last executing test programs: 7m43.56886729s ago: executing program 1 (id=319): r0 = openat$vcsu(0xffffff9c, 0x0, 0xd3e8f6c8fd92ec51, 0x0) write$P9_RLERROR(r0, &(0x7f0000000100)={0xffffffb1, 0x7, 0x1, {0xa, '/dev/vcsu\x00'}}, 0x13) (async) r1 = socket$alg(0x26, 0x5, 0x0) (async) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x7, 0xfe, 0x7fff0006}]}) (async) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000008c0)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x38, r5, 0x1, 0xfffffffc, 0x25dfdbfc, {{}, {@void, @void, @val={0xc, 0x99, {0x4, 0x77}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}]]}, 0x38}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r6) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000480)={0x0, 0x112, &(0x7f0000000580)={&(0x7f00000002c0)={0x28, r7, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4000054) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x3e, r2, 0x2}) mmap$IORING_OFF_SQ_RING(0x0, 0x1004, 0x200000a, 0x12, r8, 0x0) (async) bind$alg(r1, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5800000002060108000000000000000000000000050005000a000040050001000700000005000400000000000900020073797a310000000014000300686173683a69702c706f72742c6970"], 0x58}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) (async) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r9 = socket$netlink(0x10, 0x3, 0xc) syz_usb_disconnect(0xffffffffffffffff) (async) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000000706fb410000000000000000000000000500010006000000"], 0x1c}}, 0x0) (async) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040341a02080000000000010902"], 0x0) (async) close_range(r11, 0xffffffffffffffff, 0x0) 7m42.828428262s ago: executing program 1 (id=328): r0 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000002000/0x2000)=nil) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB=' \x00\x00\x00i\x00\v'], 0x20}}, 0x4000000) 7m42.779184303s ago: executing program 1 (id=330): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newnexthop={0x2c, 0x68, 0x501, 0x70bd2d, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x3}, @NHA_GROUP={0xc, 0x2, [{0x1, 0x6b}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040}, 0x0) 7m42.686052878s ago: executing program 1 (id=331): symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') unlink(&(0x7f00000002c0)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) syz_open_dev$dri(&(0x7f0000007c00), 0xfffffffffffffffa, 0x8100) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dri/0/name\x00', 0x0, 0x0) read(r0, &(0x7f0000000100)=""/256, 0x100) creat(&(0x7f0000000080)='./file1\x00', 0x60e341d46d072c26) 7m42.57541731s ago: executing program 1 (id=332): r0 = openat$audio1(0xffffff9c, &(0x7f00000000c0), 0x8800, 0x0) ioctl$SNDRV_PCM_IOCTL_READN_FRAMES(0xffffffffffffffff, 0x800c4153, &(0x7f0000000a80)={0x0, &(0x7f0000000a40)=[&(0x7f0000000500)="157bc289397f9335b73ffc89f323ae57b20eb764f3fc2acae66fc12ff1e6d886c39a8f01f2a7bd81793da6421f0e341f6bea6effaec6f712ff03e291aff8b7ee6a66ee1cd0f1cb44b1c993d3822c4af38b35ffb2b78f2a6c6a244a72e1ad93648365a9799d583ca4e388c236b13764b4088269fdfb3819ca66b6bdb1646cc745b8f07f3c621cc9928c55ed748260b87313baa1fd843ecfe5c8f43ca449441f4c0e4a905bbe55bcb19afe3e8e7194de7ee8a680b23b392f115d02", &(0x7f00000005c0)="f700c9c218ba7e944118793a175948a612513820653a55d29611cba14a1cbb086f05b81a6593b1d2df252aa63d286c110729a6870651e03cabce47308f4952aa1de63084dda7cfe62cf8906f6e6c5c08d1be17ce7aee22", &(0x7f00000008c0)="64662a3d2e3e0b731d3b30e082c145f1df4fbd5ebb919899c8d99346a6326a8868fc7614fabeadb1e99697b9aa880ab741de3eaa55eb13b1d630cc6a4d9e429eff95059beec5b9fe8858f92e3395ed0934f3565404618f784aa80d75545145112bc79b9c7d12ba9a08d4d80e96fe7c142ae82dc776c0c5d6875032cfaac29bf8989a4b696ec8d369d3b51106352e268c8f49", &(0x7f0000000980)="503ee34832e06ceb32190c4e33f4ae10eb9788836160e0d98fd3", &(0x7f00000009c0)="68f538a01ac1f55e76172a885f7f74e251597aa262036f25c821a9b8a04025779cd14784ae0dd66de0050125a792fc8a3678ff2a11906ded2a1ad62e86427d4f304db3beb97dc745f1a09ba5c10fbef387ffdaf6dbcf00d531345129cf86260ae37c821c8127aef911a28e4a395a40e95f79bda492c4ff163023a35949e986"]}) ioctl$SNDCTL_DSP_GETBLKSIZE(r0, 0xc0045004, &(0x7f0000000180)) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) socket$netlink(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xc, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x4}]}}]}, 0x38}}, 0x20040084) socket$netlink(0x10, 0x3, 0xf) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x9, 0x0, 0x0}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x13, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000eb0000008500000010000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffbfffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffb}, 0x1f) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x2d, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_PIT(r5, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x8, 0x0, 0x0, 0x3, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x9, 0x0, 0x0, 0x2}, {0xeda7, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x9}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="010000201000"}) 7m42.267142363s ago: executing program 1 (id=333): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x440, 0x0, @multicast1=0xe000cc02}}) 7m42.1411528s ago: executing program 32 (id=333): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x440, 0x0, @multicast1=0xe000cc02}}) 9.704609134s ago: executing program 3 (id=4252): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) ftruncate(r3, 0x1019) sendmsg$IPSET_CMD_HEADER(r3, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x4c, 0xc, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x4}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x2, 0x0, 0x1}}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000880)=@newqdisc={0x178, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x148, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0x5, 0x64, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104, 0x2, '\x00\x00 \x00'}, @TCA_GRED_MAX_P={0x8, 0x4, 0x5a}]}}]}, 0x178}}, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)) syslog(0x4, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$pppoe(0x18, 0x1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000800)=@mpls_getnetconf={0x14, 0x52, 0x7dc1ef03f111e94f}, 0x14}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x14, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x9}}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x4, 0x84}}}, 0x8c}}, 0x0) connect$pppoe(r5, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000004c0)={'netpci0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="28000000130005000100"/20, @ANYRES32=r9, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r8], 0x28}}, 0x0) sendmsg$kcm(r4, &(0x7f0000000400)={&(0x7f0000000140)=@xdp={0x2c, 0x5, r9, 0x2e}, 0x80, &(0x7f0000000280)=[{&(0x7f00000001c0)="3f0d6da2a557089599f841c6049058adc4f3b7cbad29ccdf0b163dbec167c5a867f2806f6734351167815b9856fa63551b99ce17d574c5da3f06797e80bcbbe9df08087c9b129593b5fb37a7fd40a2b9e100eef82fc9e4fc19244a2d95b3c77fd03cdb083e88c77550a2dd661e6a08fcdb7207a03f0b647984f0e80cfba2344ff2c630222cd80e09ca57011bdd382d5b2ad1aaccef9ac966dbbcc8812b51c55734b03ca00b4d00bc599f9b3e32b2074438b45c7b33f868c396c23caf0215", 0xbe}], 0x1, &(0x7f00000002c0)=[{0x14, 0x111, 0xe, "191454aa8bb3"}, {0xfc, 0x0, 0xe6, "3c53f4c1bc9a4e6d7d13b8a11972ed8e62b60289bbb6b6b44c673f74180fb24ddeb01f22b60227f93eaf5263685073d676f3408bed4a3ad80ef0ddd833fab13260853f71b5875ba52c94d2d429c9a7494cd8b44472f270bbc1727e3fab92dbdc79ae0164bc365e7137e2751d86c70c08b68973b58cb85c7cb7db34e285339494f0ed2b9db68d42eddcb390b3f955948a7ae35e2c9950330d485a6e13f6c3a55857bc8c543d60cdac2f08f8ecbf879ffc489ffbb941a565c09c4cc72ca9cdc04c875b245671194396ca59af7f52ec2eb0e48d3da16a4d31d0cf70b4c230e79e85dfb9388c05bd3a7b4cd4ad58521ccd"}], 0x110}, 0x44840) sendmmsg(r5, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) sendmsg$kcm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000011008188e6b62aa73f72cc9f0ba1f8483d0000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0) 9.54223944s ago: executing program 3 (id=4262): openat$ttyS3(0xffffffffffffff9c, 0x0, 0x28000, 0x0) r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x1a5042, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) inotify_init() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000b, 0x1010, r0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/ipv6/conf/all/forwarding\x00', 0x1, 0x0) pwritev(r3, &(0x7f0000000480)=[{&(0x7f0000000200)="a5", 0x1}], 0x1, 0x10, 0x8001) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) r6 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0a00000016000000b40000007f00000000000000", @ANYRES32, @ANYBLOB="000000070000000052ab00002d430000000000000100", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f00000002c0)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r6}, @generic={0x5d, 0x0, 0x8}, @initr0, @exit]}, &(0x7f0000000040)='GPL\x00', 0x4}, 0x94) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) dup(r1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) splice(r7, 0x0, r9, 0x0, 0x88000cc, 0x0) fcntl$setpipe(r8, 0x407, 0x100004) 8.418382668s ago: executing program 3 (id=4256): ioctl$BINDER_GET_NODE_INFO_FOR_REF(0xffffffffffffffff, 0xc018620c, 0x0) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4048000}, 0x4048840) r0 = socket(0x10, 0x5, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x4e20, 0x2, @remote, 0x55}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2d}}, @in6={0xa, 0x4e20, 0x2, @mcast1, 0xa}, @in6={0xa, 0x4e24, 0x4, @loopback, 0x98}, @in={0x2, 0x4e24, @remote}], 0x74) sendmsg$inet_sctp(r1, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x80000001, 0x30}, 0xc) r2 = dup(r1) write$cgroup_subtree(r2, &(0x7f00000001c0)=ANY=[], 0x32600) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000000)={0x7, 0x5404, 0x204, 0x5, 0x4, 0x1, 0x1, 0x80000001}, 0x20) syz_usb_connect(0x5, 0x3f, &(0x7f0000000080)=ANY=[@ANYRES64], 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x2, 0x2}}, 0x20) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x200000000000000) bind$802154_dgram(0xffffffffffffffff, &(0x7f0000000040)={0x24, @short={0x2, 0x1, 0xa1bd903b9811256d}}, 0x14) ioctl$PIO_UNIMAP(r2, 0x4b67, &(0x7f0000000200)={0x3, &(0x7f00000001c0)=[{0x5c}, {0x8, 0x8}, {0x8000, 0x79}]}) 6.075943237s ago: executing program 0 (id=4268): request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_emit_ethernet(0x3b6, &(0x7f00000003c0)={@multicast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0xf5, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf730041e5af1802"}, {0x0, 0x1, "000000050000000026000400"}, {0x18, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0xe, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x18, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "ffffffffffff00000000000200000000000000000000000000008879e66485201a0015ca837400"/55}, {0x0, 0x14, "5e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c"}, {0x3, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x187) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xa90d, 0x2, 0x2, 0x257}) mkdirat(0xffffffffffffff9c, 0x0, 0x17f) mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0) dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x358}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) openat$procfs(0xffffff9c, &(0x7f0000002840)='/proc/asound/seq/clients\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r1, 0x2285, &(0x7f00000005c0)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x20000, 0x0}, &(0x7f0000000240)="588d7acda0b2", 0x0, 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f00000001c0)='always', 0x6) nanosleep(&(0x7f00000001c0)={0x0, 0x3938700}, 0x0) 5.10972455s ago: executing program 3 (id=4269): r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24, 0xfffffffc}, 0x1c) openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) pselect6(0x40, &(0x7f0000000000)={0x7f, 0x8, 0x3, 0x7, 0x7, 0x3, 0x800, 0x6}, 0x0, 0x0, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x80000000000009e, 0x0) 5.003667298s ago: executing program 0 (id=4271): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r2, 0x5, 0x0, 0x0, r1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x2) fchdir(r3) r4 = open(0x0, 0x402002, 0x244) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0x9362, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x4030, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'ip_vti0\x00', 0xca02}) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r6 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r6}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x3ed0, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r7, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e23, @loopback}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000180)="96bc1480bb5c", 0x6}], 0x2}, 0x20040050) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) ioctl$TUNSETLINK(r0, 0x400454cd, 0x338) r8 = gettid() timer_create(0x8, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x40000) 4.112192266s ago: executing program 3 (id=4274): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) ftruncate(r3, 0x1019) sendmsg$IPSET_CMD_HEADER(r3, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x4c, 0xc, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x4}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x2, 0x0, 0x1}}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000880)=@newqdisc={0x178, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x148, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0x5, 0x64, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104, 0x2, '\x00\x00 \x00'}, @TCA_GRED_MAX_P={0x8, 0x4, 0x5a}]}}]}, 0x178}}, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)) syslog(0x4, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$pppoe(0x18, 0x1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000800)=@mpls_getnetconf={0x14, 0x52, 0x7dc1ef03f111e94f}, 0x14}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x14, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x9}}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x4, 0x84}}}, 0x8c}}, 0x0) connect$pppoe(r5, &(0x7f0000000040)={0x18, 0x0, {0x4, @local, 'macvtap0\x00'}}, 0x1e) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000004c0)={'netpci0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="28000000130005000100"/20, @ANYRES32=r8, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32], 0x28}}, 0x0) sendmsg$kcm(r4, &(0x7f0000000400)={&(0x7f0000000140)=@xdp={0x2c, 0x5, r8, 0x2e}, 0x80, &(0x7f0000000280)=[{&(0x7f00000001c0)="3f0d6da2a557089599f841c6049058adc4f3b7cbad29ccdf0b163dbec167c5a867f2806f6734351167815b9856fa63551b99ce17d574c5da3f06797e80bcbbe9df08087c9b129593b5fb37a7fd40a2b9e100eef82fc9e4fc19244a2d95b3c77fd03cdb083e88c77550a2dd661e6a08fcdb7207a03f0b647984f0e80cfba2344ff2c630222cd80e09ca57011bdd382d5b2ad1aaccef9ac966dbbcc8812b51c55734b03ca00b4d00bc599f9b3e32b2074438b45c7b33f868c396c23caf0215", 0xbe}], 0x1, &(0x7f00000002c0)=[{0x14, 0x111, 0xe, "191454aa8bb3"}, {0xfc, 0x0, 0xe6, "3c53f4c1bc9a4e6d7d13b8a11972ed8e62b60289bbb6b6b44c673f74180fb24ddeb01f22b60227f93eaf5263685073d676f3408bed4a3ad80ef0ddd833fab13260853f71b5875ba52c94d2d429c9a7494cd8b44472f270bbc1727e3fab92dbdc79ae0164bc365e7137e2751d86c70c08b68973b58cb85c7cb7db34e285339494f0ed2b9db68d42eddcb390b3f955948a7ae35e2c9950330d485a6e13f6c3a55857bc8c543d60cdac2f08f8ecbf879ffc489ffbb941a565c09c4cc72ca9cdc04c875b245671194396ca59af7f52ec2eb0e48d3da16a4d31d0cf70b4c230e79e85dfb9388c05bd3a7b4cd4ad58521ccd"}], 0x110}, 0x44840) sendmmsg(r5, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) sendmsg$kcm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000011008188e6b62aa73f72cc9f0ba1f8483d0000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0) 4.021156379s ago: executing program 0 (id=4275): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=@newlink={0x40, 0x10, 0x439, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21801, 0x6536d5ef40a93737}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_PMTUDISC={0x5, 0xa, 0x1}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) socket$nl_generic(0x10, 0x3, 0x10) openat$ttynull(0xffffffffffffff9c, &(0x7f00000001c0), 0x82084, 0x0) syz_extract_tcp_res(0x0, 0x6, 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0xc5, &(0x7f0000000300)={0x0, 0x10f211, 0x4, 0x2002, 0x40001c, 0x0, r1}, &(0x7f00000007c0), &(0x7f00000000c0), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r3, &(0x7f0000000800)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x9, @dev={0xfe, 0x80, '\x00', 0x43}, 0x5}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000680)="92ca3a839be8e27fc536b372000000a296de0d0ffc1741a765bf3f5ca07596cc2ff87ba8aa859a112c04aa9d4840d1624f0a5ae2c074a946be21e2009392db2023965d125247f55fa1bce029e1f40492d9ba71aa7890683c202b50c75f3f955b63ac5826dcdd7d524ff2f656bbfb50275d4b85a96e994dc2746067c63fd67838d6a82cf356296db4e3165011257bc44151dc994f1efde4b8fe73e132d8e94795bc9adc5875f4867021a6d8453cf1ee42700e19f5bb6f58b649e0f75abb081224b04953ecf70e88f0d81c9921efe756ab560100000000000000391e5051d7f5adbadc308cdcd00a51f0f0111213572bcf82fe894f9c12d43b8b860cf06bb97e505d74", 0x102}], 0x1}}, {{&(0x7f0000000580)={0xa, 0x4e24, 0x81, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xb}, 0x1c, 0x0}}], 0x2, 0x14) shutdown(r3, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="d8000000180081054e81f782db4cb904021d0800fe00fe05e8fe55a10a0015000600142603600e1208000f007f370301a8001600a40002400f000100035c0461c1d67f6f94007134cf6edb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090014d6d9", 0x6c}], 0x1}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0xffffffffffffffff, 0x2, &(0x7f0000000280)=0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x14, r4, 0x301, 0x70bd29, 0x25dfdbfc, {0x24}}, 0x14}, 0x1, 0x0, 0x0, 0x8041}, 0x0) ioprio_get$pid(0x3, 0x0) r6 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$PNPIPE_ENCAP(r6, 0x113, 0x1, 0x0, 0x0) 3.973216185s ago: executing program 3 (id=4277): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x37}, 0xfffffffd}, 0x1c) bind$inet6(r1, 0x0, 0x0) write$UHID_INPUT(r0, &(0x7f0000002080)={0xfc, {"a2336848149e516d4b5e071887f70e09d038e7ff7fc6e5539b0d500a8b089b3f383563030890e0879b0a71c6e70a9b334a959b669a242f0a0af3988f7ef319520100ffe8d178708c523c921b1b3e31070d0773090acd3b78130daa61d8e804003e005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9903f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928d28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe494d21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f2730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b81305c038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c20956dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849cd9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b03515304f46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484539ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d258e8c69a399567c1f93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050363d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb8843dd014e5c5ad8fe995754bd9cf36fce1e31919c4b2082fb0a30b9deae84bed4b2804563407308c58c89d9e99c81769177e6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463373b4b87c9050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e080000007ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c2769386fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454816f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e3933ed07c2b8081c128ad2706f48261ff07000000000000613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59500000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xff7d}}, 0x1006) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$USBDEVFS_RELEASE_PORT(r5, 0x80045519, &(0x7f0000000000)=0xc) 3.053077936s ago: executing program 4 (id=4279): request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_emit_ethernet(0x3b6, &(0x7f00000003c0)={@multicast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0xf5, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf730041e5af1802"}, {0x0, 0x1, "000000050000000026000400"}, {0x18, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0xe, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x18, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "ffffffffffff00000000000200000000000000000000000000008879e66485201a0015ca837400"/55}, {0x0, 0x14, "5e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c"}, {0x3, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x187) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xa90d, 0x2, 0x2, 0x257}) mkdirat(0xffffffffffffff9c, 0x0, 0x17f) mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0) dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x358}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) openat$procfs(0xffffff9c, &(0x7f0000002840)='/proc/asound/seq/clients\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r1, 0x2285, &(0x7f00000005c0)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x20000, 0x0}, &(0x7f0000000240)="588d7acda0b2", 0x0, 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f00000001c0)='always', 0x6) nanosleep(&(0x7f00000001c0)={0x0, 0x3938700}, 0x0) 2.641253132s ago: executing program 0 (id=4280): mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1048001, 0x0) io_cancel(0x0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) ioctl$USBDEVFS_RELEASE_PORT(r0, 0x80045519, &(0x7f00000003c0)=0x4) socket$nl_generic(0x10, 0x3, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'lo\x00'}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newlink={0x30, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0xe803, 0x0, 0x48815, 0x3}, [@IFLA_TXQLEN={0x8}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) 2.285112689s ago: executing program 4 (id=4282): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="0000891f0180c2000002bbbbbbbbbbbb0800ff5c001c00676000032f"], 0x2e) 2.229678107s ago: executing program 2 (id=4283): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8192, 0x121000, 0x800, 0x8, 0x1}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) bind$xdp(r0, &(0x7f00000001c0)={0x2c, 0x2, r2, 0x800000, 0x0}, 0x10) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000280)=0x140b0c, 0x4) 2.077978345s ago: executing program 2 (id=4284): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(0x0, &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000002, 0xc3072, 0xffffffffffffffff, 0x200000) r0 = open(&(0x7f0000000140)='./file2\x00', 0x66842, 0x1) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x1e200}], 0x23, 0x1a00, 0x0, 0x3) 2.023026046s ago: executing program 2 (id=4285): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000240)={0xbf, 0x99, 0x9c, 0x3, 0x0, 0x5, 0xfb, 0x5, 0xec, 0xff, 0x83, 0x84, 0x8, 0x7}, 0xe) sendto$inet6(r1, &(0x7f0000000040)='T', 0x1, 0x8910, &(0x7f0000000280)={0xa, 0xfffc, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000000)=0x4, 0x4) shutdown(r1, 0x1) recvmmsg(r1, &(0x7f0000001b80)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000000340)=""/126, 0x7e}], 0x1}, 0x7}, {{0x0, 0x0, 0x0}, 0x9b}], 0x2, 0x4, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001", @ANYRESHEX=r0, @ANYRES64=r0], 0x7c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x4040850) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x820000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r6, 0xc048aec8, &(0x7f0000000000)={0x4, 0xffffffffffffffff, 0xfffffffe}) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r4, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r7, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r2, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="00009600832901c3054679cf00007dfaf5b06c57149f104c60e9156c4ad9c2045a1c80c0818933f75020f585492610a1efd47fff9cb867bf487eb6d647ee", @ANYRES16=r4, @ANYBLOB="08002bbd7000fddbdf253a0000000c009900020000004400000006006500ff0f00000600650091000000060065000a00000014005b00bde07b2d80c490e0844f603c9e2be643"], 0x4c}, 0x1, 0x0, 0x0, 0x4004810}, 0x44000) r8 = socket$inet6(0xa, 0x5, 0x800884) setsockopt$sock_linger(r8, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xffffffff}, 0x8) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000000240)={0x98, 0x1f, 0x1, 0x70bd28, 0x0, "", [@nested={0x88, 0x15d, 0x0, 0x1, [@typed={0x83, 0x1, 0x0, 0x0, @binary="8343bc07cb696fc3f067b4a3ae219d24f33690ac443104c37d0affcad7f0fb6476ec5069c50cec64008b5520fe8cb7dacdbd11a356c4e800b5b18af3a5619cdaaf4a79a948b9d2cbcde72d1891c9ab3e6c78d3300e3622d049c57ce8fe1e614ddec085eb4b2d36abf31ae78f56a6acba382160e6e32bc94ca7d6b90beca822"}]}]}, 0x98}], 0x1}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000004c00)=ANY=[@ANYRESDEC=r0], 0x64}, 0x1, 0x0, 0x0, 0x40080a5}, 0x24040840) 2.021639453s ago: executing program 0 (id=4293): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(0x0, &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000002, 0xc3072, 0xffffffffffffffff, 0x200000) r0 = open(&(0x7f0000000140)='./file2\x00', 0x66842, 0x1) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x1e200}], 0x23, 0x1a00, 0x0, 0x3) 1.947797106s ago: executing program 0 (id=4286): syz_open_dev$sg(0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @address_request}}}}, 0x0) setsockopt$MRT_FLUSH(0xffffffffffffffff, 0x0, 0xd4, &(0x7f0000000040)=0x9, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x1, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x2000000068ff, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000880)={{0xd000, 0x0, 0x4, 0x0, 0x8, 0x0, 0x0, 0x3, 0x0, 0x8, 0x6, 0x40}, {0xffffffff, 0x10000, 0xa, 0x3, 0x2, 0x0, 0x0, 0x0, 0x7, 0xff}, {0xe6ee2000, 0x3000, 0xc, 0x0, 0x8, 0xc4, 0x0, 0x0, 0x48, 0x3, 0x0, 0xfc}, {0xeeef0000, 0xeee96000, 0xa, 0x0, 0x1, 0xa6, 0x9, 0x0, 0x8, 0x10, 0x7, 0x4}, {0xf000, 0xffff1000, 0xe, 0x0, 0x0, 0x4, 0x0, 0xfd, 0x0, 0x3c}, {0x8000000, 0x0, 0xb, 0x78, 0x5, 0x83, 0x0, 0x0, 0x3, 0xff, 0x1}, {0x1ffe, 0xeeee0000, 0xa, 0x4, 0x0, 0x5, 0xa1, 0x20, 0x0, 0x0, 0x8}, {0x81a0002, 0x6000, 0xb, 0x0, 0x0, 0x5, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0x41000, 0x8cc}, {0xdddd1000, 0x4}, 0xddf8ffdb, 0x0, 0x0, 0x134, 0xd, 0x0, 0x0, [0x80000005, 0x8, 0x1]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.894605411s ago: executing program 4 (id=4287): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x4, 0x8, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) close(0x3) ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(0xffffffffffffffff, 0x40109441, &(0x7f00000002c0)={0x200, 0x3, 0x3}) r0 = socket$nl_generic(0x10, 0x3, 0x10) mprotect(&(0x7f0000959000/0x3000)=nil, 0x3000, 0x1000008) gettid() timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)=ANY=[@ANYBLOB="180000002f00090028bd70000000000004000000040010"], 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x20000004) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x21031, 0xffffffffffffffff, 0x21d63000) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="06000000040000000010", @ANYRES32, @ANYBLOB='\x00'/17, @ANYRES32, @ANYBLOB], 0x50) r1 = socket$l2tp(0x2, 0x2, 0x73) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[], 0x9}, 0x1, 0x0, 0x0, 0x14}, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000380)=@filter={'filter\x00', 0x42, 0x4, 0x311, 0xffffffff, 0x1d8, 0x98, 0x98, 0xffffffff, 0xffffffff, 0x2a8, 0x2a8, 0x2a8, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'netpci0\x00', 'nr0\x00', {0xff}}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@ip={@private=0xa010101, @multicast2, 0xff, 0x0, 'netpci0\x00', 'team_slave_1\x00'}, 0x287, 0xe0, 0x140, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x4}}, @common=@unspec=@limit={{0x48}, {0xfffffffa, 0xb, 0x0, 0x0, 0x0, 0xfffffffc}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x1278]}, {0xffff, [0x5]}}}}, {{@ip={@dev, @remote, 0x0, 0xff000000, 'veth1_to_team\x00', 'veth1_to_batadv\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x2, [0x0, 0x3, 0x1, 0x2, 0x0, 0x5], 0x1, 0x4}, {0xffffffffffffffff, [0x7, 0x4, 0x4, 0x5], 0x6, 0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a0) getsockopt$inet_opts(r1, 0x0, 0x16, &(0x7f0000000180)=""/171, &(0x7f0000000240)=0xab) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$OCFS2_IOC_MOVE_EXT(r0, 0x40406f06, &(0x7f0000000140)={0x33, 0x4, 0x7, 0x4}) socket$nl_route(0x10, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x8914, 0x0) ioctl(0xffffffffffffffff, 0x8914, &(0x7f0000000080)="64756d6d7930000000000000000000000100"/40) ioctl(0xffffffffffffffff, 0x8914, &(0x7f00000000c0)="6c6170623000000000000000000000000100"/30) ioctl(0xffffffffffffffff, 0x890b, &(0x7f0000000100)) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4000) close(0x3) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@private2, @in6=@mcast2, 0x0, 0x1, 0x4e22, 0xe, 0xa}, {0xfffffffffffffffc, 0xffffffffffffffff, 0x10000000000}, {0x0, 0xfffffffffffffffd, 0xb5, 0x7fffffff}, 0x800, 0x0, 0x1, 0x1, 0x0, 0x3}, {{@in=@local, 0x4d6, 0x32}, 0xa, @in=@broadcast, 0x3505, 0x2, 0x3}}, 0xe4) 1.767099691s ago: executing program 2 (id=4289): socket$tipc(0x1e, 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./pipefs\x00', &(0x7f0000000100)='rpc_pipefs\x00', 0x0, 0x0) openat$ptp0(0xffffff9c, &(0x7f0000000180), 0x30001, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./pipefs/gssd/clntXX/gssd\x00', 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000380), 0x14c98, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet_sctp(0x2, 0x1, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0xc}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x16, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000908500000071000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0xffffffff, 0x10, 0xfffffffffffffffe, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f0000000080)={r5, 0x2, 0x1, "0f"}, 0x9) socket(0x10, 0x3, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$binderfs(0xffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x0, 0x0) r6 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xcf0b, 0x0, 0x3, 0x11}, 0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(0x0, r7, r8, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0x8, 0x0, 0x0, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r6, 0x101, 0x11, 0x5, 0x0, 0x0) 1.586356658s ago: executing program 4 (id=4290): r0 = openat$audio1(0xffffff9c, &(0x7f00000000c0), 0x8800, 0x0) ioctl$SNDRV_PCM_IOCTL_READN_FRAMES(0xffffffffffffffff, 0x800c4153, &(0x7f0000000a80)={0x0, &(0x7f0000000a40)=[&(0x7f0000000500)="157bc289397f9335b73ffc89f323ae57b20eb764f3fc2acae66fc12ff1e6d886c39a8f01f2a7bd81793da6421f0e341f6bea6effaec6f712ff03e291aff8b7ee6a66ee1cd0f1cb44b1c993d3822c4af38b35ffb2b78f2a6c6a244a72e1ad93648365a9799d583ca4e388c236b13764b4088269fdfb3819ca66b6bdb1646cc745b8f07f3c621cc9928c55ed748260b87313baa1fd843ecfe5c8f43ca449441f4c0e4a905bbe55bcb19afe3e8e7194de7ee8a680b23b392f115d02", &(0x7f00000005c0)="f700c9c218ba7e944118793a175948a612513820653a55d29611cba14a1cbb086f05b81a6593b1d2df252aa63d286c110729a6870651e03cabce47308f4952aa1de63084dda7cfe62cf8906f6e6c5c08d1be17ce7aee22", &(0x7f00000008c0)="64662a3d2e3e0b731d3b30e082c145f1df4fbd5ebb919899c8d99346a6326a8868fc7614fabeadb1e99697b9aa880ab741de3eaa55eb13b1d630cc6a4d9e429eff95059beec5b9fe8858f92e3395ed0934f3565404618f784aa80d75545145112bc79b9c7d12ba9a08d4d80e96fe7c142ae82dc776c0c5d6875032cfaac29bf8989a4b696ec8d369d3b51106352e268c8f49", &(0x7f0000000980)="503ee34832e06ceb32190c4e33f4ae10eb9788836160e0d98fd3", &(0x7f00000009c0)="68f538a01ac1f55e76172a885f7f74e251597aa262036f25c821a9b8a04025779cd14784ae0dd66de0050125a792fc8a3678ff2a11906ded2a1ad62e86427d4f304db3beb97dc745f1a09ba5c10fbef387ffdaf6dbcf00d531345129cf86260ae37c821c8127aef911a28e4a395a40e95f79bda492c4ff163023a35949e986"]}) ioctl$SNDCTL_DSP_GETBLKSIZE(r0, 0xc0045004, &(0x7f0000000180)) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) socket$netlink(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xc, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x4}]}}]}, 0x38}}, 0x20040084) socket$netlink(0x10, 0x3, 0xf) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x13, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000eb0000008500000010000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffbfffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffb}, 0x1f) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x2d, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_PIT(r5, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x8, 0x0, 0x0, 0x3, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x9, 0x0, 0x0, 0x2}, {0xeda7, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x9}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8924, &(0x7f0000000000)={'macsec0\x00', @random="010000201000"}) 1.584341672s ago: executing program 2 (id=4291): request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_emit_ethernet(0x3b6, &(0x7f00000003c0)={@multicast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0xf5, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf730041e5af1802"}, {0x0, 0x1, "000000050000000026000400"}, {0x18, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0xe, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x18, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "ffffffffffff00000000000200000000000000000000000000008879e66485201a0015ca837400"/55}, {0x0, 0x14, "5e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c"}, {0x3, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x187) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xa90d, 0x2, 0x2, 0x257}) mkdirat(0xffffffffffffff9c, 0x0, 0x17f) mount(0x0, &(0x7f0000000000)='./sys\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x358}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) openat$procfs(0xffffff9c, &(0x7f0000002840)='/proc/asound/seq/clients\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r1, 0x2285, &(0x7f00000005c0)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x20000, 0x0}, &(0x7f0000000240)="588d7acda0b2", 0x0, 0x0, 0x0, 0x0, 0x0}) write(0xffffffffffffffff, &(0x7f00000001c0)='always', 0x6) nanosleep(&(0x7f00000001c0)={0x0, 0x3938700}, 0x0) 597.814272ms ago: executing program 4 (id=4292): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8192, 0x121000, 0x800, 0x8, 0x1}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) bind$xdp(r0, &(0x7f00000001c0)={0x2c, 0x2, r2, 0x800000, 0x0}, 0x10) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000280)=0x140b0c, 0x4) 596.735925ms ago: executing program 4 (id=4294): syz_usb_connect(0x6, 0x371, &(0x7f0000000280)=ANY=[], 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r1) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_GET_MSRS_sys(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)={0x3, 0x0, [{0x6e0, 0x0, 0xfffffffffffffbff}, {0x31c, 0x0, 0x4000000000000000}, {0x40000090, 0x0, 0xfffffffffffffffc}]}) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x3630c1) getpid() mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat$binderfs(0xffffff9c, &(0x7f0000000280)='./binderfs2/custom0\x00', 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000240), r2) write(r3, &(0x7f00000000c0)='1\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r4, &(0x7f00000001c0)='1\x00', 0x1) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000003c0), 0x81517c2ec388522f, 0x0) r6 = epoll_create1(0x0) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, 0x0, 0xc010) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r7, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0xa00, 0xff01, 0x101, 0x100}}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000000)={0x20000008}) 0s ago: executing program 2 (id=4295): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(0x0, &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000002, 0xc3072, 0xffffffffffffffff, 0x200000) r0 = open(&(0x7f0000000140)='./file2\x00', 0x66842, 0x1) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x1e200}], 0x23, 0x1a00, 0x0, 0x3) 0s ago: executing program 2 (id=4296): mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./cfg\x00', 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./cfg\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xd, 0x4, 0x0, &(0x7f0000000080)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r0 = socket$inet6(0xa, 0x805, 0x0) getsockopt$bt_hci(r0, 0x84, 0x85, &(0x7f0000000080)=""/4060, &(0x7f00000010c0)=0xfdc) rmdir(&(0x7f0000000140)='./cfg/usb_gadget/g1/functions/ffs.usb0\x00') kernel console output (not intermixed with test programs): evice: -71 [ 467.959663][ T10] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 467.962074][ T10] usb 8-1: USB disconnect, device number 53 [ 468.199169][ T43] audit: type=1326 audit(1791015134.456:8187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18332 comm="syz.0.3829" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7fe2fec code=0x7fc00000 [ 468.390638][ T5744] Bluetooth: hci2: command tx timeout [ 468.685378][T18374] binder: 18373:18374 ioctl c0306201 80000080 returned -14 [ 469.192909][ T10] usb 9-1: new high-speed USB device number 41 using dummy_hcd [ 469.367409][ T10] usb 9-1: Using ep0 maxpacket: 32 [ 469.369648][ T10] usb 9-1: unable to get BOS descriptor or descriptor too short [ 469.369688][ T10] usb 9-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 469.372890][ T10] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 469.372914][ T10] usb 9-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 469.372948][ T10] usb 9-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 469.375231][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.375248][ T10] usb 9-1: Product: syz [ 469.375256][ T10] usb 9-1: Manufacturer: syz [ 469.375265][ T10] usb 9-1: SerialNumber: syz [ 469.628312][ T10] usb 9-1: unit 0 not found! [ 469.651053][ T10] snd-usb-audio 9-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 469.666176][ T10] usb 9-1: unit 0 not found! [ 469.711168][ T10] snd-usb-audio 9-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 469.713788][ T10] usb 9-1: USB disconnect, device number 41 [ 469.737393][T17087] udevd[17087]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb9/9-1/9-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 470.182256][T18414] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3861'. [ 470.375762][ T5801] tipc: Subscription rejected, illegal request [ 470.489170][T18437] FAULT_INJECTION: forcing a failure. [ 470.489170][T18437] name failslab, interval 1, probability 0, space 0, times 0 [ 470.489204][T18437] CPU: 3 UID: 0 PID: 18437 Comm: syz.0.3863 Tainted: G L syzkaller #0 PREEMPT(full) [ 470.489229][T18437] Tainted: [L]=SOFTLOCKUP [ 470.489236][T18437] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 470.489247][T18437] Call Trace: [ 470.489254][T18437] [ 470.489262][T18437] dump_stack_lvl+0x100/0x190 [ 470.489291][T18437] should_fail_ex.cold+0x5/0xa [ 470.489316][T18437] should_failslab+0xc2/0x120 [ 470.489344][T18437] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 470.489370][T18437] ? alloc_vmap_area+0x640/0x2bb0 [ 470.489399][T18437] alloc_vmap_area+0x640/0x2bb0 [ 470.489432][T18437] ? kasan_save_track+0x14/0x30 [ 470.489455][T18437] ? __kasan_kmalloc+0xaa/0xb0 [ 470.489475][T18437] ? __pfx_alloc_vmap_area+0x10/0x10 [ 470.489492][T18437] ? __get_vm_area_node+0x124/0x350 [ 470.489516][T18437] __get_vm_area_node+0x1ed/0x350 [ 470.489546][T18437] __vmalloc_node_range_noprof+0x268/0x1420 [ 470.489573][T18437] ? vhost_task_create+0x1db/0x370 [ 470.489596][T18437] ? lock_acquire+0x1d1/0x380 [ 470.489621][T18437] ? rcu_lock_acquire.constprop.0+0x7/0x30 [ 470.489643][T18437] ? find_held_lock+0x2b/0x80 [ 470.489665][T18437] ? rcu_read_unlock+0x17/0x60 [ 470.489685][T18437] ? vhost_task_create+0x1db/0x370 [ 470.489709][T18437] ? __memcg_slab_post_alloc_hook+0x71e/0x10c0 [ 470.489732][T18437] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 470.489762][T18437] ? rcu_is_watching+0x13/0xc0 [ 470.489782][T18437] ? trace_kmem_cache_alloc+0xdd/0x100 [ 470.489812][T18437] ? vhost_task_create+0x1db/0x370 [ 470.489833][T18437] __vmalloc_node_noprof+0xad/0xf0 [ 470.489860][T18437] ? vhost_task_create+0x1db/0x370 [ 470.489886][T18437] copy_process+0x803/0x8380 [ 470.489920][T18437] ? __pfx_copy_process+0x10/0x10 [ 470.489937][T18437] ? kasan_save_track+0x14/0x30 [ 470.489960][T18437] ? __kasan_kmalloc+0xaa/0xb0 [ 470.489985][T18437] ? lockdep_init_map_type+0x5c/0x250 [ 470.490014][T18437] ? lockdep_init_map_type+0x5c/0x250 [ 470.490041][T18437] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 470.490074][T18437] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 470.490100][T18437] vhost_task_create+0x1db/0x370 [ 470.490125][T18437] ? __pfx_vhost_task_create+0x10/0x10 [ 470.490158][T18437] ? __pfx_vhost_task_fn+0x10/0x10 [ 470.490183][T18437] ? register_lock_class+0x3f/0x7b0 [ 470.490209][T18437] ? rcu_is_watching+0x13/0xc0 [ 470.490229][T18437] ? trace_contention_end+0x126/0x160 [ 470.490264][T18437] kvm_mmu_post_init_vm+0x1b3/0x360 [ 470.490286][T18437] kvm_arch_vcpu_ioctl_run+0xb5/0x1dd0 [ 470.490316][T18437] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 470.490337][T18437] ? lock_acquire+0x1d1/0x380 [ 470.490363][T18437] ? do_raw_write_lock+0x11e/0x260 [ 470.490382][T18437] ? find_held_lock+0x2b/0x80 [ 470.490403][T18437] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 470.490427][T18437] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 470.490457][T18437] kvm_vcpu_ioctl+0x730/0x1700 [ 470.490482][T18437] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 470.490507][T18437] ? tomoyo_path_number_perm+0x188/0x580 [ 470.490530][T18437] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 470.490549][T18437] ? futex_wait+0x11e/0x370 [ 470.490582][T18437] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 470.490612][T18437] ? do_vfs_ioctl+0x226/0x13e0 [ 470.490633][T18437] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 470.490660][T18437] ? __fget_files+0x34/0x3d0 [ 470.490688][T18437] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 470.490714][T18437] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 470.490739][T18437] ? __fget_files+0x21f/0x3d0 [ 470.490768][T18437] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 470.490793][T18437] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 470.490817][T18437] __do_fast_syscall_32+0x13a/0x8b0 [ 470.490846][T18437] do_fast_syscall_32+0x32/0x70 [ 470.490870][T18437] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 470.490894][T18437] RIP: 0023:0xf7fe2fec [ 470.490920][T18437] Code: Unable to access opcode bytes at 0xf7fe2fc2. [ 470.490929][T18437] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 470.490948][T18437] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 470.490961][T18437] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 470.490973][T18437] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 470.490983][T18437] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 470.490990][T18437] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 470.491009][T18437] [ 470.491028][T18437] syz.0.3863: vmalloc error: size 32768, align 0x8000, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 470.491092][T18437] CPU: 3 UID: 0 PID: 18437 Comm: syz.0.3863 Tainted: G L syzkaller #0 PREEMPT(full) [ 470.491121][T18437] Tainted: [L]=SOFTLOCKUP [ 470.491129][T18437] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 470.491140][T18437] Call Trace: [ 470.491148][T18437] [ 470.491156][T18437] dump_stack_lvl+0x100/0x190 [ 470.491184][T18437] warn_alloc.cold+0x9e/0xb2 [ 470.491206][T18437] ? __pfx_warn_alloc+0x10/0x10 [ 470.491226][T18437] ? lockdep_hardirqs_on+0x7d/0x110 [ 470.491251][T18437] ? __get_vm_area_node+0x2f0/0x350 [ 470.491283][T18437] ? __get_vm_area_node+0x22b/0x350 [ 470.491315][T18437] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 470.491343][T18437] ? lock_acquire+0x1d1/0x380 [ 470.491368][T18437] ? rcu_lock_acquire.constprop.0+0x7/0x30 [ 470.491391][T18437] ? find_held_lock+0x2b/0x80 [ 470.491414][T18437] ? rcu_read_unlock+0x17/0x60 [ 470.491434][T18437] ? vhost_task_create+0x1db/0x370 [ 470.491460][T18437] ? __memcg_slab_post_alloc_hook+0x71e/0x10c0 [ 470.491482][T18437] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 470.491514][T18437] ? rcu_is_watching+0x13/0xc0 [ 470.491534][T18437] ? trace_kmem_cache_alloc+0xdd/0x100 [ 470.491563][T18437] ? vhost_task_create+0x1db/0x370 [ 470.491585][T18437] __vmalloc_node_noprof+0xad/0xf0 [ 470.491612][T18437] ? vhost_task_create+0x1db/0x370 [ 470.491637][T18437] copy_process+0x803/0x8380 [ 470.491671][T18437] ? __pfx_copy_process+0x10/0x10 [ 470.491688][T18437] ? kasan_save_track+0x14/0x30 [ 470.491712][T18437] ? __kasan_kmalloc+0xaa/0xb0 [ 470.491735][T18437] ? lockdep_init_map_type+0x5c/0x250 [ 470.491767][T18437] ? lockdep_init_map_type+0x5c/0x250 [ 470.491795][T18437] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 470.491848][T18437] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 470.491875][T18437] vhost_task_create+0x1db/0x370 [ 470.491900][T18437] ? __pfx_vhost_task_create+0x10/0x10 [ 470.491934][T18437] ? __pfx_vhost_task_fn+0x10/0x10 [ 470.491960][T18437] ? register_lock_class+0x3f/0x7b0 [ 470.491988][T18437] ? rcu_is_watching+0x13/0xc0 [ 470.492008][T18437] ? trace_contention_end+0x126/0x160 [ 470.492042][T18437] kvm_mmu_post_init_vm+0x1b3/0x360 [ 470.492069][T18437] kvm_arch_vcpu_ioctl_run+0xb5/0x1dd0 [ 470.492097][T18437] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 470.492119][T18437] ? lock_acquire+0x1d1/0x380 [ 470.492148][T18437] ? do_raw_write_lock+0x11e/0x260 [ 470.492167][T18437] ? find_held_lock+0x2b/0x80 [ 470.492188][T18437] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 470.492210][T18437] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 470.492239][T18437] kvm_vcpu_ioctl+0x730/0x1700 [ 470.492266][T18437] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 470.492290][T18437] ? tomoyo_path_number_perm+0x188/0x580 [ 470.492311][T18437] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 470.492330][T18437] ? futex_wait+0x11e/0x370 [ 470.492361][T18437] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 470.492390][T18437] ? do_vfs_ioctl+0x226/0x13e0 [ 470.492411][T18437] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 470.492436][T18437] ? __fget_files+0x34/0x3d0 [ 470.492466][T18437] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 470.492490][T18437] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 470.492515][T18437] ? __fget_files+0x21f/0x3d0 [ 470.492568][T18437] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 470.492592][T18437] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 470.492617][T18437] __do_fast_syscall_32+0x13a/0x8b0 [ 470.492646][T18437] do_fast_syscall_32+0x32/0x70 [ 470.492671][T18437] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 470.492694][T18437] RIP: 0023:0xf7fe2fec [ 470.492713][T18437] Code: Unable to access opcode bytes at 0xf7fe2fc2. [ 470.492723][T18437] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 470.492742][T18437] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 470.492754][T18437] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 470.492767][T18437] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 470.492779][T18437] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 470.492791][T18437] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 470.492819][T18437] [ 470.505875][T18437] Mem-Info: [ 470.505891][T18437] active_anon:2458 inactive_anon:2719 isolated_anon:0 [ 470.505891][T18437] active_file:7864 inactive_file:7115 isolated_file:0 [ 470.505891][T18437] unevictable:1000 dirty:201 writeback:0 [ 470.505891][T18437] slab_reclaimable:6677 slab_unreclaimable:59260 [ 470.505891][T18437] mapped:23481 shmem:3072 pagetables:1595 [ 470.505891][T18437] sec_pagetables:339 bounce:0 [ 470.505891][T18437] kernel_misc_reclaimable:0 [ 470.505891][T18437] free:36567 free_pcp:14543 free_cma:0 [ 470.505946][T18437] Node 0 active_anon:32kB inactive_anon:40kB active_file:1056kB inactive_file:1540kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:3408kB dirty:12kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8832kB pagetables:1300kB sec_pagetables:1160kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 470.505992][T18437] Node 1 active_anon:9800kB inactive_anon:10836kB active_file:30400kB inactive_file:26920kB unevictable:4000kB isolated(anon):0kB isolated(file):0kB mapped:90516kB dirty:792kB writeback:0kB shmem:12288kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5880kB pagetables:5080kB sec_pagetables:196kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 470.506024][T18437] Node 0 DMA free:3456kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:136kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:32kB local_pcp:0kB free_cma:0kB [ 470.506059][T18437] lowmem_reserve[]: 0 278 278 278 278 [ 470.506095][T18437] Node 0 DMA32 free:40872kB boost:28404kB min:41028kB low:44184kB high:47340kB reserved_highatomic:2048kB free_highatomic:1948kB active_anon:32kB inactive_anon:40kB active_file:920kB inactive_file:1540kB unevictable:0kB writepending:12kB zspages:680kB present:1032196kB managed:284784kB mlocked:0kB bounce:0kB free_pcp:4892kB local_pcp:3928kB free_cma:0kB [ 470.506136][T18437] lowmem_reserve[]: 0 0 0 0 0 [ 470.506159][T18437] Node 1 DMA32 free:101940kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0kB free_highatomic:0kB active_anon:9800kB inactive_anon:10836kB active_file:30400kB inactive_file:26920kB unevictable:4000kB writepending:792kB zspages:4848kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:53232kB local_pcp:13480kB free_cma:0kB [ 470.506200][T18437] lowmem_reserve[]: 0 0 0 0 0 [ 470.506223][T18437] Node 0 DMA: 88*4kB (UM) 34*8kB (UM) 25*16kB (UM) 30*32kB (UM) 5*64kB (UM) 1*128kB (M) 2*256kB (M) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 3456kB [ 470.506406][T18437] Node 0 DMA32: 1328*4kB (UMEH) 275*8kB (UMEH) 161*16kB (UMEH) 304*32kB (UMEH) 97*64kB (UMEH) 38*128kB (UMEH) 9*256kB (UMEH) 9*512kB (UMH) 3*1024kB (M) 0*2048kB 0*4096kB = 40872kB [ 470.506510][T18437] Node 1 DMA32: 2033*4kB (UM) 744*8kB (UME) 607*16kB (UME) 455*32kB (UME) 323*64kB (UME) 107*128kB (UME) 36*256kB (UME) 21*512kB (UME) 5*1024kB (M) 2*2048kB (M) 0*4096kB = 101908kB [ 470.506613][T18437] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 470.506623][T18437] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 470.506633][T18437] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 470.506642][T18437] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 470.506651][T18437] 18591 total pagecache pages [ 470.506656][T18437] 542 pages in swap cache [ 470.506661][T18437] Free swap = 105340kB [ 470.506665][T18437] Total swap = 124996kB [ 470.506670][T18437] 524155 pages RAM [ 470.506675][T18437] 0 pages HighMem/MovableOnly [ 470.506679][T18437] 212067 pages reserved [ 470.506683][T18437] 0 pages cma reserved [ 470.634218][ T5744] Bluetooth: hci2: command tx timeout [ 472.681900][ T854] usb 9-1: new full-speed USB device number 42 using dummy_hcd [ 472.846120][ T854] usb 9-1: not running at top speed; connect to a high speed hub [ 472.846151][ T854] usb 9-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 472.847139][ T854] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 472.847174][ T854] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.874811][T18495] mmap: syz.0.3889 (18495): VmData 37433344 exceed data ulimit 4. Update limits or use boot option ignore_rlimit_data. [ 472.886612][ T854] uvcvideo 9-1:1.0: Found UVC 1.00 device (046d:0825) [ 472.886648][ T854] uvcvideo 9-1:1.0: No streaming interface found for terminal 32770. [ 472.891134][ T5744] Bluetooth: hci2: command tx timeout [ 472.947182][T18497] syzkaller0: entered promiscuous mode [ 472.947206][T18497] syzkaller0: entered allmulticast mode [ 473.240601][T18515] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3890'. [ 474.524586][ T854] usb 8-1: new high-speed USB device number 54 using dummy_hcd [ 474.698333][ T854] usb 8-1: New USB device found, idVendor=16c0, idProduct=05e1, bcdDevice= 0.00 [ 474.699424][ T854] usb 8-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 474.699450][ T854] usb 8-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 474.699472][ T854] usb 8-1: config 0 interface 0 has no altsetting 0 [ 474.699498][ T854] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.703838][ T854] usb 8-1: config 0 descriptor?? [ 475.176931][ T854] input: HID 16c0:05e1 as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/0003:16C0:05E1.000E/input/input31 [ 475.297896][ T854] xinmo 0003:16C0:05E1.000E: input,hiddev0,hidraw1: USB HID v0.00 Device [HID 16c0:05e1] on usb-dummy_hcd.3-1/input0 [ 475.765198][ T5839] usb 8-1: USB disconnect, device number 54 [ 475.779399][ T6320] usb 9-1: USB disconnect, device number 42 [ 476.445598][T18559] syzkaller1: tun_chr_ioctl cmd 3223345255 [ 476.637935][ T10] usb 8-1: new high-speed USB device number 55 using dummy_hcd [ 476.802504][ T10] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 476.803927][ T10] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 476.803944][ T10] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 476.803956][ T10] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 476.803975][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.807257][ T10] usb 8-1: config 0 descriptor?? [ 477.249934][ T5839] usb 9-1: new high-speed USB device number 43 using dummy_hcd [ 477.257322][ T10] plantronics 0003:047F:FFFF.000F: reserved main item tag 0xd [ 477.277134][ T10] plantronics 0003:047F:FFFF.000F: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 477.549660][ T10] usb 8-1: USB disconnect, device number 55 [ 477.590121][ T5839] usb 9-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 477.792549][ T5839] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.792568][ T5839] usb 9-1: Product: syz [ 477.792576][ T5839] usb 9-1: Manufacturer: syz [ 477.792584][ T5839] usb 9-1: SerialNumber: syz [ 478.178329][T18584] FAULT_INJECTION: forcing a failure. [ 478.178329][T18584] name failslab, interval 1, probability 0, space 0, times 0 [ 478.178362][T18584] CPU: 0 UID: 0 PID: 18584 Comm: syz.3.3923 Tainted: G L syzkaller #0 PREEMPT(full) [ 478.178386][T18584] Tainted: [L]=SOFTLOCKUP [ 478.178394][T18584] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 478.178404][T18584] Call Trace: [ 478.178411][T18584] [ 478.178418][T18584] dump_stack_lvl+0x100/0x190 [ 478.178445][T18584] should_fail_ex.cold+0x5/0xa [ 478.178468][T18584] should_failslab+0xc2/0x120 [ 478.178492][T18584] __kmalloc_cache_noprof+0x91/0x6d0 [ 478.178510][T18584] ? snd_seq_port_use_ptr+0x3c/0x300 [ 478.178602][T18584] ? snd_seq_port_connect+0x61/0x540 [ 478.178622][T18584] snd_seq_port_connect+0x61/0x540 [ 478.178639][T18584] ? check_subscription_permission.isra.0+0x146/0x240 [ 478.178666][T18584] snd_seq_ioctl_subscribe_port+0x219/0x490 [ 478.178684][T18584] ? __pfx_snd_seq_ioctl_subscribe_port+0x10/0x10 [ 478.178709][T18584] ? lock_acquire+0x1d1/0x380 [ 478.178733][T18584] ? clientptr+0x20/0x190 [ 478.178756][T18584] ? find_held_lock+0x2b/0x80 [ 478.178773][T18584] ? clientptr+0x80/0x190 [ 478.178797][T18584] call_seq_client_ctl+0xa3/0x130 [ 478.178822][T18584] snd_seq_kernel_client_ctl+0x35/0x50 [ 478.178846][T18584] snd_seq_oss_midi_open+0x465/0x680 [ 478.178867][T18584] ? __pfx_snd_seq_oss_midi_open+0x10/0x10 [ 478.178894][T18584] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 478.178913][T18584] snd_seq_oss_midi_open_all+0x95/0xf0 [ 478.178936][T18584] snd_seq_oss_open+0x81c/0xa10 [ 478.178956][T18584] odev_open+0x6f/0x90 [ 478.178969][T18584] ? __pfx_odev_open+0x10/0x10 [ 478.178982][T18584] soundcore_open+0x2e3/0x5a0 [ 478.178999][T18584] ? __pfx_soundcore_open+0x10/0x10 [ 478.179013][T18584] chrdev_open+0x234/0x6a0 [ 478.179033][T18584] ? __pfx_apparmor_file_open+0x10/0x10 [ 478.179051][T18584] ? __pfx_chrdev_open+0x10/0x10 [ 478.179072][T18584] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 478.179103][T18584] do_dentry_open+0x6ab/0x14d0 [ 478.179121][T18584] ? __pfx_chrdev_open+0x10/0x10 [ 478.179145][T18584] vfs_open+0x82/0x3f0 [ 478.179170][T18584] path_openat+0x19fa/0x2440 [ 478.179194][T18584] ? __pfx_path_openat+0x10/0x10 [ 478.179220][T18584] do_file_open+0x20e/0x430 [ 478.179242][T18584] ? __pfx_do_file_open+0x10/0x10 [ 478.179277][T18584] ? _raw_spin_unlock+0x28/0x50 [ 478.179292][T18584] ? alloc_fd+0x471/0x7a0 [ 478.179320][T18584] do_sys_openat2+0x10f/0x1e0 [ 478.179346][T18584] ? __pfx_do_sys_openat2+0x10/0x10 [ 478.179370][T18584] ? find_held_lock+0x2b/0x80 [ 478.179387][T18584] ? __fget_files+0x215/0x3d0 [ 478.179410][T18584] __ia32_compat_sys_openat+0x12d/0x210 [ 478.179425][T18584] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 478.179450][T18584] __do_fast_syscall_32+0x13a/0x8b0 [ 478.179472][T18584] do_fast_syscall_32+0x32/0x70 [ 478.179491][T18584] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 478.179511][T18584] RIP: 0023:0xf7f97fec [ 478.179530][T18584] Code: Unable to access opcode bytes at 0xf7f97fc2. [ 478.179537][T18584] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 478.179556][T18584] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000180 [ 478.179567][T18584] RDX: 0000000000060042 RSI: 0000000000000000 RDI: 0000000000000000 [ 478.179578][T18584] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 478.179588][T18584] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 478.179599][T18584] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 478.179621][T18584] [ 478.256584][T18585] lo: entered allmulticast mode [ 478.262567][T18585] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 478.279611][T18583] lo: left allmulticast mode [ 478.405908][ T5839] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 478.405950][ T5839] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 478.409703][ T5839] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 478.409746][ T5839] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 478.410366][ T5839] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 478.416278][ T5839] lan78xx 9-1:1.0: probe with driver lan78xx failed with error -71 [ 478.430228][ T5839] usb 9-1: USB disconnect, device number 43 [ 478.662128][ T43] audit: type=1800 audit(1791015144.091:8188): pid=18597 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3927" name="file2" dev="sda1" ino=2047 res=0 errno=0 [ 481.653768][ T5748] usb 9-1: new high-speed USB device number 44 using dummy_hcd [ 481.832277][ T5748] usb 9-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 481.835240][ T5748] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.835258][ T5748] usb 9-1: Product: syz [ 481.835265][ T5748] usb 9-1: Manufacturer: syz [ 481.835273][ T5748] usb 9-1: SerialNumber: syz [ 482.070287][ T5748] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 482.070320][ T5748] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 482.070332][ T5748] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 482.071651][ T5748] lan78xx 9-1:1.0: probe with driver lan78xx failed with error -32 [ 482.099531][ T5748] usb 9-1: USB disconnect, device number 44 [ 484.606290][T18674] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 484.646782][ T61] usb 8-1: new high-speed USB device number 56 using dummy_hcd [ 484.822990][ T61] usb 8-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 484.826335][ T61] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.826355][ T61] usb 8-1: Product: syz [ 484.826366][ T61] usb 8-1: Manufacturer: syz [ 484.826376][ T61] usb 8-1: SerialNumber: syz [ 485.052028][ T61] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 485.052058][ T61] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 485.052068][ T61] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 485.053536][ T61] lan78xx 8-1:1.0: probe with driver lan78xx failed with error -32 [ 485.058106][ T61] usb 8-1: USB disconnect, device number 56 [ 485.728689][T18689] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3956'. [ 485.786383][T18689] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3956'. [ 486.071588][ T43] audit: type=1326 audit(1791015150.865:8189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18701 comm="syz.2.3959" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x0 [ 486.242774][T18707] netlink: 'syz.4.3960': attribute type 10 has an invalid length. [ 486.464316][T18715] netlink: 'syz.4.3961': attribute type 10 has an invalid length. [ 486.850991][ T5839] usb 9-1: new high-speed USB device number 45 using dummy_hcd [ 487.274571][ T5839] usb 9-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 487.463408][ T5839] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.463434][ T5839] usb 9-1: Product: syz [ 487.463446][ T5839] usb 9-1: Manufacturer: syz [ 487.463459][ T5839] usb 9-1: SerialNumber: syz [ 488.128210][ T5839] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 488.128240][ T5839] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 488.128251][ T5839] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 488.144141][ T5839] lan78xx 9-1:1.0: probe with driver lan78xx failed with error -32 [ 488.183356][ T5839] usb 9-1: USB disconnect, device number 45 [ 488.307750][T18745] netlink: 'syz.3.3971': attribute type 10 has an invalid length. [ 488.467443][ T43] audit: type=1326 audit(1791015153.063:8190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18754 comm="syz.3.3973" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f97fec code=0x0 [ 488.837786][T18764] Console: switching to colour dummy device 80x25 [ 488.899920][ T5748] kernel write not supported for file /gssd/clntXX/gssd (pid: 5748 comm: kworker/0:2) [ 489.198704][T18765] pci 0000:00:00.0: [8086:29c0] type 00 class 0x060000 conventional PCI endpoint [ 489.260636][T18765] pci 0000:00:00.0: Adding to iommu group 0 [ 489.263569][T18765] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 489.301560][T18765] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 489.366202][T18765] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff] [ 489.366399][T18765] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 489.366946][T18765] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 489.457860][T18765] pci 0000:00:01.0: Adding to iommu group 1 [ 489.468449][T18765] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 489.468492][T18765] pci 0000:00:01.0: vgaarb: bridge control possible [ 489.468504][T18765] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 489.475508][T18765] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 489.489522][T18765] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff]: assigned [ 489.515958][T18765] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 489.553343][T18765] [drm] Found bochs VGA, ID 0xb0c5. [ 489.553408][T18765] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81200000. [ 489.869123][ T43] audit: type=1800 audit(1791015154.346:8191): pid=18799 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3985" name="file2" dev="sda1" ino=2047 res=0 errno=0 [ 489.961539][T18765] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 490.018481][ T5748] usb 9-1: new high-speed USB device number 46 using dummy_hcd [ 490.184270][ T5748] usb 9-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 490.188442][ T5748] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.188502][ T5748] usb 9-1: Product: syz [ 490.188517][ T5748] usb 9-1: Manufacturer: syz [ 490.188529][ T5748] usb 9-1: SerialNumber: syz [ 490.205345][ T10] usb 7-1: new full-speed USB device number 54 using dummy_hcd [ 490.242139][T18765] Console: switching to colour frame buffer device 160x50 [ 490.276499][T18765] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 490.368543][ T10] usb 7-1: New USB device found, idVendor=0506, idProduct=4601, bcdDevice= 1.00 [ 490.369594][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 490.369664][ T10] usb 7-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 490.369676][ T10] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 490.369696][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.379917][ T10] pegasus 7-1:1.0: Missing or invalid endpoints [ 490.431289][ T5748] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 490.431320][ T5748] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 490.431331][ T5748] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 490.438322][ T5748] lan78xx 9-1:1.0: probe with driver lan78xx failed with error -32 [ 490.446844][ T5748] usb 9-1: USB disconnect, device number 46 [ 490.655823][ T5748] usb 7-1: USB disconnect, device number 54 [ 490.699029][T18808] lo: left promiscuous mode [ 490.700862][T18808] tunl0: left promiscuous mode [ 490.701603][T18808] gre0: left promiscuous mode [ 490.704139][T18808] gretap0: left promiscuous mode [ 490.705104][T18808] erspan0: left promiscuous mode [ 490.715684][T18808] ip_vti0: left promiscuous mode [ 490.716331][T18808] ip6_vti0: left promiscuous mode [ 490.720902][T18808] sit0: left promiscuous mode [ 490.724399][T18808] ip6tnl0: left promiscuous mode [ 490.725144][T18808] ip6gre0: left promiscuous mode [ 490.725786][T18808] ip6gretap0: left promiscuous mode [ 490.737630][T18808] bridge0: left promiscuous mode [ 490.738305][T18808] vcan0: left promiscuous mode [ 490.743194][T18808] bond0: left promiscuous mode [ 490.744050][T18808] 8021q: adding VLAN 0 to HW filter on device bond0 [ 490.744510][T18808] team0: left promiscuous mode [ 490.744997][T18808] 8021q: adding VLAN 0 to HW filter on device team0 [ 490.745663][T18808] dummy0: left promiscuous mode [ 490.745797][T18808] batman_adv: batadv0: Interface activated: dummy0 [ 490.745808][T18808] batadv0: mtu less than device minimum [ 490.746290][T18808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 490.746772][T18808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 490.747250][T18808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 490.747782][T18808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 490.748265][T18808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 490.748767][T18808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 490.749250][T18808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 490.749844][T18808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 490.750436][T18808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 490.801030][T18808] nlmon0: left promiscuous mode [ 490.802240][T18808] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 490.802609][T18808] vxcan0: left promiscuous mode [ 490.803168][T18808] vxcan1: left promiscuous mode [ 490.803652][T18808] veth0: left promiscuous mode [ 490.812429][T18808] veth1: left promiscuous mode [ 490.821276][T18808] wg0: left promiscuous mode [ 490.823687][T18808] wg1: left promiscuous mode [ 490.828009][T18808] wg2: left promiscuous mode [ 490.834122][T18808] veth0_to_bridge: left promiscuous mode [ 490.841664][T18808] veth1_to_bridge: left promiscuous mode [ 490.844487][T18808] veth0_to_bond: left promiscuous mode [ 490.845405][T18808] bond_slave_0: left promiscuous mode [ 490.846219][T18808] veth1_to_bond: left promiscuous mode [ 490.846818][T18808] bond_slave_1: left promiscuous mode [ 490.847299][T18808] veth0_to_team: left promiscuous mode [ 490.861997][T18808] team_slave_0: left promiscuous mode [ 490.862633][T18808] veth1_to_team: left promiscuous mode [ 490.863204][T18808] team_slave_1: left promiscuous mode [ 490.863736][T18808] veth0_to_batadv: left promiscuous mode [ 490.864644][T18808] batadv_slave_0: left promiscuous mode [ 490.865030][T18808] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 490.877682][T18808] veth1_to_batadv: left promiscuous mode [ 490.878219][T18808] batadv_slave_1: left promiscuous mode [ 490.878525][T18808] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 490.887676][T18808] xfrm0: left promiscuous mode [ 490.888430][T18808] veth0_to_hsr: left promiscuous mode [ 490.889641][T18808] veth1_to_hsr: left promiscuous mode [ 490.890534][T18808] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 490.890546][T18808] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 490.890572][T18808] hsr0: left promiscuous mode [ 490.891156][T18808] veth1_virt_wifi: left promiscuous mode [ 490.891863][T18808] veth0_virt_wifi: left promiscuous mode [ 490.892490][T18808] virt_wifi0: left promiscuous mode [ 490.893202][T18808] veth1_vlan: left promiscuous mode [ 490.894542][T18808] vlan0: left promiscuous mode [ 490.895118][T18808] vlan1: left promiscuous mode [ 490.896048][T18808] veth1_vlan: entered promiscuous mode [ 490.896159][T18808] macvlan0: left promiscuous mode [ 490.896825][T18808] macvlan1: left promiscuous mode [ 490.897405][T18808] ipvlan0: left promiscuous mode [ 490.898073][T18808] ipvlan1: left promiscuous mode [ 490.898879][T18808] geneve0: left promiscuous mode [ 490.899952][T18808] geneve1: left promiscuous mode [ 490.901041][T18808] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 490.901215][T18808] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 490.901635][T18808] netdevsim netdevsim3 netdevsim1: left promiscuous mode [ 490.901793][T18808] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 490.902222][T18808] netdevsim netdevsim3 netdevsim2: left promiscuous mode [ 490.902841][T18808] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 490.903269][T18808] netdevsim netdevsim3 netdevsim3: left promiscuous mode [ 490.903627][T18808] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 490.904089][T18808] mac80211_hwsim hwsim33 wlan0: left promiscuous mode [ 490.904507][T18808] mac80211_hwsim hwsim34 wlan1: left promiscuous mode [ 490.904815][T18808] erspan1: left promiscuous mode [ 490.905483][T18808] batadv0.5: left promiscuous mode [ 490.905493][T18808] batadv0: left promiscuous mode [ 490.906198][T18808] sit1: left promiscuous mode [ 490.927044][ T74] bridge0: port 1(bridge_slave_0) entered blocking state [ 490.927090][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state [ 490.930795][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 490.930842][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 490.968793][ T5839] vxcan1 speed is unknown, defaulting to 1000 [ 490.969755][ T5839] syz2: Port: 1 Link ACTIVE [ 490.974587][ T5839] vxcan1 speed is unknown, defaulting to 1000 [ 490.978978][ T5801] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.979013][ T5788] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.979038][ T5788] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.979056][ T5788] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.295958][ T854] usb 9-1: new full-speed USB device number 47 using dummy_hcd [ 491.470817][ T854] usb 9-1: New USB device found, idVendor=0403, idProduct=fc0c, bcdDevice= 0.7a [ 491.471793][ T854] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 491.471816][ T854] usb 9-1: can't read configurations, error -71 [ 492.221447][ T5744] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 493.117732][ T5846] usb 9-1: new high-speed USB device number 49 using dummy_hcd [ 493.284074][ T5846] usb 9-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 493.286606][ T5846] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.286622][ T5846] usb 9-1: Product: syz [ 493.286630][ T5846] usb 9-1: Manufacturer: syz [ 493.286638][ T5846] usb 9-1: SerialNumber: syz [ 493.483060][ T854] kernel write not supported for file /gssd/clntXX/gssd (pid: 854 comm: kworker/2:2) [ 493.518546][ T5846] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 493.518573][ T5846] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 493.548289][ T5846] lan78xx 9-1:1.0: probe with driver lan78xx failed with error -32 [ 493.564662][ T5846] usb 9-1: USB disconnect, device number 49 [ 493.586973][ T5839] usb 8-1: new full-speed USB device number 57 using dummy_hcd [ 493.681101][ T43] audit: type=1800 audit(1791015157.837:8192): pid=18860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.4003" name="file2" dev="sda1" ino=2047 res=0 errno=0 [ 493.823659][ T5839] usb 8-1: New USB device found, idVendor=0506, idProduct=4601, bcdDevice= 1.00 [ 493.935714][ T5839] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 493.935744][ T5839] usb 8-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 493.935756][ T5839] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 493.935777][ T5839] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.226057][ T5839] pegasus 8-1:1.0: Missing or invalid endpoints [ 494.403577][ T5744] Bluetooth: Unknown BR/EDR signaling command 0x0e [ 494.403603][ T5744] Bluetooth: Wrong link type (-22) [ 494.490381][ T5748] usb 8-1: USB disconnect, device number 57 [ 495.253187][T18883] FAULT_INJECTION: forcing a failure. [ 495.253187][T18883] name failslab, interval 1, probability 0, space 0, times 0 [ 495.253220][T18883] CPU: 0 UID: 0 PID: 18883 Comm: syz.3.4011 Tainted: G L syzkaller #0 PREEMPT(full) [ 495.253247][T18883] Tainted: [L]=SOFTLOCKUP [ 495.253254][T18883] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 495.253266][T18883] Call Trace: [ 495.253272][T18883] [ 495.253280][T18883] dump_stack_lvl+0x100/0x190 [ 495.253376][T18883] should_fail_ex.cold+0x5/0xa [ 495.253402][T18883] should_failslab+0xc2/0x120 [ 495.253454][T18883] __kmalloc_noprof+0xfc/0x840 [ 495.253476][T18883] ? rcu_is_watching+0x13/0xc0 [ 495.253498][T18883] ? tomoyo_realpath_from_path+0xb6/0x690 [ 495.253528][T18883] tomoyo_realpath_from_path+0xb6/0x690 [ 495.253558][T18883] tomoyo_path_number_perm+0x23c/0x580 [ 495.253577][T18883] ? tomoyo_path_number_perm+0x22e/0x580 [ 495.253599][T18883] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 495.253619][T18883] ? get_pid_task+0x106/0x250 [ 495.253646][T18883] ? __lock_acquire+0x5c0/0x1f40 [ 495.253687][T18883] ? __fget_files+0x34/0x3d0 [ 495.253711][T18883] ? find_held_lock+0x2b/0x80 [ 495.253732][T18883] ? __fget_files+0x215/0x3d0 [ 495.253752][T18883] ? hook_file_ioctl_common+0x140/0x440 [ 495.253770][T18883] ? __fget_files+0x215/0x3d0 [ 495.253796][T18883] ? __fget_files+0x21f/0x3d0 [ 495.253822][T18883] security_file_ioctl_compat+0xd3/0x230 [ 495.253842][T18883] __ia32_compat_sys_ioctl+0xc2/0x360 [ 495.253864][T18883] __do_fast_syscall_32+0x13a/0x8b0 [ 495.253912][T18883] ? lockdep_hardirqs_on+0x7d/0x110 [ 495.253936][T18883] do_fast_syscall_32+0x32/0x70 [ 495.253959][T18883] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 495.253980][T18883] RIP: 0023:0xf7f97fec [ 495.253999][T18883] Code: Unable to access opcode bytes at 0xf7f97fc2. [ 495.254006][T18883] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 495.254024][T18883] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000005607 [ 495.254034][T18883] RDX: 0000000000000015 RSI: 0000000000000000 RDI: 0000000000000000 [ 495.254042][T18883] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 495.254050][T18883] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 495.254059][T18883] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 495.254091][T18883] [ 495.254204][T18883] ERROR: Out of memory at tomoyo_realpath_from_path. [ 495.992337][T18899] FAULT_INJECTION: forcing a failure. [ 495.992337][T18899] name failslab, interval 1, probability 0, space 0, times 0 [ 495.992363][T18899] CPU: 2 UID: 0 PID: 18899 Comm: syz.2.4017 Tainted: G L syzkaller #0 PREEMPT(full) [ 495.992381][T18899] Tainted: [L]=SOFTLOCKUP [ 495.992386][T18899] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 495.992394][T18899] Call Trace: [ 495.992399][T18899] [ 495.992405][T18899] dump_stack_lvl+0x100/0x190 [ 495.992452][T18899] should_fail_ex.cold+0x5/0xa [ 495.992472][T18899] should_failslab+0xc2/0x120 [ 495.992492][T18899] __kmalloc_cache_noprof+0x91/0x6d0 [ 495.992506][T18899] ? snd_seq_port_use_ptr+0x3c/0x300 [ 495.992568][T18899] ? snd_seq_port_connect+0x61/0x540 [ 495.992584][T18899] snd_seq_port_connect+0x61/0x540 [ 495.992597][T18899] ? check_subscription_permission.isra.0+0x146/0x240 [ 495.992621][T18899] snd_seq_ioctl_subscribe_port+0x219/0x490 [ 495.992638][T18899] ? __pfx_snd_seq_ioctl_subscribe_port+0x10/0x10 [ 495.992656][T18899] ? lock_acquire+0x1d1/0x380 [ 495.992674][T18899] ? clientptr+0x20/0x190 [ 495.992692][T18899] ? find_held_lock+0x2b/0x80 [ 495.992706][T18899] ? clientptr+0x80/0x190 [ 495.992725][T18899] call_seq_client_ctl+0xa3/0x130 [ 495.992745][T18899] snd_seq_kernel_client_ctl+0x35/0x50 [ 495.992765][T18899] snd_seq_oss_midi_open+0x465/0x680 [ 495.992781][T18899] ? __pfx_snd_seq_oss_midi_open+0x10/0x10 [ 495.992803][T18899] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 495.992818][T18899] snd_seq_oss_midi_open_all+0x95/0xf0 [ 495.992836][T18899] snd_seq_oss_open+0x81c/0xa10 [ 495.992852][T18899] odev_open+0x6f/0x90 [ 495.992862][T18899] ? __pfx_odev_open+0x10/0x10 [ 495.992872][T18899] soundcore_open+0x2e3/0x5a0 [ 495.992886][T18899] ? __pfx_soundcore_open+0x10/0x10 [ 495.992898][T18899] chrdev_open+0x234/0x6a0 [ 495.992913][T18899] ? __pfx_apparmor_file_open+0x10/0x10 [ 495.992928][T18899] ? __pfx_chrdev_open+0x10/0x10 [ 495.992944][T18899] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 495.992966][T18899] do_dentry_open+0x6ab/0x14d0 [ 495.992981][T18899] ? __pfx_chrdev_open+0x10/0x10 [ 495.993000][T18899] vfs_open+0x82/0x3f0 [ 495.993020][T18899] path_openat+0x19fa/0x2440 [ 495.993038][T18899] ? __pfx_path_openat+0x10/0x10 [ 495.993059][T18899] do_file_open+0x20e/0x430 [ 495.993077][T18899] ? __pfx_do_file_open+0x10/0x10 [ 495.993104][T18899] ? _raw_spin_unlock+0x28/0x50 [ 495.993116][T18899] ? alloc_fd+0x471/0x7a0 [ 495.993137][T18899] do_sys_openat2+0x10f/0x1e0 [ 495.993161][T18899] ? __pfx_do_sys_openat2+0x10/0x10 [ 495.993182][T18899] ? find_held_lock+0x2b/0x80 [ 495.993196][T18899] ? __fget_files+0x215/0x3d0 [ 495.993216][T18899] __ia32_compat_sys_openat+0x12d/0x210 [ 495.993230][T18899] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 495.993250][T18899] __do_fast_syscall_32+0x13a/0x8b0 [ 495.993266][T18899] ? lockdep_hardirqs_on+0x7d/0x110 [ 495.993282][T18899] do_fast_syscall_32+0x32/0x70 [ 495.993299][T18899] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 495.993314][T18899] RIP: 0023:0xf701efec [ 495.993330][T18899] Code: Unable to access opcode bytes at 0xf701efc2. [ 495.993335][T18899] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 495.993347][T18899] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000180 [ 495.993355][T18899] RDX: 0000000000060042 RSI: 0000000000000000 RDI: 0000000000000000 [ 495.993362][T18899] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 495.993369][T18899] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 495.993376][T18899] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 495.993392][T18899] [ 496.479538][T18906] Console: switching to colour dummy device 80x25 [ 496.609761][T13879] net_ratelimit: 71 callbacks suppressed [ 496.609808][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 496.609832][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 496.740355][ T5748] kernel write not supported for file /gssd/clntXX/gssd (pid: 5748 comm: kworker/0:2) [ 497.165022][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 497.165046][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 497.535849][T18907] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 497.599229][T18907] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 497.599600][T18907] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff] [ 497.599797][T18907] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 497.612967][T18907] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 497.612993][T18907] pci 0000:00:01.0: pci_fixup_video+0x0/0x280 took 11043 usecs [ 497.675697][T18907] pci 0000:00:01.0: Adding to iommu group 1 [ 497.690064][T18907] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 497.690081][T18907] pci 0000:00:01.0: vgaarb: bridge control possible [ 497.690091][T18907] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 497.711830][T18907] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 497.711958][T18907] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff]: assigned [ 497.714293][T18907] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 497.775544][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 497.775566][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 497.826386][T18907] [drm] Found bochs VGA, ID 0xb0c5. [ 497.826406][T18907] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81200000. [ 497.929310][T18907] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 498.219145][T18907] Console: switching to colour frame buffer device 160x50 [ 498.256080][T18907] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 498.334873][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 498.334906][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 498.415833][ T5846] kernel write not supported for file /gssd/clntXX/gssd (pid: 5846 comm: kworker/0:3) [ 498.887887][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 498.887911][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 499.114513][T18956] netlink: 'syz.0.4033': attribute type 10 has an invalid length. [ 499.538061][T18975] dvmrp6: entered allmulticast mode [ 499.692904][ T5839] kernel write not supported for file /gssd/clntXX/gssd (pid: 5839 comm: kworker/3:6) [ 499.908442][T18980] FAULT_INJECTION: forcing a failure. [ 499.908442][T18980] name fail_futex, interval 1, probability 0, space 0, times 0 [ 499.908486][T18980] CPU: 0 UID: 0 PID: 18980 Comm: syz.0.4041 Tainted: G L syzkaller #0 PREEMPT(full) [ 499.908517][T18980] Tainted: [L]=SOFTLOCKUP [ 499.908526][T18980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 499.908540][T18980] Call Trace: [ 499.908549][T18980] [ 499.908559][T18980] dump_stack_lvl+0x100/0x190 [ 499.908692][T18980] should_fail_ex.cold+0x5/0xa [ 499.908723][T18980] get_futex_key+0x1d0/0x14f0 [ 499.908751][T18980] ? __pfx_get_futex_key+0x10/0x10 [ 499.908785][T18980] futex_wait_setup+0x91/0x540 [ 499.908829][T18980] __futex_wait+0x19f/0x300 [ 499.908861][T18980] ? __pfx___futex_wait+0x10/0x10 [ 499.908888][T18980] ? futex_hash+0x311/0x400 [ 499.908913][T18980] ? __pfx_futex_wake_mark+0x10/0x10 [ 499.908947][T18980] ? __pfx_futex_hash+0x10/0x10 [ 499.908979][T18980] futex_wait+0xe6/0x370 [ 499.909007][T18980] ? __pfx_futex_wait+0x10/0x10 [ 499.909043][T18980] ? irqentry_exit+0x24d/0xa10 [ 499.909119][T18980] do_futex+0x265/0x440 [ 499.909146][T18980] ? __pfx_do_futex+0x10/0x10 [ 499.909171][T18980] ? strncpy_from_user+0x275/0x2d0 [ 499.909242][T18980] __ia32_sys_futex_time32+0x2f4/0x470 [ 499.909276][T18980] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 499.909316][T18980] __do_fast_syscall_32+0x13a/0x8b0 [ 499.909349][T18980] do_fast_syscall_32+0x32/0x70 [ 499.909376][T18980] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 499.909402][T18980] RIP: 0023:0xf7fe2fec [ 499.909427][T18980] Code: Unable to access opcode bytes at 0xf7fe2fc2. [ 499.909438][T18980] RSP: 002b:00000000f54a65bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 499.909464][T18980] RAX: ffffffffffffffda RBX: 00000000f74a4f88 RCX: 0000000000000080 [ 499.909482][T18980] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f74a4f8c [ 499.909496][T18980] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 499.909615][T18980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 499.909644][T18980] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 499.909676][T18980] [ 500.315028][ T5744] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 500.654495][T19008] netlink: 'syz.2.4047': attribute type 10 has an invalid length. [ 500.973345][T19019] FAULT_INJECTION: forcing a failure. [ 500.973345][T19019] name failslab, interval 1, probability 0, space 0, times 0 [ 500.973369][T19019] CPU: 0 UID: 0 PID: 19019 Comm: syz.2.4051 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.973386][T19019] Tainted: [L]=SOFTLOCKUP [ 500.973392][T19019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 500.973400][T19019] Call Trace: [ 500.973405][T19019] [ 500.973411][T19019] dump_stack_lvl+0x100/0x190 [ 500.973433][T19019] should_fail_ex.cold+0x5/0xa [ 500.973449][T19019] should_failslab+0xc2/0x120 [ 500.973472][T19019] __kmalloc_cache_noprof+0x91/0x6d0 [ 500.973485][T19019] ? snd_seq_port_use_ptr+0x3c/0x300 [ 500.973543][T19019] ? snd_seq_port_connect+0x61/0x540 [ 500.973558][T19019] snd_seq_port_connect+0x61/0x540 [ 500.973572][T19019] ? check_subscription_permission.isra.0+0x146/0x240 [ 500.973595][T19019] snd_seq_ioctl_subscribe_port+0x219/0x490 [ 500.973699][T19019] ? __pfx_snd_seq_ioctl_subscribe_port+0x10/0x10 [ 500.973714][T19019] ? lock_acquire+0x1d1/0x380 [ 500.973733][T19019] ? clientptr+0x20/0x190 [ 500.973755][T19019] ? find_held_lock+0x2b/0x80 [ 500.973771][T19019] ? clientptr+0x80/0x190 [ 500.973792][T19019] call_seq_client_ctl+0xa3/0x130 [ 500.973814][T19019] snd_seq_kernel_client_ctl+0x35/0x50 [ 500.973835][T19019] snd_seq_oss_midi_open+0x465/0x680 [ 500.973851][T19019] ? __pfx_snd_seq_oss_midi_open+0x10/0x10 [ 500.973885][T19019] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 500.973902][T19019] snd_seq_oss_midi_open_all+0x95/0xf0 [ 500.973920][T19019] snd_seq_oss_open+0x81c/0xa10 [ 500.973935][T19019] odev_open+0x6f/0x90 [ 500.973945][T19019] ? __pfx_odev_open+0x10/0x10 [ 500.973955][T19019] soundcore_open+0x2e3/0x5a0 [ 500.973975][T19019] ? __pfx_soundcore_open+0x10/0x10 [ 500.973987][T19019] chrdev_open+0x234/0x6a0 [ 500.974004][T19019] ? __pfx_apparmor_file_open+0x10/0x10 [ 500.974021][T19019] ? __pfx_chrdev_open+0x10/0x10 [ 500.974038][T19019] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 500.974060][T19019] do_dentry_open+0x6ab/0x14d0 [ 500.974076][T19019] ? __pfx_chrdev_open+0x10/0x10 [ 500.974095][T19019] vfs_open+0x82/0x3f0 [ 500.974115][T19019] path_openat+0x19fa/0x2440 [ 500.974133][T19019] ? __pfx_path_openat+0x10/0x10 [ 500.974153][T19019] do_file_open+0x20e/0x430 [ 500.974170][T19019] ? __pfx_do_file_open+0x10/0x10 [ 500.974197][T19019] ? _raw_spin_unlock+0x28/0x50 [ 500.974209][T19019] ? alloc_fd+0x471/0x7a0 [ 500.974229][T19019] do_sys_openat2+0x10f/0x1e0 [ 500.974247][T19019] ? __pfx_do_sys_openat2+0x10/0x10 [ 500.974266][T19019] ? find_held_lock+0x2b/0x80 [ 500.974279][T19019] ? __fget_files+0x215/0x3d0 [ 500.974298][T19019] __ia32_compat_sys_openat+0x12d/0x210 [ 500.974312][T19019] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 500.974332][T19019] __do_fast_syscall_32+0x13a/0x8b0 [ 500.974348][T19019] ? lockdep_hardirqs_on+0x7d/0x110 [ 500.974363][T19019] do_fast_syscall_32+0x32/0x70 [ 500.974377][T19019] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 500.974394][T19019] RIP: 0023:0xf701efec [ 500.974408][T19019] Code: Unable to access opcode bytes at 0xf701efc2. [ 500.974414][T19019] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 500.974427][T19019] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000180 [ 500.974435][T19019] RDX: 0000000000060042 RSI: 0000000000000000 RDI: 0000000000000000 [ 500.974443][T19019] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 500.974451][T19019] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 500.974459][T19019] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 500.974475][T19019] [ 501.374252][T19028] netlink: 'syz.4.4050': attribute type 39 has an invalid length. [ 502.214880][T19046] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4058'. [ 502.214950][T19046] net_ratelimit: 11 callbacks suppressed [ 502.214959][T19046] openvswitch: netlink: Missing valid actions attribute. [ 502.222411][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 502.222431][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 502.509190][T19055] FAULT_INJECTION: forcing a failure. [ 502.509190][T19055] name fail_futex, interval 1, probability 0, space 0, times 0 [ 502.509226][T19055] CPU: 3 UID: 0 PID: 19055 Comm: syz.3.4061 Tainted: G L syzkaller #0 PREEMPT(full) [ 502.509255][T19055] Tainted: [L]=SOFTLOCKUP [ 502.509263][T19055] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 502.509275][T19055] Call Trace: [ 502.509284][T19055] [ 502.509293][T19055] dump_stack_lvl+0x100/0x190 [ 502.509325][T19055] should_fail_ex.cold+0x5/0xa [ 502.509354][T19055] get_futex_key+0x1d0/0x14f0 [ 502.509380][T19055] ? __pfx_get_futex_key+0x10/0x10 [ 502.509411][T19055] futex_wait_setup+0x91/0x540 [ 502.509446][T19055] __futex_wait+0x19f/0x300 [ 502.509486][T19055] ? __pfx___futex_wait+0x10/0x10 [ 502.509515][T19055] ? __pfx_try_to_wake_up+0x10/0x10 [ 502.509546][T19055] ? futex_hash+0x311/0x400 [ 502.509570][T19055] ? __pfx_futex_wake_mark+0x10/0x10 [ 502.509601][T19055] ? find_held_lock+0x2b/0x80 [ 502.509626][T19055] ? futex_wake+0x4ea/0x5e0 [ 502.509658][T19055] futex_wait+0xe6/0x370 [ 502.509685][T19055] ? __pfx_futex_wait+0x10/0x10 [ 502.509716][T19055] ? irqentry_exit+0x24d/0xa10 [ 502.509749][T19055] do_futex+0x265/0x440 [ 502.509774][T19055] ? __pfx_do_futex+0x10/0x10 [ 502.509796][T19055] ? strncpy_from_user+0x275/0x2d0 [ 502.509832][T19055] __ia32_sys_futex_time32+0x2f4/0x470 [ 502.509861][T19055] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 502.509898][T19055] __do_fast_syscall_32+0x13a/0x8b0 [ 502.509924][T19055] ? lockdep_hardirqs_on+0x7d/0x110 [ 502.509951][T19055] do_fast_syscall_32+0x32/0x70 [ 502.509977][T19055] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 502.510003][T19055] RIP: 0023:0xf7f97fec [ 502.510024][T19055] Code: Unable to access opcode bytes at 0xf7f97fc2. [ 502.510034][T19055] RSP: 002b:00000000f54565bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 502.510055][T19055] RAX: ffffffffffffffda RBX: 00000000f7454f88 RCX: 0000000000000080 [ 502.510069][T19055] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7454f8c [ 502.510082][T19055] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 502.510095][T19055] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 502.510107][T19055] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 502.510136][T19055] [ 502.555077][T19057] netlink: 'syz.4.4060': attribute type 10 has an invalid length. [ 502.623886][T19055] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 502.775022][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 502.775044][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 502.852050][ T5748] kernel write not supported for file /gssd/clntXX/gssd (pid: 5748 comm: kworker/0:2) [ 503.327613][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 503.327638][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 503.816201][ T5748] usb 9-1: new high-speed USB device number 50 using dummy_hcd [ 503.825396][T19068] Console: switching to colour dummy device 80x25 [ 503.883957][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 503.883988][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 503.994845][ T5748] usb 9-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 503.996886][ T5748] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 503.996902][ T5748] usb 9-1: config 1 has no interface number 0 [ 504.009375][ T5748] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.009392][ T5748] usb 9-1: Product: syz [ 504.009400][ T5748] usb 9-1: Manufacturer: syz [ 504.009408][ T5748] usb 9-1: SerialNumber: syz [ 504.031387][ T5748] usb 9-1: 3:0 : does not exist [ 504.031405][ T5748] usb 9-1: 3:0 : does not exist [ 504.433131][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 504.828002][ T5748] usb 9-1: USB disconnect, device number 50 [ 505.130928][T19079] netlink: 'syz.0.4069': attribute type 39 has an invalid length. [ 505.383963][T19086] FAULT_INJECTION: forcing a failure. [ 505.383963][T19086] name failslab, interval 1, probability 0, space 0, times 0 [ 505.383993][T19086] CPU: 2 UID: 0 PID: 19086 Comm: syz.0.4070 Tainted: G L syzkaller #0 PREEMPT(full) [ 505.384021][T19086] Tainted: [L]=SOFTLOCKUP [ 505.384030][T19086] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 505.384043][T19086] Call Trace: [ 505.384050][T19086] [ 505.384059][T19086] dump_stack_lvl+0x100/0x190 [ 505.384085][T19086] should_fail_ex.cold+0x5/0xa [ 505.384117][T19086] should_failslab+0xc2/0x120 [ 505.384146][T19086] __kmalloc_cache_noprof+0x91/0x6d0 [ 505.384164][T19086] ? snd_seq_port_use_ptr+0x3c/0x300 [ 505.384192][T19086] ? snd_seq_port_connect+0x61/0x540 [ 505.384215][T19086] snd_seq_port_connect+0x61/0x540 [ 505.384233][T19086] ? check_subscription_permission.isra.0+0x146/0x240 [ 505.384262][T19086] snd_seq_ioctl_subscribe_port+0x219/0x490 [ 505.384284][T19086] ? __pfx_snd_seq_ioctl_subscribe_port+0x10/0x10 [ 505.384306][T19086] ? lock_acquire+0x1d1/0x380 [ 505.384332][T19086] ? clientptr+0x20/0x190 [ 505.384359][T19086] ? find_held_lock+0x2b/0x80 [ 505.384375][T19086] ? clientptr+0x80/0x190 [ 505.384434][T19086] call_seq_client_ctl+0xa3/0x130 [ 505.384466][T19086] snd_seq_kernel_client_ctl+0x35/0x50 [ 505.384496][T19086] snd_seq_oss_midi_open+0x465/0x680 [ 505.384520][T19086] ? __pfx_snd_seq_oss_midi_open+0x10/0x10 [ 505.384553][T19086] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 505.384578][T19086] snd_seq_oss_midi_open_all+0x95/0xf0 [ 505.384600][T19086] snd_seq_oss_open+0x81c/0xa10 [ 505.384624][T19086] odev_open+0x6f/0x90 [ 505.384640][T19086] ? __pfx_odev_open+0x10/0x10 [ 505.384656][T19086] soundcore_open+0x2e3/0x5a0 [ 505.384677][T19086] ? __pfx_soundcore_open+0x10/0x10 [ 505.384689][T19086] chrdev_open+0x234/0x6a0 [ 505.384712][T19086] ? __pfx_apparmor_file_open+0x10/0x10 [ 505.384735][T19086] ? __pfx_chrdev_open+0x10/0x10 [ 505.384761][T19086] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 505.384789][T19086] do_dentry_open+0x6ab/0x14d0 [ 505.384811][T19086] ? __pfx_chrdev_open+0x10/0x10 [ 505.384842][T19086] vfs_open+0x82/0x3f0 [ 505.384872][T19086] path_openat+0x19fa/0x2440 [ 505.384896][T19086] ? __pfx_path_openat+0x10/0x10 [ 505.384928][T19086] do_file_open+0x20e/0x430 [ 505.384956][T19086] ? __pfx_do_file_open+0x10/0x10 [ 505.384992][T19086] ? _raw_spin_unlock+0x28/0x50 [ 505.385012][T19086] ? alloc_fd+0x471/0x7a0 [ 505.385044][T19086] do_sys_openat2+0x10f/0x1e0 [ 505.385074][T19086] ? __pfx_do_sys_openat2+0x10/0x10 [ 505.385099][T19086] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 505.385131][T19086] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 505.385164][T19086] __ia32_compat_sys_openat+0x12d/0x210 [ 505.385181][T19086] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 505.385210][T19086] __do_fast_syscall_32+0x13a/0x8b0 [ 505.385238][T19086] do_fast_syscall_32+0x32/0x70 [ 505.385262][T19086] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 505.385281][T19086] RIP: 0023:0xf7fe2fec [ 505.385301][T19086] Code: Unable to access opcode bytes at 0xf7fe2fc2. [ 505.385310][T19086] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 505.385330][T19086] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000180 [ 505.385344][T19086] RDX: 0000000000060042 RSI: 0000000000000000 RDI: 0000000000000000 [ 505.385357][T19086] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 505.385368][T19086] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 505.385377][T19086] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 505.385402][T19086] [ 505.712263][T18345] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 505.886020][T18345] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 505.889046][T18345] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.889061][T18345] usb 5-1: Product: syz [ 505.889070][T18345] usb 5-1: Manufacturer: syz [ 505.889079][T18345] usb 5-1: SerialNumber: syz [ 505.918759][T19099] netlink: 'syz.4.4074': attribute type 10 has an invalid length. [ 506.460928][T18345] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 506.462487][T18345] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 506.480579][T18345] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 506.521405][T18345] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 506.693786][T18345] usb 5-1: USB disconnect, device number 25 [ 506.970749][T19114] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 507.102632][T19114] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 507.102771][T19114] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff] [ 507.103013][T19114] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 507.103472][T19114] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 507.124046][T19114] pci 0000:00:01.0: Adding to iommu group 1 [ 507.143302][T19118] FAULT_INJECTION: forcing a failure. [ 507.143302][T19118] name failslab, interval 1, probability 0, space 0, times 0 [ 507.143328][T19118] CPU: 0 UID: 0 PID: 19118 Comm: syz.2.4080 Tainted: G L syzkaller #0 PREEMPT(full) [ 507.143347][T19118] Tainted: [L]=SOFTLOCKUP [ 507.143352][T19118] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 507.143360][T19118] Call Trace: [ 507.143412][T19118] [ 507.143418][T19118] dump_stack_lvl+0x100/0x190 [ 507.143478][T19118] should_fail_ex.cold+0x5/0xa [ 507.143499][T19118] should_failslab+0xc2/0x120 [ 507.143550][T19118] __kmalloc_cache_noprof+0x91/0x6d0 [ 507.143568][T19118] ? snd_seq_port_use_ptr+0x3c/0x300 [ 507.143622][T19118] ? snd_seq_port_connect+0x61/0x540 [ 507.143641][T19118] snd_seq_port_connect+0x61/0x540 [ 507.143653][T19118] ? check_subscription_permission.isra.0+0x146/0x240 [ 507.143676][T19118] snd_seq_ioctl_subscribe_port+0x219/0x490 [ 507.143690][T19118] ? __pfx_snd_seq_ioctl_subscribe_port+0x10/0x10 [ 507.143703][T19118] ? lock_acquire+0x1d1/0x380 [ 507.143721][T19118] ? clientptr+0x20/0x190 [ 507.143739][T19118] ? find_held_lock+0x2b/0x80 [ 507.143753][T19118] ? clientptr+0x80/0x190 [ 507.143772][T19118] call_seq_client_ctl+0xa3/0x130 [ 507.143791][T19118] snd_seq_kernel_client_ctl+0x35/0x50 [ 507.143810][T19118] snd_seq_oss_midi_open+0x465/0x680 [ 507.143827][T19118] ? __pfx_snd_seq_oss_midi_open+0x10/0x10 [ 507.143848][T19118] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 507.143863][T19118] snd_seq_oss_midi_open_all+0x95/0xf0 [ 507.143880][T19118] snd_seq_oss_open+0x81c/0xa10 [ 507.143896][T19118] odev_open+0x6f/0x90 [ 507.143905][T19118] ? __pfx_odev_open+0x10/0x10 [ 507.143916][T19118] soundcore_open+0x2e3/0x5a0 [ 507.143929][T19118] ? __pfx_soundcore_open+0x10/0x10 [ 507.143941][T19118] chrdev_open+0x234/0x6a0 [ 507.143956][T19118] ? __pfx_apparmor_file_open+0x10/0x10 [ 507.143970][T19118] ? __pfx_chrdev_open+0x10/0x10 [ 507.143986][T19118] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 507.144008][T19118] do_dentry_open+0x6ab/0x14d0 [ 507.144025][T19118] ? __pfx_chrdev_open+0x10/0x10 [ 507.144046][T19118] vfs_open+0x82/0x3f0 [ 507.144065][T19118] path_openat+0x19fa/0x2440 [ 507.144084][T19118] ? __pfx_path_openat+0x10/0x10 [ 507.144104][T19118] do_file_open+0x20e/0x430 [ 507.144121][T19118] ? __pfx_do_file_open+0x10/0x10 [ 507.144147][T19118] ? _raw_spin_unlock+0x28/0x50 [ 507.144186][T19118] ? alloc_fd+0x471/0x7a0 [ 507.144208][T19118] do_sys_openat2+0x10f/0x1e0 [ 507.144229][T19118] ? __pfx_do_sys_openat2+0x10/0x10 [ 507.144264][T19118] ? find_held_lock+0x2b/0x80 [ 507.144279][T19118] ? __fget_files+0x215/0x3d0 [ 507.144297][T19118] __ia32_compat_sys_openat+0x12d/0x210 [ 507.144310][T19118] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 507.144329][T19118] __do_fast_syscall_32+0x13a/0x8b0 [ 507.144344][T19118] ? lockdep_hardirqs_on+0x7d/0x110 [ 507.144362][T19118] do_fast_syscall_32+0x32/0x70 [ 507.144401][T19118] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 507.144420][T19118] RIP: 0023:0xf701efec [ 507.144436][T19118] Code: Unable to access opcode bytes at 0xf701efc2. [ 507.144463][T19118] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 507.144477][T19118] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000180 [ 507.144485][T19118] RDX: 0000000000060042 RSI: 0000000000000000 RDI: 0000000000000000 [ 507.144494][T19118] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 507.144501][T19118] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 507.144509][T19118] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 507.144533][T19118] [ 507.184907][T19114] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 507.184921][T19114] pci 0000:00:01.0: vgaarb: bridge control possible [ 507.184929][T19114] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 507.297830][T19114] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 507.297956][T19114] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff]: assigned [ 507.300695][T19114] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 507.333166][T19114] [drm] Found bochs VGA, ID 0xb0c5. [ 507.333179][T19114] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81200000. [ 507.347202][T19114] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 507.368407][T19129] netlink: 'syz.4.4083': attribute type 10 has an invalid length. [ 507.481710][T19114] Console: switching to colour frame buffer device 160x50 [ 507.514114][T19114] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 507.731024][T19130] Console: switching to colour dummy device 80x25 [ 507.847721][ T5788] net_ratelimit: 13 callbacks suppressed [ 507.847744][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 507.847766][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 508.002897][T19131] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 508.017439][T19131] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 508.018193][T19131] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff] [ 508.018928][T19131] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 508.031312][T19131] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 508.127449][T19131] pci 0000:00:01.0: Adding to iommu group 1 [ 508.139130][T19131] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 508.139153][T19131] pci 0000:00:01.0: vgaarb: bridge control possible [ 508.139166][T19131] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 508.160471][T19131] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 508.160661][T19131] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff]: assigned [ 508.166823][T19131] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 508.196323][T19131] [drm] Found bochs VGA, ID 0xb0c5. [ 508.196339][T19131] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81200000. [ 508.243146][T19131] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 508.373126][T19144] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4087'. [ 508.419004][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 508.419026][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 508.496612][T19131] Console: switching to colour frame buffer device 160x50 [ 508.547981][T19131] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 508.879727][T19144] vxcan1 speed is unknown, defaulting to 1000 [ 508.963015][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 508.963036][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 509.017881][T19161] netlink: 'syz.4.4092': attribute type 10 has an invalid length. [ 509.130574][T19144] dummy0 speed is unknown, defaulting to 1000 [ 509.538922][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 509.538959][ T5788] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 509.782834][T19176] Console: switching to colour dummy device 80x25 [ 510.090128][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 510.090150][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 510.376418][T19177] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 510.592390][T19177] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 510.592620][T19177] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff] [ 510.592887][T19177] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 510.595390][T19177] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 510.662897][T19177] pci 0000:00:01.0: Adding to iommu group 1 [ 510.682159][T19177] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 510.682176][T19177] pci 0000:00:01.0: vgaarb: bridge control possible [ 510.682186][T19177] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 510.712707][T19177] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 510.712899][T19177] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff]: assigned [ 510.714725][T19177] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 510.735918][T19177] [drm] Found bochs VGA, ID 0xb0c5. [ 510.735981][T19177] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81200000. [ 510.762360][T19177] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 510.953672][T19177] Console: switching to colour frame buffer device 160x50 [ 511.080403][T19177] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 511.776844][T19185] netlink: 'syz.4.4097': attribute type 39 has an invalid length. [ 512.152976][T19203] netlink: 'syz.4.4101': attribute type 10 has an invalid length. [ 512.537708][ T10] kernel write not supported for file /gssd/clntXX/gssd (pid: 10 comm: kworker/0:1) [ 512.617384][ T5748] usb 7-1: new high-speed USB device number 55 using dummy_hcd [ 512.732412][T19214] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4106'. [ 512.800689][ T5748] usb 7-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 512.804043][ T5748] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.804060][ T5748] usb 7-1: Product: syz [ 512.804067][ T5748] usb 7-1: Manufacturer: syz [ 512.804075][ T5748] usb 7-1: SerialNumber: syz [ 512.882728][ T61] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 512.935608][T19219] FAULT_INJECTION: forcing a failure. [ 512.935608][T19219] name failslab, interval 1, probability 0, space 0, times 0 [ 512.935631][T19219] CPU: 3 UID: 0 PID: 19219 Comm: syz.4.4108 Tainted: G L syzkaller #0 PREEMPT(full) [ 512.935647][T19219] Tainted: [L]=SOFTLOCKUP [ 512.935652][T19219] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 512.935659][T19219] Call Trace: [ 512.935665][T19219] [ 512.935670][T19219] dump_stack_lvl+0x100/0x190 [ 512.935745][T19219] should_fail_ex.cold+0x5/0xa [ 512.935763][T19219] should_failslab+0xc2/0x120 [ 512.935800][T19219] __kmalloc_cache_noprof+0x91/0x6d0 [ 512.935813][T19219] ? snd_seq_port_use_ptr+0x3c/0x300 [ 512.935851][T19219] ? snd_seq_port_connect+0x61/0x540 [ 512.935867][T19219] snd_seq_port_connect+0x61/0x540 [ 512.935879][T19219] ? check_subscription_permission.isra.0+0x146/0x240 [ 512.935903][T19219] snd_seq_ioctl_subscribe_port+0x219/0x490 [ 512.935919][T19219] ? __pfx_snd_seq_ioctl_subscribe_port+0x10/0x10 [ 512.935933][T19219] ? lock_acquire+0x1d1/0x380 [ 512.935952][T19219] ? clientptr+0x20/0x190 [ 512.935974][T19219] ? find_held_lock+0x2b/0x80 [ 512.935987][T19219] ? clientptr+0x80/0x190 [ 512.936006][T19219] call_seq_client_ctl+0xa3/0x130 [ 512.936025][T19219] snd_seq_kernel_client_ctl+0x35/0x50 [ 512.936044][T19219] snd_seq_oss_midi_open+0x465/0x680 [ 512.936061][T19219] ? __pfx_snd_seq_oss_midi_open+0x10/0x10 [ 512.936083][T19219] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 512.936100][T19219] snd_seq_oss_midi_open_all+0x95/0xf0 [ 512.936118][T19219] snd_seq_oss_open+0x81c/0xa10 [ 512.936135][T19219] odev_open+0x6f/0x90 [ 512.936145][T19219] ? __pfx_odev_open+0x10/0x10 [ 512.936155][T19219] soundcore_open+0x2e3/0x5a0 [ 512.936168][T19219] ? __pfx_soundcore_open+0x10/0x10 [ 512.936179][T19219] chrdev_open+0x234/0x6a0 [ 512.936194][T19219] ? __pfx_apparmor_file_open+0x10/0x10 [ 512.936208][T19219] ? __pfx_chrdev_open+0x10/0x10 [ 512.936223][T19219] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 512.936251][T19219] do_dentry_open+0x6ab/0x14d0 [ 512.936272][T19219] ? __pfx_chrdev_open+0x10/0x10 [ 512.936300][T19219] vfs_open+0x82/0x3f0 [ 512.936329][T19219] path_openat+0x19fa/0x2440 [ 512.936380][T19219] ? __pfx_path_openat+0x10/0x10 [ 512.936405][T19219] do_file_open+0x20e/0x430 [ 512.936429][T19219] ? __pfx_do_file_open+0x10/0x10 [ 512.936469][T19219] ? _raw_spin_unlock+0x28/0x50 [ 512.936518][T19219] ? alloc_fd+0x471/0x7a0 [ 512.936552][T19219] do_sys_openat2+0x10f/0x1e0 [ 512.936582][T19219] ? __pfx_do_sys_openat2+0x10/0x10 [ 512.936613][T19219] ? find_held_lock+0x2b/0x80 [ 512.936634][T19219] ? __fget_files+0x215/0x3d0 [ 512.936665][T19219] __ia32_compat_sys_openat+0x12d/0x210 [ 512.936686][T19219] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 512.936718][T19219] __do_fast_syscall_32+0x13a/0x8b0 [ 512.936743][T19219] ? lockdep_hardirqs_on+0x7d/0x110 [ 512.936769][T19219] do_fast_syscall_32+0x32/0x70 [ 512.936795][T19219] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 512.936820][T19219] RIP: 0023:0xf7f15fec [ 512.936843][T19219] Code: Unable to access opcode bytes at 0xf7f15fc2. [ 512.936852][T19219] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 512.936872][T19219] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000180 [ 512.936887][T19219] RDX: 0000000000060042 RSI: 0000000000000000 RDI: 0000000000000000 [ 512.936900][T19219] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 512.936912][T19219] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 512.936925][T19219] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 512.936951][T19219] [ 512.968777][T19219] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 513.060217][ T61] usb 5-1: New USB device found, idVendor=1235, idProduct=8203, bcdDevice= 0.40 [ 513.064598][ T61] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.064623][ T61] usb 5-1: Product: syz [ 513.064639][ T61] usb 5-1: Manufacturer: syz [ 513.064653][ T61] usb 5-1: SerialNumber: syz [ 513.099116][T19222] fuse: Unknown parameter '0x0000000000000006' [ 513.273123][ T5748] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 513.273463][ T5748] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 513.273838][ T5748] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 513.281373][ T5748] lan78xx 7-1:1.0: probe with driver lan78xx failed with error -71 [ 513.288428][ T5748] usb 7-1: USB disconnect, device number 55 [ 513.306638][ T61] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 513.308983][ T61] usb 5-1: Focusrite Scarlett Gen 2 Mixer Driver enabled (pid=0x8203); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 513.309044][ T61] usb 5-1: Error initialising Scarlett Gen 2 Mixer Driver: -22 [ 513.342072][ T61] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 513.350869][ T61] usb 5-1: USB disconnect, device number 26 [ 513.352507][ T5820] usb 9-1: new high-speed USB device number 51 using dummy_hcd [ 513.383922][T17087] udevd[17087]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 513.427992][T13879] net_ratelimit: 12 callbacks suppressed [ 513.428008][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 513.428022][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 513.515069][ T5820] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 513.516048][ T5820] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 513.516063][ T5820] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 513.516075][ T5820] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 513.517884][ T5820] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.517897][ T5820] usb 9-1: Product: syz [ 513.517905][ T5820] usb 9-1: Manufacturer: syz [ 513.517912][ T5820] usb 9-1: SerialNumber: syz [ 513.520372][ T5820] hub 9-1:1.0: bad descriptor, ignoring hub [ 513.520387][ T5820] hub 9-1:1.0: probe with driver hub failed with error -5 [ 513.748516][ T5820] usblp 9-1:1.0: usblp0: USB Unidirectional printer dev 51 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 513.973470][T19229] netlink: 'syz.2.4112': attribute type 10 has an invalid length. [ 514.006495][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 514.006530][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 514.055211][T19235] Console: switching to colour dummy device 80x25 [ 514.177308][ T10] usb 9-1: USB disconnect, device number 51 [ 514.178754][ T10] usblp0: removed [ 514.500681][T19237] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 514.512269][T19237] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 514.512800][T19237] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff] [ 514.513188][T19237] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 514.515068][T19237] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 514.551479][T19237] pci 0000:00:01.0: Adding to iommu group 1 [ 514.567108][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 514.567135][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 514.567880][T19237] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 514.567895][T19237] pci 0000:00:01.0: vgaarb: bridge control possible [ 514.567905][T19237] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 514.585180][T19237] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 514.585599][T19237] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff]: assigned [ 514.594634][T19237] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 514.641341][T19237] [drm] Found bochs VGA, ID 0xb0c5. [ 514.641355][T19237] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81200000. [ 514.675553][T19237] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 514.953570][T19237] Console: switching to colour frame buffer device 160x50 [ 515.021744][T19237] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 515.120597][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 515.120620][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 516.141885][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 516.142046][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 516.737247][T19257] netlink: 'syz.4.4118': attribute type 39 has an invalid length. [ 517.076623][T19268] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4121'. [ 517.259324][T19279] netlink: 'syz.2.4122': attribute type 10 has an invalid length. [ 517.272885][T19281] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4125'. [ 518.006942][T19291] gtp0: entered promiscuous mode [ 518.006964][T19291] gtp0: entered allmulticast mode [ 518.060891][T19292] 9p: Bad value for 'rfdno' [ 518.099400][T19272] nvme nvme0: rdma connection establishment failed (-512) [ 518.764142][T19319] netlink: 'syz.3.4134': attribute type 10 has an invalid length. [ 518.922369][ T5801] net_ratelimit: 8 callbacks suppressed [ 518.922390][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 518.922412][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 518.947982][T19315] netlink: 'syz.2.4133': attribute type 39 has an invalid length. [ 519.476796][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 519.476828][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 519.666849][T19359] binder: 19358:19359 ioctl 8008551d 800002c0 returned -22 [ 519.667455][T19359] binder: 19358:19359 ioctl c0306201 800002c0 returned -14 [ 520.029780][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 520.029840][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 520.581175][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 520.581211][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 521.067940][ T5839] usb 8-1: new high-speed USB device number 58 using dummy_hcd [ 521.123431][ T5820] usb 7-1: new high-speed USB device number 56 using dummy_hcd [ 521.146660][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 521.146692][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 521.201306][T19391] netlink: 'syz.0.4150': attribute type 39 has an invalid length. [ 521.231871][ T5839] usb 8-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 521.235716][ T5839] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.235742][ T5839] usb 8-1: Product: syz [ 521.235756][ T5839] usb 8-1: Manufacturer: syz [ 521.235770][ T5839] usb 8-1: SerialNumber: syz [ 521.285717][ T5820] usb 7-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 521.290274][ T5820] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.290300][ T5820] usb 7-1: Product: syz [ 521.290314][ T5820] usb 7-1: Manufacturer: syz [ 521.290328][ T5820] usb 7-1: SerialNumber: syz [ 521.475708][ T5839] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -32 [ 521.475734][ T5839] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 521.482063][ T5839] lan78xx 8-1:1.0: probe with driver lan78xx failed with error -32 [ 521.499483][ T5839] usb 8-1: USB disconnect, device number 58 [ 521.750937][ T5820] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 521.756561][ T5820] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 521.757110][ T5820] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 521.759533][ T5820] lan78xx 7-1:1.0: probe with driver lan78xx failed with error -71 [ 521.768785][ T5820] usb 7-1: USB disconnect, device number 56 [ 522.089861][T19400] vxcan1 speed is unknown, defaulting to 1000 [ 522.122462][T19405] FAULT_INJECTION: forcing a failure. [ 522.122462][T19405] name failslab, interval 1, probability 0, space 0, times 0 [ 522.122495][T19405] CPU: 2 UID: 0 PID: 19405 Comm: syz.4.4155 Tainted: G L syzkaller #0 PREEMPT(full) [ 522.122524][T19405] Tainted: [L]=SOFTLOCKUP [ 522.122531][T19405] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 522.122543][T19405] Call Trace: [ 522.122550][T19405] [ 522.122559][T19405] dump_stack_lvl+0x100/0x190 [ 522.122650][T19405] should_fail_ex.cold+0x5/0xa [ 522.122677][T19405] should_failslab+0xc2/0x120 [ 522.122727][T19405] __kmalloc_cache_noprof+0x91/0x6d0 [ 522.122748][T19405] ? kvm_dev_ioctl+0x13ee/0x1b50 [ 522.122775][T19405] kvm_dev_ioctl+0x13ee/0x1b50 [ 522.122805][T19405] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 522.122837][T19405] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 522.122858][T19405] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 522.122884][T19405] __do_fast_syscall_32+0x13a/0x8b0 [ 522.122929][T19405] ? lockdep_hardirqs_on+0x7d/0x110 [ 522.122960][T19405] do_fast_syscall_32+0x32/0x70 [ 522.122984][T19405] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 522.123007][T19405] RIP: 0023:0xf7f15fec [ 522.123028][T19405] Code: Unable to access opcode bytes at 0xf7f15fc2. [ 522.123037][T19405] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 522.123056][T19405] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae01 [ 522.123068][T19405] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 522.123079][T19405] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 522.123090][T19405] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 522.123102][T19405] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 522.123127][T19405] [ 522.263392][T19407] vxcan1 speed is unknown, defaulting to 1000 [ 522.264500][T19400] dummy0 speed is unknown, defaulting to 1000 [ 522.459322][T19419] netlink: 'syz.2.4158': attribute type 10 has an invalid length. [ 522.485512][T19407] dummy0 speed is unknown, defaulting to 1000 [ 522.653656][T19430] kAFS: unparsable volume name [ 523.262396][T19445] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 523.262426][T19445] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 523.262486][T19445] vhci_hcd vhci_hcd.0: Device attached [ 523.420933][T19450] vhci_hcd: connection closed [ 523.421188][ T5801] vhci_hcd vhci_hcd.4: stop threads [ 523.421211][ T5801] vhci_hcd vhci_hcd.4: release socket [ 523.421254][ T5801] vhci_hcd vhci_hcd.4: disconnect device [ 523.561248][T19455] FAULT_INJECTION: forcing a failure. [ 523.561248][T19455] name failslab, interval 1, probability 0, space 0, times 0 [ 523.561284][T19455] CPU: 0 UID: 0 PID: 19455 Comm: syz.4.4165 Tainted: G L syzkaller #0 PREEMPT(full) [ 523.561314][T19455] Tainted: [L]=SOFTLOCKUP [ 523.561322][T19455] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 523.561333][T19455] Call Trace: [ 523.561341][T19455] [ 523.561350][T19455] dump_stack_lvl+0x100/0x190 [ 523.561383][T19455] should_fail_ex.cold+0x5/0xa [ 523.561410][T19455] should_failslab+0xc2/0x120 [ 523.561438][T19455] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 523.561464][T19455] ? __d_alloc+0x35/0xa50 [ 523.561495][T19455] __d_alloc+0x35/0xa50 [ 523.561525][T19455] d_alloc+0x4a/0x1e0 [ 523.561553][T19455] lookup_one_qstr_excl+0x171/0x250 [ 523.561575][T19455] start_dirop+0x59/0xb0 [ 523.561600][T19455] simple_start_creating+0xf9/0x110 [ 523.561626][T19455] ? __pfx_simple_start_creating+0x10/0x10 [ 523.561653][T19455] ? mntput+0x70/0xa0 [ 523.561676][T19455] ? simple_pin_fs+0xa3/0x190 [ 523.561701][T19455] debugfs_start_creating.part.0+0x7b/0x150 [ 523.561734][T19455] __debugfs_create_file+0xa9/0x500 [ 523.561767][T19455] debugfs_create_file_full+0x41/0x60 [ 523.561801][T19455] kvm_dev_ioctl+0x1560/0x1b50 [ 523.561832][T19455] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 523.561865][T19455] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 523.561887][T19455] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 523.561914][T19455] __do_fast_syscall_32+0x13a/0x8b0 [ 523.561945][T19455] do_fast_syscall_32+0x32/0x70 [ 523.561983][T19455] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 523.562009][T19455] RIP: 0023:0xf7f15fec [ 523.562033][T19455] Code: Unable to access opcode bytes at 0xf7f15fc2. [ 523.562043][T19455] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 523.562064][T19455] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae01 [ 523.562077][T19455] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 523.562089][T19455] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 523.562102][T19455] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 523.562115][T19455] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 523.562144][T19455] [ 523.675796][T19455] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 523.704227][T19464] netlink: 'syz.2.4167': attribute type 10 has an invalid length. [ 523.766819][T19447] netlink: 'syz.0.4162': attribute type 39 has an invalid length. [ 523.885547][ T5820] usb 8-1: new high-speed USB device number 59 using dummy_hcd [ 524.071090][ T5820] usb 8-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 524.074327][ T5820] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 524.074351][ T5820] usb 8-1: Product: syz [ 524.074364][ T5820] usb 8-1: Manufacturer: syz [ 524.074377][ T5820] usb 8-1: SerialNumber: syz [ 524.471138][T13879] net_ratelimit: 13 callbacks suppressed [ 524.471159][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 524.471239][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 524.527782][ T5820] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 524.527820][ T5820] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 524.529025][ T5820] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 524.529051][ T5820] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 524.529324][ T5820] lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 524.531277][ T5820] lan78xx 8-1:1.0: probe with driver lan78xx failed with error -71 [ 524.542831][ T5820] usb 8-1: USB disconnect, device number 59 [ 524.613483][T19494] No control pipe specified [ 524.670048][ T6320] kernel write not supported for file /gssd/clntXX/gssd (pid: 6320 comm: kworker/2:4) [ 524.927277][T19501] Console: switching to colour dummy device 80x25 [ 525.035854][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 525.035898][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 525.176378][T19502] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 525.187488][T19502] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 525.187942][T19502] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff] [ 525.188620][T19502] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 525.189526][T19502] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 525.254848][T19502] pci 0000:00:01.0: Adding to iommu group 1 [ 525.281124][T19502] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 525.281140][T19502] pci 0000:00:01.0: vgaarb: bridge control possible [ 525.281149][T19502] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 525.301265][T19502] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 525.301636][T19502] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff]: assigned [ 525.308841][T19502] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 525.360937][T19502] [drm] Found bochs VGA, ID 0xb0c5. [ 525.360977][T19502] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81200000. [ 525.403551][T19502] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 525.587843][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 525.587897][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 525.789790][T19502] Console: switching to colour frame buffer device 160x50 [ 525.837496][T19502] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 525.975283][T19523] netlink: 'syz.3.4180': attribute type 39 has an invalid length. [ 526.083113][T19528] FAULT_INJECTION: forcing a failure. [ 526.083113][T19528] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 526.083146][T19528] CPU: 0 UID: 0 PID: 19528 Comm: syz.4.4186 Tainted: G L syzkaller #0 PREEMPT(full) [ 526.083172][T19528] Tainted: [L]=SOFTLOCKUP [ 526.083179][T19528] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 526.083189][T19528] Call Trace: [ 526.083194][T19528] [ 526.083202][T19528] dump_stack_lvl+0x100/0x190 [ 526.083292][T19528] should_fail_ex.cold+0x5/0xa [ 526.083314][T19528] _copy_to_user+0x32/0xd0 [ 526.083368][T19528] simple_read_from_buffer+0xcb/0x170 [ 526.083391][T19528] proc_fail_nth_read+0x1af/0x230 [ 526.083435][T19528] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 526.083462][T19528] ? rw_verify_area+0xce/0x6d0 [ 526.083482][T19528] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 526.083501][T19528] vfs_read+0x1e4/0xb40 [ 526.083521][T19528] ? lock_acquire+0x1d1/0x380 [ 526.083548][T19528] ? __fget_files+0x34/0x3d0 [ 526.083570][T19528] ? __pfx_vfs_read+0x10/0x10 [ 526.083588][T19528] ? find_held_lock+0x2b/0x80 [ 526.083607][T19528] ? __fget_files+0x215/0x3d0 [ 526.083636][T19528] ? __fget_files+0x21f/0x3d0 [ 526.083670][T19528] ksys_read+0x12a/0x250 [ 526.083693][T19528] ? __pfx_ksys_read+0x10/0x10 [ 526.083721][T19528] do_int80_emulation+0x166/0x650 [ 526.083783][T19528] asm_int80_emulation+0x1a/0x20 [ 526.083800][T19528] RIP: 0023:0xf71175ab [ 526.083818][T19528] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 526.083837][T19528] RSP: 002b:00000000f53d64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 526.083858][T19528] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53d65d0 [ 526.083872][T19528] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 526.083884][T19528] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 526.083896][T19528] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 526.083908][T19528] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 526.083935][T19528] [ 526.144677][ T5748] kernel write not supported for file /gssd/clntXX/gssd (pid: 5748 comm: kworker/0:2) [ 526.193102][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 526.193133][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 526.348440][ T5744] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 526.392894][T19536] netlink: 124 bytes leftover after parsing attributes in process `syz.2.4188'. [ 526.487923][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 526.546142][T19540] FAULT_INJECTION: forcing a failure. [ 526.546142][T19540] name failslab, interval 1, probability 0, space 0, times 0 [ 526.546167][T19540] CPU: 0 UID: 0 PID: 19540 Comm: syz.2.4190 Tainted: G L syzkaller #0 PREEMPT(full) [ 526.546183][T19540] Tainted: [L]=SOFTLOCKUP [ 526.546187][T19540] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 526.546195][T19540] Call Trace: [ 526.546199][T19540] [ 526.546204][T19540] dump_stack_lvl+0x100/0x190 [ 526.546225][T19540] should_fail_ex.cold+0x5/0xa [ 526.546241][T19540] should_failslab+0xc2/0x120 [ 526.546260][T19540] __kmalloc_noprof+0xfc/0x840 [ 526.546276][T19540] ? ceph_msg_new2+0x298/0x4f0 [ 526.546298][T19540] ceph_msg_new2+0x298/0x4f0 [ 526.546317][T19540] msgpool_alloc+0xa8/0x200 [ 526.546331][T19540] ? __pfx_msgpool_alloc+0x10/0x10 [ 526.546344][T19540] ? __pfx_msgpool_alloc+0x10/0x10 [ 526.546358][T19540] mempool_init_node+0x2f7/0x6f0 [ 526.546374][T19540] ? __pfx_msgpool_free+0x10/0x10 [ 526.546387][T19540] mempool_create_node_noprof+0xe9/0x1b0 [ 526.546401][T19540] ? __pfx_msgpool_alloc+0x10/0x10 [ 526.546416][T19540] ceph_msgpool_init+0xdc/0x1d0 [ 526.546431][T19540] ceph_osdc_init+0x539/0xa00 [ 526.546452][T19540] ceph_create_client+0x281/0x370 [ 526.546471][T19540] ceph_get_tree+0x1a4/0x1fd0 [ 526.546489][T19540] ? bpf_lsm_capable+0x9/0x10 [ 526.546501][T19540] ? security_capable+0x80/0x260 [ 526.546519][T19540] vfs_get_tree+0x92/0x320 [ 526.546538][T19540] path_mount+0x7d0/0x24c0 [ 526.546563][T19540] ? __pfx_path_mount+0x10/0x10 [ 526.546609][T19540] ? lockdep_hardirqs_on+0x7d/0x110 [ 526.546629][T19540] ? putname+0xb1/0x110 [ 526.546652][T19540] ? kmem_cache_free+0x127/0x6c0 [ 526.546677][T19540] ? __ia32_sys_mount+0x292/0x310 [ 526.546693][T19540] __ia32_sys_mount+0x292/0x310 [ 526.546711][T19540] ? __pfx___ia32_sys_mount+0x10/0x10 [ 526.546728][T19540] ? arch_syscall_is_vdso_sigreturn+0x19b/0x200 [ 526.546743][T19540] ? syscall_user_dispatch+0x76/0x130 [ 526.546758][T19540] __do_fast_syscall_32+0x13a/0x8b0 [ 526.546775][T19540] do_fast_syscall_32+0x32/0x70 [ 526.546790][T19540] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 526.546805][T19540] RIP: 0023:0xf701efec [ 526.546818][T19540] Code: Unable to access opcode bytes at 0xf701efc2. [ 526.546824][T19540] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 526.546836][T19540] RAX: ffffffffffffffda RBX: 0000000080003100 RCX: 0000000080003000 [ 526.546843][T19540] RDX: 0000000080003200 RSI: 0000000000000000 RDI: 0000000000000000 [ 526.546850][T19540] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 526.546857][T19540] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 526.546864][T19540] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 526.546879][T19540] [ 527.738013][ T10] kernel write not supported for file /gssd/clntXX/gssd (pid: 10 comm: kworker/0:1) [ 528.213984][T19577] jffs2: notice: (19577) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 528.855300][T19587] netlink: 'syz.3.4199': attribute type 39 has an invalid length. [ 529.000506][T19591] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 529.939618][T19619] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 529.974264][ T5748] kernel write not supported for file /gssd/clntXX/gssd (pid: 5748 comm: kworker/0:2) [ 530.138899][ T5801] net_ratelimit: 12 callbacks suppressed [ 530.138914][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 530.138928][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 530.436045][T19646] Console: switching to colour dummy device 80x25 [ 530.604087][T19648] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 530.637596][T19648] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 530.637737][T19648] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff] [ 530.637974][T19648] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 530.638447][T19648] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 530.702241][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 530.702263][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 530.728703][T19648] pci 0000:00:01.0: Adding to iommu group 1 [ 530.729842][T19657] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4214'. [ 530.746615][T19648] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 530.746640][T19648] pci 0000:00:01.0: vgaarb: bridge control possible [ 530.746652][T19648] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 530.770221][T19648] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 530.770354][T19648] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff]: assigned [ 530.771991][T19648] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 530.781669][T19648] [drm] Found bochs VGA, ID 0xb0c5. [ 530.781691][T19648] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81200000. [ 530.793948][T19648] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 531.265701][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 531.265723][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 531.437401][T19648] Console: switching to colour frame buffer device 160x50 [ 531.467954][T19648] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 531.829789][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 531.829823][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 531.869931][T19666] netlink: 'syz.3.4218': attribute type 23 has an invalid length. [ 532.408926][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 532.408986][ T5801] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 532.478464][ T10] kernel write not supported for file /gssd/clntXX/gssd (pid: 10 comm: kworker/0:1) [ 532.679945][T19681] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4221'. [ 532.695428][T19663] netlink: 'syz.2.4216': attribute type 39 has an invalid length. [ 532.915265][ T5744] Bluetooth: hci4: ACL packet for unknown connection handle 200 [ 533.191958][ T43] audit: type=1326 audit(1791015193.248:8193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19703 comm="syz.3.4228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97fec code=0x7ffc0000 [ 533.192161][ T43] audit: type=1326 audit(1791015193.248:8194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19703 comm="syz.3.4228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97fec code=0x7ffc0000 [ 533.193212][ T43] audit: type=1326 audit(1791015193.248:8195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19703 comm="syz.3.4228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97fec code=0x7ffc0000 [ 533.193253][ T43] audit: type=1326 audit(1791015193.248:8196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19703 comm="syz.3.4228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97fec code=0x7ffc0000 [ 533.193294][ T43] audit: type=1326 audit(1791015193.248:8197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19703 comm="syz.3.4228" exe="/syz-executor" sig=0 arch=40000003 syscall=41 compat=1 ip=0xf7f97fec code=0x7ffc0000 [ 533.193332][ T43] audit: type=1326 audit(1791015193.248:8198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19703 comm="syz.3.4228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97fec code=0x7ffc0000 [ 533.193370][ T43] audit: type=1326 audit(1791015193.248:8199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19703 comm="syz.3.4228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97fec code=0x7ffc0000 [ 533.193673][ T43] audit: type=1326 audit(1791015193.248:8200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19703 comm="syz.3.4228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97fec code=0x7ffc0000 [ 533.193870][ T43] audit: type=1326 audit(1791015193.248:8201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19703 comm="syz.3.4228" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f97fec code=0x7ffc0000 [ 533.194038][ T43] audit: type=1326 audit(1791015193.248:8202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19703 comm="syz.3.4228" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf7f97fec code=0x7ffc0000 [ 533.316890][T19711] netlink: 'syz.4.4229': attribute type 10 has an invalid length. [ 533.705476][ C3] ata1: illegal qc_active transition (00000000->00008000) [ 533.881402][T19728] Console: switching to colour dummy device 80x25 [ 534.087140][T19735] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 534.096715][ T1127] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) [ 534.122576][T19736] netlink: 'syz.0.4234': attribute type 39 has an invalid length. [ 534.123367][ T1127] ata1.00: configured for UDMA/100 [ 534.128390][T19735] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 534.128505][T19735] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff] [ 534.128712][T19735] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 534.129541][T19735] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 534.160808][T19735] pci 0000:00:01.0: Adding to iommu group 1 [ 534.180211][T19735] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 534.180270][T19735] pci 0000:00:01.0: vgaarb: bridge control possible [ 534.180285][T19735] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 534.226610][T19735] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 534.226772][T19735] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff]: assigned [ 534.240456][T19735] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 534.270857][T19735] [drm] Found bochs VGA, ID 0xb0c5. [ 534.270880][T19735] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81200000. [ 534.312838][T19735] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 534.443657][T19735] Console: switching to colour frame buffer device 160x50 [ 534.499800][T19735] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 534.649429][T19757] netlink: 'syz.0.4239': attribute type 10 has an invalid length. [ 534.923790][ T5744] Bluetooth: hci4: ACL packet for unknown connection handle 200 [ 534.998197][T19773] netlink: 'syz.3.4245': attribute type 3 has an invalid length. [ 535.076289][T19777] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 535.408446][T19797] netlink: 'syz.3.4252': attribute type 10 has an invalid length. [ 535.484132][T19798] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 535.720584][T13879] net_ratelimit: 10 callbacks suppressed [ 535.720603][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 535.720618][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 535.833576][T19786] netlink: 'syz.4.4249': attribute type 39 has an invalid length. [ 535.968892][ T10] usb 7-1: new high-speed USB device number 57 using dummy_hcd [ 536.132380][ T10] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 536.133535][ T10] usb 7-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 536.134801][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 536.134825][ T10] usb 7-1: SerialNumber: syz [ 536.164586][T19811] ieee802154 phy1 wpan1: encryption failed: -22 [ 536.272614][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 536.272637][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 536.836020][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 536.836050][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 536.876735][ T10] cdc_ether 7-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.2-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 536.956109][ T61] usb 8-1: new high-speed USB device number 60 using dummy_hcd [ 537.125836][T19823] Console: switching to colour dummy device 80x25 [ 537.138499][ T6320] usb 7-1: USB disconnect, device number 57 [ 537.141848][ T6320] cdc_ether 7-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.2-1, CDC Ethernet Device [ 537.182698][ T61] usb 8-1: device descriptor read/64, error -71 [ 537.389628][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 537.389656][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 537.490441][T19838] Invalid ELF header magic: != ELF [ 537.493551][T19838] overlay: Unknown parameter '/' [ 537.497131][ T5744] Bluetooth: hci0: command 0x0c1a tx timeout [ 537.889492][T19827] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 537.902195][T19827] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 537.902335][T19827] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff] [ 537.902571][T19827] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 537.903194][T19827] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 537.922435][T19827] pci 0000:00:01.0: Adding to iommu group 1 [ 537.928250][T19827] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 537.928272][T19827] pci 0000:00:01.0: vgaarb: bridge control possible [ 537.928287][T19827] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 537.946622][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 537.946652][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 537.968352][T19827] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 537.968507][T19827] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff]: assigned [ 537.971184][T19827] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 537.984573][ T61] usb 8-1: new high-speed USB device number 61 using dummy_hcd [ 537.990103][T19827] [drm] Found bochs VGA, ID 0xb0c5. [ 537.990119][T19827] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81200000. [ 538.016359][T19827] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 538.136618][ T61] usb 8-1: device descriptor read/64, error -71 [ 538.152903][T19827] Console: switching to colour frame buffer device 160x50 [ 538.186725][T19827] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 538.256097][ T61] usb usb8-port1: attempt power cycle [ 538.438584][T19849] netlink: 'syz.4.4263': attribute type 10 has an invalid length. [ 538.570935][T19851] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 538.634975][ T61] usb 8-1: new high-speed USB device number 62 using dummy_hcd [ 538.657276][ T61] usb 8-1: device descriptor read/8, error -71 [ 538.732609][T19854] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 538.938409][ T61] usb 8-1: new high-speed USB device number 63 using dummy_hcd [ 538.971261][ T61] usb 8-1: device descriptor read/8, error -71 [ 539.108743][ T61] usb usb8-port1: unable to enumerate USB device [ 540.511271][T19885] netlink: 'syz.0.4271': attribute type 39 has an invalid length. [ 540.727824][T19883] netlink: 'syz.2.4272': attribute type 39 has an invalid length. [ 540.992533][T19889] netlink: 'syz.3.4274': attribute type 10 has an invalid length. [ 541.212308][T19896] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 541.279194][T13879] net_ratelimit: 11 callbacks suppressed [ 541.279211][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 541.279225][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 541.831862][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 541.831892][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 542.373633][ T43] kauditd_printk_skb: 126 callbacks suppressed [ 542.373647][ T43] audit: type=1800 audit(1791015201.719:8329): pid=19901 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.4278" name="file1" dev="sda1" ino=2040 res=0 errno=0 [ 542.384664][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 542.384682][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 542.631836][T19912] 8021q: adding VLAN 0 to HW filter on device bond0 [ 542.635642][T19912] 8021q: adding VLAN 0 to HW filter on device team0 [ 542.649891][T19912] batman_adv: batadv0: Interface activated: dummy0 [ 542.649914][T19912] batadv0: mtu less than device minimum [ 542.650895][T19912] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 542.651845][T19912] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 542.652714][T19912] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 542.756269][T19912] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 542.803181][T19912] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 542.826342][T19912] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 542.881024][T19912] virt_wifi0: entered allmulticast mode [ 542.887019][T19912] 8021q: adding VLAN 0 to HW filter on device eth0 [ 542.889358][T19912] 8021q: adding VLAN 0 to HW filter on device eth1 [ 542.895400][T19912] 8021q: adding VLAN 0 to HW filter on device eth2 [ 542.898160][T19912] 8021q: adding VLAN 0 to HW filter on device eth3 [ 542.914523][ T5984] bridge0: port 1(bridge_slave_0) entered blocking state [ 542.914571][ T5984] bridge0: port 1(bridge_slave_0) entered forwarding state [ 542.915884][ T5984] bridge0: port 2(bridge_slave_1) entered blocking state [ 542.915958][ T5984] bridge0: port 2(bridge_slave_1) entered forwarding state [ 543.004057][T13879] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.004235][T13879] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.023971][T13879] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.023998][T13879] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.124441][T19930] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 543.147283][T19928] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4285'. [ 543.370044][T18345] kernel write not supported for file /gssd/clntXX/gssd (pid: 18345 comm: kworker/2:1) [ 543.498772][ T5751] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 543.513024][ T5751] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 543.514043][ T5751] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 543.518551][ T5751] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 543.519218][ T5751] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 543.997949][T19938] vxcan1 speed is unknown, defaulting to 1000 [ 544.092126][T19938] dummy0 speed is unknown, defaulting to 1000 [ 545.021279][T19965] Console: switching to colour dummy device 80x25 [ 545.092286][T19964] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 545.101296][T19964] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 545.101408][T19964] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff] [ 545.101609][T19964] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 545.101969][T19964] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 545.106711][T19964] pci 0000:00:01.0: Adding to iommu group 1 [ 545.109407][T19964] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 545.109421][T19964] pci 0000:00:01.0: vgaarb: bridge control possible [ 545.109430][T19964] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 545.113524][T19964] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 545.113633][T19964] pci 0000:00:01.0: BAR 2 [mem 0x81200000-0x81200fff]: assigned [ 545.114848][T19964] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 545.120597][T19964] [drm] Found bochs VGA, ID 0xb0c5. [ 545.120609][T19964] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81200000. [ 545.125519][T19964] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 545.182565][T19938] bridge0: port 1(bridge_slave_0) entered blocking state [ 545.182609][T19938] bridge0: port 1(bridge_slave_0) entered disabled state [ 545.182687][T19938] bridge_slave_0: entered allmulticast mode [ 545.183487][T19938] bridge_slave_0: entered promiscuous mode [ 545.198374][T19938] bridge0: port 2(bridge_slave_1) entered blocking state [ 545.198427][T19938] bridge0: port 2(bridge_slave_1) entered disabled state [ 545.198502][T19938] bridge_slave_1: entered allmulticast mode [ 545.200473][T19964] Console: switching to colour frame buffer device 160x50 [ 545.212470][T19938] bridge_slave_1: entered promiscuous mode [ 545.217167][T19964] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 545.255073][T19938] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 545.259579][T19938] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 545.292607][T19938] team0: Port device team_slave_0 added [ 545.294057][T19938] team0: Port device team_slave_1 added [ 545.318646][T19938] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 545.318658][T19938] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 545.318672][T19938] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 545.318956][T19974] [ 545.319361][T19938] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 545.319369][T19938] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 545.319381][T19938] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 545.340244][T19938] hsr_slave_0: entered promiscuous mode [ 545.340517][T19938] hsr_slave_1: entered promiscuous mode [ 545.340706][T19938] debugfs: 'hsr0' already exists in 'hsr' [ 545.340716][T19938] Cannot create hsr debugfs directory [ 545.358575][T19974] ====================================================== [ 545.361297][T19974] WARNING: possible circular locking dependency detected [ 545.363589][T19974] syzkaller #0 Tainted: G L [ 545.366308][T19974] ------------------------------------------------------ [ 545.369060][T19974] syz.2.4296/19974 is trying to acquire lock: [ 545.371441][T19974] ffff8880243faa70 (&p->frag_sem){++++}-{4:4}, at: configfs_rmdir+0x3fa/0x950 [ 545.375165][T19974] [ 545.375165][T19974] but task is already holding lock: [ 545.378313][T19974] ffff88801369b0c0 (&sb->s_type->i_mutex_key#31){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 545.382429][T19974] [ 545.382429][T19974] which lock already depends on the new lock. [ 545.382429][T19974] [ 545.386569][T19974] [ 545.386569][T19974] the existing dependency chain (in reverse order) is: [ 545.390054][T19974] [ 545.390054][T19974] -> #4 (&sb->s_type->i_mutex_key#31){++++}-{4:4}: [ 545.393544][T19974] lock_acquire+0x1d1/0x380 [ 545.395607][T19974] down_write+0x8b/0x1f0 [ 545.397516][T19974] configfs_depend_item_unlocked+0xf3/0x6a0 [ 545.399958][T19974] usbg_make_tpg+0x251/0x610 [ 545.401973][T19974] target_fabric_make_tpg+0xab/0x8c0 [ 545.404223][T19974] configfs_mkdir+0x525/0xd40 [ 545.406059][T19974] vfs_mkdir+0x364/0x850 [ 545.407754][T19974] filename_mkdirat+0x48b/0x5e0 [ 545.410407][T19974] __ia32_sys_mkdirat+0x88/0xc0 [ 545.413039][T19974] __do_fast_syscall_32+0x13a/0x8b0 [ 545.415421][T19974] do_fast_syscall_32+0x32/0x70 [ 545.417526][T19974] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 545.420191][T19974] [ 545.420191][T19974] -> #3 (tpg_instances_lock){+.+.}-{4:4}: [ 545.423206][T19974] lock_acquire+0x1d1/0x380 [ 545.425070][T19974] __mutex_lock+0x1a4/0x1bd0 [ 545.426682][T19974] tcm_alloc_inst+0x5f/0x1e0 [ 545.428697][T19974] try_get_usb_function_instance+0x136/0x1f0 [ 545.431227][T19974] usb_get_function_instance+0x16/0x70 [ 545.433567][T19974] function_make+0x18c/0x3f0 [ 545.435654][T19974] configfs_mkdir+0x525/0xd40 [ 545.437829][T19974] vfs_mkdir+0x364/0x850 [ 545.439983][T19974] filename_mkdirat+0x48b/0x5e0 [ 545.442044][T19974] __ia32_sys_mkdirat+0x88/0xc0 [ 545.443839][T19974] __do_fast_syscall_32+0x13a/0x8b0 [ 545.446103][T19974] do_fast_syscall_32+0x32/0x70 [ 545.448177][T19974] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 545.450813][T19974] [ 545.450813][T19974] -> #2 (func_lock){+.+.}-{4:4}: [ 545.453507][T19974] lock_acquire+0x1d1/0x380 [ 545.455532][T19974] __mutex_lock+0x1a4/0x1bd0 [ 545.457633][T19974] try_get_usb_function_instance+0x26/0x1f0 [ 545.460130][T19974] usb_get_function_instance+0x16/0x70 [ 545.462461][T19974] function_make+0x18c/0x3f0 [ 545.464559][T19974] configfs_mkdir+0x525/0xd40 [ 545.466767][T19974] vfs_mkdir+0x364/0x850 [ 545.468824][T19974] filename_mkdirat+0x48b/0x5e0 [ 545.470915][T19974] __ia32_sys_mkdirat+0x88/0xc0 [ 545.472999][T19974] __do_fast_syscall_32+0x13a/0x8b0 [ 545.475228][T19974] do_fast_syscall_32+0x32/0x70 [ 545.477317][T19974] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 545.480045][T19974] [ 545.480045][T19974] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 545.483764][T19974] lock_acquire+0x1d1/0x380 [ 545.486142][T19974] __mutex_lock+0x1a4/0x1bd0 [ 545.488247][T19974] uvcg_default_processing_bm_controls_store+0xbd/0x430 [ 545.491038][T19974] configfs_write_iter+0x302/0x4e0 [ 545.493029][T19974] vfs_write+0x6af/0x1050 [ 545.494490][T19974] ksys_write+0x12a/0x250 [ 545.495949][T19974] __do_fast_syscall_32+0x13a/0x8b0 [ 545.497660][T19974] do_fast_syscall_32+0x32/0x70 [ 545.499301][T19974] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 545.501307][T19974] [ 545.501307][T19974] -> #0 (&p->frag_sem){++++}-{4:4}: [ 545.503346][T19974] check_prev_add+0xeb/0xe60 [ 545.504897][T19974] __lock_acquire+0x1528/0x1f40 [ 545.506515][T19974] lock_acquire+0x1d1/0x380 [ 545.508042][T19974] down_write_killable+0x93/0x240 [ 545.509708][T19974] configfs_rmdir+0x3fa/0x950 [ 545.511324][T19974] vfs_rmdir+0x328/0x8a0 [ 545.512798][T19974] filename_rmdir+0x31a/0x5c0 [ 545.514402][T19974] __ia32_sys_rmdir+0x45/0x60 [ 545.515953][T19974] __do_fast_syscall_32+0x13a/0x8b0 [ 545.517648][T19974] do_fast_syscall_32+0x32/0x70 [ 545.519250][T19974] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 545.521313][T19974] [ 545.521313][T19974] other info that might help us debug this: [ 545.521313][T19974] [ 545.524296][T19974] Chain exists of: [ 545.524296][T19974] &p->frag_sem --> tpg_instances_lock --> &sb->s_type->i_mutex_key#31 [ 545.524296][T19974] [ 545.528480][T19974] Possible unsafe locking scenario: [ 545.528480][T19974] [ 545.530824][T19974] CPU0 CPU1 [ 545.532507][T19974] ---- ---- [ 545.534301][T19974] lock(&sb->s_type->i_mutex_key#31); [ 545.536221][T19974] lock(tpg_instances_lock); [ 545.538717][T19974] lock(&sb->s_type->i_mutex_key#31); [ 545.541155][T19974] lock(&p->frag_sem); [ 545.542412][T19974] [ 545.542412][T19974] *** DEADLOCK *** [ 545.542412][T19974] [ 545.544819][T19974] locks held by syz.2.4296/19974: 3, last CPU#3: [ 545.546719][T19974] #0: ffff88802270e460 (sb_writers#16){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 545.549504][T19974] #1: ffff88801369e040 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 545.552896][T19974] #2: ffff88801369b0c0 (&sb->s_type->i_mutex_key#31){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 545.555948][T19974] [ 545.555948][T19974] stack backtrace: [ 545.557782][T19974] CPU: 3 UID: 0 PID: 19974 Comm: syz.2.4296 Tainted: G L syzkaller #0 PREEMPT(full) [ 545.561137][T19974] Tainted: [L]=SOFTLOCKUP [ 545.562457][T19974] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 545.565415][T19974] Call Trace: [ 545.566430][T19974] [ 545.567315][T19974] dump_stack_lvl+0x100/0x190 [ 545.568761][T19974] print_circular_bug.cold+0x178/0x1be [ 545.570446][T19974] check_noncircular+0x146/0x160 [ 545.571957][T19974] check_prev_add+0xeb/0xe60 [ 545.573459][T19974] __lock_acquire+0x1528/0x1f40 [ 545.575210][T19974] lock_acquire+0x1d1/0x380 [ 545.576879][T19974] ? configfs_rmdir+0x3fa/0x950 [ 545.578609][T19974] ? __pfx___might_resched+0x10/0x10 [ 545.580556][T19974] down_write_killable+0x93/0x240 [ 545.582104][T19974] ? configfs_rmdir+0x3fa/0x950 [ 545.583583][T19974] ? __pfx_down_write_killable+0x10/0x10 [ 545.585313][T19974] ? configfs_rmdir+0x3be/0x950 [ 545.586801][T19974] configfs_rmdir+0x3fa/0x950 [ 545.588217][T19974] ? __pfx_configfs_rmdir+0x10/0x10 [ 545.589823][T19974] ? __pfx_down_write+0x10/0x10 [ 545.591336][T19974] vfs_rmdir+0x328/0x8a0 [ 545.592639][T19974] filename_rmdir+0x31a/0x5c0 [ 545.594096][T19974] ? __pfx_filename_rmdir+0x10/0x10 [ 545.595685][T19974] ? do_getname+0x191/0x390 [ 545.597098][T19974] __ia32_sys_rmdir+0x45/0x60 [ 545.598558][T19974] __do_fast_syscall_32+0x13a/0x8b0 [ 545.600169][T19974] do_fast_syscall_32+0x32/0x70 [ 545.601766][T19974] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 545.603817][T19974] RIP: 0023:0xf701efec [ 545.605246][T19974] Code: Unable to access opcode bytes at 0xf701efc2. [ 545.607599][T19974] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000028 [ 545.610546][T19974] RAX: ffffffffffffffda RBX: 0000000080000140 RCX: 0000000000000000 [ 545.612868][T19974] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 545.615231][T19974] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 545.617610][T19974] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 545.619991][T19974] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 545.622384][T19974] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 545.664748][T13793] process 16982 (syz.4.3332) no longer affine to cpu1 [ 545.664770][T13793] process 17062 (syz.4.3360) no longer affine to cpu1 [ 545.699206][T19974] unloading [ 545.720313][T19938] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 545.743967][ T5744] Bluetooth: hci3: command tx timeout [ 545.821846][T19938] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 545.960025][T19938] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.016103][T13879] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.049985][T19938] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.149269][T13879] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.211456][T13879] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.276803][T13879] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.329553][T13879] bridge_slave_1: left allmulticast mode [ 546.329572][T13879] bridge_slave_1: left promiscuous mode [ 546.329671][T13879] bridge0: port 2(bridge_slave_1) entered disabled state [ 546.331032][T13879] bridge_slave_0: left allmulticast mode [ 546.331049][T13879] bridge_slave_0: left promiscuous mode [ 546.331149][T13879] bridge0: port 1(bridge_slave_0) entered disabled state [ 546.440456][T13879] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 546.441479][T13879] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 546.442065][T13879] bond0 (unregistering): Released all slaves [ 546.512588][T13879] tipc: Left network mode [ 546.567884][ T5453] 8021q: adding VLAN 0 to HW filter on device eth7 [ 546.684808][ T5453] 8021q: adding VLAN 0 to HW filter on device eth8 [ 546.776283][T13879] hsr_slave_0: left promiscuous mode [ 546.792668][T13879] hsr_slave_1: left promiscuous mode [ 546.800948][T13879] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 546.800970][T13879] net_ratelimit: 83 callbacks suppressed [ 546.800981][T13879] batadv0: mtu less than device minimum [ 546.801479][T13879] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 546.801883][T13879] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 546.802283][T13879] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 546.802633][T13879] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 546.802967][T13879] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 546.803292][T13879] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 546.803526][T13879] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 546.803756][T13879] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 546.804017][T13879] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 546.809901][T13879] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 546.811838][T13879] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 546.818649][T13879] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 546.820696][T13879] batman_adv: batadv0: Interface deactivated: dummy0 [ 546.820713][T13879] batman_adv: batadv0: Removing interface: dummy0 [ 546.826654][T13879] veth1_vlan: left promiscuous mode [ 546.826710][T13879] veth0_vlan: left promiscuous mode [ 546.880678][T13879] team0 (unregistering): Port device team_slave_1 removed [ 546.885702][T13879] team0 (unregistering): Port device team_slave_0 removed [ 546.920615][ T5980] smc: removing ib device syz2 [ 546.932150][ T5453] 8021q: adding VLAN 0 to HW filter on device eth10 [ 546.932341][T18345] infiniband syz2: ib_query_port failed (-19) [ 546.936129][ T5980] smbdirect: ib_dev[syz2] removed [ 547.105205][ T5453] 8021q: adding VLAN 0 to HW filter on device eth9 [ 547.214133][T13879] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.253963][T13879] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.318236][T13879] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.373723][T13879] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.563495][ T5453] 8021q: adding VLAN 0 to HW filter on device eth11 [ 547.668365][ T5453] 8021q: adding VLAN 0 to HW filter on device eth12 [ 547.700403][T13879] bridge_slave_1: left allmulticast mode [ 547.700420][T13879] bridge_slave_1: left promiscuous mode [ 547.700488][T13879] bridge0: port 2(bridge_slave_1) entered disabled state [ 547.701485][T13879] bridge_slave_0: left allmulticast mode [ 547.701501][T13879] bridge_slave_0: left promiscuous mode [ 547.701622][T13879] bridge0: port 1(bridge_slave_0) entered disabled state [ 547.703664][T13879] bridge_slave_1: left allmulticast mode [ 547.703676][T13879] bridge_slave_1: left promiscuous mode [ 547.703733][T13879] bridge0: port 2(bridge_slave_1) entered disabled state [ 547.704428][T13879] bridge_slave_0: left allmulticast mode [ 547.704438][T13879] bridge_slave_0: left promiscuous mode [ 547.704489][T13879] bridge0: port 1(bridge_slave_0) entered disabled state [ 547.706497][T13879] dvmrp6: left allmulticast mode [ 547.713211][T13879] bridge_slave_1: left allmulticast mode [ 547.713232][T13879] bridge_slave_1: left promiscuous mode [ 547.713306][T13879] bridge0: port 2(bridge_slave_1) entered disabled state [ 547.721665][T13879] bridge_slave_0: left allmulticast mode [ 547.721680][T13879] bridge_slave_0: left promiscuous mode [ 547.721751][T13879] bridge0: port 1(bridge_slave_0) entered disabled state [ 547.762975][T13879] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 547.764174][T13879] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 547.764963][T13879] bond0 (unregistering): Released all slaves [ 547.793747][T13879] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 547.795141][T13879] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 547.795669][T13879] bond0 (unregistering): Released all slaves [ 547.874444][T13879] bond0 (unregistering): (slave 30): Releasing backup interface [ 547.875097][T13879] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 547.875407][T13879] bond0 (unregistering): Released all slaves [ 547.876978][ T5453] 8021q: adding VLAN 0 to HW filter on device eth13 [ 547.980938][T13879] tipc: Left network mode [ 548.028957][ T5453] 8021q: adding VLAN 0 to HW filter on device eth14 [ 548.155973][ T5453] 8021q: adding VLAN 0 to HW filter on device eth15 [ 548.212895][T13879] hsr_slave_0: left promiscuous mode [ 548.213128][T13879] hsr_slave_1: left promiscuous mode [ 548.214836][T13879] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 548.215159][T13879] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 548.217933][T13879] hsr_slave_0: left promiscuous mode [ 548.219586][T13879] hsr_slave_1: left promiscuous mode [ 548.219874][T13879] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 548.219885][T13879] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 548.222219][T13879] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 548.222232][T13879] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 548.232346][T13879] hsr_slave_0: left promiscuous mode [ 548.234918][T13879] hsr_slave_1: left promiscuous mode [ 548.235201][T13879] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 548.237629][T13879] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 548.242873][T13879] veth1_vlan: left promiscuous mode [ 548.242919][T13879] veth0_vlan: left promiscuous mode [ 548.290424][T13879] team0 (unregistering): Port device team_slave_1 removed [ 548.297131][T13879] team0 (unregistering): Port device team_slave_0 removed [ 548.343936][T13879] team0 (unregistering): Port device team_slave_1 removed [ 548.349366][T13879] team0 (unregistering): Port device team_slave_0 removed [ 548.419329][T13879] team0 (unregistering): Port device team_slave_1 removed [ 548.425191][T13879] team0 (unregistering): Port device team_slave_0 removed [ 548.472975][ T5984] smbdirect: ib_dev[syz0] removed [ 548.477637][ T5453] 8021q: adding VLAN 0 to HW filter on device eth17 [ 548.579459][ T5453] 8021q: adding VLAN 0 to HW filter on device eth16 [ 548.669449][ T5453] 8021q: adding VLAN 0 to HW filter on device eth18 [ 552.463021][T13879] net_ratelimit: 50 callbacks suppressed [ 552.463041][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 552.463061][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 553.015714][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 553.015736][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 553.568485][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 553.568516][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 554.121287][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 554.121321][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 554.673799][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 554.673820][T13879] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01