27809] ? __kmalloc_node_noprof+0x360/0x880 [ 1129.121889][T27809] ? __get_vm_area_node+0x1ff/0x350 [ 1129.121904][T27809] ? __get_vm_area_node+0x22b/0x350 [ 1129.121918][T27809] ? __vmalloc_node_range_noprof+0x3d4/0x1420 [ 1129.121938][T27809] __vmalloc_node_range_noprof+0x10f4/0x1420 [ 1129.121962][T27809] ? n_tty_open+0x1a/0x170 [ 1129.121976][T27809] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1129.121994][T27809] ? do_raw_spin_lock+0x128/0x260 [ 1129.122006][T27809] ? find_held_lock+0x2b/0x80 [ 1129.122019][T27809] ? n_tty_open+0x12b/0x170 [ 1129.122029][T27809] ? n_tty_open+0x12b/0x170 [ 1129.122041][T27809] ? n_tty_open+0x1a/0x170 [ 1129.122052][T27809] __vmalloc_node_noprof+0xad/0xf0 [ 1129.122068][T27809] ? n_tty_open+0x1a/0x170 [ 1129.122080][T27809] ? __pfx_n_tty_open+0x10/0x10 [ 1129.122091][T27809] n_tty_open+0x1a/0x170 [ 1129.122103][T27809] tty_ldisc_open+0xa2/0x120 [ 1129.122118][T27809] tty_ldisc_setup+0x87/0xf0 [ 1129.122134][T27809] tty_init_dev.part.0+0x1b5/0x470 [ 1129.122153][T27809] tty_init_dev+0x60/0x80 [ 1129.122171][T27809] ? __pfx_ptmx_open+0x10/0x10 [ 1129.122184][T27809] ptmx_open+0x128/0x360 [ 1129.122198][T27809] ? __pfx_ptmx_open+0x10/0x10 [ 1129.122211][T27809] chrdev_open+0x234/0x6a0 [ 1129.122225][T27809] ? __pfx_apparmor_file_open+0x10/0x10 [ 1129.122238][T27809] ? __pfx_chrdev_open+0x10/0x10 [ 1129.122253][T27809] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 1129.122299][T27809] do_dentry_open+0x6ab/0x14d0 [ 1129.122314][T27809] ? __pfx_chrdev_open+0x10/0x10 [ 1129.122333][T27809] vfs_open+0x82/0x3f0 [ 1129.122352][T27809] path_openat+0x19fa/0x2440 [ 1129.122370][T27809] ? __pfx_path_openat+0x10/0x10 [ 1129.122390][T27809] do_file_open+0x20e/0x430 [ 1129.122407][T27809] ? __pfx_do_file_open+0x10/0x10 [ 1129.122432][T27809] ? _raw_spin_unlock+0x28/0x50 [ 1129.122449][T27809] ? alloc_fd+0x471/0x7a0 [ 1129.122467][T27809] do_sys_openat2+0x10f/0x1e0 [ 1129.122483][T27809] ? __pfx_do_sys_openat2+0x10/0x10 [ 1129.122501][T27809] ? find_held_lock+0x2b/0x80 [ 1129.122513][T27809] ? __fget_files+0x215/0x3d0 [ 1129.122530][T27809] __ia32_compat_sys_openat+0x12d/0x210 [ 1129.122549][T27809] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 1129.122572][T27809] __do_fast_syscall_32+0x13a/0x8b0 [ 1129.122606][T27809] do_fast_syscall_32+0x32/0x70 [ 1129.122620][T27809] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1129.122635][T27809] RIP: 0023:0xf7fc2fec [ 1129.122648][T27809] Code: Unable to access opcode bytes at 0xf7fc2fc2. [ 1129.122653][T27809] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 1129.122666][T27809] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 1129.122673][T27809] RDX: 0000000000060081 RSI: 0000000000000000 RDI: 0000000000000000 [ 1129.122680][T27809] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1129.122687][T27809] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1129.122694][T27809] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1129.122709][T27809] [ 1129.122752][T27809] Mem-Info: [ 1129.122759][T27809] active_anon:2094 inactive_anon:832 isolated_anon:0 [ 1129.122759][T27809] active_file:6472 inactive_file:12728 isolated_file:0 [ 1129.122759][T27809] unevictable:0 dirty:357 writeback:0 [ 1129.122759][T27809] slab_reclaimable:7629 slab_unreclaimable:72263 [ 1129.122759][T27809] mapped:24206 shmem:45 pagetables:1787 [ 1129.122759][T27809] sec_pagetables:342 bounce:0 [ 1129.122759][T27809] kernel_misc_reclaimable:0 [ 1129.122759][T27809] free:36783 free_pcp:7718 free_cma:0 [ 1129.122793][T27809] Node 0 active_anon:0kB inactive_anon:8kB active_file:56kB inactive_file:1168kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:800kB dirty:12kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8800kB pagetables:1384kB sec_pagetables:1140kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1129.122824][T27809] Node 1 active_anon:8376kB inactive_anon:3320kB active_file:25832kB inactive_file:49744kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:96024kB dirty:1416kB writeback:0kB shmem:180kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7320kB pagetables:5764kB sec_pagetables:228kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1129.122854][T27809] Node 0 DMA free:2756kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:68kB local_pcp:0kB free_cma:0kB [ 1129.122889][T27809] lowmem_reserve[]: 0 278 278 278 278 [ 1129.122911][T27809] Node 0 DMA32 free:34416kB boost:28404kB min:41028kB low:44184kB high:47340kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:8kB active_file:56kB inactive_file:1168kB unevictable:0kB writepending:12kB zspages:520kB present:1032196kB managed:284860kB mlocked:0kB bounce:0kB free_pcp:6064kB local_pcp:1824kB free_cma:0kB [ 1129.122945][T27809] lowmem_reserve[]: 0 0 0 0 0 [ 1129.122965][T27809] Node 1 DMA32 free:109960kB boost:2048kB min:49188kB low:60972kB high:72756kB reserved_highatomic:0kB free_highatomic:0kB active_anon:8376kB inactive_anon:3320kB active_file:25832kB inactive_file:49744kB unevictable:0kB writepending:1416kB zspages:5520kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:24740kB local_pcp:7820kB free_cma:0kB [ 1129.122996][T27809] lowmem_reserve[]: 0 0 0 0 0 [ 1129.123014][T27809] Node 0 DMA: 89*4kB (U) 18*8kB (UM) 9*16kB (U) 8*32kB (UM) 9*64kB (U) 0*128kB 1*256kB (M) 0*512kB 1*1024kB (M) 0*2048kB 0*4096kB = 2756kB [ 1129.123116][T27809] Node 0 DMA32: 1000*4kB (UME) 178*8kB (UME) 48*16kB (UME) 124*32kB (UME) 31*64kB (UME) 20*128kB (UME) 9*256kB (UM) 12*512kB (UM) 7*1024kB (UM) 2*2048kB (UM) 0*4096kB = 34416kB [ 1129.123211][T27809] Node 1 DMA32: 1617*4kB (UME) 835*8kB (UME) 547*16kB (UME) 465*32kB (UME) 241*64kB (UME) 149*128kB (UM) 43*256kB (UM) 30*512kB (UM) 12*1024kB (M) 0*2048kB 0*4096kB = 109932kB [ 1129.123303][T27809] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1129.123313][T27809] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1129.123322][T27809] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1129.123332][T27809] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 1129.123341][T27809] 20518 total pagecache pages [ 1129.123346][T27809] 1262 pages in swap cache [ 1129.123351][T27809] Free swap = 97184kB [ 1129.123355][T27809] Total swap = 124996kB [ 1129.123361][T27809] 524155 pages RAM [ 1129.123365][T27809] 0 pages HighMem/MovableOnly [ 1129.123369][T27809] 212048 pages reserved [ 1129.123373][T27809] 0 pages cma reserved [ 1129.129904][T27809] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 1129.800025][T27827] netlink: 'syz.6.6494': attribute type 21 has an invalid length. [ 1129.800100][T27827] netlink: 'syz.6.6494': attribute type 3 has an invalid length. [ 1129.800110][T27827] netlink: 144 bytes leftover after parsing attributes in process `syz.6.6494'. [ 1130.348310][T27080] usb 12-1: new high-speed USB device number 4 using dummy_hcd [ 1130.548669][T27080] usb 12-1: New USB device found, idVendor=0d8c, idProduct=0014, bcdDevice= 0.40 [ 1130.554449][T27080] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1130.554471][T27080] usb 12-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1130.556691][T27080] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1130.556720][T27080] usb 12-1: Product: syz [ 1130.556731][T27080] usb 12-1: Manufacturer: syz [ 1130.556742][T27080] usb 12-1: SerialNumber: syz [ 1130.604174][T27080] usb 12-1: 0:1 : does not exist [ 1131.000404][T27842] Process accounting resumed [ 1131.169621][T27853] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1131.169992][T27853] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1131.445263][T27874] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 1131.815988][T27239] svc: failed to register nfsdv3 RPC service (errno 111). [ 1131.819844][T27239] svc: failed to register nfsaclv3 RPC service (errno 111). [ 1131.819904][T27239] failed to unregister tcp with rpcbind [ 1131.821425][T27239] svc: failed to register nfsdv3 RPC service (errno 97). [ 1131.821438][T27239] svc: failed to register nfsaclv3 RPC service (errno 97). [ 1131.821445][T27239] failed to unregister tcp with rpcbind [ 1131.876126][ T5887] usb 11-1: new high-speed USB device number 29 using dummy_hcd [ 1132.038607][ T5887] usb 11-1: Using ep0 maxpacket: 16 [ 1132.039830][ T5887] usb 11-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1132.040693][ T5887] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1132.040710][ T5887] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1132.040722][ T5887] usb 11-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1132.040742][ T5887] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1132.051408][ T5887] usb 11-1: config 0 descriptor?? [ 1132.292013][T27907] nvmet: adding nsid 1 to subsystem testsubsys [ 1132.527484][ T5887] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0 [ 1132.527512][ T5887] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0 [ 1132.527524][ T5887] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0 [ 1132.527536][ T5887] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0 [ 1132.527548][ T5887] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0 [ 1132.527560][ T5887] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0 [ 1132.527572][ T5887] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0 [ 1132.527635][ T5887] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0 [ 1132.527647][ T5887] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0 [ 1132.527659][ T5887] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0 [ 1132.534962][ T5887] input: HID 045e:07da as /devices/platform/dummy_hcd.6/usb11/11-1/11-1:0.0/0003:045E:07DA.0007/input/input26 [ 1132.623760][ T5887] microsoft 0003:045E:07DA.0007: input,hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 [ 1132.709780][T24989] usb 11-1: USB disconnect, device number 29 [ 1132.870998][T27908] fido_id[27908]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb11/report_descriptor': No such file or directory [ 1133.176592][T27080] usb 12-1: unit 0 not found! [ 1133.200901][T27080] usb 12-1: USB disconnect, device number 4 [ 1133.257162][ T5741] udevd[5741]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb12/12-1/12-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1133.463553][T27929] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6534'. [ 1134.069545][T27947] FAT-fs (mtdblock0): invalid media value (0x2c) [ 1134.069567][T27947] FAT-fs (mtdblock0): Can't find a valid FAT filesystem [ 1134.520074][T24989] usb 11-1: new high-speed USB device number 30 using dummy_hcd [ 1134.627427][T27969] FAULT_INJECTION: forcing a failure. [ 1134.627427][T27969] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1134.627487][T27969] CPU: 3 UID: 0 PID: 27969 Comm: syz.0.6550 Tainted: G L syzkaller #0 PREEMPT(full) [ 1134.627505][T27969] Tainted: [L]=SOFTLOCKUP [ 1134.627509][T27969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1134.627517][T27969] Call Trace: [ 1134.627522][T27969] [ 1134.627527][T27969] dump_stack_lvl+0x100/0x190 [ 1134.627547][T27969] should_fail_ex.cold+0x5/0xa [ 1134.627564][T27969] _copy_from_user+0x2e/0xd0 [ 1134.627582][T27969] copy_from_sockptr_offset.constprop.0+0x134/0x170 [ 1134.627599][T27969] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 1134.627617][T27969] ? __local_bh_enable_ip+0xa5/0x120 [ 1134.627639][T27969] sk_setsockopt+0x45bc/0x5d80 [ 1134.627653][T27969] ? __pfx_sk_setsockopt+0x10/0x10 [ 1134.627665][T27969] ? futex_wait+0x11e/0x370 [ 1134.627682][T27969] ? __lock_acquire+0x5c0/0x1f40 [ 1134.627703][T27969] ? rcu_read_lock_any_held+0x6a/0x90 [ 1134.627717][T27969] ? find_held_lock+0x2b/0x80 [ 1134.627733][T27969] unix_setsockopt+0xf9/0x340 [ 1134.627749][T27969] ? __pfx_unix_setsockopt+0x10/0x10 [ 1134.627763][T27969] ? aa_sock_opt_perm+0x114/0x1e0 [ 1134.627784][T27969] ? __pfx_unix_setsockopt+0x10/0x10 [ 1134.627800][T27969] do_sock_setsockopt+0xf3/0x1d0 [ 1134.627815][T27969] __sys_setsockopt+0x119/0x190 [ 1134.627836][T27969] __ia32_sys_setsockopt+0xbc/0x160 [ 1134.627853][T27969] ? __do_fast_syscall_32+0xb3/0x8b0 [ 1134.627869][T27969] ? lockdep_hardirqs_on+0x7d/0x110 [ 1134.627881][T27969] __do_fast_syscall_32+0x13a/0x8b0 [ 1134.627896][T27969] do_fast_syscall_32+0x32/0x70 [ 1134.627909][T27969] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1134.627925][T27969] RIP: 0023:0xf7fd3fec [ 1134.627937][T27969] Code: Unable to access opcode bytes at 0xf7fd3fc2. [ 1134.627943][T27969] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 1134.627956][T27969] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000001 [ 1134.627964][T27969] RDX: 0000000000000032 RSI: 0000000080000180 RDI: 0000000000000004 [ 1134.627971][T27969] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1134.627978][T27969] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1134.627985][T27969] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1134.627999][T27969] [ 1134.694488][T24989] usb 11-1: Using ep0 maxpacket: 8 [ 1134.694990][T24989] usb 11-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 1134.695897][T24989] usb 11-1: config 0 has an invalid interface number: 186 but max is 0 [ 1134.695911][T24989] usb 11-1: config 0 has no interface number 0 [ 1134.695930][T24989] usb 11-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1134.695942][T24989] usb 11-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1134.695954][T24989] usb 11-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1134.695966][T24989] usb 11-1: config 0 interface 186 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1134.695978][T24989] usb 11-1: config 0 interface 186 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1134.695991][T24989] usb 11-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1134.698672][T24989] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1134.698686][T24989] usb 11-1: Product: syz [ 1134.698694][T24989] usb 11-1: Manufacturer: syz [ 1134.698701][T24989] usb 11-1: SerialNumber: syz [ 1134.699937][T24989] usb 11-1: config 0 descriptor?? [ 1134.700887][T27957] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1134.716681][T27080] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 1134.912803][T27080] usb 9-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 1134.913662][T27080] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1134.936727][T24989] iowarrior 11-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 1134.945925][T27982] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6553'. [ 1135.013022][T27983] team0: Device macvlan2 failed to change mtu [ 1135.166498][ C3] iowarrior 11-1:0.186: iowarrior_callback - usb_submit_urb failed with result -1 [ 1135.175671][T23452] usb 11-1: USB disconnect, device number 30 [ 1135.254484][T27080] net1080 9-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.4-1, NetChip TurboCONNECT, 2e:a5:2c:ee:ec:81 [ 1135.682276][T27995] netlink: 'syz.0.6557': attribute type 1 has an invalid length. [ 1135.682304][T27995] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1135.682311][T27995] IPv6: NLM_F_CREATE should be set when creating new route [ 1137.447723][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 1137.447757][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 1138.139754][T24693] Bluetooth: hci0: command 0x0c1a tx timeout [ 1140.393458][ T5745] Bluetooth: hci0: command 0x0c1a tx timeout [ 1140.750443][T28021] tipc: Enabling of bearer rejected, failed to enable media [ 1140.823884][T28032] gadgetfs: bound to dummy_udc driver [ 1140.887815][ T5818] usb 9-1: USB disconnect, device number 18 [ 1140.888836][ T5818] net1080 9-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.4-1, NetChip TurboCONNECT [ 1140.961448][ T43] kauditd_printk_skb: 982 callbacks suppressed [ 1140.961460][ T43] audit: type=1326 audit(1790200067.847:7804): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28045 comm="syz.4.6572" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f23fec code=0x0 [ 1141.663761][T28069] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 8) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1141.712124][T28072] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1142.009071][T28077] binder: 28076:28077 ioctl c0306201 0 returned -14 [ 1142.057978][T28079] syzkaller0: entered promiscuous mode [ 1142.057998][T28079] syzkaller0: entered allmulticast mode [ 1142.354683][T27080] usb 11-1: new high-speed USB device number 31 using dummy_hcd [ 1142.517667][T27080] usb 11-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 1142.518550][T27080] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1142.518567][T27080] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1142.519938][T27080] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 1142.519951][T27080] usb 11-1: Product: syz [ 1142.519958][T27080] usb 11-1: Manufacturer: syz [ 1142.525667][T27080] mos7840 11-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 1142.597060][T28089] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6587'. [ 1142.648218][ T5745] Bluetooth: hci0: command 0x0c1a tx timeout [ 1143.357088][T28101] binder: 28099:28101 ioctl c0306201 0 returned -14 [ 1144.871955][T28127] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6600'. [ 1144.962602][T27080] usb 11-1: Moschip 7840/7820 USB Serial Driver converter now attached to ttyUSB0 [ 1144.965606][T27080] usb 11-1: USB disconnect, device number 31 [ 1144.971366][T27080] mos7840 ttyUSB0: Moschip 7840/7820 USB Serial Driver converter now disconnected from ttyUSB0 [ 1144.977087][T27080] mos7840 11-1:1.0: device disconnected [ 1146.085834][T15727] IPVS: starting estimator thread 0... [ 1146.180223][T28146] IPVS: using max 46 ests per chain, 110400 per kthread [ 1146.219803][T28150] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6608'. [ 1146.318135][T28152] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6609'. [ 1146.429414][T28161] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6612'. [ 1146.429658][T28161] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6612'. [ 1146.806243][T28176] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6619'. [ 1147.199965][T28189] netlink: 'syz.6.6623': attribute type 1 has an invalid length. [ 1147.284844][T28193] svc: failed to register nfsdv3 RPC service (errno 111). [ 1147.286931][T28193] svc: failed to register nfsaclv3 RPC service (errno 111). [ 1147.286943][T28193] failed to unregister tcp with rpcbind [ 1147.287053][T28193] svc: failed to register nfsdv3 RPC service (errno 97). [ 1147.287063][T28193] svc: failed to register nfsaclv3 RPC service (errno 97). [ 1147.287070][T28193] failed to unregister tcp with rpcbind [ 1147.443643][T28201] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6628'. [ 1147.587384][T28211] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6631'. [ 1148.417289][T28231] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6637'. [ 1149.094987][T27080] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 1149.257961][T27080] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1149.259015][T27080] usb 9-1: config 0 has no interfaces? [ 1149.259032][T27080] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1149.266572][T27080] usb 9-1: config 0 descriptor?? [ 1149.394326][T28252] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input27 [ 1149.489046][T27080] usb 9-1: USB disconnect, device number 19 [ 1149.539222][T28254] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6647'. [ 1149.972620][T27080] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 1150.140964][T27080] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1150.141433][T27080] usb 9-1: config 0 has no interfaces? [ 1150.141452][T27080] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1150.143133][T27080] usb 9-1: config 0 descriptor?? [ 1150.177709][T28267] FAULT_INJECTION: forcing a failure. [ 1150.177709][T28267] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1150.177735][T28267] CPU: 2 UID: 0 PID: 28267 Comm: syz.0.6651 Tainted: G L syzkaller #0 PREEMPT(full) [ 1150.177752][T28267] Tainted: [L]=SOFTLOCKUP [ 1150.177757][T28267] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1150.177766][T28267] Call Trace: [ 1150.177770][T28267] [ 1150.177776][T28267] dump_stack_lvl+0x100/0x190 [ 1150.177796][T28267] should_fail_ex.cold+0x5/0xa [ 1150.177811][T28267] ? prepare_alloc_pages+0x16d/0x5b0 [ 1150.177830][T28267] should_fail_alloc_page+0xeb/0x140 [ 1150.177849][T28267] prepare_alloc_pages+0x1f0/0x5b0 [ 1150.177868][T28267] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 1150.177883][T28267] ? prepare_alloc_pages+0x1b1/0x5b0 [ 1150.177898][T28267] ? is_bpf_text_address+0x94/0x1a0 [ 1150.177916][T28267] ? rcu_is_watching+0x13/0xc0 [ 1150.177929][T28267] ? __alloc_frozen_pages_noprof+0x56b/0x3300 [ 1150.177944][T28267] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1150.177960][T28267] ? stack_trace_save+0x8e/0xc0 [ 1150.177975][T28267] ? __pfx_stack_trace_save+0x10/0x10 [ 1150.177989][T28267] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1150.178005][T28267] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1150.178021][T28267] ? kasan_save_track+0x14/0x30 [ 1150.178035][T28267] ? __kasan_slab_alloc+0x89/0x90 [ 1150.178049][T28267] ? kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 1150.178062][T28267] ? alloc_vmap_area+0x1814/0x2bb0 [ 1150.178076][T28267] ? vm_map_ram+0x745/0xf80 [ 1150.178089][T28267] ? fuse_readdir_uncached+0x858/0x1c00 [ 1150.178105][T28267] ? fuse_readdir+0x9bb/0x1f20 [ 1150.178120][T28267] ? iterate_dir+0x296/0xae0 [ 1150.178130][T28267] ? __ia32_sys_getdents64+0x13a/0x2c0 [ 1150.178149][T28267] ? __do_fast_syscall_32+0x13a/0x8b0 [ 1150.178163][T28267] ? do_fast_syscall_32+0x32/0x70 [ 1150.178177][T28267] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1150.178197][T28267] alloc_pages_bulk_noprof+0x5e1/0x13c0 [ 1150.178214][T28267] ? policy_nodemask+0xed/0x4f0 [ 1150.178234][T28267] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 1150.178257][T28267] __kasan_populate_vmalloc+0xf0/0x210 [ 1150.178274][T28267] alloc_vmap_area+0x95d/0x2bb0 [ 1150.178294][T28267] ? kasan_save_track+0x14/0x30 [ 1150.178308][T28267] ? __kasan_kmalloc+0xaa/0xb0 [ 1150.178322][T28267] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1150.178337][T28267] ? vm_map_ram+0x31d/0xf80 [ 1150.178351][T28267] ? vm_map_ram+0x6d9/0xf80 [ 1150.178366][T28267] vm_map_ram+0x745/0xf80 [ 1150.178384][T28267] fuse_readdir_uncached+0x858/0x1c00 [ 1150.178406][T28267] ? lock_acquire+0x1d1/0x380 [ 1150.178442][T28267] ? futex_unqueue+0x29/0x2c0 [ 1150.178455][T28267] ? __pfx_fuse_readdir_uncached+0x10/0x10 [ 1150.178472][T28267] ? find_held_lock+0x2b/0x80 [ 1150.178573][T28267] ? __lock_acquire+0x5c0/0x1f40 [ 1150.178594][T28267] ? futex_unqueue+0x13d/0x2c0 [ 1150.178609][T28267] ? look_up_lock_class+0x55/0x120 [ 1150.178628][T28267] ? register_lock_class+0x3f/0x7b0 [ 1150.178650][T28267] ? look_up_lock_class+0x55/0x120 [ 1150.178676][T28267] ? find_held_lock+0x2b/0x80 [ 1150.178689][T28267] ? fuse_readdir+0x9a7/0x1f20 [ 1150.178704][T28267] ? fuse_readdir+0x9a7/0x1f20 [ 1150.178723][T28267] fuse_readdir+0x9bb/0x1f20 [ 1150.178747][T28267] iterate_dir+0x296/0xae0 [ 1150.178762][T28267] __ia32_sys_getdents64+0x13a/0x2c0 [ 1150.178777][T28267] ? __pfx___ia32_sys_getdents64+0x10/0x10 [ 1150.178790][T28267] ? xfd_validate_state+0x129/0x190 [ 1150.178808][T28267] ? __pfx_filldir64+0x10/0x10 [ 1150.178825][T28267] __do_fast_syscall_32+0x13a/0x8b0 [ 1150.178838][T28267] ? lockdep_hardirqs_on+0x7d/0x110 [ 1150.178851][T28267] do_fast_syscall_32+0x32/0x70 [ 1150.178864][T28267] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1150.178878][T28267] RIP: 0023:0xf7fd3fec [ 1150.178894][T28267] Code: Unable to access opcode bytes at 0xf7fd3fc2. [ 1150.178899][T28267] RSP: 002b:00000000f547550c EFLAGS: 00000292 ORIG_RAX: 00000000000000dc [ 1150.178911][T28267] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000 [ 1150.178918][T28267] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1150.178925][T28267] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1150.178931][T28267] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1150.178939][T28267] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1150.178973][T28267] [ 1150.227249][T28269] fuse: Bad value for 'fd' [ 1150.369051][T28243] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1150.369268][T28243] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1150.376817][T27080] usb 9-1: USB disconnect, device number 20 [ 1150.495987][T28275] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6656'. [ 1150.595317][T28287] rnbd_client L213: map_device: Parameters missing [ 1150.658479][T28291] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2182154216 (4364308432 ns) > initial count (507749598 ns). Using initial count to start timer. [ 1150.861283][T27080] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 1151.037657][T27080] usb 9-1: New USB device found, idVendor=08fd, idProduct=0002, bcdDevice= 0.00 [ 1151.038814][T27080] usb 9-1: config index 0 descriptor too short (expected 53, got 36) [ 1151.038829][T27080] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1151.038849][T27080] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 1151.038862][T27080] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1151.038881][T27080] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1151.090468][T28305] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6666'. [ 1151.263802][ T65] usb 9-1: USB disconnect, device number 21 [ 1151.263865][ C3] Bluetooth: hci3: urb ffff888024c21e00 failed to resubmit (19) [ 1151.939048][T28323] bridge0: port 2(bridge_slave_1) entered disabled state [ 1152.009268][T28330] gtp0: entered allmulticast mode [ 1152.015073][T28331] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6680'. [ 1152.080963][T28333] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6675'. [ 1152.270331][T28347] netlink: 140 bytes leftover after parsing attributes in process `syz.4.6682'. [ 1152.776975][T24693] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 1153.223250][T28364] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6686'. [ 1153.321429][T24693] Bluetooth: hci3: command 0xfc0e tx timeout [ 1153.502605][T28368] FAULT_INJECTION: forcing a failure. [ 1153.502605][T28368] name failslab, interval 1, probability 0, space 0, times 0 [ 1153.502632][T28368] CPU: 0 UID: 0 PID: 28368 Comm: syz.4.6689 Tainted: G L syzkaller #0 PREEMPT(full) [ 1153.502653][T28368] Tainted: [L]=SOFTLOCKUP [ 1153.502658][T28368] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1153.502668][T28368] Call Trace: [ 1153.502673][T28368] [ 1153.502680][T28368] dump_stack_lvl+0x100/0x190 [ 1153.502703][T28368] should_fail_ex.cold+0x5/0xa [ 1153.502724][T28368] should_failslab+0xc2/0x120 [ 1153.502744][T28368] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1153.502777][T28368] ? key_alloc+0xb8b/0x1310 [ 1153.502790][T28368] ? key_alloc+0xc0f/0x1310 [ 1153.502804][T28368] key_alloc+0xc0f/0x1310 [ 1153.502818][T28368] ? keyctl_get_persistent+0x536/0x8b0 [ 1153.502833][T28368] ? __pfx_key_alloc+0x10/0x10 [ 1153.502851][T28368] keyring_alloc+0x44/0xc0 [ 1153.502867][T28368] keyctl_get_persistent+0x6c7/0x8b0 [ 1153.502884][T28368] ? __pfx_keyctl_get_persistent+0x10/0x10 [ 1153.502896][T28368] ? __fget_files+0x21f/0x3d0 [ 1153.502913][T28368] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 1153.502956][T28368] __ia32_compat_sys_keyctl+0x38f/0x550 [ 1153.502975][T28368] __do_fast_syscall_32+0x13a/0x8b0 [ 1153.502993][T28368] do_fast_syscall_32+0x32/0x70 [ 1153.503009][T28368] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1153.503025][T28368] RIP: 0023:0xf7f23fec [ 1153.503040][T28368] Code: Unable to access opcode bytes at 0xf7f23fc2. [ 1153.503046][T28368] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000120 [ 1153.503059][T28368] RAX: ffffffffffffffda RBX: 0000000000000016 RCX: 0000000000000000 [ 1153.503068][T28368] RDX: 000000001ddec3ac RSI: 0000000000000000 RDI: 0000000000000000 [ 1153.503075][T28368] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1153.503082][T28368] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1153.503089][T28368] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1153.503115][T28368] [ 1153.860553][T28381] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6696'. [ 1154.582376][T28399] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 1154.582394][T28399] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1154.583201][T28399] vhci_hcd vhci_hcd.0: Device attached [ 1154.838508][ T5887] usb 37-1: new high-speed USB device number 2 using vhci_hcd [ 1155.013080][T28411] input: syz0 as /devices/virtual/input/input28 [ 1155.093398][T28415] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6706'. [ 1155.136016][T28403] vhci_hcd: connection reset by peer [ 1155.138405][T20723] vhci_hcd vhci_hcd.0: stop threads [ 1155.138424][T20723] vhci_hcd vhci_hcd.0: release socket [ 1155.138453][T20723] vhci_hcd vhci_hcd.0: disconnect device [ 1155.139771][T28417] netlink: 140 bytes leftover after parsing attributes in process `syz.7.6707'. [ 1155.488942][T27080] usb 12-1: new full-speed USB device number 5 using dummy_hcd [ 1155.654459][T27080] usb 12-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 1155.660747][T27080] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1155.660773][T27080] usb 12-1: Product: syz [ 1155.660786][T27080] usb 12-1: Manufacturer: syz [ 1155.660799][T27080] usb 12-1: SerialNumber: syz [ 1155.899978][T27080] usb 12-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1155.906186][T27080] usb 12-1: unit 4 not found! [ 1155.990737][T27080] usb 12-1: USB disconnect, device number 5 [ 1156.090525][ T5755] udevd[5755]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb12/12-1/12-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1156.298415][T28436] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6715'. [ 1156.789529][T28457] No source specified [ 1156.990012][T28470] syzkaller1: entered promiscuous mode [ 1156.990028][T28470] syzkaller1: entered allmulticast mode [ 1156.991503][T28463] futex_wake_op: syz.0.6726 tries to shift op by 144; fix this program [ 1156.991592][T28463] futex_wake_op: syz.0.6726 tries to shift op by 144; fix this program [ 1157.335112][T28483] openvswitch: netlink: IPv4 tunnel dst address is zero [ 1157.335136][T28483] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1157.697714][T28495] No source specified [ 1158.818764][T28522] sg_write: data in/out 768/2 bytes for SCSI command 0x0-- guessing data in; [ 1158.818764][T28522] program syz.4.6747 not setting count and/or reply_len properly [ 1158.959244][T28528] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6748'. [ 1159.305330][ T5818] usb 12-1: new high-speed USB device number 6 using dummy_hcd [ 1159.478735][ T5818] usb 12-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 1159.479751][ T5818] usb 12-1: config 0 has an invalid interface number: 50 but max is 0 [ 1159.479767][ T5818] usb 12-1: config 0 has no interface number 0 [ 1159.479793][ T5818] usb 12-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1159.481716][ T5818] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1159.481731][ T5818] usb 12-1: Product: syz [ 1159.481739][ T5818] usb 12-1: Manufacturer: syz [ 1159.481746][ T5818] usb 12-1: SerialNumber: syz [ 1159.484248][ T5818] usb 12-1: config 0 descriptor?? [ 1159.491455][ T5818] yurex 12-1:0.50: USB YUREX device now attached to Yurex #0 [ 1159.771540][T28528] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1159.771845][T28528] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1159.874197][T28548] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6756'. [ 1160.390979][T28563] JFS: discard option not supported on device [ 1160.393619][T28563] Mount JFS Failure: -5 [ 1160.393632][T28563] jfs_mount failed w/return code = -5 [ 1160.411737][ T5887] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 1160.687074][T28570] FAULT_INJECTION: forcing a failure. [ 1160.687074][T28570] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1160.687096][T28570] CPU: 2 UID: 0 PID: 28570 Comm: syz.0.6763 Tainted: G L syzkaller #0 PREEMPT(full) [ 1160.687112][T28570] Tainted: [L]=SOFTLOCKUP [ 1160.687117][T28570] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1160.687125][T28570] Call Trace: [ 1160.687130][T28570] [ 1160.687135][T28570] dump_stack_lvl+0x100/0x190 [ 1160.687155][T28570] should_fail_ex.cold+0x5/0xa [ 1160.687171][T28570] _copy_to_user+0x32/0xd0 [ 1160.687189][T28570] bpf_vlog_reverse_ubuf+0x2c3/0x470 [ 1160.687213][T28570] bpf_vlog_finalize+0x271/0x360 [ 1160.687226][T28570] bpf_log_attr_finalize+0x86/0x1a0 [ 1160.687239][T28570] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 1160.687256][T28570] btf_new_fd+0x9c7/0x5bc0 [ 1160.687272][T28570] ? __lock_acquire+0x5c0/0x1f40 [ 1160.687291][T28570] ? __lock_acquire+0x5c0/0x1f40 [ 1160.687311][T28570] ? __pfx_btf_new_fd+0x10/0x10 [ 1160.687329][T28570] ? lock_acquire+0x1d1/0x380 [ 1160.687345][T28570] ? rcu_is_watching+0x13/0xc0 [ 1160.687357][T28570] ? apparmor_capable+0x1d7/0x4d0 [ 1160.687375][T28570] ? bpf_lsm_capable+0x9/0x10 [ 1160.687390][T28570] ? security_capable+0x80/0x260 [ 1160.687410][T28570] ? ns_capable+0xd2/0xf0 [ 1160.687430][T28570] __sys_bpf+0x13ef/0x4a30 [ 1160.687448][T28570] ? __pfx___sys_bpf+0x10/0x10 [ 1160.687461][T28570] ? find_held_lock+0x2b/0x80 [ 1160.687474][T28570] ? futex_wake+0x4ea/0x5e0 [ 1160.687502][T28570] ? rcu_read_lock_any_held+0x6a/0x90 [ 1160.687516][T28570] ? find_held_lock+0x2b/0x80 [ 1160.687528][T28570] ? ksys_write+0x190/0x250 [ 1160.687540][T28570] ? ksys_write+0x190/0x250 [ 1160.687560][T28570] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 1160.687574][T28570] ? xfd_validate_state+0x129/0x190 [ 1160.687595][T28570] ? __ia32_sys_bpf+0xcc/0x170 [ 1160.687607][T28570] __ia32_sys_bpf+0xcc/0x170 [ 1160.687620][T28570] ? __do_fast_syscall_32+0xb3/0x8b0 [ 1160.687635][T28570] __do_fast_syscall_32+0x13a/0x8b0 [ 1160.687650][T28570] do_fast_syscall_32+0x32/0x70 [ 1160.687663][T28570] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1160.687678][T28570] RIP: 0023:0xf7fd3fec [ 1160.687691][T28570] Code: Unable to access opcode bytes at 0xf7fd3fc2. [ 1160.687697][T28570] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1160.687711][T28570] RAX: ffffffffffffffda RBX: 0000000000000012 RCX: 0000000080000180 [ 1160.687718][T28570] RDX: 0000000000000028 RSI: 0000000000000000 RDI: 0000000000000000 [ 1160.687725][T28570] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1160.687732][T28570] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1160.687739][T28570] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1160.687753][T28570] [ 1160.979316][T28574] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6765'. [ 1161.211947][T28586] sctp: [Deprecated]: syz.0.6769 (pid 28586) Use of int in maxseg socket option. [ 1161.211947][T28586] Use struct sctp_assoc_value instead [ 1161.754186][T28601] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6775'. [ 1161.913473][ C0] usb 12-1: yurex_control_callback - control failed: -2 [ 1161.984934][ T5887] usb 12-1: USB disconnect, device number 6 [ 1161.989107][ T5887] yurex 12-1:0.50: USB YUREX #0 now disconnected [ 1162.129422][T24693] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1162.130362][T24693] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1162.134545][T24693] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1162.161542][T24693] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1162.164916][T24693] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1162.619098][T28611] bridge0: port 1(bridge_slave_0) entered blocking state [ 1162.619184][T28611] bridge0: port 1(bridge_slave_0) entered disabled state [ 1162.619246][T28611] bridge_slave_0: entered allmulticast mode [ 1162.620036][T28611] bridge_slave_0: entered promiscuous mode [ 1162.621303][T28611] bridge0: port 2(bridge_slave_1) entered blocking state [ 1162.621376][T28611] bridge0: port 2(bridge_slave_1) entered disabled state [ 1162.621433][T28611] bridge_slave_1: entered allmulticast mode [ 1162.622175][T28611] bridge_slave_1: entered promiscuous mode [ 1162.635211][T28611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1162.637057][T28611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1162.649499][T28611] team0: Port device team_slave_0 added [ 1162.650746][T28611] team0: Port device team_slave_1 added [ 1162.663563][T28611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1162.663575][T28611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1162.663589][T28611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1162.664420][T28611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1162.664428][T28611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1162.664442][T28611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1162.683268][T28611] hsr_slave_0: entered promiscuous mode [ 1162.683676][T28611] hsr_slave_1: entered promiscuous mode [ 1162.683963][T28611] debugfs: 'hsr0' already exists in 'hsr' [ 1162.683976][T28611] Cannot create hsr debugfs directory [ 1162.769893][T28611] netdevsim netdevsim6 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1162.861050][T28611] netdevsim netdevsim6 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1162.958079][T28611] netdevsim netdevsim6 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1163.001023][T28634] gadgetfs: bound to dummy_udc driver [ 1163.058313][T28611] netdevsim netdevsim6 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1163.180751][T28611] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1163.182847][T28611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1163.183327][T28611] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1163.205073][T28611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1163.208424][T28611] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1163.210309][T28611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1163.210776][T28611] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1163.228675][T28611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1163.251306][T28611] bridge0: port 2(bridge_slave_1) entered blocking state [ 1163.251360][T28611] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1163.251503][T28611] bridge0: port 1(bridge_slave_0) entered blocking state [ 1163.251547][T28611] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1163.317838][T28611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1163.329933][T28611] 8021q: adding VLAN 0 to HW filter on device team0 [ 1163.450628][T28649] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6784'. [ 1164.409480][ T5745] Bluetooth: hci3: command tx timeout [ 1164.484164][T28611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1164.602206][T28694] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6795'. [ 1164.716766][T28611] veth0_vlan: entered promiscuous mode [ 1164.722074][T28611] veth1_vlan: entered promiscuous mode [ 1164.746542][T28704] [ 1164.746695][T28611] veth0_macvtap: entered promiscuous mode [ 1164.748154][T28611] veth1_macvtap: entered promiscuous mode [ 1164.751298][T28704] ====================================================== [ 1164.752959][T28611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1164.755541][T28611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1164.758590][T28704] WARNING: possible circular locking dependency detected [ 1164.760746][T28704] syzkaller #0 Tainted: G L [ 1164.762733][T28704] ------------------------------------------------------ [ 1164.765524][T28704] syz.4.6800/28704 is trying to acquire lock: [ 1164.767529][T28704] ffffffff90400e68 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x650 [ 1164.771245][T28704] [ 1164.771245][T28704] but task is already holding lock: [ 1164.774488][T28704] ffff888013095200 (&sb->s_type->i_mutex_key#34){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 1164.778835][T28704] [ 1164.778835][T28704] which lock already depends on the new lock. [ 1164.778835][T28704] [ 1164.783433][T28704] [ 1164.783433][T28704] the existing dependency chain (in reverse order) is: [ 1164.787164][T28704] [ 1164.787164][T28704] -> #3 (&sb->s_type->i_mutex_key#34){++++}-{4:4}: [ 1164.790913][T28704] lock_acquire+0x1d1/0x380 [ 1164.793467][T28704] down_write+0x8b/0x1f0 [ 1164.795556][T28704] configfs_depend_item_unlocked+0xf3/0x6a0 [ 1164.797905][T28704] usbg_make_tpg+0x251/0x610 [ 1164.800423][T28704] target_fabric_make_tpg+0xab/0x8c0 [ 1164.803357][T28704] configfs_mkdir+0x525/0xd40 [ 1164.805573][T28704] vfs_mkdir+0x364/0x850 [ 1164.807602][T28704] filename_mkdirat+0x48b/0x5e0 [ 1164.809867][T28704] __ia32_sys_mkdirat+0x88/0xc0 [ 1164.812185][T28704] __do_fast_syscall_32+0x13a/0x8b0 [ 1164.814592][T28704] do_fast_syscall_32+0x32/0x70 [ 1164.816881][T28704] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1164.819746][T28704] [ 1164.819746][T28704] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 1164.823104][T28704] lock_acquire+0x1d1/0x380 [ 1164.825291][T28704] __mutex_lock+0x1a4/0x1bd0 [ 1164.827461][T28704] tcm_alloc_inst+0x5f/0x1e0 [ 1164.829078][T28704] try_get_usb_function_instance+0x136/0x1f0 [ 1164.831245][T28704] usb_get_function_instance+0x16/0x70 [ 1164.833350][T28704] function_make+0x18c/0x3f0 [ 1164.835256][T28704] configfs_mkdir+0x525/0xd40 [ 1164.837809][T28704] vfs_mkdir+0x364/0x850 [ 1164.840043][T28704] filename_mkdirat+0x48b/0x5e0 [ 1164.841805][T28704] __ia32_sys_mkdirat+0x88/0xc0 [ 1164.843587][T28704] __do_fast_syscall_32+0x13a/0x8b0 [ 1164.845421][T28704] do_fast_syscall_32+0x32/0x70 [ 1164.847160][T28704] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1164.849323][T28704] [ 1164.849323][T28704] -> #1 (func_lock){+.+.}-{4:4}: [ 1164.851605][T28704] lock_acquire+0x1d1/0x380 [ 1164.853247][T28704] __mutex_lock+0x1a4/0x1bd0 [ 1164.854877][T28704] try_get_usb_function_instance+0x26/0x1f0 [ 1164.857032][T28704] usb_get_function_instance+0x16/0x70 [ 1164.859026][T28704] function_make+0x18c/0x3f0 [ 1164.860727][T28704] configfs_mkdir+0x525/0xd40 [ 1164.862476][T28704] vfs_mkdir+0x364/0x850 [ 1164.864062][T28704] filename_mkdirat+0x48b/0x5e0 [ 1164.865803][T28704] __ia32_sys_mkdirat+0x88/0xc0 [ 1164.867544][T28704] __do_fast_syscall_32+0x13a/0x8b0 [ 1164.869357][T28704] do_fast_syscall_32+0x32/0x70 [ 1164.871067][T28704] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1164.873442][T28704] [ 1164.873442][T28704] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 1164.876472][T28704] check_prev_add+0xeb/0xe60 [ 1164.878349][T28704] __lock_acquire+0x1528/0x1f40 [ 1164.880209][T28704] lock_acquire+0x1d1/0x380 [ 1164.881898][T28704] __mutex_lock+0x1a4/0x1bd0 [ 1164.883662][T28704] uvcg_streaming_header_allow_link+0x7c/0x650 [ 1164.885974][T28704] configfs_symlink+0x695/0x1340 [ 1164.887750][T28704] vfs_symlink+0x178/0x4d0 [ 1164.889343][T28704] filename_symlinkat+0x2a6/0x560 [ 1164.891121][T28704] __ia32_sys_symlinkat+0x9b/0xe0 [ 1164.892969][T28704] __do_fast_syscall_32+0x13a/0x8b0 [ 1164.894787][T28704] do_fast_syscall_32+0x32/0x70 [ 1164.896595][T28704] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1164.898877][T28704] [ 1164.898877][T28704] other info that might help us debug this: [ 1164.898877][T28704] [ 1164.902174][T28704] Chain exists of: [ 1164.902174][T28704] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#34 [ 1164.902174][T28704] [ 1164.907089][T28704] Possible unsafe locking scenario: [ 1164.907089][T28704] [ 1164.909415][T28704] CPU0 CPU1 [ 1164.911135][T28704] ---- ---- [ 1164.912940][T28704] lock(&sb->s_type->i_mutex_key#34); [ 1164.914784][T28704] lock(tpg_instances_lock); [ 1164.917361][T28704] lock(&sb->s_type->i_mutex_key#34); [ 1164.920013][T28704] lock(gadget_subsys.su_mutex); [ 1164.921605][T28704] [ 1164.921605][T28704] *** DEADLOCK *** [ 1164.921605][T28704] [ 1164.924221][T28704] locks held by syz.4.6800/28704: 2, last CPU#0: [ 1164.926486][T28704] #0: ffff8880224b6460 (sb_writers#18){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 1164.930357][T28704] #1: ffff888013095200 (&sb->s_type->i_mutex_key#34){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 1164.934655][T28704] [ 1164.934655][T28704] stack backtrace: [ 1164.936710][T28704] CPU: 0 UID: 0 PID: 28704 Comm: syz.4.6800 Tainted: G L syzkaller #0 PREEMPT(full) [ 1164.940120][T28704] Tainted: [L]=SOFTLOCKUP [ 1164.941667][T28704] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1164.944873][T28704] Call Trace: [ 1164.946032][T28704] [ 1164.947019][T28704] dump_stack_lvl+0x100/0x190 [ 1164.948551][T28704] print_circular_bug.cold+0x178/0x1be [ 1164.950292][T28704] check_noncircular+0x146/0x160 [ 1164.951881][T28704] check_prev_add+0xeb/0xe60 [ 1164.953370][T28704] ? stack_trace_save+0x8e/0xc0 [ 1164.954963][T28704] __lock_acquire+0x1528/0x1f40 [ 1164.956832][T28704] ? kasan_save_track+0x14/0x30 [ 1164.958751][T28704] ? kasan_save_free_info+0x3b/0x70 [ 1164.960480][T28704] lock_acquire+0x1d1/0x380 [ 1164.961987][T28704] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 1164.964120][T28704] ? __pfx___might_resched+0x10/0x10 [ 1164.966065][T28704] __mutex_lock+0x1a4/0x1bd0 [ 1164.968129][T28704] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 1164.970933][T28704] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 1164.973739][T28704] ? __lock_acquire+0x5c0/0x1f40 [ 1164.975932][T28704] ? __pfx___mutex_lock+0x10/0x10 [ 1164.978183][T28704] ? make_vfsuid+0xec/0x140 [ 1164.980199][T28704] ? __pfx___might_resched+0x10/0x10 [ 1164.981954][T28704] ? make_vfsgid+0xf1/0x140 [ 1164.983463][T28704] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 1164.985573][T28704] ? security_inode_permission+0xbf/0x250 [ 1164.987411][T28704] uvcg_streaming_header_allow_link+0x7c/0x650 [ 1164.989353][T28704] ? inode_permission+0x374/0x620 [ 1164.990980][T28704] ? mntput_no_expire+0xe7/0x220 [ 1164.992587][T28704] configfs_symlink+0x695/0x1340 [ 1164.994156][T28704] ? bpf_lsm_inode_permission+0x9/0x10 [ 1164.995918][T28704] ? security_inode_permission+0xbf/0x250 [ 1164.997747][T28704] ? __pfx_configfs_symlink+0x10/0x10 [ 1164.999455][T28704] vfs_symlink+0x178/0x4d0 [ 1165.000880][T28704] filename_symlinkat+0x2a6/0x560 [ 1165.002484][T28704] ? __pfx_filename_symlinkat+0x10/0x10 [ 1165.004289][T28704] ? strncpy_from_user+0x19d/0x2d0 [ 1165.006186][T28704] ? do_getname+0x191/0x390 [ 1165.007794][T28704] __ia32_sys_symlinkat+0x9b/0xe0 [ 1165.009405][T28704] __do_fast_syscall_32+0x13a/0x8b0 [ 1165.011098][T28704] do_fast_syscall_32+0x32/0x70 [ 1165.012720][T28704] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1165.014706][T28704] RIP: 0023:0xf7f23fec [ 1165.016046][T28704] Code: Unable to access opcode bytes at 0xf7f23fc2. [ 1165.018188][T28704] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000130 [ 1165.020820][T28704] RAX: ffffffffffffffda RBX: 0000000080000380 RCX: 00000000ffffff9c [ 1165.023353][T28704] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 1165.025996][T28704] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1165.029149][T28704] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1165.031975][T28704] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1165.034507][T28704] [ 1165.055659][T28611] ieee80211 phy52: Selected rate control algorithm 'minstrel_ht' SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1165.065111][T28611] ieee80211 phy53: Selected rate control algorithm 'minstrel_ht' [ 1165.066473][T15726] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1165.066485][T15726] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1165.078382][T20723] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1165.078416][T20723] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1165.078438][T20723] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1165.078455][T20723] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1165.347282][T26951] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1165.432248][T26951] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1165.548806][T26951] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1165.614531][T26951] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1165.709482][T26951] bridge_slave_1: left allmulticast mode [ 1165.709498][T26951] bridge_slave_1: left promiscuous mode [ 1165.709571][T26951] bridge0: port 2(bridge_slave_1) entered disabled state [ 1165.710644][T26951] bridge_slave_0: left allmulticast mode [ 1165.710658][T26951] bridge_slave_0: left promiscuous mode [ 1165.710737][T26951] bridge0: port 1(bridge_slave_0) entered disabled state [ 1165.907744][T26951] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1165.908697][T26951] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1165.909256][T26951] bond0 (unregistering): Released all slaves [ 1166.013121][ T5450] 8021q: adding VLAN 0 to HW filter on device eth18 [ 1166.115394][T26951] hsr_slave_0: left promiscuous mode [ 1166.115795][T26951] hsr_slave_1: left promiscuous mode [ 1166.116039][T26951] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1166.116049][T26951] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1166.116372][T26951] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1166.116381][T26951] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1166.118058][T26951] veth1_macvtap: left promiscuous mode [ 1166.118083][T26951] veth0_macvtap: left promiscuous mode [ 1166.118115][T26951] veth1_vlan: left promiscuous mode [ 1166.118136][T26951] veth0_vlan: left promiscuous mode [ 1166.177130][T26951] team0 (unregistering): Port device team_slave_1 removed [ 1166.179226][T26951] team0 (unregistering): Port device team_slave_0 removed [ 1166.212623][ T5450] 8021q: adding VLAN 0 to HW filter on device eth19 [ 1166.344824][ T5450] 8021q: adding VLAN 0 to HW filter on device eth20 [ 1166.439429][ T5450] 8021q: adding VLAN 0 to HW filter on device eth21 [ 1166.471480][T26951] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1166.514326][T26951] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1166.579474][T26951] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1166.623672][T26951] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1166.678502][T26951] bridge_slave_1: left allmulticast mode [ 1166.678530][T26951] bridge_slave_1: left promiscuous mode [ 1166.678619][T26951] bridge0: port 2(bridge_slave_1) entered disabled state [ 1166.680937][T26951] bridge_slave_0: left allmulticast mode [ 1166.680952][T26951] bridge_slave_0: left promiscuous mode [ 1166.681036][T26951] bridge0: port 1(bridge_slave_0) entered disabled state [ 1166.734476][T26951] bond4 (unregistering): (slave bridge2): Releasing backup interface [ 1166.734495][T26951] bridge2 (unregistering): left promiscuous mode [ 1166.744313][T26951] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1166.745168][T26951] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1166.745704][T26951] bond0 (unregistering): Released all slaves [ 1166.746899][T26951] bond1 (unregistering): Released all slaves [ 1166.748908][T26951] bond2 (unregistering): Released all slaves [ 1166.752948][T26951] bond3 (unregistering): Released all slaves [ 1166.755456][T26951] bond4 (unregistering): Released all slaves [ 1166.757317][T26951] bond5 (unregistering): Released all slaves [ 1166.760595][T26951] bond6 (unregistering): left allmulticast mode [ 1166.760609][T26951] bond6 (unregistering): left promiscuous mode [ 1166.764711][T26951] team0: Port device macvlan2 removed [ 1166.768703][T26951] bond6 (unregistering): Released all slaves [ 1166.801023][T26951] tipc: Left network mode [ 1166.858994][ T5450] 8021q: adding VLAN 0 to HW filter on device eth22 [ 1166.956018][ T5450] 8021q: adding VLAN 0 to HW filter on device eth23 [ 1167.058176][T26951] hsr_slave_0: left promiscuous mode [ 1167.058508][T26951] hsr_slave_1: left promiscuous mode [ 1167.058751][T26951] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1167.058761][T26951] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1167.059214][T26951] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1167.059223][T26951] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1167.061071][T26951] veth1_macvtap: left promiscuous mode [ 1167.061096][T26951] veth0_macvtap: left promiscuous mode [ 1167.061135][T26951] veth1_vlan: left promiscuous mode [ 1167.061166][T26951] veth0_vlan: left promiscuous mode [ 1167.144377][T26951] team0 (unregistering): Port device team_slave_1 removed [ 1167.146643][T26951] team0 (unregistering): Port device team_slave_0 removed [ 1167.192302][ T5450] 8021q: adding VLAN 0 to HW filter on device eth24 [ 1167.351558][ T5450] 8021q: adding VLAN 0 to HW filter on device eth25 [ 1167.397733][T26951] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1168.097001][T26951] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1168.152436][T26951] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1168.218167][T26951] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1168.272277][T26951] bridge_slave_1: left allmulticast mode [ 1168.272292][T26951] bridge_slave_1: left promiscuous mode [ 1168.272377][T26951] bridge0: port 2(bridge_slave_1) entered disabled state [ 1168.276051][T26951] bridge_slave_0: left allmulticast mode [ 1168.276071][T26951] bridge_slave_0: left promiscuous mode [ 1168.276187][T26951] bridge0: port 1(bridge_slave_0) entered disabled state [ 1168.308167][T26951] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1168.309129][T26951] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1168.312519][T26951] bond0 (unregistering): Released all slaves [ 1168.435472][ T5450] 8021q: adding VLAN 0 to HW filter on device eth26 [ 1168.533213][ T5450] 8021q: adding VLAN 0 to HW filter on device eth27 [ 1168.577319][T26951] hsr_slave_0: left promiscuous mode [ 1168.577718][T26951] hsr_slave_1: left promiscuous mode [ 1168.578004][T26951] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1168.578015][T26951] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1168.578388][T26951] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1168.578401][T26951] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1168.580615][T26951] veth1_macvtap: left promiscuous mode [ 1168.580640][T26951] veth0_macvtap: left promiscuous mode [ 1168.583236][T26951] veth1_vlan: left promiscuous mode [ 1168.583295][T26951] veth0_vlan: left promiscuous mode [ 1168.658857][T26951] team0 (unregistering): Port device team_slave_1 removed [ 1168.661066][T26951] team0 (unregistering): Port device team_slave_0 removed [ 1168.689948][ T5450] 8021q: adding VLAN 0 to HW filter on device eth28 [ 1168.807906][ T5450] 8021q: adding VLAN 0 to HW filter on device eth29