last executing test programs: 2m4.153991635s ago: executing program 1 (id=605): mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000580)='./sys\x00', &(0x7f00000005c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/devices/0000:00:02.0/resource\x00', 0x0, 0x0) read(r0, &(0x7f0000000000)=""/256, 0x100) (fail_nth: 3) 2m4.040553814s ago: executing program 1 (id=606): r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0}, &(0x7f0000000480)=0x31) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@can_newroute={0x44, 0x18, 0x1, 0x70bd28, 0x25dfdbfe, {0x1d, 0x1, 0x7}, [@CGW_DST_IF={0x8}, @CGW_MOD_UID={0x8, 0xe, r1}, @CGW_MOD_XOR={0x15, 0x3, {{{0x1, 0x0, 0x0, 0x1}, 0x7, 0x1, 0x0, 0x0, "d3698ac660061306"}, 0x4}}, @CGW_MOD_UID={0x8, 0xe, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0xde50a9659187563d}, 0x40000c0) 2m3.880520327s ago: executing program 1 (id=608): socket$inet6_mptcp(0xa, 0x1, 0x106) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x9}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0xc50}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xff, 0x0, 0x4, 0x6, 0x7f, 0x20c}, {0xf1c2, 0x3, 0x38, 0xf, 0x84, 0x7, 0x3, 0x50, 0x0, 0x5, 0x4, 0x5, 0x3a}], 0xffffffff}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000003240), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x4, 0x7fff, 0x3, 0x400000000], 0x80a0000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_usb_connect(0x3, 0x36, 0x0, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r5, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 2m2.429228335s ago: executing program 1 (id=614): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = open$dir(&(0x7f0000000140)='./config/usb_gadget/g1/UDC\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000380)='0', 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020732500000000000709007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000730000008500000050000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000000600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$pokeuser(0x6, r2, 0x108, 0x4) r3 = syz_open_dev$audion(&(0x7f0000000300), 0xfffffff7, 0x4000) recvmsg$can_j1939(r3, &(0x7f0000000bc0)={&(0x7f0000000680)=@ethernet, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000700)=""/225, 0xe1}, {&(0x7f0000000800)=""/69, 0x45}, {&(0x7f0000000880)=""/93, 0x5d}, {&(0x7f0000000900)=""/252, 0xfc}, {&(0x7f0000000a00)=""/231, 0xe7}, {&(0x7f0000000b00)=""/26, 0x1a}], 0x6, &(0x7f0000000b80), 0x64}, 0x0) ptrace$pokeuser(0x6, r2, 0x118, 0x1) ptrace$pokeuser(0x6, r2, 0x6, 0x3) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000380)={0xfffffff8, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x22, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1c) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000480)='usbip-vudc.0', 0xc) faccessat2(r0, &(0x7f0000000180)='./config/usb_gadget/g1/UDC\x00', 0x5, 0x1000) write(r5, &(0x7f00000004c0)='\n', 0x1) symlinkat(&(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000000), 0x1000) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x613402) getuid() ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000240)={{0x1, 0x1, 0x18, r5, {0x0, 0xee01}}, './config\x00'}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) 2m1.609481668s ago: executing program 1 (id=616): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[], 0x48) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e045f2d20"], 0x7) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e24, @broadcast}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x10}}, {0x2, 0x4e24, @broadcast}, 0x1, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x1, 0x8}) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00', @ANYRES16, @ANYBLOB="040026bd7000fcdbdf250f000000080031000200000008003400000000"], 0x2c}, 0x1, 0x0, 0x0, 0x8841}, 0x4008041) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = dup(0xffffffffffffffff) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000480)=@HCI_SCODATA_PKT={0x3, {0xc9, 0x8b}, "d7d54fdb46f5ac3753ee9cddb568665fbd34c395ffa0d5a93e3ba26f4b8d24096441343208caf4893a2755ba68570af320d8ad961badbbb3ecb18c01a5eed1637ba265e99a61f18388a96978f91f6fda9ec721875c8932cc6cca5760b1bc588fe7c7dc37fedc26e2ced1ccf8187c69677819945f0284314cbbd182243357005cb1de30ad901918f33a473e"}, 0x8f) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000080)={{0xa, 0x4e22, 0xffff26c0, @loopback, 0x28}, {0xa, 0x4e22, 0x5, @mcast1}, 0x0, {[0x8, 0x8, 0x101, 0x8, 0x1, 0x200, 0x8, 0x6]}}, 0x5c) r3 = socket$inet_sctp(0x2, 0x1, 0x84) syz_emit_vhci(&(0x7f0000000300)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x2, 0x0, 0x1a}, @l2cap_cid_signaling={{0x16}, [@l2cap_conn_req={{0x2, 0x36, 0x4}, {0xd, 0x2}}, @l2cap_disconn_rsp={{0x7, 0x81, 0x4}, {0x1, 0x3}}, @l2cap_cmd_rej_unk={{0x1, 0x6, 0x2}, {0xc66}}]}}, 0x1f) sendto$inet(r3, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r3, 0xda90) accept4(r3, 0x0, 0x0, 0x0) fsopen(&(0x7f0000000040)='f2fs\x00', 0x1) openat$cgroup_root(0xffffff9c, &(0x7f0000000340)='./cgroup/syz0\x00', 0x200002, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000100)='test_dum\ry_encpyp+\x84E\xdc', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\r\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8c{\x9e\x85\xdbO\xb3\xa2\xfev\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Q', 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f0000000000)=@req3={0x1, 0x8, 0x7, 0x4, 0xf8b, 0x1, 0x80}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7c2}, 0x94) 2m1.2664114s ago: executing program 1 (id=618): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x80, 0x0) mount$tmpfs(0x0, &(0x7f0000000300)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x86022, &(0x7f0000000180)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000002000100fffe0900010073797a300000000040000000030a01020000000000000000010000000900030073797a310000000014000480080002400000000008000140000000040900010073797a300000000064000000060a010400000000000000000100000008000b40000000000900010073797a30000000003c00048010000180080001006c6f6700040002802800018008000100666962001c000280080001400000001108000340000000050800"], 0xec}}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) mount(0x0, 0x0, 0x0, 0x44021, 0x0) madvise(&(0x7f00002d9000/0x2000)=nil, 0x2000, 0x70) r1 = openat$null(0xffffff9c, &(0x7f0000000140), 0x101201, 0x0) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000340)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) set_mempolicy(0x0, &(0x7f0000000040)=0xfffffffffffffbff, 0x5) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES16], 0x48) set_mempolicy(0x8000, &(0x7f0000000100)=0x9, 0x1) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x44) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f000000bbc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000001180)="dd", 0x1}], 0x1, &(0x7f00000003c0)=[@rights={{0x10, 0x1, 0x1, [r2]}}], 0x10, 0x20000041}}], 0x1, 0xc004) recvmmsg(r3, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000500)={'nat\x00', 0x0, 0x4, 0x0, [0x0, 0x7, 0x2, 0x0, 0x6, 0x5], 0x0, &(0x7f00000002c0), 0x0}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) ptrace(0x4206, 0x0) 2m1.20001306s ago: executing program 32 (id=618): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x80, 0x0) mount$tmpfs(0x0, &(0x7f0000000300)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x86022, &(0x7f0000000180)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000002000100fffe0900010073797a300000000040000000030a01020000000000000000010000000900030073797a310000000014000480080002400000000008000140000000040900010073797a300000000064000000060a010400000000000000000100000008000b40000000000900010073797a30000000003c00048010000180080001006c6f6700040002802800018008000100666962001c000280080001400000001108000340000000050800"], 0xec}}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) mount(0x0, 0x0, 0x0, 0x44021, 0x0) madvise(&(0x7f00002d9000/0x2000)=nil, 0x2000, 0x70) r1 = openat$null(0xffffff9c, &(0x7f0000000140), 0x101201, 0x0) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000340)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) set_mempolicy(0x0, &(0x7f0000000040)=0xfffffffffffffbff, 0x5) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES16], 0x48) set_mempolicy(0x8000, &(0x7f0000000100)=0x9, 0x1) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x44) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f000000bbc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000001180)="dd", 0x1}], 0x1, &(0x7f00000003c0)=[@rights={{0x10, 0x1, 0x1, [r2]}}], 0x10, 0x20000041}}], 0x1, 0xc004) recvmmsg(r3, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f0000000500)={'nat\x00', 0x0, 0x4, 0x0, [0x0, 0x7, 0x2, 0x0, 0x6, 0x5], 0x0, &(0x7f00000002c0), 0x0}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) ptrace(0x4206, 0x0) 9.479089971s ago: executing program 3 (id=1054): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sched_setscheduler(0x0, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[], 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xb5, 0x7, 0x4}, 0x9c) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ehci-pci/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='0000:00:1d.7', 0xc) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/drivers/ehci-pci/bind\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='0000:00:1d.7', 0xc) r6 = socket(0x10, 0x3, 0x0) write(r6, &(0x7f0000000080)="240000004e0025000307f4f9002304000a04f55f08000100020100020800038005000000", 0x24) accept4$inet(r6, &(0x7f0000000080)={0x2, 0x0, @dev}, &(0x7f00000001c0)=0x10, 0x80000) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="04010000100007000000000000000000ff02000000000000000000000000000100000000000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00], 0x104}}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x25) 7.829799572s ago: executing program 4 (id=1058): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041d"], 0x8) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r1, &(0x7f00000001c0)='functionfs', 0xa) read(r0, &(0x7f0000000100), 0xb) mount(&(0x7f0000000240)=@filename='usb0\x00', &(0x7f0000000280)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r2) sendmsg$NLBL_MGMT_C_ADD(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000bc0)={0x29c, r3, 0xe701ac47a3d23ccd, 0x0, 0x2, {}, [@NLBL_MGMT_A_DOMAIN={0x277, 0x1, 'C\xec\xf8\xa0w\x15|:\xac\r\xab\xb93\x14\xcd\xcb\xb6\xb9\xbb\x84\xe5\xbc\xdb\x7f\x9a\xf2\xea\xcc\x91:v@\xe83-\x1d\xaagQl\x7f\tKt\fc\x1f\x95K]\xce,\xd1\xeb\x17]\xd5\xd0\xa7D!_\xa9$\x94\x02\v\x10od\xe6,\xd3@I\x17\xf3\xbees0\xad\xc6\xbf/*s6\xec\x06\xc7\x1dO\xb6(o\x91t\x12\x93UK\xf4@n\xdc\xdc\x8a7y\x81FY\xbe\xbbc\xd2\xc3\x01\xa5\xe2V\x8c\xb3im~\xd2V\xdaG\xbdbF\xc8n\x86\xac\x9c\xfb\xdak\x1a\x13\xe9\tc\x85\xb4\xcb\x815\x87\xd5\x97C\x1cM\x9eCdb\xad;\xa2\x8fs\xbf6\xe8\xe3Xg3&\xe2 \xd2\n\x9d=~=\xe5\xdc\x90\a\xe7M\x9c<\x93/\xaf\x89\x06+\x96]\xb5+\xee\xff8^D*\xdb\xb8\xd8t\x80\xd4\xb4\v[\xdc@5\xbe\x9f\xccz\x81\x1f\xb4A|\x1a2p\xd1\x95\xb0i\"g\xd1\xf7t\xa4\xb3\x94\xe9\x01\xce\x82`\x17n\f\x05\xaa:\x03\x8cJs\x92\x81\xb0\\\xa5\xc7eB\xa5\a\xb6\x814\x05\xd1$3\x15/\xfcwNV\xeaif\xeb\x0f6\x94{5Se\xe9o\x86\a!\xf0\x9b\x80\x95\x84\xa6E\x90\xc9 \t \x04\xb1\xe7\xec\xf4\xe6 \x91\xfa\xd01<\xbcc\xd1\xac?V\xe2b3\xdelP[I\xae\x18Z\xa6K\xf2~\x19\x0f\xe7\x90\xb0\x84M)\x8e\x1av\xc2\a\xb4{\xb1(\b\xb5uh\x12k\xe2R?\x8boI\t\x87\xab\x80{\x8a\x1e\x85\xd6\x8c8vx\xeeTF\x1f&\x1fmaCc;Q\x9e\xd2\x9e\xcb\xa4\xb5M\xb1I\xfe%ukl\x18\xf7\xa5`\xaa\xed\xd7\xb1\xbf\xa0S?8\xb3Z\xb3\x1c\xb7FI7\xac\xdb\xa8\x1aF\xe5\x99\xc1\xa8\x9d\x84\x80]\x96\x0f\x0e\xd3\x00\xc91\xf1\x99\x02\xce\x01\x00\x00\x00\x00\x00\x00\x00;\xc5\b\x95\x1e\xff\xfc\xc8\x8e\x82\xb1\x8b_E\xc1\xb9AVN\v\xdf\xc1\x7f\x8f\xe9\xac\xab/\x85\xb3\xe8\xde\r\x04\xe7`\xb2\x1a\xcb;\xd8)\xac\x96\x1b\xd6K\x94z\xf7\xb8l0e\xed\x7f\xbb]\xdb\x1e\xff\xe8\xe8\x03V\x0e/\xc5K\x1e\x99\x9d\x11\xfe\x85c\x8a\x98|}\v\xb6\xaak\xc9p\xa0j\xe5!\r3\xd3I|\x1e]\xc8\xc4x\x92\xf3UE\xbcr\xbe\x0fI\xcfj\xdeB\x90\xa1\xe2Q\fD\xda_p\x87\x1b\xcd\x04\x94\xd67\xbe\xa2\xcaW\x12c{RzZ\x06\xf9\x95Pj\x06\x04\xbdz\x89o\x83N\x1ez\x10\xda\xdeK\xbaf\xcbDq\x97'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0xa}]}, 0x29c}, 0x1, 0x0, 0x0, 0x20084880}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r4) sendmsg$NLBL_MGMT_C_LISTDEF(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)={0x5, r6, 0xc01, 0x70bd29, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x44000) memfd_create(&(0x7f00000002c0)='#\x00', 0x1) 7.829114429s ago: executing program 4 (id=1059): ioctl$VHOST_SET_VRING_ENDIAN(0xffffffffffffffff, 0x4008af13, &(0x7f0000000100)={0x1, 0x200}) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) socket$inet_udp(0x2, 0x2, 0x0) r1 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r4, 0xc018643a, &(0x7f0000000140)={0x4000000}) pread64(r4, 0x0, 0x0, 0x100000000) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020300091800000000000000000000000400030000000000000000000000000000000000000000000000000000000000050006003c0000000a0000000000fffffc0100000000000000000000000000000000000000000000010004"], 0xc0}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000540)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) bind$inet6(r7, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback={0xff00000000000000}}, 0x1c) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@bridge_delneigh={0x28, 0x1d, 0x1, 0x70bd25, 0x25dfdbcd, {0x7, 0x0, 0x0, r8, 0x80, 0x2, 0x8}, [@NDA_LLADDR={0xa, 0x2, @link_local}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000800}, 0x24044050) ioctl$sock_ifreq(r2, 0x8990, &(0x7f0000000480)={'dummy0\x00', @ifru_data=&(0x7f0000000440)="d39dbee1f98213b860157c7485cdf319f525b87836d19b04f4aff9e841689326"}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=@newqdisc={0x148, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x0, 0x1}, {0xffff, 0xffff}, {0x16}}, [@qdisc_kind_options=@q_red={{0x8}, {0x11c, 0x2, [@TCA_RED_STAB={0x104, 0x2, "09000020000000008f29d158039b90627d7b60f0d5ca47f33eed46409b7c8722ce020df6b24c2e6ac7b97dc04d01be2092874115214b1ebb764511f69cd1e9f6263346363d2c639c76000067af25166c2f0f85f36aa8867406119c010400002e31dea98204000000d560eae59ea49ef95d73202a6e3b5e1eb38244e694e7410d33bc92794ad27031f2a19698b5142ddf36e2a876a4fc871207bf12a84f1d4d132f5bb7edcf2d08d677e6a7268e106b6ced3c7f53df24092ddb9e0fac6a1153c3fc88bfd1404fef22cf3e825a6e19c6a48a5444eabb459ac3ec9a278df4011773d2f2e6529ed0ad424b47ec67522477f979360b76d1008000"}, @TCA_RED_PARMS={0x14, 0x1, {0x3f26, 0xbe, 0x81, 0xc, 0xb, 0x54, 0x5}}]}}]}, 0x148}}, 0x2004809c) 7.303465547s ago: executing program 0 (id=1064): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01080000000000000000010000000900030073797a32000000001400048008000240ff"], 0x88}, 0x1, 0x0, 0x0, 0x2000c045}, 0x24000004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) 7.225858544s ago: executing program 3 (id=1065): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r1, 0x4068aea3, &(0x7f0000000180)={0x8f, 0x0, 0x2}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) openat$ppp(0xffffff9c, &(0x7f0000000240), 0x400, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r3) r4 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r3) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000640)={&(0x7f0000000740)={0x434, r5, 0x10, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_FRAME={0x22, 0x33, @disassoc={{{0x0, 0x0, 0xa, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1}, {0x7ff7}, @device_a, @device_a, @random="f3ef25875ff4", {0x0, 0x7}, @value=@ver_80211n={0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}}, 0x19, @void}}, @NL80211_ATTR_DURATION={0x8, 0x57, 0xe27}, @NL80211_ATTR_FRAME={0x28e, 0x33, @reassoc_resp={{{0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1}, {}, @device_b, @broadcast, @from_mac=@device_b, {0x5, 0x3}, @value=@ver_80211n={0x0, 0xff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x104, 0x25, @default, @val, @void, [{0xdd, 0xa8, "b8f494015ed965f2fb08c22ea56e358d0ca989c855acd1c443a961bbde611370bcd382322f35f93bd3b6811cb9952f1a9f3c44f582885d3cda5e8c9c90f4736c6df85ad4e30da5ae2d4fd1ecd2aa234cccd4d4a56610d7575f85c3d9c1506ecb708a89a08d3a06dbe1dcba38d692b3bc8b9980ecaa15a2f9072baae66d7365e9f98b4f617bdfd16575e746e1cdcf7fec934c570b390c3cf8e14b0aad380fb8a08c5f5513d612aada"}, {0xdd, 0xbf, "2d4dbf8cd7e7857c8d27913ad57fdd916d445a1904c21074d86376388be0009b1cb2eed03e229ae73db6bfc04918c75c879a7d099f1da1d255b65c9b1a73aa3bf16d45e0e432cb323e3c5ae55771a2df1fa9c6047ce567d30c0a7d7e9a6c4b1bfd673dfa7445a9760e1adaa2ad8ef1c4c2844a44a87d439e83f15f561cbe222a73f3d4e3de783f9d4364cc98b45732d67aa8fd7e73cfe6b78360955e82b89c261ca7c86fb767c81664076564ce133d23d04d6fc222e259808b9573937f6b20"}, {0xdd, 0xaa, "aff30ed77be17bbde0785e8d59fa723c1cc9b75b255c7f8ac778f1e72b1815b01d6dd9ebb6acd192a3d058fa9b82ddb6a46fd8170f2f9788493c92493fac003b369da0c52f81efb3f1a54ad6be80176abdf12e3d93ac6299076cd2f0fd6d2fbcad0335d58435d3ec9d892cd910a896bdd5c80750fd2bd5f52f7dc1299fa5b07b89a391fe122b661896ba1627a042309f5cd752b038293f25873483925ca9d63603989671cf878b74c5e7"}, {0xdd, 0x4d, "8a79133b7f7982457913bc27837a66b33835a5de9f5033fb667587980413a555107236eae087f63436ad01aaae56cc1a89487dbe5228c90d071465749062fb7209583099c127acfbca743d6c58"}]}}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x1326}, @NL80211_ATTR_FRAME={0x14e, 0x33, @probe_request={{{0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x80}, @device_b, @device_a, @initial, {0x3, 0x5}, @value=@ver_80211n={0x0, 0x87d, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1}}, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x6, [{0xc, 0x1}, {0x36}, {0x4, 0x1}, {0x2}, {0x60, 0x1}, {0x2, 0x1}]}, @val={0x3, 0x1, 0x3}, @val={0x2d, 0x1a, {0x2, 0x3, 0x0, 0x0, {0x6, 0x5d3, 0x0, 0x7, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x40}}, @val={0x72, 0x6}, [{0xdd, 0xa1, "1e6c69b38c39da190011e6da90697f4b7c6899fa3c6a937ba2827035a718ac0716288ed7790bb876398f83ac14a4904c4a36c60cd25a809989d03dcfb2d35e7678e077ac3aa2294b0ac576b9af024ccc262d9ebd8c9f388e073507dd03aea81357bf89f005c9652ef9cec00933a187ed6e5de8fe4ea2de3ba893d959c219c940b704afb2411208d9992fd9f53cf39b33381e7a440cee2e6a56d40ba0aaddc977bd"}, {0xdd, 0x2c, "22437c5b67bfbab783eccdc93dfdd6b1a582bec823ea84820c10c2c52118e6f24ebcdc7eb6278531176aff3d"}, {0xdd, 0x24, "94c0a534d8d99f2258c85e2230d3dc079a59b131e895a9f7a933314703c58d6b518a89ed"}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40040d1}, 0x4000044) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000140)=0x2000) ppoll(&(0x7f0000000040)=[{r4, 0x20}], 0x1, 0x0, 0x0, 0x0) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) write$dsp(r6, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0xff51) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6.897529564s ago: executing program 4 (id=1066): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/keys\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x1, 0xa, 0x0, 0x3}, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') accept4$inet6(r4, 0x0, 0x0, 0x100000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) accept4$tipc(r1, &(0x7f00000000c0), &(0x7f00000001c0)=0x10, 0x80000) r6 = openat$hwrng(0xffffff9c, &(0x7f0000000240), 0x10002, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x4, 0x0, {0xa, 0xfffe, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x32) socket$inet_udp(0x2, 0x2, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) r7 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r7) write$USERIO_CMD_SET_PORT_TYPE(r7, &(0x7f0000000000)={0x1, 0x2}, 0x2) read$FUSE(r4, &(0x7f0000000640)={0x2020}, 0x2020) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000800)={[&(0x7f0000000940)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01']}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 6.395525701s ago: executing program 0 (id=1068): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=@newtaction={0x110, 0x30, 0x1, 0x0, 0x0, {}, [{0xfc, 0x1, [@m_skbedit={0xb0, 0x0, 0x0, 0x0, {{0xc}, {0x4c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xffff, 0xa}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xffe0, 0xfff1}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x9}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x7}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xb, 0xfff2}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xb, 0x9, 0x3, 0x7, 0x7}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x88fc9d66c8570d13}]}, {0x3c, 0x6, "9c0d6928ae300f1c09b2d372c98813697435303fa353a54cc06fa545942aa536b9c113fe9367e59a80f0ed2527aecf82fd0677cbaf23b31c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000180)=0x4, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/11], 0x50) 5.962427611s ago: executing program 4 (id=1070): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=@newtaction={0x110, 0x30, 0x1, 0x0, 0x0, {}, [{0xfc, 0x1, [@m_skbedit={0xb0, 0x0, 0x0, 0x0, {{0xc}, {0x4c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xffff, 0xa}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xffe0, 0xfff1}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x7}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x8001}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xb, 0xfff2}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xb, 0x9, 0x3, 0x7, 0x7}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x88fc9d66c8570d13}]}, {0x3c, 0x6, "9c0d6928ae300f1c09b2d372c98813697435303fa353a54cc06fa545942aa536b9c113fe9367e59a80f0ed2527aecf82fd0677cbaf23b31c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000180)=0x4, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/11], 0x50) 4.938683017s ago: executing program 0 (id=1071): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sched_setscheduler(0x0, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[], 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xb5, 0x7, 0x4}, 0x9c) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/ehci-pci/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='0000:00:1d.7', 0xc) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/pci/drivers/ehci-pci/bind\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='0000:00:1d.7', 0xc) r6 = socket(0x10, 0x3, 0x0) write(r6, &(0x7f0000000080)="240000004e0025000307f4f9002304000a04f55f08000100020100020800038005000000", 0x24) accept4$inet(r6, &(0x7f0000000080)={0x2, 0x0, @dev}, &(0x7f00000001c0)=0x10, 0x80000) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="04010000100007000000000000000000ff02000000000000000000000000000100000000000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00], 0x104}}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x25) 4.418434689s ago: executing program 4 (id=1072): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=@newtaction={0x110, 0x30, 0x1, 0x0, 0x0, {}, [{0xfc, 0x1, [@m_skbedit={0xb0, 0x0, 0x0, 0x0, {{0xc}, {0x4c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xffff, 0xa}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xffe0, 0xfff1}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x9}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x8001}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xb, 0xfff2}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xb, 0x9, 0x3, 0x7, 0x7}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x88fc9d66c8570d13}]}, {0x3c, 0x6, "9c0d6928ae300f1c09b2d372c98813697435303fa353a54cc06fa545942aa536b9c113fe9367e59a80f0ed2527aecf82fd0677cbaf23b31c"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000180)=0x4, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/11], 0x50) 3.966818143s ago: executing program 3 (id=1075): r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xec}}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) mount(0x0, 0x0, 0x0, 0x44021, 0x0) madvise(&(0x7f00002d9000/0x2000)=nil, 0x2000, 0x70) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000340)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) set_mempolicy(0x0, &(0x7f0000000040)=0xfffffffffffffbff, 0x5) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES16], 0x48) set_mempolicy(0x8000, &(0x7f0000000100)=0x9, 0x1) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x41, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x44) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f000000bbc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000001180)="dd", 0x1}], 0x1, &(0x7f00000003c0)=[@rights={{0x10, 0x1, 0x1, [r3]}}], 0x10, 0x20000041}}], 0x1, 0xc004) recvmmsg(r4, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f0000000500)={'nat\x00', 0x0, 0x4, 0x0, [0x0, 0x7, 0x2, 0x0, 0x6, 0x5], 0x0, &(0x7f00000002c0), 0x0}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, 0x0, &(0x7f0000000680)) 2.597177257s ago: executing program 3 (id=1077): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./ffs\x00', 0x1ff) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041d"], 0x8) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r1, &(0x7f00000001c0)='functionfs', 0xa) read(r0, &(0x7f0000000100), 0xb) mount(&(0x7f0000000240)=@filename='usb0\x00', &(0x7f0000000280)='./ffs\x00', &(0x7f0000000100), 0x0, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r2) sendmsg$NLBL_MGMT_C_ADD(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000bc0)={0x29c, r3, 0xe701ac47a3d23ccd, 0x0, 0x2, {}, [@NLBL_MGMT_A_DOMAIN={0x277, 0x1, 'C\xec\xf8\xa0w\x15|:\xac\r\xab\xb93\x14\xcd\xcb\xb6\xb9\xbb\x84\xe5\xbc\xdb\x7f\x9a\xf2\xea\xcc\x91:v@\xe83-\x1d\xaagQl\x7f\tKt\fc\x1f\x95K]\xce,\xd1\xeb\x17]\xd5\xd0\xa7D!_\xa9$\x94\x02\v\x10od\xe6,\xd3@I\x17\xf3\xbees0\xad\xc6\xbf/*s6\xec\x06\xc7\x1dO\xb6(o\x91t\x12\x93UK\xf4@n\xdc\xdc\x8a7y\x81FY\xbe\xbbc\xd2\xc3\x01\xa5\xe2V\x8c\xb3im~\xd2V\xdaG\xbdbF\xc8n\x86\xac\x9c\xfb\xdak\x1a\x13\xe9\tc\x85\xb4\xcb\x815\x87\xd5\x97C\x1cM\x9eCdb\xad;\xa2\x8fs\xbf6\xe8\xe3Xg3&\xe2 \xd2\n\x9d=~=\xe5\xdc\x90\a\xe7M\x9c<\x93/\xaf\x89\x06+\x96]\xb5+\xee\xff8^D*\xdb\xb8\xd8t\x80\xd4\xb4\v[\xdc@5\xbe\x9f\xccz\x81\x1f\xb4A|\x1a2p\xd1\x95\xb0i\"g\xd1\xf7t\xa4\xb3\x94\xe9\x01\xce\x82`\x17n\f\x05\xaa:\x03\x8cJs\x92\x81\xb0\\\xa5\xc7eB\xa5\a\xb6\x814\x05\xd1$3\x15/\xfcwNV\xeaif\xeb\x0f6\x94{5Se\xe9o\x86\a!\xf0\x9b\x80\x95\x84\xa6E\x90\xc9 \t \x04\xb1\xe7\xec\xf4\xe6 \x91\xfa\xd01<\xbcc\xd1\xac?V\xe2b3\xdelP[I\xae\x18Z\xa6K\xf2~\x19\x0f\xe7\x90\xb0\x84M)\x8e\x1av\xc2\a\xb4{\xb1(\b\xb5uh\x12k\xe2R?\x8boI\t\x87\xab\x80{\x8a\x1e\x85\xd6\x8c8vx\xeeTF\x1f&\x1fmaCc;Q\x9e\xd2\x9e\xcb\xa4\xb5M\xb1I\xfe%ukl\x18\xf7\xa5`\xaa\xed\xd7\xb1\xbf\xa0S?8\xb3Z\xb3\x1c\xb7FI7\xac\xdb\xa8\x1aF\xe5\x99\xc1\xa8\x9d\x84\x80]\x96\x0f\x0e\xd3\x00\xc91\xf1\x99\x02\xce\x01\x00\x00\x00\x00\x00\x00\x00;\xc5\b\x95\x1e\xff\xfc\xc8\x8e\x82\xb1\x8b_E\xc1\xb9AVN\v\xdf\xc1\x7f\x8f\xe9\xac\xab/\x85\xb3\xe8\xde\r\x04\xe7`\xb2\x1a\xcb;\xd8)\xac\x96\x1b\xd6K\x94z\xf7\xb8l0e\xed\x7f\xbb]\xdb\x1e\xff\xe8\xe8\x03V\x0e/\xc5K\x1e\x99\x9d\x11\xfe\x85c\x8a\x98|}\v\xb6\xaak\xc9p\xa0j\xe5!\r3\xd3I|\x1e]\xc8\xc4x\x92\xf3UE\xbcr\xbe\x0fI\xcfj\xdeB\x90\xa1\xe2Q\fD\xda_p\x87\x1b\xcd\x04\x94\xd67\xbe\xa2\xcaW\x12c{RzZ\x06\xf9\x95Pj\x06\x04\xbdz\x89o\x83N\x1ez\x10\xda\xdeK\xbaf\xcbDq\x97'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0xa}]}, 0x29c}, 0x1, 0x0, 0x0, 0x20084880}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r4) sendmsg$NLBL_MGMT_C_LISTDEF(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)={0x5, r6, 0xc01, 0x70bd29, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x28}, 0x1, 0x0, 0x0, 0x90}, 0x44000) memfd_create(&(0x7f00000002c0)='#\x00', 0x1) 2.330977867s ago: executing program 2 (id=1078): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) setreuid(0xee01, 0xee01) kexec_load(0x0, 0x0, 0x0, 0x3e0000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x4000) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x400001}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000440), 0x10) listen(r2, 0x5) connect$vsock_stream(r2, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/hardlockup_count', 0x800, 0x4) read$char_usb(r3, &(0x7f0000000040)=""/236, 0xec) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) fspick(0xffffffffffffffff, 0x0, 0x0) open(&(0x7f0000000280)='.\x00', 0x0, 0x1d0) symlink(&(0x7f0000001640)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000e40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') readlink(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200)=""/237, 0xed) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/rcu_expedited', 0xa82, 0x0) write$cgroup_int(r4, &(0x7f0000000580)=0x8000000000000499, 0x12) r5 = socket$nl_generic(0x10, 0x3, 0x10) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r7}, 0x2c, {[{@cache_fscache}, {@cachetag={'cachetag', 0x3d, '\x14\xe2\xc3\x11\xe2\xcb\x86\xc8-Hs\xc6\xafm\xdc{\xdeU#\xebp7-\x9f\xb8\xf3A\xb2CX\xd3//\xdd28+\x9dS\"\x9bm\x19\xd0K4a\xe6\xfb\xdb\xf7\xe4K\xb5\xc8\x94_\a\xe61\x91\xe4<@\xc37+\x9c\xb2\xe8E=T\xd5\xb1\'\xc3w\f\'\xd4\x97\xf8\xba\xe8\xa0\n\x8d\xc7\xc9\x7f\xa8\x1d\x88\xa3\x17\xca\xa5e\x7fYj\x82Z\xe9K\xa0T\\\x87u\x8coL\a|\xc8f^\x01\x04\xe4\x8e\x0f\xfe\x16\xa7G\xd4\xa1\xef\xc5\xa7k\x1dE\xb0\x9d!i\x99\\^\\]G?E+\xcd}\xf7i\xe2\xa2\x8dEW\xab\xdc\x8c\xe9Y\xb1\xc8\xc4\x97!\xbc\xf4\xef\xc9\x03v\xf3 \xb2\xc5\xd5\xf0$\xa0KD5\xf4\x9c\xe1\r\xc4\xa0\xd1\'\xadC\xb7Z\f[t\xd1\xadYk\x90v0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f000000bbc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000001180)="dd", 0x1}], 0x1, &(0x7f00000003c0)=[@rights={{0x10, 0x1, 0x1, [r4]}}], 0x10, 0x20000041}}], 0x1, 0xc004) recvmmsg(r5, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r3, 0x0, 0x81, &(0x7f0000000500)={'nat\x00', 0x0, 0x4, 0x0, [0x0, 0x7, 0x2, 0x0, 0x6, 0x5], 0x0, &(0x7f00000002c0), 0x0}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) ptrace(0x4206, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, 0x0, &(0x7f0000000680)) 2.11096806s ago: executing program 2 (id=1081): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000700000023000100090000"], 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x1c, 0x21, 0x9, 0x2, 0x25dfdbff, {0x3}, [@typed={0x8, 0x8, 0x0, 0x0, @fd=r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4008814) connect$unix(0xffffffffffffffff, 0x0, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x2c}) openat$sequencer(0xffffff9c, &(0x7f0000000040), 0x460400, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000240)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) write(0xffffffffffffffff, &(0x7f0000000180), 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$OCFS2_IOC_INFO(0xffffffffffffffff, 0x80106f05, &(0x7f000000c140)={0x0}) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x1858}, 0x1, 0x0, 0x0, 0x200408d1}, 0x4008094) 1.018152307s ago: executing program 0 (id=1082): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$NFC_CMD_FW_DOWNLOAD(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022cbd7000fcdbdf25150000000500140000000000040014000800140047504c000800140047504c005ec5e918d95f96f2f5ab36dc50fb12ba0cb00dd3894d74abe2b861c0ac3cd4269bb44c4633d823894775c19f0796889bd059f28b2e496350ea9a781ebfe596cbf9606c4c06b8f60e1bd8daa5ac021841d86d505706c43919434952026eb88d9cf3c6d163b7e1bf2569fb433c83034b339d5cce8338d72dcae05d9e234db9e83a40c4ac82bbe4fd49a918211e16655c2f8b46593cdfd45bd563da98803ab6ccaf6ca80505a1f70371db7baaba7686815c3bba5d5ba7239a220a46cf8a3d53648b74c03dfa82f16007fb1959146304b24e517160fe5afdb3ea"], 0x30}, 0x1, 0x0, 0x0, 0x84016}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r0, 0x0, 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000bc0)=@bpf_tracing={0x1a, 0x2d, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1}, {}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @alu={0x4, 0x1, 0x0, 0x4, 0x5, 0xfffffffffffffffc}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x101}}, @ldst={0x0, 0x3, 0xdc65d231dbe5d1ab, 0x8, 0xb, 0xfffffffffffffff4, 0x10}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000940)='GPL\x00', 0x7, 0xf9, &(0x7f0000000980)=""/249, 0x41100, 0x10, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x2eef3, 0xffffffffffffffff, 0x9, &(0x7f0000000ac0)=[0xffffffffffffffff], &(0x7f0000000b00)=[{0x5, 0x2, 0xd}, {0x1, 0x1, 0x6, 0x2}, {0x3, 0x3, 0x9, 0x1}, {0x2, 0x2, 0x2, 0xc}, {0x5, 0x1, 0xa, 0xc}, {0x2, 0x4, 0x0, 0xa}, {0x5, 0x4, 0x1, 0xc}, {0x3, 0x5, 0x4, 0x4}, {0x5, 0x3, 0x3e3240d0, 0x6}], 0x10, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0x20, &(0x7f0000000000)={&(0x7f0000000240)=""/187, 0xbb, 0x0, &(0x7f0000000440)=""/204, 0xcc}}, 0x10) io_uring_setup(0xf06, &(0x7f00000003c0)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) init_module(0x0, 0x0, 0x0) get_robust_list(0x0, &(0x7f0000000240)=0x0, &(0x7f0000000280)) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="04010000160001000000000000000000fe8000000000000000000000000000aae000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000ddff32000000ffffffff000000020000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000002"], 0x104}, 0x1, 0x0, 0x0, 0x40004}, 0x0) sendmsg$nl_xfrm(r2, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$DRM_IOCTL_GET_MAP(0xffffffffffffffff, 0xc0186404, &(0x7f00000000c0)={&(0x7f0000006000/0x2000)=nil}) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) close(0xffffffffffffffff) 1.00743821s ago: executing program 4 (id=1083): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r1, 0x4068aea3, &(0x7f0000000180)={0x8f, 0x0, 0x2}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) openat$ppp(0xffffff9c, &(0x7f0000000240), 0x400, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r3) r4 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r3) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000640)={&(0x7f0000000740)={0x434, r5, 0x10, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_FRAME={0x22, 0x33, @disassoc={{{0x0, 0x0, 0xa, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1}, {0x7ff7}, @device_a, @device_a, @random="f3ef25875ff4", {0x0, 0x7}, @value=@ver_80211n={0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}}, 0x19, @void}}, @NL80211_ATTR_DURATION={0x8, 0x57, 0xe27}, @NL80211_ATTR_FRAME={0x28e, 0x33, @reassoc_resp={{{0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1}, {}, @device_b, @broadcast, @from_mac=@device_b, {0x5, 0x3}, @value=@ver_80211n={0x0, 0xff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x104, 0x25, @default, @val, @void, [{0xdd, 0xa8, "b8f494015ed965f2fb08c22ea56e358d0ca989c855acd1c443a961bbde611370bcd382322f35f93bd3b6811cb9952f1a9f3c44f582885d3cda5e8c9c90f4736c6df85ad4e30da5ae2d4fd1ecd2aa234cccd4d4a56610d7575f85c3d9c1506ecb708a89a08d3a06dbe1dcba38d692b3bc8b9980ecaa15a2f9072baae66d7365e9f98b4f617bdfd16575e746e1cdcf7fec934c570b390c3cf8e14b0aad380fb8a08c5f5513d612aada"}, {0xdd, 0xbf, "2d4dbf8cd7e7857c8d27913ad57fdd916d445a1904c21074d86376388be0009b1cb2eed03e229ae73db6bfc04918c75c879a7d099f1da1d255b65c9b1a73aa3bf16d45e0e432cb323e3c5ae55771a2df1fa9c6047ce567d30c0a7d7e9a6c4b1bfd673dfa7445a9760e1adaa2ad8ef1c4c2844a44a87d439e83f15f561cbe222a73f3d4e3de783f9d4364cc98b45732d67aa8fd7e73cfe6b78360955e82b89c261ca7c86fb767c81664076564ce133d23d04d6fc222e259808b9573937f6b20"}, {0xdd, 0xaa, "aff30ed77be17bbde0785e8d59fa723c1cc9b75b255c7f8ac778f1e72b1815b01d6dd9ebb6acd192a3d058fa9b82ddb6a46fd8170f2f9788493c92493fac003b369da0c52f81efb3f1a54ad6be80176abdf12e3d93ac6299076cd2f0fd6d2fbcad0335d58435d3ec9d892cd910a896bdd5c80750fd2bd5f52f7dc1299fa5b07b89a391fe122b661896ba1627a042309f5cd752b038293f25873483925ca9d63603989671cf878b74c5e7"}, {0xdd, 0x4d, "8a79133b7f7982457913bc27837a66b33835a5de9f5033fb667587980413a555107236eae087f63436ad01aaae56cc1a89487dbe5228c90d071465749062fb7209583099c127acfbca743d6c58"}]}}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x1326}, @NL80211_ATTR_FRAME={0x14e, 0x33, @probe_request={{{0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x80}, @device_b, @device_a, @initial, {0x3, 0x5}, @value=@ver_80211n={0x0, 0x87d, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1}}, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x6, [{0xc, 0x1}, {0x36}, {0x4, 0x1}, {0x2}, {0x60, 0x1}, {0x2, 0x1}]}, @val={0x3, 0x1, 0x3}, @val={0x2d, 0x1a, {0x2, 0x3, 0x0, 0x0, {0x6, 0x5d3, 0x0, 0x7, 0x0, 0x1, 0x1}, 0x400, 0x2, 0x40}}, @val={0x72, 0x6}, [{0xdd, 0xa1, "1e6c69b38c39da190011e6da90697f4b7c6899fa3c6a937ba2827035a718ac0716288ed7790bb876398f83ac14a4904c4a36c60cd25a809989d03dcfb2d35e7678e077ac3aa2294b0ac576b9af024ccc262d9ebd8c9f388e073507dd03aea81357bf89f005c9652ef9cec00933a187ed6e5de8fe4ea2de3ba893d959c219c940b704afb2411208d9992fd9f53cf39b33381e7a440cee2e6a56d40ba0aaddc977bd"}, {0xdd, 0x2c, "22437c5b67bfbab783eccdc93dfdd6b1a582bec823ea84820c10c2c52118e6f24ebcdc7eb6278531176aff3d"}, {0xdd, 0x24, "94c0a534d8d99f2258c85e2230d3dc079a59b131e895a9f7a933314703c58d6b518a89ed"}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40040d1}, 0x4000044) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000140)=0x2000) ppoll(&(0x7f0000000040)=[{r4, 0x20}], 0x1, 0x0, 0x0, 0x0) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) write$dsp(r6, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0xff51) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.00242416s ago: executing program 2 (id=1084): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000700000023000100090000"], 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x1c, 0x21, 0x9, 0x2, 0x25dfdbff, {0x3}, [@typed={0x8, 0x8, 0x0, 0x0, @fd=r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4008814) connect$unix(0xffffffffffffffff, 0x0, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x2c}) openat$sequencer(0xffffff9c, &(0x7f0000000040), 0x460400, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000240)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) write(0xffffffffffffffff, &(0x7f0000000180), 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$OCFS2_IOC_INFO(0xffffffffffffffff, 0x80106f05, &(0x7f000000c140)={0x0}) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200408d1}, 0x4008094) 973.845259ms ago: executing program 3 (id=1085): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) openat$ppp(0xffffff9c, 0x0, 0x400, 0x0) ioctl$KVM_NMI(r1, 0xae9a) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r2) r3 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r2) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000740)={0x1c, r4, 0x10, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40040d1}, 0x4000044) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000000140)=0x2000) ppoll(&(0x7f0000000040)=[{r3, 0x20}], 0x1, 0x0, 0x0, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) write$dsp(r5, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784c", 0x1f) ioctl$KVM_RUN(r1, 0xae80, 0x0) 184.090349ms ago: executing program 2 (id=1086): syz_emit_ethernet(0x27e, &(0x7f0000000000)={@multicast, @random="01800000279f", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "430093", 0x248, 0x3a, 0x0, @dev, @mcast2, {[], @echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "65fe990e7d6a42cab919d3119e4e2b0fd71a6f6a968bd2730e235ed2f63c1dccc86c16a3b16b1d8436c5933fbbe0ac37148cf1b38b3721ad616e2d35828bce6a3566769bf839802d882ad12100215b9a15b6c4188afabc4d4faa6bbf1e9fd5d53d13fd634b5a12e4ceb7f6528b76f06e0c402af440eebad5dbc10e8fd776899d846b269fdb07728bdeef79e4de4a901ee14b1c376f66f08ed7476c69cc1c6576845b60e4ff339fc10e81b1d4238327bab7a10234341191d768cf53162d289b5f62928efc6874494e4da7a4aed33cc8596b3647740e9b9539c5b22decf3ef3280dd6c9827cd8aa29adca7ad548a8582e9bbb4fe9d209404612261835e72e7fec746e46aa0a1dd570a57b15ec697815ab07089f6d7669642dc7a3e5c7e6c0919c35efd3b43c038a80c2e89bc4871e5dd3600d8c4b48c3ac83d5cd014c18021953f51c7cef74bbb17e64c72fb263b78c2742afdcc620f4ca3f5460b993ef90ef7ff1b73169137faf4beffacdd9249b28e3bcd9282956c2d6895d43c0bd4f8307718d962b8ef250df8db6c2106b2a641ab643075ac36613a4e9cdf1b9f1bd63a556e0f2e2b478afbf2d2dcc70d21ac9cf0665e26e1e1465df47109c361bdeb01c9ac0d740820d0d78492b6d79f0e4dc3de50fd91a71709492f1ce891cbd9a4d61b504942afc3fdfb9cc31bc7be7e361e489b505f85c48c1b9dc5d10e0e7fed2bbd5e90c9b556a3f1a613b28668b141e60caeed0852f52f0331e64fd51b46bcdcfe7b5fec7e70d0cd30ca9ece8d8da4d441d8fe8d6fd8a5a4399729271a881b7604df"}}}}}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000001c0)=ANY=[@ANYBLOB="00010000", @ANYRES16=r1, @ANYBLOB="01000000000000000000010000000c00048005000300020000000800020001000000080001000000000004000880cc00088034000780080005007c6610430800060004000000080006009700000008000500c6a13c5008000500d25c493f08000500bf2081642c000780000005004c730d6e08000500eba3b54708000600a300000008000600f100000008000600750000001c000780080005a441f829e1ef7ffc005100000008000600240000004c00078008000600"], 0x100}}, 0x0) (fail_nth: 3) 101.83638ms ago: executing program 2 (id=1087): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r8 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r8, r7, &(0x7f0000000280)={0x0, 0xf5b8, 0x10, 0x1, 0x215, 0x0, r1}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe4b8, 0x2, 0x3, 0xf}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2b4f, 0x4000, 0x0, 0x344}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6f38, 0x1, 0x3, 0x221, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa5df, 0x801, 0x2, 0x2bd, 0x0, r1}}], 0x4, &(0x7f0000001dc0)={0x2e, 0xc, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xfff9}, 0x0, r6, '\x00', {0x1, 0x362, 0x0, 0x0}}, &(0x7f0000001e40)) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/strings/0x409/s1\x00', 0x1ff) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r10) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) sendmsg$nl_route_sched(r11, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0x0, 0xe}, {0xfff7, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x5, 0x8, 0x9, 0x3ff, 0xa0dd}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r13 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r13, 0x0, 0x0, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r12, 0x1, 0xd8, 0x6, @remote}, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x85) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000080)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/mass_storage.usb0\x00') r14 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r14, 0x8916, &(0x7f0000000340)={@dev={0xfe, 0x80, '\x00', 0x26}, 0x7c, r12}) write(r14, &(0x7f0000000d00)='dummy_udc.0', 0xb) 42.89059ms ago: executing program 0 (id=1088): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) fsync(r0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r3, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, r1, 0x200, 0x70bd27, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x10000, 0x8}}}}, [@NL80211_ATTR_KEY_CIPHER={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x449cc79f52ee975d}, 0x44000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x0, 0x0) write(r4, &(0x7f00000000c0)='1\x00', 0x1) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) clock_settime(0xfffffffb, &(0x7f0000000140)) bind$bt_hci(r4, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) write(r5, &(0x7f0000000000)="2a000200010078", 0x7) r6 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r6, &(0x7f00000001c0)='1\x00', 0x1) 0s ago: executing program 0 (id=1089): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/keys\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x1, 0xa, 0x0, 0x3}, 0x0) r4 = syz_open_procfs(0x0, 0x0) accept4$inet6(r4, 0x0, 0x0, 0x100000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) accept4$tipc(r1, &(0x7f00000000c0), &(0x7f00000001c0)=0x10, 0x80000) r6 = openat$hwrng(0xffffff9c, &(0x7f0000000240), 0x10002, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x4, 0x0, {0xa, 0xfffe, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x32) socket$inet_udp(0x2, 0x2, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) r7 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r7) write$USERIO_CMD_SET_PORT_TYPE(r7, &(0x7f0000000000)={0x1, 0x2}, 0x2) read$FUSE(r4, &(0x7f0000000640)={0x2020}, 0x2020) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000800)={[&(0x7f0000000940)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01']}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) kernel console output (not intermixed with test programs): s_ioctl+0xc2/0x360 [ 286.957806][ T9025] __do_fast_syscall_32+0xe7/0x970 [ 286.957828][ T9025] ? lockdep_hardirqs_on+0x78/0x100 [ 286.957850][ T9025] do_fast_syscall_32+0x32/0x70 [ 286.957872][ T9025] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 286.957893][ T9025] RIP: 0023:0xf7f72fec [ 286.957942][ T9025] Code: Unable to access opcode bytes at 0xf7f72fc2. [ 286.957950][ T9025] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 286.957967][ T9025] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000004008ae89 [ 286.957978][ T9025] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 286.957988][ T9025] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 286.957997][ T9025] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 286.958007][ T9025] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 286.958031][ T9025] [ 286.958048][ T9025] ERROR: Out of memory at tomoyo_realpath_from_path. [ 287.903365][ T9037] ehci-pci 0000:00:1d.7: remove, state 1 [ 287.906157][ T9037] usb usb1: USB disconnect, device number 1 [ 287.908901][ T9037] usb 1-1: USB disconnect, device number 2 [ 288.086880][ T9041] netlink: 'syz.4.749': attribute type 3 has an invalid length. [ 288.099795][ T9041] netlink: 24 bytes leftover after parsing attributes in process `syz.4.749'. [ 288.233102][ T9037] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 288.505329][ T5836] usb 2-1: new full-speed USB device number 55 using uhci_hcd [ 288.691970][ T5836] usb 2-1: not running at top speed; connect to a high speed hub [ 288.718714][ T5836] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 288.728768][ T5836] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 288.739233][ T5836] usb 2-1: Product: QEMU USB Tablet [ 288.745297][ T5836] usb 2-1: Manufacturer: QEMU [ 288.748482][ T5836] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 288.789481][ T5836] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0055/input/input103 [ 288.870913][ T5836] hid-generic 0003:0627:0001.0055: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 289.184219][ T9045] netlink: 16 bytes leftover after parsing attributes in process `syz.0.751'. [ 289.219319][ T9040] usb 2-1: USB disconnect, device number 55 [ 289.419061][ T9040] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 289.427672][ T9040] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 289.437186][ T9040] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 289.459467][ T9040] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 289.497805][ T9040] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 289.501306][ T9040] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 289.504349][ T9040] usb usb1: Product: EHCI Host Controller [ 289.507344][ T9040] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 289.512094][ T9040] usb usb1: SerialNumber: 0000:00:1d.7 [ 289.554115][ T9040] hub 1-0:1.0: USB hub found [ 289.565830][ T9040] hub 1-0:1.0: 6 ports detected [ 289.656822][ T9051] netlink: 'syz.2.752': attribute type 3 has an invalid length. [ 289.677669][ T9051] netlink: 24 bytes leftover after parsing attributes in process `syz.2.752'. [ 289.696168][ T9040] hub 2-0:1.0: USB hub found [ 289.699638][ T9040] hub 2-0:1.0: 2 ports detected [ 289.726515][ T9040] hub 3-0:1.0: USB hub found [ 289.728734][ T9040] hub 3-0:1.0: 2 ports detected [ 289.769477][ T9040] hub 4-0:1.0: USB hub found [ 289.777736][ T9040] hub 4-0:1.0: 2 ports detected [ 289.794392][ T9049] ehci-pci 0000:00:1d.7: remove, state 1 [ 289.797800][ T9049] usb usb1: USB disconnect, device number 1 [ 289.838839][ T6263] usb usb1-port1: attempt power cycle [ 290.029686][ T9049] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 290.515537][ T5836] usb 2-1: new full-speed USB device number 56 using uhci_hcd [ 290.522071][ T42] audit: type=1804 audit(1784947968.319:20): pid=9061 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.755" name="/newroot/202/file0" dev="tmpfs" ino=1126 res=1 errno=0 [ 290.772258][ T5836] usb 2-1: not running at top speed; connect to a high speed hub [ 290.792857][ T5836] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 290.795922][ T5836] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 290.798393][ T5836] usb 2-1: Product: QEMU USB Tablet [ 290.800011][ T5836] usb 2-1: Manufacturer: QEMU [ 290.801464][ T5836] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 290.827411][ T5836] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0056/input/input104 [ 290.888964][ T5836] hid-generic 0003:0627:0001.0056: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 290.900191][ T9050] usb 2-1: USB disconnect, device number 56 [ 291.037139][ T9067] fido_id[9067]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 291.084689][ T9050] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 291.097923][ T9050] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 291.107918][ T9050] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 291.135732][ T9050] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 291.148942][ T9050] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 291.153389][ T9050] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 291.159340][ T9050] usb usb1: Product: EHCI Host Controller [ 291.165448][ T9050] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 291.168202][ T9050] usb usb1: SerialNumber: 0000:00:1d.7 [ 291.201707][ T9050] hub 1-0:1.0: USB hub found [ 291.210297][ T9050] hub 1-0:1.0: 6 ports detected [ 291.309262][ T9050] hub 2-0:1.0: USB hub found [ 291.311110][ T9050] hub 2-0:1.0: 2 ports detected [ 291.358875][ T9050] hub 3-0:1.0: USB hub found [ 291.367392][ T9050] hub 3-0:1.0: 2 ports detected [ 291.406498][ T9050] hub 4-0:1.0: USB hub found [ 291.410996][ T9050] hub 4-0:1.0: 2 ports detected [ 291.479119][ T5758] Bluetooth: hci1: unexpected event for opcode 0x202d [ 291.483633][ T5758] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 291.505999][ T9072] netlink: 'syz.4.757': attribute type 3 has an invalid length. [ 291.525504][ T6436] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 291.527148][ T9072] netlink: 24 bytes leftover after parsing attributes in process `syz.4.757'. [ 291.656568][ T5758] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 291.967357][ T6436] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 291.981006][ T6436] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 291.986903][ T6436] usb 1-1: Product: QEMU USB Tablet [ 291.988902][ T6436] usb 1-1: Manufacturer: QEMU [ 291.996995][ T6436] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 292.150376][ T6436] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0057/input/input105 [ 292.250774][ T6436] hid-generic 0003:0627:0001.0057: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 292.697010][ T9088] net_ratelimit: 9 callbacks suppressed [ 292.697043][ T9088] netlink: zone id is out of range [ 292.703064][ T9088] netlink: zone id is out of range [ 292.706738][ T9088] netlink: zone id is out of range [ 292.710063][ T9088] netlink: zone id is out of range [ 292.714130][ T9088] netlink: zone id is out of range [ 292.718107][ T9088] netlink: zone id is out of range [ 292.720457][ T9088] netlink: zone id is out of range [ 292.724602][ T9088] netlink: zone id is out of range [ 292.727558][ T9088] netlink: zone id is out of range [ 292.731994][ T9088] netlink: zone id is out of range [ 292.788662][ T9094] ehci-pci 0000:00:1d.7: remove, state 1 [ 292.791243][ T9094] usb usb1: USB disconnect, device number 1 [ 292.793850][ T9094] usb 1-1: USB disconnect, device number 2 [ 292.969608][ T9096] netlink: 'syz.3.764': attribute type 3 has an invalid length. [ 292.997739][ T9096] netlink: 24 bytes leftover after parsing attributes in process `syz.3.764'. [ 293.103922][ T9094] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 293.443258][ T6436] usb 2-1: new full-speed USB device number 57 using uhci_hcd [ 293.657135][ T6436] usb 2-1: not running at top speed; connect to a high speed hub [ 293.697840][ T6436] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 293.708627][ T6436] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 293.723127][ T6436] usb 2-1: Product: QEMU USB Tablet [ 293.732142][ T6436] usb 2-1: Manufacturer: QEMU [ 293.740200][ T6436] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 294.067364][ T6436] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0058/input/input106 [ 294.220369][ T6436] hid-generic 0003:0627:0001.0058: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 294.645328][ T9095] usb 2-1: USB disconnect, device number 57 [ 294.877883][ T9095] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 294.882522][ T9095] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 294.888814][ T9095] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 294.916064][ T9095] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 294.933995][ T9095] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 294.941734][ T9095] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 294.947629][ T9095] usb usb1: Product: EHCI Host Controller [ 294.949509][ T9095] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 294.951480][ T9095] usb usb1: SerialNumber: 0000:00:1d.7 [ 294.964421][ T9095] hub 1-0:1.0: USB hub found [ 294.967466][ T9095] hub 1-0:1.0: 6 ports detected [ 295.036553][ T9095] hub 2-0:1.0: USB hub found [ 295.038842][ T9095] hub 2-0:1.0: 2 ports detected [ 295.076420][ T9095] hub 3-0:1.0: USB hub found [ 295.078656][ T9095] hub 3-0:1.0: 2 ports detected [ 295.118073][ T9095] hub 4-0:1.0: USB hub found [ 295.122319][ T9095] hub 4-0:1.0: 2 ports detected [ 295.275639][ T6436] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 295.482919][ T6436] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 295.502233][ T6436] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 295.517048][ T6436] usb 1-1: Product: QEMU USB Tablet [ 295.534047][ T6436] usb 1-1: Manufacturer: QEMU [ 295.548351][ T6436] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 295.778917][ T6436] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0059/input/input107 [ 295.931168][ T6436] hid-generic 0003:0627:0001.0059: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 295.973091][ T5758] Bluetooth: hci0: unexpected event for opcode 0x202d [ 296.040082][ T5758] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 296.159488][ T5758] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 296.815967][ T9142] netlink: 16 bytes leftover after parsing attributes in process `syz.0.777'. [ 297.214886][ T5758] Bluetooth: hci2: link tx timeout [ 297.218089][ T5758] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 298.013331][ T9159] netlink: 'syz.0.781': attribute type 3 has an invalid length. [ 298.039286][ T9159] netlink: 24 bytes leftover after parsing attributes in process `syz.0.781'. [ 298.252005][ T9161] netlink: 8 bytes leftover after parsing attributes in process `syz.2.783'. [ 299.111766][ T9177] net_ratelimit: 9 callbacks suppressed [ 299.111802][ T9177] netlink: zone id is out of range [ 299.119422][ T9177] netlink: zone id is out of range [ 299.125735][ T9177] netlink: zone id is out of range [ 299.129154][ T9177] netlink: zone id is out of range [ 299.132927][ T9177] netlink: zone id is out of range [ 299.139206][ T9177] netlink: zone id is out of range [ 299.141539][ T9177] netlink: zone id is out of range [ 299.145758][ T9177] netlink: zone id is out of range [ 299.148739][ T9177] netlink: zone id is out of range [ 299.153233][ T9177] netlink: zone id is out of range [ 299.179542][ T5748] Bluetooth: hci0: unexpected event for opcode 0x202d [ 299.256269][ T5748] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 299.311843][ T5748] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 299.385611][ T5748] Bluetooth: hci2: command 0x0406 tx timeout [ 300.356870][ T9188] kvm: apic: phys broadcast and lowest prio [ 300.908362][ T9205] netlink: 16 bytes leftover after parsing attributes in process `syz.3.799'. [ 301.318691][ T9212] netlink: 'syz.2.800': attribute type 3 has an invalid length. [ 301.330013][ T9212] netlink: 24 bytes leftover after parsing attributes in process `syz.2.800'. [ 302.052531][ T9216] netlink: 'syz.4.802': attribute type 3 has an invalid length. [ 302.074778][ T9216] netlink: 24 bytes leftover after parsing attributes in process `syz.4.802'. [ 302.607675][ T9224] netlink: 36 bytes leftover after parsing attributes in process `syz.2.803'. [ 302.611265][ T9227] netlink: 36 bytes leftover after parsing attributes in process `syz.2.803'. [ 302.813164][ T9238] FAULT_INJECTION: forcing a failure. [ 302.813164][ T9238] name failslab, interval 1, probability 0, space 0, times 0 [ 302.817500][ T9238] CPU: 1 UID: 0 PID: 9238 Comm: syz.0.809 Tainted: G L syzkaller #0 PREEMPT(full) [ 302.817518][ T9238] Tainted: [L]=SOFTLOCKUP [ 302.817522][ T9238] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 302.817529][ T9238] Call Trace: [ 302.817533][ T9238] [ 302.817537][ T9238] dump_stack_lvl+0x100/0x190 [ 302.817555][ T9238] should_fail_ex.cold+0x5/0xa [ 302.817567][ T9238] should_failslab+0xc2/0x120 [ 302.817584][ T9238] __kmalloc_noprof+0xfc/0x820 [ 302.817598][ T9238] ? tomoyo_encode2+0xfb/0x3c0 [ 302.817617][ T9238] tomoyo_encode2+0xfb/0x3c0 [ 302.817635][ T9238] tomoyo_encode+0x29/0x50 [ 302.817651][ T9238] tomoyo_realpath_from_path+0x18c/0x690 [ 302.817671][ T9238] tomoyo_path_number_perm+0x23c/0x580 [ 302.817685][ T9238] ? tomoyo_path_number_perm+0x22e/0x580 [ 302.817700][ T9238] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 302.817715][ T9238] ? get_pid_task+0x106/0x250 [ 302.817742][ T9238] ? find_held_lock+0x2b/0x80 [ 302.817756][ T9238] ? __fget_files+0x215/0x3d0 [ 302.817765][ T9238] ? hook_file_ioctl_common+0x140/0x440 [ 302.817779][ T9238] ? __fget_files+0x215/0x3d0 [ 302.817791][ T9238] ? __fget_files+0x21f/0x3d0 [ 302.817803][ T9238] security_file_ioctl_compat+0xd3/0x230 [ 302.817818][ T9238] __ia32_compat_sys_ioctl+0xc2/0x360 [ 302.817856][ T9238] __do_fast_syscall_32+0xe7/0x970 [ 302.817871][ T9238] ? lockdep_hardirqs_on+0x78/0x100 [ 302.817884][ T9238] do_fast_syscall_32+0x32/0x70 [ 302.817899][ T9238] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 302.817913][ T9238] RIP: 0023:0xf7f93fec [ 302.817926][ T9238] Code: Unable to access opcode bytes at 0xf7f93fc2. [ 302.817931][ T9238] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 302.817942][ T9238] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c058534f [ 302.817948][ T9238] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 302.817955][ T9238] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 302.817961][ T9238] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 302.817968][ T9238] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 302.817981][ T9238] [ 302.817991][ T9238] ERROR: Out of memory at tomoyo_realpath_from_path. [ 303.008941][ T9240] netlink: 12 bytes leftover after parsing attributes in process `syz.0.810'. [ 303.168321][ T9246] netlink: 'syz.4.811': attribute type 3 has an invalid length. [ 303.173096][ T9246] netlink: 24 bytes leftover after parsing attributes in process `syz.4.811'. [ 303.697893][ T9252] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 304.062910][ T9261] Illegal XDP return value 3310080778 on prog (id 29) dev N/A, expect packet loss! [ 304.336738][ T9265] tmpfs: Unknown parameter 'hug P' [ 304.409270][ T9267] FAULT_INJECTION: forcing a failure. [ 304.409270][ T9267] name failslab, interval 1, probability 0, space 0, times 0 [ 304.414743][ T9267] CPU: 0 UID: 0 PID: 9267 Comm: syz.0.819 Tainted: G L syzkaller #0 PREEMPT(full) [ 304.414762][ T9267] Tainted: [L]=SOFTLOCKUP [ 304.414766][ T9267] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 304.414773][ T9267] Call Trace: [ 304.414778][ T9267] [ 304.414782][ T9267] dump_stack_lvl+0x100/0x190 [ 304.414798][ T9267] should_fail_ex.cold+0x5/0xa [ 304.414812][ T9267] should_failslab+0xc2/0x120 [ 304.414828][ T9267] __kmalloc_noprof+0xfc/0x820 [ 304.414842][ T9267] ? __pfx_dynamic_dname+0x10/0x10 [ 304.414857][ T9267] ? tomoyo_encode2+0xfb/0x3c0 [ 304.414876][ T9267] tomoyo_encode2+0xfb/0x3c0 [ 304.414894][ T9267] tomoyo_encode+0x29/0x50 [ 304.414910][ T9267] tomoyo_realpath_from_path+0x18c/0x690 [ 304.414930][ T9267] tomoyo_path_number_perm+0x23c/0x580 [ 304.414944][ T9267] ? tomoyo_path_number_perm+0x22e/0x580 [ 304.414959][ T9267] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 304.414974][ T9267] ? get_pid_task+0x106/0x250 [ 304.415001][ T9267] ? find_held_lock+0x2b/0x80 [ 304.415015][ T9267] ? __fget_files+0x215/0x3d0 [ 304.415024][ T9267] ? hook_file_ioctl_common+0x140/0x440 [ 304.415038][ T9267] ? __fget_files+0x215/0x3d0 [ 304.415050][ T9267] ? __fget_files+0x21f/0x3d0 [ 304.415062][ T9267] security_file_ioctl_compat+0xd3/0x230 [ 304.415078][ T9267] __ia32_compat_sys_ioctl+0xc2/0x360 [ 304.415097][ T9267] __do_fast_syscall_32+0xe7/0x970 [ 304.415111][ T9267] ? lockdep_hardirqs_on+0x78/0x100 [ 304.415142][ T9267] do_fast_syscall_32+0x32/0x70 [ 304.415158][ T9267] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 304.415172][ T9267] RIP: 0023:0xf7f93fec [ 304.415186][ T9267] Code: Unable to access opcode bytes at 0xf7f93fc2. [ 304.415191][ T9267] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 304.415202][ T9267] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 304.415209][ T9267] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 304.415215][ T9267] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 304.415221][ T9267] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 304.415227][ T9267] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 304.415242][ T9267] [ 304.499235][ T9267] ERROR: Out of memory at tomoyo_realpath_from_path. [ 304.625260][ T5821] usb 8-1: new low-speed USB device number 5 using dummy_hcd [ 304.785228][ T5821] usb 8-1: Invalid ep0 maxpacket: 16 [ 304.803702][ T9276] net_ratelimit: 9 callbacks suppressed [ 304.803719][ T9276] netlink: zone id is out of range [ 304.808619][ T9276] netlink: zone id is out of range [ 304.810755][ T9276] netlink: zone id is out of range [ 304.813351][ T9276] netlink: zone id is out of range [ 304.816780][ T9276] netlink: zone id is out of range [ 304.819366][ T9276] netlink: zone id is out of range [ 304.821626][ T9276] netlink: zone id is out of range [ 304.824203][ T9276] netlink: zone id is out of range [ 304.826612][ T9276] netlink: zone id is out of range [ 304.829088][ T9276] netlink: zone id is out of range [ 305.015255][ T5821] usb 8-1: new low-speed USB device number 6 using dummy_hcd [ 305.175205][ T9285] netlink: 'syz.0.825': attribute type 3 has an invalid length. [ 305.185570][ T9285] netlink: 24 bytes leftover after parsing attributes in process `syz.0.825'. [ 305.355242][ T5821] usb 8-1: Invalid ep0 maxpacket: 16 [ 305.817357][ T5821] usb usb8-port1: attempt power cycle [ 306.121553][ T9295] netlink: 8 bytes leftover after parsing attributes in process `syz.4.829'. [ 306.124449][ T9295] netlink: 4 bytes leftover after parsing attributes in process `syz.4.829'. [ 306.128032][ T9295] netlink: 'syz.4.829': attribute type 7 has an invalid length. [ 306.140489][ T12] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.145674][ T12] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.148462][ T12] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.153360][ T12] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.244557][ T9299] netlink: 8 bytes leftover after parsing attributes in process `syz.0.828'. [ 306.303047][ T5821] usb 8-1: new low-speed USB device number 7 using dummy_hcd [ 306.519018][ T5821] usb 8-1: Invalid ep0 maxpacket: 16 [ 306.629190][ T9308] ehci-pci 0000:00:1d.7: remove, state 1 [ 306.631543][ T9308] usb usb1: USB disconnect, device number 1 [ 306.633857][ T9308] usb 1-1: USB disconnect, device number 2 [ 306.751279][ T9310] netlink: 'syz.4.833': attribute type 3 has an invalid length. [ 306.763854][ T9310] netlink: 24 bytes leftover after parsing attributes in process `syz.4.833'. [ 306.775904][ T5821] usb 8-1: new low-speed USB device number 8 using dummy_hcd [ 306.863295][ T5821] usb 8-1: Invalid ep0 maxpacket: 16 [ 306.865277][ T5821] usb usb8-port1: unable to enumerate USB device [ 307.087477][ T9308] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 307.345249][ T2322] usb 2-1: new full-speed USB device number 58 using uhci_hcd [ 307.464618][ T9328] FAULT_INJECTION: forcing a failure. [ 307.464618][ T9328] name failslab, interval 1, probability 0, space 0, times 0 [ 307.469132][ T9328] CPU: 1 UID: 0 PID: 9328 Comm: syz.3.838 Tainted: G L syzkaller #0 PREEMPT(full) [ 307.469157][ T9328] Tainted: [L]=SOFTLOCKUP [ 307.469161][ T9328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 307.469167][ T9328] Call Trace: [ 307.469171][ T9328] [ 307.469176][ T9328] dump_stack_lvl+0x100/0x190 [ 307.469193][ T9328] should_fail_ex.cold+0x5/0xa [ 307.469206][ T9328] should_failslab+0xc2/0x120 [ 307.469221][ T9328] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 307.469236][ T9328] ? __alloc_skb+0x5b7/0x710 [ 307.469250][ T9328] ? __alloc_skb+0x140/0x710 [ 307.469265][ T9328] __alloc_skb+0x140/0x710 [ 307.469278][ T9328] ? __alloc_skb+0x5b7/0x710 [ 307.469291][ T9328] ? __pfx___alloc_skb+0x10/0x10 [ 307.469308][ T9328] netlink_alloc_large_skb+0x69/0x150 [ 307.469322][ T9328] netlink_sendmsg+0x680/0xda0 [ 307.469335][ T9328] ? __pfx_netlink_sendmsg+0x10/0x10 [ 307.469349][ T9328] ? apparmor_socket_sendmsg+0x15b/0x270 [ 307.469364][ T9328] ____sys_sendmsg+0xa4d/0xbe0 [ 307.469373][ T9328] ? __pfx_netlink_sendmsg+0x10/0x10 [ 307.469386][ T9328] ? __pfx_____sys_sendmsg+0x10/0x10 [ 307.469402][ T9328] ___sys_sendmsg+0x190/0x1e0 [ 307.469414][ T9328] ? __pfx____sys_sendmsg+0x10/0x10 [ 307.469431][ T9328] ? find_held_lock+0x2b/0x80 [ 307.469454][ T9328] __sys_sendmsg+0x160/0x210 [ 307.469469][ T9328] ? __pfx___sys_sendmsg+0x10/0x10 [ 307.469495][ T9328] ? __pfx_ksys_write+0x10/0x10 [ 307.469515][ T9328] __do_fast_syscall_32+0xe7/0x970 [ 307.469532][ T9328] ? lockdep_hardirqs_on+0x78/0x100 [ 307.469546][ T9328] do_fast_syscall_32+0x32/0x70 [ 307.469560][ T9328] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 307.469575][ T9328] RIP: 0023:0xf7f72fec [ 307.469588][ T9328] Code: Unable to access opcode bytes at 0xf7f72fc2. [ 307.469593][ T9328] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 307.469604][ T9328] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 307.469611][ T9328] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 307.469617][ T9328] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 307.469623][ T9328] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 307.469629][ T9328] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 307.469642][ T9328] [ 307.580864][ T2322] usb 2-1: not running at top speed; connect to a high speed hub [ 307.615619][ T2322] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 307.619539][ T2322] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 307.622929][ T2322] usb 2-1: Product: QEMU USB Tablet [ 307.624891][ T2322] usb 2-1: Manufacturer: QEMU [ 307.626798][ T2322] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 307.660149][ T2322] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.005A/input/input108 [ 307.720617][ T9334] FAULT_INJECTION: forcing a failure. [ 307.720617][ T9334] name failslab, interval 1, probability 0, space 0, times 0 [ 307.726404][ T9334] CPU: 3 UID: 0 PID: 9334 Comm: syz.2.841 Tainted: G L syzkaller #0 PREEMPT(full) [ 307.726432][ T9334] Tainted: [L]=SOFTLOCKUP [ 307.726438][ T9334] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 307.726449][ T9334] Call Trace: [ 307.726455][ T9334] [ 307.726462][ T9334] dump_stack_lvl+0x100/0x190 [ 307.726486][ T9334] should_fail_ex.cold+0x5/0xa [ 307.726504][ T9334] should_failslab+0xc2/0x120 [ 307.726525][ T9334] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 307.726548][ T9334] ? __alloc_skb+0x5b7/0x710 [ 307.726568][ T9334] ? __alloc_skb+0x140/0x710 [ 307.726590][ T9334] __alloc_skb+0x140/0x710 [ 307.726609][ T9334] ? __alloc_skb+0x5b7/0x710 [ 307.726628][ T9334] ? __pfx___alloc_skb+0x10/0x10 [ 307.726656][ T9334] netlink_alloc_large_skb+0x69/0x150 [ 307.726677][ T9334] netlink_sendmsg+0x680/0xda0 [ 307.726699][ T9334] ? __pfx_netlink_sendmsg+0x10/0x10 [ 307.726727][ T9334] ? apparmor_socket_sendmsg+0x15b/0x270 [ 307.726751][ T9334] ____sys_sendmsg+0xa4d/0xbe0 [ 307.726766][ T9334] ? __pfx_netlink_sendmsg+0x10/0x10 [ 307.726787][ T9334] ? __pfx_____sys_sendmsg+0x10/0x10 [ 307.726815][ T9334] ___sys_sendmsg+0x190/0x1e0 [ 307.726849][ T9334] ? __pfx____sys_sendmsg+0x10/0x10 [ 307.726880][ T9334] ? find_held_lock+0x2b/0x80 [ 307.726916][ T9334] __sys_sendmsg+0x160/0x210 [ 307.726940][ T9334] ? __pfx___sys_sendmsg+0x10/0x10 [ 307.726968][ T9334] ? __pfx_ksys_write+0x10/0x10 [ 307.726990][ T9334] __do_fast_syscall_32+0xe7/0x970 [ 307.727012][ T9334] ? lockdep_hardirqs_on+0x78/0x100 [ 307.727033][ T9334] do_fast_syscall_32+0x32/0x70 [ 307.727054][ T9334] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 307.727077][ T9334] RIP: 0023:0xf705efec [ 307.727096][ T9334] Code: Unable to access opcode bytes at 0xf705efc2. [ 307.727105][ T9334] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 307.727122][ T9334] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000340 [ 307.727133][ T9334] RDX: 0000000000000800 RSI: 0000000000000000 RDI: 0000000000000000 [ 307.727143][ T9334] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 307.727152][ T9334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 307.727161][ T9334] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 307.727183][ T9334] [ 307.838316][ T2322] hid-generic 0003:0627:0001.005A: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 307.866264][ T9340] FAULT_INJECTION: forcing a failure. [ 307.866264][ T9340] name failslab, interval 1, probability 0, space 0, times 0 [ 307.871408][ T9340] CPU: 1 UID: 0 PID: 9340 Comm: syz.2.843 Tainted: G L syzkaller #0 PREEMPT(full) [ 307.871433][ T9340] Tainted: [L]=SOFTLOCKUP [ 307.871438][ T9340] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 307.871447][ T9340] Call Trace: [ 307.871452][ T9340] [ 307.871458][ T9340] dump_stack_lvl+0x100/0x190 [ 307.871481][ T9340] should_fail_ex.cold+0x5/0xa [ 307.871502][ T9340] should_failslab+0xc2/0x120 [ 307.871527][ T9340] kmem_cache_alloc_noprof+0x91/0x6a0 [ 307.871549][ T9340] ? __send_signal_locked+0x155/0x12d0 [ 307.871577][ T9340] __send_signal_locked+0x155/0x12d0 [ 307.871608][ T9340] ptrace_attach+0x53a/0x5c0 [ 307.871629][ T9340] __ia32_compat_sys_ptrace+0x22b/0x2c0 [ 307.871650][ T9340] ? __secure_computing+0x1e4/0x2c0 [ 307.871670][ T9340] __do_fast_syscall_32+0xe7/0x970 [ 307.871691][ T9340] ? lockdep_hardirqs_on+0x78/0x100 [ 307.871710][ T9340] do_fast_syscall_32+0x32/0x70 [ 307.871731][ T9340] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 307.871751][ T9340] RIP: 0023:0xf705efec [ 307.871768][ T9340] Code: Unable to access opcode bytes at 0xf705efc2. [ 307.871776][ T9340] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 000000000000001a [ 307.871793][ T9340] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 00000000000002c0 [ 307.871803][ T9340] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 307.871813][ T9340] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 307.871822][ T9340] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 307.871831][ T9340] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 307.871854][ T9340] [ 307.922360][ T9309] usb 2-1: USB disconnect, device number 58 [ 308.121080][ T9309] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 308.130959][ T9309] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 308.138705][ T9309] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 308.166431][ T9309] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 308.171589][ T9309] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 308.174959][ T9309] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 308.185435][ T9309] usb usb1: Product: EHCI Host Controller [ 308.188943][ T9309] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 308.191730][ T9309] usb usb1: SerialNumber: 0000:00:1d.7 [ 308.203457][ T9309] hub 1-0:1.0: USB hub found [ 308.205518][ T9309] hub 1-0:1.0: 6 ports detected [ 308.240938][ T9309] hub 2-0:1.0: USB hub found [ 308.247108][ T9309] hub 2-0:1.0: 2 ports detected [ 308.283348][ T9309] hub 3-0:1.0: USB hub found [ 308.290391][ T9309] hub 3-0:1.0: 2 ports detected [ 308.328491][ T9309] hub 4-0:1.0: USB hub found [ 308.334734][ T9309] hub 4-0:1.0: 2 ports detected [ 308.362457][ T9354] ehci-pci 0000:00:1d.7: remove, state 1 [ 308.364633][ T9354] usb usb1: USB disconnect, device number 1 [ 308.424205][ T5843] usb usb1-port1: attempt power cycle [ 308.429077][ T9357] netlink: 'syz.0.847': attribute type 3 has an invalid length. [ 308.448439][ T9357] netlink: 24 bytes leftover after parsing attributes in process `syz.0.847'. [ 308.609895][ T9354] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 308.622474][ T9359] FAULT_INJECTION: forcing a failure. [ 308.622474][ T9359] name failslab, interval 1, probability 0, space 0, times 0 [ 308.627582][ T9359] CPU: 3 UID: 0 PID: 9359 Comm: syz.4.849 Tainted: G L syzkaller #0 PREEMPT(full) [ 308.627606][ T9359] Tainted: [L]=SOFTLOCKUP [ 308.627612][ T9359] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 308.627621][ T9359] Call Trace: [ 308.627626][ T9359] [ 308.627632][ T9359] dump_stack_lvl+0x100/0x190 [ 308.627658][ T9359] should_fail_ex.cold+0x5/0xa [ 308.627681][ T9359] should_failslab+0xc2/0x120 [ 308.627703][ T9359] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 308.627723][ T9359] ? __alloc_skb+0x5b7/0x710 [ 308.627742][ T9359] ? __alloc_skb+0x140/0x710 [ 308.627764][ T9359] __alloc_skb+0x140/0x710 [ 308.627781][ T9359] ? __alloc_skb+0x5b7/0x710 [ 308.627801][ T9359] ? __pfx___alloc_skb+0x10/0x10 [ 308.627831][ T9359] netlink_alloc_large_skb+0x69/0x150 [ 308.627851][ T9359] netlink_sendmsg+0x680/0xda0 [ 308.627871][ T9359] ? __pfx_netlink_sendmsg+0x10/0x10 [ 308.627890][ T9359] ? apparmor_socket_sendmsg+0x15b/0x270 [ 308.627911][ T9359] ____sys_sendmsg+0xa4d/0xbe0 [ 308.627924][ T9359] ? __pfx_netlink_sendmsg+0x10/0x10 [ 308.627941][ T9359] ? __pfx_____sys_sendmsg+0x10/0x10 [ 308.627971][ T9359] ___sys_sendmsg+0x190/0x1e0 [ 308.627993][ T9359] ? __pfx____sys_sendmsg+0x10/0x10 [ 308.628020][ T9359] ? find_held_lock+0x2b/0x80 [ 308.628054][ T9359] __sys_sendmsg+0x160/0x210 [ 308.628075][ T9359] ? __pfx___sys_sendmsg+0x10/0x10 [ 308.628101][ T9359] ? __pfx_ksys_write+0x10/0x10 [ 308.628126][ T9359] __do_fast_syscall_32+0xe7/0x970 [ 308.628146][ T9359] ? lockdep_hardirqs_on+0x78/0x100 [ 308.628165][ T9359] do_fast_syscall_32+0x32/0x70 [ 308.628184][ T9359] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 308.628203][ T9359] RIP: 0023:0xf708efec [ 308.628221][ T9359] Code: Unable to access opcode bytes at 0xf708efc2. [ 308.628228][ T9359] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 308.628247][ T9359] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 308.628259][ T9359] RDX: 0000000004048000 RSI: 0000000000000000 RDI: 0000000000000000 [ 308.628269][ T9359] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 308.628280][ T9359] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 308.628292][ T9359] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 308.628314][ T9359] [ 308.870834][ T9365] FAULT_INJECTION: forcing a failure. [ 308.870834][ T9365] name failslab, interval 1, probability 0, space 0, times 0 [ 308.875228][ T9365] CPU: 2 UID: 0 PID: 9365 Comm: syz.3.852 Tainted: G L syzkaller #0 PREEMPT(full) [ 308.875246][ T9365] Tainted: [L]=SOFTLOCKUP [ 308.875249][ T9365] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 308.875269][ T9365] Call Trace: [ 308.875273][ T9365] [ 308.875278][ T9365] dump_stack_lvl+0x100/0x190 [ 308.875294][ T9365] should_fail_ex.cold+0x5/0xa [ 308.875306][ T9365] should_failslab+0xc2/0x120 [ 308.875322][ T9365] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 308.875337][ T9365] ? __alloc_skb+0x5b7/0x710 [ 308.875351][ T9365] ? __alloc_skb+0x140/0x710 [ 308.875366][ T9365] __alloc_skb+0x140/0x710 [ 308.875379][ T9365] ? __alloc_skb+0x5b7/0x710 [ 308.875392][ T9365] ? __pfx___alloc_skb+0x10/0x10 [ 308.875409][ T9365] netlink_alloc_large_skb+0x69/0x150 [ 308.875423][ T9365] netlink_sendmsg+0x680/0xda0 [ 308.875437][ T9365] ? __pfx_netlink_sendmsg+0x10/0x10 [ 308.875450][ T9365] ? apparmor_socket_sendmsg+0x15b/0x270 [ 308.875465][ T9365] ____sys_sendmsg+0xa4d/0xbe0 [ 308.875475][ T9365] ? __pfx_netlink_sendmsg+0x10/0x10 [ 308.875488][ T9365] ? __pfx_____sys_sendmsg+0x10/0x10 [ 308.875505][ T9365] ___sys_sendmsg+0x190/0x1e0 [ 308.875517][ T9365] ? __pfx____sys_sendmsg+0x10/0x10 [ 308.875534][ T9365] ? find_held_lock+0x2b/0x80 [ 308.875558][ T9365] __sys_sendmsg+0x160/0x210 [ 308.875573][ T9365] ? __pfx___sys_sendmsg+0x10/0x10 [ 308.875591][ T9365] ? __pfx_ksys_write+0x10/0x10 [ 308.875605][ T9365] __do_fast_syscall_32+0xe7/0x970 [ 308.875619][ T9365] ? lockdep_hardirqs_on+0x78/0x100 [ 308.875638][ T9365] do_fast_syscall_32+0x32/0x70 [ 308.875652][ T9365] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 308.875666][ T9365] RIP: 0023:0xf7f72fec [ 308.875680][ T9365] Code: Unable to access opcode bytes at 0xf7f72fc2. [ 308.875685][ T9365] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 308.875696][ T9365] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000900 [ 308.875703][ T9365] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 308.875709][ T9365] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 308.875715][ T9365] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 308.875722][ T9365] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 308.875751][ T9365] [ 309.287674][ T9376] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 309.290408][ T9376] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 309.294077][ T9376] vhci_hcd vhci_hcd.0: Device attached [ 309.365332][ T2322] usb 2-1: new full-speed USB device number 59 using uhci_hcd [ 309.531888][ T2322] usb 2-1: not running at top speed; connect to a high speed hub [ 309.553565][ T2322] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 309.557878][ T2322] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 309.561859][ T2322] usb 2-1: Product: QEMU USB Tablet [ 309.564233][ T2322] usb 2-1: Manufacturer: QEMU [ 309.566795][ T2322] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 309.585471][ T5836] usb 44-1: SetAddress Request (26) to port 0 [ 309.591577][ T5836] usb 44-1: new SuperSpeed USB device number 26 using vhci_hcd [ 309.676472][ T2322] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.005B/input/input109 [ 309.762211][ T2322] hid-generic 0003:0627:0001.005B: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 309.819334][ T9356] usb 2-1: USB disconnect, device number 59 [ 309.857294][ T9378] vhci_hcd: connection reset by peer [ 309.874265][ T5611] vhci_hcd vhci_hcd.3: stop threads [ 309.876754][ T5611] vhci_hcd vhci_hcd.3: release socket [ 309.879263][ T5611] vhci_hcd vhci_hcd.3: disconnect device [ 309.892634][ T9389] fido_id[9389]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/2-1/report_descriptor': No such file or directory [ 310.020247][ T9356] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 310.023595][ T9356] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 310.028982][ T9356] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 310.096474][ T1487] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 310.116859][ T9356] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 310.120586][ T9356] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 310.123502][ T9356] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 310.126456][ T9356] usb usb1: Product: EHCI Host Controller [ 310.128309][ T9356] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 310.130927][ T9356] usb usb1: SerialNumber: 0000:00:1d.7 [ 310.136289][ T9356] hub 1-0:1.0: USB hub found [ 310.138120][ T9356] hub 1-0:1.0: 6 ports detected [ 310.177116][ T9356] hub 2-0:1.0: USB hub found [ 310.181698][ T9356] hub 2-0:1.0: 2 ports detected [ 310.219805][ T9356] hub 3-0:1.0: USB hub found [ 310.222268][ T9356] hub 3-0:1.0: 2 ports detected [ 310.258327][ T9356] hub 4-0:1.0: USB hub found [ 310.260239][ T9356] hub 4-0:1.0: 2 ports detected [ 310.275513][ T1487] usb 7-1: Using ep0 maxpacket: 16 [ 310.281998][ T1487] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 310.291501][ T1487] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 310.296080][ T1487] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.300322][ T1487] usb 7-1: Product: syz [ 310.302564][ T1487] usb 7-1: Manufacturer: syz [ 310.303741][ T1487] usb 7-1: SerialNumber: syz [ 310.309144][ T1487] usb 7-1: config 0 descriptor?? [ 310.313478][ T1487] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 310.316406][ T1487] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 310.364223][ T9391] netlink: 8 bytes leftover after parsing attributes in process `syz.0.857'. [ 310.446303][ T5892] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 310.500421][ T9400] netlink: 16 bytes leftover after parsing attributes in process `syz.0.862'. [ 310.639863][ T5892] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 310.642937][ T5892] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 310.646815][ T5892] usb 1-1: Product: QEMU USB Tablet [ 310.648485][ T5892] usb 1-1: Manufacturer: QEMU [ 310.650195][ T5892] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 310.683969][ T5892] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.005C/input/input110 [ 310.759587][ T5892] hid-generic 0003:0627:0001.005C: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 310.938930][ T1487] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 311.445849][ T1487] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 311.470360][ T1487] em28xx 7-1:0.0: board has no eeprom [ 311.490504][ T5758] Bluetooth: hci3: unexpected event for opcode 0x202d [ 311.494035][ T9388] em28xx 7-1:0.0: reading from i2c device at 0xe failed (error=-5) [ 311.504460][ T5758] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 311.599249][ T5758] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 311.635969][ T1487] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 311.648652][ T1487] em28xx 7-1:0.0: dvb set to bulk mode. [ 311.662269][ T5821] em28xx 7-1:0.0: Binding DVB extension [ 311.671997][ T1487] usb 7-1: USB disconnect, device number 6 [ 311.674561][ T1487] em28xx 7-1:0.0: Disconnecting em28xx [ 311.732004][ T5821] em28xx 7-1:0.0: Registering input extension [ 311.734155][ T1487] em28xx 7-1:0.0: Closing input extension [ 311.824202][ T1487] em28xx 7-1:0.0: Freeing device [ 312.084793][ T2219] IPVS: starting estimator thread 0... [ 312.151317][ T9433] FAULT_INJECTION: forcing a failure. [ 312.151317][ T9433] name failslab, interval 1, probability 0, space 0, times 0 [ 312.158523][ T9433] CPU: 3 UID: 0 PID: 9433 Comm: syz.2.870 Tainted: G L syzkaller #0 PREEMPT(full) [ 312.158543][ T9433] Tainted: [L]=SOFTLOCKUP [ 312.158547][ T9433] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 312.158554][ T9433] Call Trace: [ 312.158557][ T9433] [ 312.158562][ T9433] dump_stack_lvl+0x100/0x190 [ 312.158578][ T9433] should_fail_ex.cold+0x5/0xa [ 312.158592][ T9433] should_failslab+0xc2/0x120 [ 312.158608][ T9433] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 312.158623][ T9433] ? __alloc_skb+0x5b7/0x710 [ 312.158637][ T9433] ? __alloc_skb+0x140/0x710 [ 312.158653][ T9433] __alloc_skb+0x140/0x710 [ 312.158665][ T9433] ? __alloc_skb+0x5b7/0x710 [ 312.158678][ T9433] ? __pfx___alloc_skb+0x10/0x10 [ 312.158696][ T9433] netlink_alloc_large_skb+0x69/0x150 [ 312.158709][ T9433] netlink_sendmsg+0x680/0xda0 [ 312.158723][ T9433] ? __pfx_netlink_sendmsg+0x10/0x10 [ 312.158737][ T9433] ? apparmor_socket_sendmsg+0x15b/0x270 [ 312.158751][ T9433] ____sys_sendmsg+0xa4d/0xbe0 [ 312.158761][ T9433] ? __pfx_netlink_sendmsg+0x10/0x10 [ 312.158773][ T9433] ? __pfx_____sys_sendmsg+0x10/0x10 [ 312.158790][ T9433] ___sys_sendmsg+0x190/0x1e0 [ 312.158802][ T9433] ? __pfx____sys_sendmsg+0x10/0x10 [ 312.158820][ T9433] ? find_held_lock+0x2b/0x80 [ 312.158843][ T9433] __sys_sendmsg+0x160/0x210 [ 312.158859][ T9433] ? __pfx___sys_sendmsg+0x10/0x10 [ 312.158877][ T9433] ? __pfx_ksys_write+0x10/0x10 [ 312.158891][ T9433] __do_fast_syscall_32+0xe7/0x970 [ 312.158905][ T9433] ? lockdep_hardirqs_on+0x78/0x100 [ 312.158919][ T9433] do_fast_syscall_32+0x32/0x70 [ 312.158933][ T9433] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 312.158948][ T9433] RIP: 0023:0xf705efec [ 312.158961][ T9433] Code: Unable to access opcode bytes at 0xf705efc2. [ 312.158966][ T9433] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 312.158978][ T9433] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000f00 [ 312.158990][ T9433] RDX: 0000000000044000 RSI: 0000000000000000 RDI: 0000000000000000 [ 312.158996][ T9433] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 312.159002][ T9433] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 312.159009][ T9433] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 312.159022][ T9433] [ 312.253237][ T9431] IPVS: using max 43 ests per chain, 103200 per kthread [ 312.515835][ T9444] FAULT_INJECTION: forcing a failure. [ 312.515835][ T9444] name failslab, interval 1, probability 0, space 0, times 0 [ 312.519800][ T9444] CPU: 1 UID: 0 PID: 9444 Comm: syz.4.874 Tainted: G L syzkaller #0 PREEMPT(full) [ 312.519819][ T9444] Tainted: [L]=SOFTLOCKUP [ 312.519834][ T9444] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 312.519842][ T9444] Call Trace: [ 312.519846][ T9444] [ 312.519851][ T9444] dump_stack_lvl+0x100/0x190 [ 312.519868][ T9444] should_fail_ex.cold+0x5/0xa [ 312.519881][ T9444] should_failslab+0xc2/0x120 [ 312.519897][ T9444] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 312.519912][ T9444] ? __alloc_skb+0x5b7/0x710 [ 312.519925][ T9444] ? __alloc_skb+0x140/0x710 [ 312.519940][ T9444] __alloc_skb+0x140/0x710 [ 312.519953][ T9444] ? __alloc_skb+0x5b7/0x710 [ 312.519966][ T9444] ? __pfx___alloc_skb+0x10/0x10 [ 312.519984][ T9444] netlink_alloc_large_skb+0x69/0x150 [ 312.519997][ T9444] netlink_sendmsg+0x680/0xda0 [ 312.520011][ T9444] ? __pfx_netlink_sendmsg+0x10/0x10 [ 312.520024][ T9444] ? apparmor_socket_sendmsg+0x15b/0x270 [ 312.520038][ T9444] ____sys_sendmsg+0xa4d/0xbe0 [ 312.520048][ T9444] ? __pfx_netlink_sendmsg+0x10/0x10 [ 312.520061][ T9444] ? __pfx_____sys_sendmsg+0x10/0x10 [ 312.520077][ T9444] ___sys_sendmsg+0x190/0x1e0 [ 312.520089][ T9444] ? __pfx____sys_sendmsg+0x10/0x10 [ 312.520107][ T9444] ? find_held_lock+0x2b/0x80 [ 312.520129][ T9444] __sys_sendmsg+0x160/0x210 [ 312.520145][ T9444] ? __pfx___sys_sendmsg+0x10/0x10 [ 312.520163][ T9444] ? __pfx_ksys_write+0x10/0x10 [ 312.520176][ T9444] __do_fast_syscall_32+0xe7/0x970 [ 312.520195][ T9444] ? lockdep_hardirqs_on+0x78/0x100 [ 312.520209][ T9444] do_fast_syscall_32+0x32/0x70 [ 312.520223][ T9444] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 312.520238][ T9444] RIP: 0023:0xf708efec [ 312.520251][ T9444] Code: Unable to access opcode bytes at 0xf708efc2. [ 312.520256][ T9444] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 312.520267][ T9444] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080006000 [ 312.520274][ T9444] RDX: 0000000000028000 RSI: 0000000000000000 RDI: 0000000000000000 [ 312.520280][ T9444] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 312.520287][ T9444] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 312.520293][ T9444] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 312.520306][ T9444] [ 312.868461][ T9449] gretap1: entered promiscuous mode [ 312.871647][ T9449] batman_adv: batadv0: Adding interface: gretap1 [ 312.874260][ T9449] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 312.882341][ T9449] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 313.269978][ T9456] fuse: Bad value for 'fd' [ 313.284489][ T9460] FAULT_INJECTION: forcing a failure. [ 313.284489][ T9460] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 313.289594][ T9460] CPU: 2 UID: 0 PID: 9460 Comm: syz.0.879 Tainted: G L syzkaller #0 PREEMPT(full) [ 313.289617][ T9460] Tainted: [L]=SOFTLOCKUP [ 313.289621][ T9460] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 313.289628][ T9460] Call Trace: [ 313.289632][ T9460] [ 313.289636][ T9460] dump_stack_lvl+0x100/0x190 [ 313.289653][ T9460] should_fail_ex.cold+0x5/0xa [ 313.289666][ T9460] _copy_from_user+0x2e/0xd0 [ 313.289684][ T9460] kstrtouint_from_user+0xd6/0x1d0 [ 313.289697][ T9460] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 313.289709][ T9460] ? __lock_acquire+0x49f/0x1a40 [ 313.289733][ T9460] proc_fail_nth_write+0x83/0x220 [ 313.289749][ T9460] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 313.289768][ T9460] vfs_write+0x2aa/0x1050 [ 313.289798][ T9460] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 313.289815][ T9460] ? __pfx_vfs_write+0x10/0x10 [ 313.289824][ T9460] ? find_held_lock+0x2b/0x80 [ 313.289838][ T9460] ? __fget_files+0x215/0x3d0 [ 313.289850][ T9460] ? __fget_files+0x21f/0x3d0 [ 313.289864][ T9460] ksys_write+0x12a/0x250 [ 313.289874][ T9460] ? __pfx_ksys_write+0x10/0x10 [ 313.289888][ T9460] do_int80_emulation+0x14b/0x720 [ 313.289904][ T9460] asm_int80_emulation+0x1a/0x20 [ 313.289916][ T9460] RIP: 0023:0xf71972eb [ 313.289925][ T9460] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 313.289936][ T9460] RSP: 002b:00000000f54354bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 313.289947][ T9460] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f54355d0 [ 313.289953][ T9460] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 313.289960][ T9460] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 313.289966][ T9460] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 313.289972][ T9460] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 313.289986][ T9460] [ 313.458469][ T9465] net_ratelimit: 9 callbacks suppressed [ 313.458542][ T9465] netlink: zone id is out of range [ 313.462981][ T9465] netlink: zone id is out of range [ 313.466824][ T9465] netlink: zone id is out of range [ 313.470214][ T9465] netlink: zone id is out of range [ 313.473881][ T9465] netlink: zone id is out of range [ 313.476226][ T9465] netlink: zone id is out of range [ 313.477998][ T9465] netlink: zone id is out of range [ 313.480246][ T9465] netlink: zone id is out of range [ 313.481892][ T9465] netlink: zone id is out of range [ 313.483641][ T9465] netlink: zone id is out of range [ 314.596149][ T5843] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 314.657500][ T5836] usb 44-1: device descriptor read/8, error -110 [ 314.815094][ T9494] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 314.817915][ T9494] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 314.834522][ T9494] vhci_hcd vhci_hcd.0: Device attached [ 315.078183][ T5836] usb usb44-port1: attempt power cycle [ 315.105296][ T6436] usb 42-1: SetAddress Request (26) to port 0 [ 315.107295][ T6436] usb 42-1: new SuperSpeed USB device number 26 using vhci_hcd [ 315.244310][ T9495] vhci_hcd: connection reset by peer [ 315.247871][ T5611] vhci_hcd vhci_hcd.2: stop threads [ 315.249896][ T5611] vhci_hcd vhci_hcd.2: release socket [ 315.251836][ T5611] vhci_hcd vhci_hcd.2: disconnect device [ 315.647713][ T5836] usb usb44-port1: unable to enumerate USB device [ 315.776876][ T9516] netlink: 6208 bytes leftover after parsing attributes in process `syz.3.888'. [ 315.891933][ T9517] netlink: 6208 bytes leftover after parsing attributes in process `syz.0.889'. [ 316.579660][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.582380][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.754528][ T9519] netlink: 11 bytes leftover after parsing attributes in process `syz.3.890'. [ 316.801455][ T9521] netlink: 4 bytes leftover after parsing attributes in process `syz.0.891'. [ 316.814858][ T9521] netlink: 28 bytes leftover after parsing attributes in process `syz.0.891'. [ 316.830490][ T9521] bridge_slave_0: left allmulticast mode [ 316.832261][ T9521] bridge_slave_0: left promiscuous mode [ 316.836800][ T9521] bridge0: port 1(bridge_slave_0) entered disabled state [ 316.843361][ T9521] bridge_slave_1: left allmulticast mode [ 316.845868][ T9521] bridge_slave_1: left promiscuous mode [ 316.848265][ T9521] bridge0: port 2(bridge_slave_1) entered disabled state [ 316.858333][ T9521] bond0: (slave bond_slave_0): Releasing backup interface [ 316.864105][ T9521] bond0: (slave bond_slave_1): Releasing backup interface [ 316.878158][ T9521] team0: Port device team_slave_0 removed [ 316.883589][ T9521] team0: Port device team_slave_1 removed [ 316.886833][ T9521] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 316.889175][ T9521] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 316.893483][ T9521] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 316.897118][ T9521] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 316.916132][ T9524] team0: Port device xfrm0 added [ 317.001501][ T9521] batadv_slave_1: entered promiscuous mode [ 317.012420][ T9521] macvlan2: entered allmulticast mode [ 317.015490][ T9521] batadv_slave_1: entered allmulticast mode [ 317.027837][ T9521] batman_adv: batadv0: Adding interface: macvlan2 [ 317.030775][ T9521] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 317.042910][ T9521] batman_adv: batadv0: Interface activated: macvlan2 [ 317.049449][ T9524] tipc: Started in network mode [ 317.051720][ T9524] tipc: Node identity 523762d61fc5, cluster identity 4711 [ 317.053981][ T9524] tipc: Enabled bearer , priority 0 [ 317.263964][ T5758] Bluetooth: hci2: unexpected event for opcode 0x202d [ 317.278900][ T5758] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 318.166610][ T5844] tipc: Node number set to 1307730646 [ 320.175480][ T6436] usb 42-1: device descriptor read/8, error -110 [ 320.566913][ T6436] usb usb42-port1: attempt power cycle [ 321.145695][ T6436] usb usb42-port1: unable to enumerate USB device [ 322.023755][ T9566] netlink: 96 bytes leftover after parsing attributes in process `syz.0.900'. [ 322.029237][ T9564] netlink: 6208 bytes leftover after parsing attributes in process `syz.4.899'. [ 322.071659][ T9566] netlink: 56 bytes leftover after parsing attributes in process `syz.0.900'. [ 322.099086][ T9566] netlink: 56 bytes leftover after parsing attributes in process `syz.0.900'. [ 322.629767][ T9574] input: syz0 as /devices/virtual/input/input112 [ 322.889475][ T42] audit: type=1326 audit(1784948000.709:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9576 comm="syz.2.902" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 323.039602][ T9581] net_ratelimit: 30 callbacks suppressed [ 323.039618][ T9581] netlink: zone id is out of range [ 323.057681][ T9581] netlink: zone id is out of range [ 323.066721][ T9581] netlink: zone id is out of range [ 323.071838][ T9581] netlink: zone id is out of range [ 323.079721][ T9581] netlink: zone id is out of range [ 323.083000][ T9581] netlink: zone id is out of range [ 323.085989][ T9581] netlink: zone id is out of range [ 323.090758][ T9581] netlink: zone id is out of range [ 323.094039][ T9581] netlink: zone id is out of range [ 323.097728][ T9581] netlink: zone id is out of range [ 323.344453][ T42] audit: type=1326 audit(1784948001.159:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9587 comm="syz.3.906" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f72fec code=0x0 [ 323.491023][ T9596] netlink: 16 bytes leftover after parsing attributes in process `syz.4.908'. [ 323.899807][ T5758] Bluetooth: hci3: unexpected event for opcode 0x0c23 [ 324.110263][ T9609] tipc: Resetting bearer [ 324.255573][ T5758] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 324.314833][ T5758] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 325.238658][ T9609] batman_adv: batadv0: Interface deactivated: macvlan2 [ 325.242024][ T9609] batadv_slave_1: left allmulticast mode [ 325.248397][ T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.337508][ T9628] ehci-pci 0000:00:1d.7: remove, state 1 [ 325.340173][ T9628] usb usb1: USB disconnect, device number 1 [ 325.342752][ T9628] usb 1-1: USB disconnect, device number 2 [ 325.367331][ T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.372118][ T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.378681][ T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.466597][ T9630] netlink: 'syz.2.915': attribute type 3 has an invalid length. [ 325.475583][ T9630] netlink: 24 bytes leftover after parsing attributes in process `syz.2.915'. [ 325.562655][ T9628] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 325.711203][ T9634] ALSA: mixer_oss: invalid OSS volume '' [ 325.824618][ T9638] netlink: 'syz.0.917': attribute type 3 has an invalid length. [ 325.833426][ T5836] usb 2-1: new full-speed USB device number 60 using uhci_hcd [ 325.856821][ T9638] netlink: 24 bytes leftover after parsing attributes in process `syz.0.917'. [ 326.011828][ T5836] usb 2-1: not running at top speed; connect to a high speed hub [ 326.040883][ T5836] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 326.051712][ T5836] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 326.068114][ T5836] usb 2-1: Product: QEMU USB Tablet [ 326.083291][ T5836] usb 2-1: Manufacturer: QEMU [ 326.093624][ T5836] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 326.618532][ T5836] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.005D/input/input113 [ 326.707214][ T5836] hid-generic 0003:0627:0001.005D: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 326.779846][ T9629] usb 2-1: USB disconnect, device number 60 [ 327.000811][ T9647] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 327.072409][ T9647] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 327.080442][ T9647] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 327.145365][ T9648] fido_id[9648]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/2-1/report_descriptor': No such file or directory [ 327.307458][ T9653] syz.3.919 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 327.429671][ T9629] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 327.448847][ T9629] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 327.457394][ T9629] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 327.480210][ T9629] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 327.561977][ T9629] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 327.565056][ T9629] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 327.568063][ T9629] usb usb1: Product: EHCI Host Controller [ 327.569876][ T9629] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 327.572796][ T9629] usb usb1: SerialNumber: 0000:00:1d.7 [ 327.593879][ T9629] hub 1-0:1.0: USB hub found [ 327.605308][ T9629] hub 1-0:1.0: 6 ports detected [ 327.747382][ T9629] hub 2-0:1.0: USB hub found [ 327.751785][ T9629] hub 2-0:1.0: 2 ports detected [ 327.795059][ T9629] hub 3-0:1.0: USB hub found [ 327.801106][ T9629] hub 3-0:1.0: 2 ports detected [ 327.837976][ T9629] hub 4-0:1.0: USB hub found [ 327.843073][ T9629] hub 4-0:1.0: 2 ports detected [ 327.859885][ T9636] ehci-pci 0000:00:1d.7: remove, state 1 [ 327.861959][ T9636] usb usb1: USB disconnect, device number 1 [ 327.905675][ T2219] usb usb1-port1: attempt power cycle [ 328.034686][ T9636] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 328.099126][ T5758] Bluetooth: hci0: unexpected event for opcode 0x0000 [ 328.120502][ T5758] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 328.145386][ T9658] FAULT_INJECTION: forcing a failure. [ 328.145386][ T9658] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 328.151798][ T9658] CPU: 2 UID: 0 PID: 9658 Comm: syz.3.923 Tainted: G L syzkaller #0 PREEMPT(full) [ 328.151816][ T9658] Tainted: [L]=SOFTLOCKUP [ 328.151820][ T9658] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 328.151827][ T9658] Call Trace: [ 328.151831][ T9658] [ 328.151836][ T9658] dump_stack_lvl+0x100/0x190 [ 328.151853][ T9658] should_fail_ex.cold+0x5/0xa [ 328.151866][ T9658] _copy_from_user+0x2e/0xd0 [ 328.151884][ T9658] get_compat_msghdr+0xb3/0x480 [ 328.151901][ T9658] ? __pfx_get_compat_msghdr+0x10/0x10 [ 328.151928][ T9658] ___sys_sendmsg+0x1b6/0x1e0 [ 328.151942][ T9658] ? __pfx____sys_sendmsg+0x10/0x10 [ 328.151959][ T9658] ? find_held_lock+0x2b/0x80 [ 328.151982][ T9658] __sys_sendmsg+0x160/0x210 [ 328.151997][ T9658] ? __pfx___sys_sendmsg+0x10/0x10 [ 328.152016][ T9658] ? __pfx_ksys_write+0x10/0x10 [ 328.152029][ T9658] __do_fast_syscall_32+0xe7/0x970 [ 328.152044][ T9658] ? lockdep_hardirqs_on+0x78/0x100 [ 328.152058][ T9658] do_fast_syscall_32+0x32/0x70 [ 328.152072][ T9658] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 328.152087][ T9658] RIP: 0023:0xf7f72fec [ 328.152100][ T9658] Code: Unable to access opcode bytes at 0xf7f72fc2. [ 328.152105][ T9658] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 328.152116][ T9658] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000500 [ 328.152123][ T9658] RDX: 0000000004008000 RSI: 0000000000000000 RDI: 0000000000000000 [ 328.152130][ T9658] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 328.152136][ T9658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 328.152143][ T9658] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 328.152156][ T9658] [ 328.235325][ T5758] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 328.498927][ T5758] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 328.665606][ T5836] usb 2-1: new full-speed USB device number 61 using uhci_hcd [ 328.667104][ T5758] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 328.825317][ T2219] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 328.876040][ T5836] usb 2-1: not running at top speed; connect to a high speed hub [ 328.986883][ T2219] usb 9-1: config index 0 descriptor too short (expected 23569, got 27) [ 328.989550][ T2219] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 328.993442][ T2219] usb 9-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 328.996387][ T2219] usb 9-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 328.998832][ T2219] usb 9-1: Manufacturer: syz [ 329.001462][ T2219] usb 9-1: config 0 descriptor?? [ 329.065260][ T2219] rc_core: IR keymap rc-hauppauge not found [ 329.067193][ T2219] Registered IR keymap rc-empty [ 329.070390][ T2219] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 329.074676][ T2219] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input114 [ 329.202749][ T5836] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 329.206955][ T5836] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 329.210259][ T5836] usb 2-1: Product: QEMU USB Tablet [ 329.210328][ T5836] usb 2-1: Manufacturer: QEMU [ 329.210404][ T5836] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 329.226342][ T9664] FAULT_INJECTION: forcing a failure. [ 329.226342][ T9664] name failslab, interval 1, probability 0, space 0, times 0 [ 329.235311][ T9664] CPU: 3 UID: 0 PID: 9664 Comm: syz.4.925 Tainted: G L syzkaller #0 PREEMPT(full) [ 329.235337][ T9664] Tainted: [L]=SOFTLOCKUP [ 329.235343][ T9664] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 329.235352][ T9664] Call Trace: [ 329.235358][ T9664] [ 329.235364][ T9664] dump_stack_lvl+0x100/0x190 [ 329.235389][ T9664] should_fail_ex.cold+0x5/0xa [ 329.235423][ T9664] should_failslab+0xc2/0x120 [ 329.235448][ T9664] __kmalloc_noprof+0xfc/0x820 [ 329.235468][ T9664] ? tomoyo_encode2+0xfb/0x3c0 [ 329.235495][ T9664] tomoyo_encode2+0xfb/0x3c0 [ 329.235520][ T9664] tomoyo_encode+0x29/0x50 [ 329.235541][ T9664] tomoyo_realpath_from_path+0x18c/0x690 [ 329.235570][ T9664] tomoyo_path_number_perm+0x23c/0x580 [ 329.235590][ T9664] ? tomoyo_path_number_perm+0x22e/0x580 [ 329.235611][ T9664] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 329.235632][ T9664] ? get_pid_task+0x106/0x250 [ 329.235692][ T9664] ? find_held_lock+0x2b/0x80 [ 329.235712][ T9664] ? __fget_files+0x215/0x3d0 [ 329.235725][ T9664] ? hook_file_ioctl_common+0x140/0x440 [ 329.235744][ T9664] ? __fget_files+0x215/0x3d0 [ 329.235763][ T9664] ? __fget_files+0x21f/0x3d0 [ 329.235782][ T9664] security_file_ioctl_compat+0xd3/0x230 [ 329.235803][ T9664] __ia32_compat_sys_ioctl+0xc2/0x360 [ 329.235830][ T9664] __do_fast_syscall_32+0xe7/0x970 [ 329.235850][ T9664] ? lockdep_hardirqs_on+0x78/0x100 [ 329.235870][ T9664] do_fast_syscall_32+0x32/0x70 [ 329.235894][ T9664] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 329.235913][ T9664] RIP: 0023:0xf708efec [ 329.235931][ T9664] Code: Unable to access opcode bytes at 0xf708efc2. [ 329.235938][ T9664] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 329.235953][ T9664] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000004b4c [ 329.235960][ T9664] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 329.235966][ T9664] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 329.235973][ T9664] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 329.235983][ T9664] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 329.235997][ T9664] [ 329.236045][ T9664] ERROR: Out of memory at tomoyo_realpath_from_path. [ 329.285445][ T5836] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.005E/input/input115 [ 329.317240][ T2219] usb 9-1: USB disconnect, device number 3 [ 329.400478][ T5836] hid-generic 0003:0627:0001.005E: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 329.434006][ T9637] usb 2-1: USB disconnect, device number 61 [ 329.521678][ T9672] fido_id[9672]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 329.618399][ T9637] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 329.625010][ T9637] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 329.633759][ T9637] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 329.667336][ T9637] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 329.678969][ T9637] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 329.684337][ T9637] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 329.690198][ T9637] usb usb1: Product: EHCI Host Controller [ 329.693815][ T9637] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 329.697428][ T9637] usb usb1: SerialNumber: 0000:00:1d.7 [ 329.708262][ T9637] hub 1-0:1.0: USB hub found [ 329.712592][ T9637] hub 1-0:1.0: 6 ports detected [ 329.759303][ T9637] hub 2-0:1.0: USB hub found [ 329.762052][ T9637] hub 2-0:1.0: 2 ports detected [ 329.794398][ T9688] IPv6: Can't replace route, no match found [ 329.810018][ T9637] hub 3-0:1.0: USB hub found [ 329.814915][ T9637] hub 3-0:1.0: 2 ports detected [ 329.950086][ T9637] hub 4-0:1.0: USB hub found [ 329.954706][ T9637] hub 4-0:1.0: 2 ports detected [ 329.998558][ T5758] Bluetooth: hci2: unexpected event for opcode 0x002d [ 330.007552][ T9693] ehci-pci 0000:00:1d.7: remove, state 1 [ 330.009359][ T9693] usb usb1: USB disconnect, device number 1 [ 330.073900][ T5758] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 330.076139][ T9695] netlink: 'syz.3.931': attribute type 3 has an invalid length. [ 330.087903][ T9695] netlink: 24 bytes leftover after parsing attributes in process `syz.3.931'. [ 330.093428][ T2219] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 330.629370][ T2219] usb usb1-port1: attempt power cycle [ 331.098240][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 331.192871][ T9703] netlink: 16 bytes leftover after parsing attributes in process `syz.0.933'. [ 331.250008][ T9693] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 331.337614][ T9709] netlink: 6208 bytes leftover after parsing attributes in process `syz.2.935'. [ 331.525397][ T6436] usb 2-1: new full-speed USB device number 62 using uhci_hcd [ 331.862381][ T6436] usb 2-1: not running at top speed; connect to a high speed hub [ 332.106045][ T6436] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 332.108968][ T6436] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 332.111441][ T6436] usb 2-1: Product: QEMU USB Tablet [ 332.113071][ T6436] usb 2-1: Manufacturer: QEMU [ 332.114542][ T6436] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 332.140793][ T6436] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.005F/input/input116 [ 332.142763][ T9718] netlink: 'syz.4.937': attribute type 3 has an invalid length. [ 332.173192][ T9718] netlink: 24 bytes leftover after parsing attributes in process `syz.4.937'. [ 332.185637][ T5758] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 332.189141][ T5758] Bluetooth: hci0: Injecting HCI hardware error event [ 332.193747][ T5758] Bluetooth: hci0: hardware error 0x00 [ 332.213106][ T6436] hid-generic 0003:0627:0001.005F: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 332.266473][ T9694] usb 2-1: USB disconnect, device number 62 [ 332.425324][ T9725] netlink: 'syz.2.940': attribute type 3 has an invalid length. [ 332.442301][ T9725] netlink: 24 bytes leftover after parsing attributes in process `syz.2.940'. [ 332.954471][ T9694] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 332.976558][ T9694] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 332.998652][ T9694] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 333.045571][ T9694] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 333.049303][ T9694] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 333.052016][ T9694] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 333.054678][ T9694] usb usb1: Product: EHCI Host Controller [ 333.056575][ T9694] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 333.058768][ T9694] usb usb1: SerialNumber: 0000:00:1d.7 [ 333.067352][ T9694] hub 1-0:1.0: USB hub found [ 333.072851][ T9694] hub 1-0:1.0: 6 ports detected [ 333.073541][ T9728] fido_id[9728]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 333.117047][ T9694] hub 2-0:1.0: USB hub found [ 333.118992][ T9694] hub 2-0:1.0: 2 ports detected [ 333.146197][ T9694] hub 3-0:1.0: USB hub found [ 333.148088][ T9694] hub 3-0:1.0: 2 ports detected [ 333.177623][ T9694] hub 4-0:1.0: USB hub found [ 333.179397][ T9694] hub 4-0:1.0: 2 ports detected [ 333.186143][ T9713] ehci-pci 0000:00:1d.7: remove, state 1 [ 333.187962][ T9713] usb usb1: USB disconnect, device number 1 [ 333.206922][ T9713] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 333.285510][ T5844] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 333.428897][ T9734] Bluetooth: MGMT ver 1.23 [ 333.465231][ T5844] usb 5-1: Using ep0 maxpacket: 16 [ 333.468639][ T5844] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 333.474329][ T5844] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 333.478161][ T5844] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.481367][ T5844] usb 5-1: Product: syz [ 333.483253][ T5844] usb 5-1: Manufacturer: syz [ 333.485204][ T5844] usb 5-1: SerialNumber: syz [ 333.491406][ T5844] usb 5-1: config 0 descriptor?? [ 333.497423][ T5844] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 333.501138][ T5844] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 333.585238][ T2322] usb 2-1: new full-speed USB device number 63 using uhci_hcd [ 333.618879][ T5748] Bluetooth: hci1: unexpected event for opcode 0x002d [ 333.621764][ T5748] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 333.677904][ T5748] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 333.751869][ T2322] usb 2-1: not running at top speed; connect to a high speed hub [ 333.773570][ T2322] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 333.776922][ T2322] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 333.779382][ T2322] usb 2-1: Product: QEMU USB Tablet [ 333.780981][ T2322] usb 2-1: Manufacturer: QEMU [ 333.782515][ T2322] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 333.814700][ T2322] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0060/input/input117 [ 333.892108][ T2322] hid-generic 0003:0627:0001.0060: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 333.901828][ T9714] usb 2-1: USB disconnect, device number 63 [ 334.126203][ T9714] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 334.131112][ T9739] fido_id[9739]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 334.159074][ T9714] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 334.177302][ T5844] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 334.185015][ T9714] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 334.207547][ T9714] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 334.210918][ T9714] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 334.213758][ T9714] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 334.216298][ T9714] usb usb1: Product: EHCI Host Controller [ 334.218058][ T9714] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 334.220066][ T9714] usb usb1: SerialNumber: 0000:00:1d.7 [ 334.279653][ T9714] hub 1-0:1.0: USB hub found [ 334.281831][ T9714] hub 1-0:1.0: 6 ports detected [ 334.340088][ T9714] hub 2-0:1.0: USB hub found [ 334.353008][ T9714] hub 2-0:1.0: 2 ports detected [ 334.386433][ T9714] hub 3-0:1.0: USB hub found [ 334.394981][ T9714] hub 3-0:1.0: 2 ports detected [ 334.415287][ T5758] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 334.440548][ T9743] netlink: 12 bytes leftover after parsing attributes in process `syz.3.946'. [ 334.446775][ T9714] hub 4-0:1.0: USB hub found [ 334.450728][ T9714] hub 4-0:1.0: 2 ports detected [ 334.460114][ T9723] ehci-pci 0000:00:1d.7: remove, state 1 [ 334.464503][ T9723] usb usb1: USB disconnect, device number 1 [ 334.505736][ T2219] usb usb1-port1: attempt power cycle [ 334.505972][ T9747] FAULT_INJECTION: forcing a failure. [ 334.505972][ T9747] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 334.513755][ T9747] CPU: 2 UID: 0 PID: 9747 Comm: syz.4.948 Tainted: G L syzkaller #0 PREEMPT(full) [ 334.513783][ T9747] Tainted: [L]=SOFTLOCKUP [ 334.513790][ T9747] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 334.513801][ T9747] Call Trace: [ 334.513809][ T9747] [ 334.513816][ T9747] dump_stack_lvl+0x100/0x190 [ 334.513843][ T9747] should_fail_ex.cold+0x5/0xa [ 334.513866][ T9747] _copy_from_iter+0x1f4/0x1690 [ 334.513899][ T9747] ? __asan_memset+0x23/0x50 [ 334.513921][ T9747] ? __pfx__copy_from_iter+0x10/0x10 [ 334.513949][ T9747] ? __pfx___alloc_skb+0x10/0x10 [ 334.513984][ T9747] netlink_sendmsg+0x808/0xda0 [ 334.514011][ T9747] ? __pfx_netlink_sendmsg+0x10/0x10 [ 334.514034][ T9747] ? apparmor_socket_sendmsg+0x15b/0x270 [ 334.514062][ T9747] ____sys_sendmsg+0xa4d/0xbe0 [ 334.514080][ T9747] ? __pfx_netlink_sendmsg+0x10/0x10 [ 334.514103][ T9747] ? __pfx_____sys_sendmsg+0x10/0x10 [ 334.514133][ T9747] ___sys_sendmsg+0x190/0x1e0 [ 334.514156][ T9747] ? __pfx____sys_sendmsg+0x10/0x10 [ 334.514185][ T9747] ? find_held_lock+0x2b/0x80 [ 334.514225][ T9747] __sys_sendmsg+0x160/0x210 [ 334.514250][ T9747] ? __pfx___sys_sendmsg+0x10/0x10 [ 334.514283][ T9747] ? __pfx_ksys_write+0x10/0x10 [ 334.514307][ T9747] __do_fast_syscall_32+0xe7/0x970 [ 334.514332][ T9747] ? lockdep_hardirqs_on+0x78/0x100 [ 334.514356][ T9747] do_fast_syscall_32+0x32/0x70 [ 334.514380][ T9747] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 334.514403][ T9747] RIP: 0023:0xf708efec [ 334.514426][ T9747] Code: Unable to access opcode bytes at 0xf708efc2. [ 334.514434][ T9747] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 334.514453][ T9747] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000180 [ 334.514465][ T9747] RDX: 0000000000004090 RSI: 0000000000000000 RDI: 0000000000000000 [ 334.514475][ T9747] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 334.514486][ T9747] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 334.514497][ T9747] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 334.514522][ T9747] [ 334.610949][ T9723] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 334.686677][ T5844] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 334.689198][ T5844] em28xx 5-1:0.0: board has no eeprom [ 335.025349][ T2322] usb 2-1: new full-speed USB device number 64 using uhci_hcd [ 335.240420][ T9760] netlink: 'syz.4.951': attribute type 3 has an invalid length. [ 335.245390][ T9760] netlink: 24 bytes leftover after parsing attributes in process `syz.4.951'. [ 335.274676][ T2322] usb 2-1: not running at top speed; connect to a high speed hub [ 335.570081][ T2322] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 335.573509][ T2322] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 335.576977][ T2322] usb 2-1: Product: QEMU USB Tablet [ 335.579134][ T2322] usb 2-1: Manufacturer: QEMU [ 335.581048][ T2322] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 335.602098][ T2322] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0061/input/input118 [ 335.668934][ T2322] hid-generic 0003:0627:0001.0061: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 335.686047][ T9724] usb 2-1: USB disconnect, device number 64 [ 335.709737][ T9727] em28xx 5-1:0.0: reading from i2c device at 0xe failed (error=-5) [ 335.771377][ T5844] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 335.780865][ T5844] em28xx 5-1:0.0: dvb set to bulk mode. [ 335.782590][ T5835] em28xx 5-1:0.0: Binding DVB extension [ 335.800965][ T5844] usb 5-1: USB disconnect, device number 4 [ 335.804108][ T9761] fido_id[9761]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 335.808855][ T5844] em28xx 5-1:0.0: Disconnecting em28xx [ 335.823089][ T5835] em28xx 5-1:0.0: Registering input extension [ 335.829585][ T5844] em28xx 5-1:0.0: Closing input extension [ 335.846896][ T5844] em28xx 5-1:0.0: Freeing device [ 335.863411][ T9724] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 335.904902][ T9724] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 335.918071][ T9724] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 335.935926][ T9724] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 335.940985][ T9724] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 335.944550][ T9724] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 335.948252][ T9724] usb usb1: Product: EHCI Host Controller [ 335.950490][ T9724] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 335.953038][ T9724] usb usb1: SerialNumber: 0000:00:1d.7 [ 335.960968][ T9724] hub 1-0:1.0: USB hub found [ 335.963197][ T9724] hub 1-0:1.0: 6 ports detected [ 336.019015][ T9724] hub 2-0:1.0: USB hub found [ 336.021596][ T9724] hub 2-0:1.0: 2 ports detected [ 336.060175][ T9724] hub 3-0:1.0: USB hub found [ 336.062720][ T9724] hub 3-0:1.0: 2 ports detected [ 336.085477][ T9767] netlink: 6208 bytes leftover after parsing attributes in process `syz.3.953'. [ 336.099752][ T9724] hub 4-0:1.0: USB hub found [ 336.102598][ T9724] hub 4-0:1.0: 2 ports detected [ 336.112654][ T9758] ehci-pci 0000:00:1d.7: remove, state 1 [ 336.118289][ T9758] usb usb1: USB disconnect, device number 1 [ 336.175585][ T2322] usb usb1-port1: attempt power cycle [ 336.278875][ T9758] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 336.516830][ T5758] Bluetooth: hci3: unexpected event for opcode 0x202d [ 336.534745][ T5758] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 336.545245][ T2322] usb 2-1: new full-speed USB device number 65 using uhci_hcd [ 336.609716][ T5758] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 336.722501][ T2322] usb 2-1: not running at top speed; connect to a high speed hub [ 336.750631][ T2322] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 336.754749][ T2322] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 336.759360][ T2322] usb 2-1: Product: QEMU USB Tablet [ 336.763602][ T2322] usb 2-1: Manufacturer: QEMU [ 336.767431][ T2322] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 336.847260][ T2322] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0062/input/input120 [ 336.889513][ T2322] hid-generic 0003:0627:0001.0062: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 336.912089][ T9759] usb 2-1: USB disconnect, device number 65 [ 337.111023][ T9779] fido_id[9779]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 337.172220][ T9759] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 337.191819][ T9759] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 337.201324][ T9759] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 337.225286][ T9759] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 337.246106][ T9759] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 337.250319][ T9759] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 337.259914][ T9759] usb usb1: Product: EHCI Host Controller [ 337.262357][ T9759] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 337.270302][ T9759] usb usb1: SerialNumber: 0000:00:1d.7 [ 337.288742][ T9759] hub 1-0:1.0: USB hub found [ 337.294827][ T9759] hub 1-0:1.0: 6 ports detected [ 337.368012][ T9759] hub 2-0:1.0: USB hub found [ 337.369726][ T9759] hub 2-0:1.0: 2 ports detected [ 337.405375][ T9759] hub 3-0:1.0: USB hub found [ 337.421559][ T9759] hub 3-0:1.0: 2 ports detected [ 337.484036][ T9759] hub 4-0:1.0: USB hub found [ 337.493833][ T9759] hub 4-0:1.0: 2 ports detected [ 337.605381][ T1487] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 337.802807][ T1487] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 337.815305][ T1487] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 337.827563][ T1487] usb 1-1: Product: QEMU USB Tablet [ 337.831557][ T1487] usb 1-1: Manufacturer: QEMU [ 337.840346][ T1487] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 337.893576][ T1487] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0063/input/input121 [ 337.968701][ T1487] hid-generic 0003:0627:0001.0063: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 338.596010][ T9801] FAULT_INJECTION: forcing a failure. [ 338.596010][ T9801] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 338.600015][ T9801] CPU: 2 UID: 0 PID: 9801 Comm: syz.4.964 Tainted: G L syzkaller #0 PREEMPT(full) [ 338.600032][ T9801] Tainted: [L]=SOFTLOCKUP [ 338.600036][ T9801] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 338.600042][ T9801] Call Trace: [ 338.600047][ T9801] [ 338.600051][ T9801] dump_stack_lvl+0x100/0x190 [ 338.600068][ T9801] should_fail_ex.cold+0x5/0xa [ 338.600081][ T9801] _copy_to_user+0x32/0xd0 [ 338.600100][ T9801] simple_read_from_buffer+0xcb/0x170 [ 338.600119][ T9801] proc_fail_nth_read+0x1af/0x230 [ 338.600135][ T9801] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 338.600151][ T9801] ? rw_verify_area+0xce/0x6d0 [ 338.600167][ T9801] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 338.600182][ T9801] vfs_read+0x1e4/0xb40 [ 338.600201][ T9801] ? __pfx_vfs_read+0x10/0x10 [ 338.600218][ T9801] ? find_held_lock+0x2b/0x80 [ 338.600233][ T9801] ? __fget_files+0x215/0x3d0 [ 338.600246][ T9801] ? __fget_files+0x21f/0x3d0 [ 338.600259][ T9801] ksys_read+0x12a/0x250 [ 338.600269][ T9801] ? __pfx_ksys_read+0x10/0x10 [ 338.600283][ T9801] do_int80_emulation+0x14b/0x720 [ 338.600299][ T9801] asm_int80_emulation+0x1a/0x20 [ 338.600310][ T9801] RIP: 0023:0xf71c72eb [ 338.600320][ T9801] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 338.600331][ T9801] RSP: 002b:00000000f547d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 338.600342][ T9801] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f547d5d0 [ 338.600349][ T9801] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 338.600355][ T9801] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 338.600361][ T9801] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 338.600367][ T9801] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 338.600381][ T9801] [ 338.759439][ T9805] file system registered [ 338.771077][ T9805] FAULT_INJECTION: forcing a failure. [ 338.771077][ T9805] name failslab, interval 1, probability 0, space 0, times 0 [ 338.785268][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: syz.4.965 Tainted: G L syzkaller #0 PREEMPT(full) [ 338.785288][ T9805] Tainted: [L]=SOFTLOCKUP [ 338.785291][ T9805] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 338.785298][ T9805] Call Trace: [ 338.785302][ T9805] [ 338.785307][ T9805] dump_stack_lvl+0x100/0x190 [ 338.785323][ T9805] should_fail_ex.cold+0x5/0xa [ 338.785348][ T9805] should_failslab+0xc2/0x120 [ 338.785366][ T9805] kmem_cache_alloc_noprof+0x91/0x6a0 [ 338.785380][ T9805] ? stack_trace_save+0x8e/0xc0 [ 338.785396][ T9805] ? alloc_empty_file+0x5b/0x1c0 [ 338.785412][ T9805] alloc_empty_file+0x5b/0x1c0 [ 338.785427][ T9805] path_openat+0xe7/0x4280 [ 338.785438][ T9805] ? kasan_save_track+0x14/0x30 [ 338.785462][ T9805] ? __kasan_slab_alloc+0x89/0x90 [ 338.785477][ T9805] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 338.785490][ T9805] ? do_getname+0x35/0x390 [ 338.785503][ T9805] ? do_sys_openat2+0xc7/0x1e0 [ 338.785517][ T9805] ? __ia32_compat_sys_openat+0x12d/0x210 [ 338.785532][ T9805] ? __do_fast_syscall_32+0xe7/0x970 [ 338.785551][ T9805] ? __pfx_path_openat+0x10/0x10 [ 338.785566][ T9805] do_file_open+0x20e/0x430 [ 338.785584][ T9805] ? __lock_acquire+0x49f/0x1a40 [ 338.785602][ T9805] ? __pfx_do_file_open+0x10/0x10 [ 338.785622][ T9805] ? _raw_spin_unlock+0x28/0x50 [ 338.785633][ T9805] ? alloc_fd+0x471/0x7a0 [ 338.785647][ T9805] do_sys_openat2+0x10f/0x1e0 [ 338.785685][ T9805] ? __pfx_do_sys_openat2+0x10/0x10 [ 338.785707][ T9805] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 338.785728][ T9805] __ia32_compat_sys_openat+0x12d/0x210 [ 338.785745][ T9805] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 338.785761][ T9805] ? fput+0x79/0x100 [ 338.785773][ T9805] ? ksys_write+0x1ac/0x250 [ 338.785783][ T9805] ? __pfx_ksys_write+0x10/0x10 [ 338.785795][ T9805] __do_fast_syscall_32+0xe7/0x970 [ 338.785809][ T9805] ? lockdep_hardirqs_on+0x78/0x100 [ 338.785823][ T9805] do_fast_syscall_32+0x32/0x70 [ 338.785837][ T9805] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 338.785851][ T9805] RIP: 0023:0xf708efec [ 338.785865][ T9805] Code: Unable to access opcode bytes at 0xf708efc2. [ 338.785869][ T9805] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 338.785880][ T9805] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800002c0 [ 338.785887][ T9805] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 338.785894][ T9805] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 338.785900][ T9805] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 338.785906][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 338.785919][ T9805] [ 338.836154][ T8400] ffs_data_put(): freeing [ 338.917346][ T9807] read descriptors [ 338.919375][ T9807] FAULT_INJECTION: forcing a failure. [ 338.919375][ T9807] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 338.923662][ T9807] CPU: 2 UID: 0 PID: 9807 Comm: syz.2.967 Tainted: G L syzkaller #0 PREEMPT(full) [ 338.923680][ T9807] Tainted: [L]=SOFTLOCKUP [ 338.923684][ T9807] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 338.923690][ T9807] Call Trace: [ 338.923695][ T9807] [ 338.923699][ T9807] dump_stack_lvl+0x100/0x190 [ 338.923715][ T9807] should_fail_ex.cold+0x5/0xa [ 338.923728][ T9807] _copy_to_user+0x32/0xd0 [ 338.923747][ T9807] simple_read_from_buffer+0xcb/0x170 [ 338.923766][ T9807] proc_fail_nth_read+0x1af/0x230 [ 338.923783][ T9807] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 338.923799][ T9807] ? rw_verify_area+0xce/0x6d0 [ 338.923815][ T9807] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 338.923830][ T9807] vfs_read+0x1e4/0xb40 [ 338.923849][ T9807] ? __pfx_vfs_read+0x10/0x10 [ 338.923866][ T9807] ? find_held_lock+0x2b/0x80 [ 338.923881][ T9807] ? __fget_files+0x215/0x3d0 [ 338.923893][ T9807] ? __fget_files+0x21f/0x3d0 [ 338.923907][ T9807] ksys_read+0x12a/0x250 [ 338.923917][ T9807] ? __pfx_ksys_read+0x10/0x10 [ 338.923930][ T9807] do_int80_emulation+0x14b/0x720 [ 338.923947][ T9807] asm_int80_emulation+0x1a/0x20 [ 338.923963][ T9807] RIP: 0023:0xf71972eb [ 338.923972][ T9807] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 338.923983][ T9807] RSP: 002b:00000000f544d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 338.923994][ T9807] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f544d5d0 [ 338.924000][ T9807] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 338.924007][ T9807] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 338.924013][ T9807] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 338.924019][ T9807] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 338.924033][ T9807] [ 339.016154][ T5741] ffs_data_put(): freeing [ 339.267267][ T9819] netlink: 16 bytes leftover after parsing attributes in process `syz.0.970'. [ 339.273613][ T9819] team0: No ports can be present during mode change [ 339.285933][ T9819] tipc: Enabling of bearer rejected, already enabled [ 339.523416][ T9827] syzkaller0: entered promiscuous mode [ 339.526876][ T9827] syzkaller0: entered allmulticast mode [ 339.926588][ T9839] trusted_key: syz.0.977 sent an empty control message without MSG_MORE. [ 339.933312][ T9839] netlink: 4 bytes leftover after parsing attributes in process `syz.0.977'. [ 340.437779][ T9849] NILFS (loop3): device size too small [ 340.841986][ T9854] FAULT_INJECTION: forcing a failure. [ 340.841986][ T9854] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 340.851146][ T9854] CPU: 1 UID: 0 PID: 9854 Comm: syz.0.981 Tainted: G L syzkaller #0 PREEMPT(full) [ 340.851172][ T9854] Tainted: [L]=SOFTLOCKUP [ 340.851177][ T9854] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 340.851185][ T9854] Call Trace: [ 340.851190][ T9854] [ 340.851196][ T9854] dump_stack_lvl+0x100/0x190 [ 340.851217][ T9854] should_fail_ex.cold+0x5/0xa [ 340.851237][ T9854] _copy_to_user+0x32/0xd0 [ 340.851265][ T9854] simple_read_from_buffer+0xcb/0x170 [ 340.851296][ T9854] proc_fail_nth_read+0x1af/0x230 [ 340.851321][ T9854] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 340.851344][ T9854] ? rw_verify_area+0xce/0x6d0 [ 340.851368][ T9854] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 340.851391][ T9854] vfs_read+0x1e4/0xb40 [ 340.851420][ T9854] ? __pfx_vfs_read+0x10/0x10 [ 340.851444][ T9854] ? find_held_lock+0x2b/0x80 [ 340.851467][ T9854] ? __fget_files+0x215/0x3d0 [ 340.851488][ T9854] ? __fget_files+0x21f/0x3d0 [ 340.851511][ T9854] ksys_read+0x12a/0x250 [ 340.851528][ T9854] ? __pfx_ksys_read+0x10/0x10 [ 340.851557][ T9854] do_int80_emulation+0x14b/0x720 [ 340.851582][ T9854] asm_int80_emulation+0x1a/0x20 [ 340.851601][ T9854] RIP: 0023:0xf71972eb [ 340.851615][ T9854] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 340.851631][ T9854] RSP: 002b:00000000f54564bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 340.851648][ T9854] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f54565d0 [ 340.851659][ T9854] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 340.851669][ T9854] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 340.851678][ T9854] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 340.851688][ T9854] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 340.851712][ T9854] [ 341.124613][ T9859] netlink: 8 bytes leftover after parsing attributes in process `syz.0.983'. [ 341.127628][ T9859] net_ratelimit: 9 callbacks suppressed [ 341.127637][ T9859] openvswitch: netlink: Flow key attr not present in new flow. [ 342.075786][ T9866] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 342.078192][ T9866] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 342.124126][ T9866] vhci_hcd vhci_hcd.0: Device attached [ 342.244530][ T9875] Bluetooth: MGMT ver 1.23 [ 342.247864][ T9861] netlink: 12 bytes leftover after parsing attributes in process `syz.0.983'. [ 342.266633][ T8400] ffs_data_put(): freeing [ 342.297011][ T9878] usb 1-1: USB disconnect, device number 2 [ 342.385561][ T6436] usb 38-1: SetAddress Request (30) to port 0 [ 342.389022][ T6436] usb 38-1: new SuperSpeed USB device number 30 using vhci_hcd [ 342.417112][ T9867] vhci_hcd: connection reset by peer [ 342.419605][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 342.422037][ T5820] vhci_hcd vhci_hcd.0: release socket [ 342.424409][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 342.463360][ T9885] input: syz0 as /devices/virtual/input/input122 [ 342.567564][ T5758] Bluetooth: hci2: unexpected event for opcode 0x202d [ 342.572974][ T5758] Bluetooth: hci2: SCO packet for unknown connection handle 201 [ 343.380895][ T9900] FAULT_INJECTION: forcing a failure. [ 343.380895][ T9900] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 343.395483][ T9900] CPU: 1 UID: 0 PID: 9900 Comm: syz.2.995 Tainted: G L syzkaller #0 PREEMPT(full) [ 343.395502][ T9900] Tainted: [L]=SOFTLOCKUP [ 343.395506][ T9900] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 343.395512][ T9900] Call Trace: [ 343.395516][ T9900] [ 343.395521][ T9900] dump_stack_lvl+0x100/0x190 [ 343.395538][ T9900] should_fail_ex.cold+0x5/0xa [ 343.395551][ T9900] _copy_to_user+0x32/0xd0 [ 343.395570][ T9900] simple_read_from_buffer+0xcb/0x170 [ 343.395606][ T9900] proc_fail_nth_read+0x1af/0x230 [ 343.395622][ T9900] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 343.395637][ T9900] ? rw_verify_area+0xce/0x6d0 [ 343.395654][ T9900] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 343.395668][ T9900] vfs_read+0x1e4/0xb40 [ 343.395688][ T9900] ? __pfx_vfs_read+0x10/0x10 [ 343.395704][ T9900] ? find_held_lock+0x2b/0x80 [ 343.395718][ T9900] ? __fget_files+0x215/0x3d0 [ 343.395731][ T9900] ? __fget_files+0x21f/0x3d0 [ 343.395745][ T9900] ksys_read+0x12a/0x250 [ 343.395754][ T9900] ? __pfx_ksys_read+0x10/0x10 [ 343.395768][ T9900] do_int80_emulation+0x14b/0x720 [ 343.395784][ T9900] asm_int80_emulation+0x1a/0x20 [ 343.395796][ T9900] RIP: 0023:0xf71972eb [ 343.395805][ T9900] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 343.395816][ T9900] RSP: 002b:00000000f544d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 343.395828][ T9900] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f544d5d0 [ 343.395835][ T9900] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 343.395845][ T9900] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 343.395851][ T9900] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 343.395858][ T9900] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 343.395871][ T9900] [ 343.488764][ T5755] ffs_data_put(): freeing [ 343.595234][ T34] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 343.755499][ T34] usb 8-1: Using ep0 maxpacket: 32 [ 343.765567][ T34] usb 8-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 343.775212][ T34] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 343.779200][ T34] usb 8-1: config 0 descriptor?? [ 343.988154][ T34] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 343.992488][ T34] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 343.995892][ T34] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 343.999585][ T34] usb 8-1: media controller created [ 344.014080][ T34] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 344.319731][ T9897] netlink: 20 bytes leftover after parsing attributes in process `syz.3.993'. [ 344.330847][ T34] az6027: usb out operation failed. (-71) [ 344.334210][ T34] az6027: usb out operation failed. (-71) [ 344.336030][ T34] stb0899_attach: Driver disabled by Kconfig [ 344.338751][ T34] az6027: no front-end attached [ 344.338751][ T34] [ 344.341137][ T34] az6027: usb out operation failed. (-71) [ 344.342868][ T34] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 344.347514][ T34] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb8/8-1/input/input123 [ 344.356512][ T34] dvb-usb: schedule remote query interval to 400 msecs. [ 344.362583][ T34] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 344.368524][ T34] usb 8-1: USB disconnect, device number 9 [ 344.404720][ T34] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 344.489264][ T5758] Bluetooth: hci3: unexpected event for opcode 0x202d [ 344.492959][ T5758] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 344.549432][ T5758] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 345.204684][ T9937] ehci-pci 0000:00:1d.7: remove, state 4 [ 345.207270][ T9937] usb usb1: USB disconnect, device number 1 [ 345.263471][ T9937] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 345.287023][ T5758] Bluetooth: hci3: unexpected event for opcode 0x200f [ 345.346265][ T9943] netlink: 'syz.3.1005': attribute type 3 has an invalid length. [ 345.355405][ T9943] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1005'. [ 345.525296][ T2322] usb 2-1: new full-speed USB device number 66 using uhci_hcd [ 345.681111][ T2322] usb 2-1: not running at top speed; connect to a high speed hub [ 345.711941][ T2322] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 345.715072][ T2322] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 345.718404][ T2322] usb 2-1: Product: QEMU USB Tablet [ 345.720988][ T2322] usb 2-1: Manufacturer: QEMU [ 345.723053][ T2322] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 345.754063][ T2322] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0064/input/input124 [ 345.846013][ T2322] hid-generic 0003:0627:0001.0064: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 345.895030][ T9938] usb 2-1: USB disconnect, device number 66 [ 346.594263][ T9961] fido_id[9961]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 346.595258][ T9938] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 346.643246][ T9938] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 346.675812][ T9938] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 346.690226][ T5758] Bluetooth: hci3: unexpected event for opcode 0x202d [ 346.853586][ T9974] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1015'. [ 346.857720][ T9974] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1015'. [ 346.884300][ T9974] macsec1: entered promiscuous mode [ 346.884396][ T9974] dummy0: entered promiscuous mode [ 346.887090][ T9974] macsec1: entered allmulticast mode [ 346.887104][ T9974] dummy0: entered allmulticast mode [ 347.067890][ T9938] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 347.069954][ T9938] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 347.069978][ T9938] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 347.069994][ T9938] usb usb1: Product: EHCI Host Controller [ 347.070004][ T9938] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 347.070013][ T9938] usb usb1: SerialNumber: 0000:00:1d.7 [ 347.073595][ T9938] hub 1-0:1.0: USB hub found [ 347.074531][ T9938] hub 1-0:1.0: 6 ports detected [ 347.324438][ T9938] hub 2-0:1.0: USB hub found [ 347.334786][ T9938] hub 2-0:1.0: 2 ports detected [ 347.517205][ T5843] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 347.520688][ T9938] hub 3-0:1.0: USB hub found [ 347.524235][ T9938] hub 3-0:1.0: 2 ports detected [ 347.598584][ T9938] hub 4-0:1.0: USB hub found [ 347.598823][ T9938] hub 4-0:1.0: 2 ports detected [ 347.712001][ T5843] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 347.712056][ T5843] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 347.712071][ T5843] usb 1-1: Product: QEMU USB Tablet [ 347.712081][ T5843] usb 1-1: Manufacturer: QEMU [ 347.712140][ T5843] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 347.795213][ T5843] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0065/input/input125 [ 347.832396][ T5758] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 347.832424][ T5758] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 347.832516][ T6436] usb 38-1: device descriptor read/8, error -110 [ 347.836953][ T5843] hid-generic 0003:0627:0001.0065: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 347.878158][ T9978] FAULT_INJECTION: forcing a failure. [ 347.878158][ T9978] name failslab, interval 1, probability 0, space 0, times 0 [ 347.878191][ T9978] CPU: 0 UID: 0 PID: 9978 Comm: syz.3.1016 Tainted: G L syzkaller #0 PREEMPT(full) [ 347.878207][ T9978] Tainted: [L]=SOFTLOCKUP [ 347.878211][ T9978] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 347.878218][ T9978] Call Trace: [ 347.878222][ T9978] [ 347.878227][ T9978] dump_stack_lvl+0x100/0x190 [ 347.878243][ T9978] should_fail_ex.cold+0x5/0xa [ 347.878256][ T9978] should_failslab+0xc2/0x120 [ 347.878273][ T9978] __kmalloc_noprof+0xfc/0x820 [ 347.878286][ T9978] ? rcu_is_watching+0x12/0xc0 [ 347.878301][ T9978] ? tomoyo_realpath_from_path+0xb6/0x690 [ 347.878321][ T9978] tomoyo_realpath_from_path+0xb6/0x690 [ 347.878341][ T9978] tomoyo_path_number_perm+0x23c/0x580 [ 347.878362][ T9978] ? tomoyo_path_number_perm+0x22e/0x580 [ 347.878377][ T9978] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 347.878392][ T9978] ? get_pid_task+0x106/0x250 [ 347.878418][ T9978] ? find_held_lock+0x2b/0x80 [ 347.878432][ T9978] ? __fget_files+0x215/0x3d0 [ 347.878442][ T9978] ? hook_file_ioctl_common+0x140/0x440 [ 347.878456][ T9978] ? __fget_files+0x215/0x3d0 [ 347.878469][ T9978] ? __fget_files+0x21f/0x3d0 [ 347.878481][ T9978] security_file_ioctl_compat+0xd3/0x230 [ 347.878497][ T9978] __ia32_compat_sys_ioctl+0xc2/0x360 [ 347.878516][ T9978] __do_fast_syscall_32+0xe7/0x970 [ 347.878530][ T9978] ? lockdep_hardirqs_on+0x78/0x100 [ 347.878544][ T9978] do_fast_syscall_32+0x32/0x70 [ 347.878559][ T9978] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 347.878574][ T9978] RIP: 0023:0xf7f72fec [ 347.878588][ T9978] Code: Unable to access opcode bytes at 0xf7f72fc2. [ 347.878593][ T9978] RSP: 002b:00000000f543650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 347.878607][ T9978] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000040505330 [ 347.878614][ T9978] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 347.878621][ T9978] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 347.878628][ T9978] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 347.878634][ T9978] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 347.878649][ T9978] [ 347.878654][ T9978] ERROR: Out of memory at tomoyo_realpath_from_path. [ 348.135780][ T9988] ehci-pci 0000:00:1d.7: remove, state 1 [ 348.137747][ T9988] usb usb1: USB disconnect, device number 1 [ 348.139862][ T9988] usb 1-1: USB disconnect, device number 2 [ 348.226142][ T6436] usb usb38-port1: attempt power cycle [ 348.350217][ T9996] netlink: 'syz.0.1019': attribute type 3 has an invalid length. [ 348.368785][ T9996] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1019'. [ 348.408436][ T9988] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 348.733886][ T2322] usb 2-1: new full-speed USB device number 67 using uhci_hcd [ 349.321479][ T2322] usb 2-1: not running at top speed; connect to a high speed hub [ 349.325789][ T6436] usb usb38-port1: unable to enumerate USB device [ 349.343232][ T2322] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 349.347863][ T2322] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 349.351345][ T2322] usb 2-1: Product: QEMU USB Tablet [ 349.353319][ T2322] usb 2-1: Manufacturer: QEMU [ 349.354864][ T2322] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 349.383032][ T2322] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0066/input/input126 [ 349.511685][ T2322] hid-generic 0003:0627:0001.0066: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 349.523116][ T9991] usb 2-1: USB disconnect, device number 67 [ 349.641605][T10008] fido_id[10008]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 349.694929][ T9991] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 349.702204][ T9991] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 349.712846][ T9991] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 349.754333][ T9991] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 349.759712][ T9991] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 349.770192][ T9991] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 349.774974][ T9991] usb usb1: Product: EHCI Host Controller [ 349.777963][ T9991] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 349.780754][ T9991] usb usb1: SerialNumber: 0000:00:1d.7 [ 349.832577][ T9991] hub 1-0:1.0: USB hub found [ 349.835189][ T9991] hub 1-0:1.0: 6 ports detected [ 349.880347][ T9991] hub 2-0:1.0: USB hub found [ 349.882918][ T9991] hub 2-0:1.0: 2 ports detected [ 349.929099][ T9991] hub 3-0:1.0: USB hub found [ 349.931825][ T9991] hub 3-0:1.0: 2 ports detected [ 349.990626][ T9991] hub 4-0:1.0: USB hub found [ 349.998119][ T9991] hub 4-0:1.0: 2 ports detected [ 350.096746][ T5758] Bluetooth: hci1: unexpected event for opcode 0x202d [ 350.101284][T10015] FAULT_INJECTION: forcing a failure. [ 350.101284][T10015] name failslab, interval 1, probability 0, space 0, times 0 [ 350.104954][ T5758] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 350.107412][T10015] CPU: 2 UID: 0 PID: 10015 Comm: syz.0.1026 Tainted: G L syzkaller #0 PREEMPT(full) [ 350.107431][T10015] Tainted: [L]=SOFTLOCKUP [ 350.107435][T10015] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 350.107442][T10015] Call Trace: [ 350.107447][T10015] [ 350.107451][T10015] dump_stack_lvl+0x100/0x190 [ 350.107470][T10015] should_fail_ex.cold+0x5/0xa [ 350.107483][T10015] should_failslab+0xc2/0x120 [ 350.107500][T10015] __kmalloc_cache_noprof+0x91/0x6c0 [ 350.107513][T10015] ? new_id_store+0x358/0x5b0 [ 350.107529][T10015] new_id_store+0x358/0x5b0 [ 350.107542][T10015] ? __pfx_new_id_store+0x10/0x10 [ 350.107559][T10015] ? find_held_lock+0x2b/0x80 [ 350.107573][T10015] ? sysfs_file_kobj+0xe4/0x290 [ 350.107588][T10015] ? sysfs_file_kobj+0xe4/0x290 [ 350.107603][T10015] ? __pfx_new_id_store+0x10/0x10 [ 350.107617][T10015] drv_attr_store+0x74/0xb0 [ 350.107630][T10015] ? __pfx_drv_attr_store+0x10/0x10 [ 350.107640][T10015] sysfs_kf_write+0xf2/0x150 [ 350.107656][T10015] kernfs_fop_write_iter+0x3e0/0x5f0 [ 350.107669][T10015] ? __pfx_sysfs_kf_write+0x10/0x10 [ 350.107686][T10015] vfs_write+0x6ac/0x1050 [ 350.107697][T10015] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 350.107712][T10015] ? __pfx_vfs_write+0x10/0x10 [ 350.107721][T10015] ? find_held_lock+0x2b/0x80 [ 350.107744][T10015] ksys_write+0x12a/0x250 [ 350.107754][T10015] ? __pfx_ksys_write+0x10/0x10 [ 350.107764][T10015] ? ksys_write+0x1ac/0x250 [ 350.107774][T10015] ? __pfx_ksys_write+0x10/0x10 [ 350.107787][T10015] __do_fast_syscall_32+0xe7/0x970 [ 350.107802][T10015] ? lockdep_hardirqs_on+0x78/0x100 [ 350.107817][T10015] do_fast_syscall_32+0x32/0x70 [ 350.107831][T10015] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 350.107846][T10015] RIP: 0023:0xf7f93fec [ 350.107860][T10015] Code: Unable to access opcode bytes at 0xf7f93fc2. [ 350.107865][T10015] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 350.107876][T10015] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800001c0 [ 350.107886][T10015] RDX: 0000000000000011 RSI: 0000000000000000 RDI: 0000000000000000 [ 350.107892][T10015] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 350.107899][T10015] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 350.107905][T10015] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 350.107920][T10015] [ 350.135374][ T34] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 350.252112][ T5758] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 350.425848][ T34] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 350.428684][ T34] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 350.431344][ T34] usb 1-1: Product: QEMU USB Tablet [ 350.433128][ T34] usb 1-1: Manufacturer: QEMU [ 350.434800][ T34] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 350.469446][ T34] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0067/input/input127 [ 350.528507][ T34] hid-generic 0003:0627:0001.0067: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 351.190103][T10026] FAULT_INJECTION: forcing a failure. [ 351.190103][T10026] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 351.195568][T10026] CPU: 3 UID: 0 PID: 10026 Comm: syz.2.1028 Tainted: G L syzkaller #0 PREEMPT(full) [ 351.195597][T10026] Tainted: [L]=SOFTLOCKUP [ 351.195603][T10026] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 351.195616][T10026] Call Trace: [ 351.195622][T10026] [ 351.195629][T10026] dump_stack_lvl+0x100/0x190 [ 351.195657][T10026] should_fail_ex.cold+0x5/0xa [ 351.195679][T10026] _copy_to_user+0x32/0xd0 [ 351.195707][T10026] simple_read_from_buffer+0xcb/0x170 [ 351.195737][T10026] proc_fail_nth_read+0x1af/0x230 [ 351.195763][T10026] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 351.195790][T10026] ? rw_verify_area+0xce/0x6d0 [ 351.195816][T10026] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 351.195840][T10026] vfs_read+0x1e4/0xb40 [ 351.195872][T10026] ? __pfx_vfs_read+0x10/0x10 [ 351.195897][T10026] ? find_held_lock+0x2b/0x80 [ 351.195921][T10026] ? __fget_files+0x215/0x3d0 [ 351.195943][T10026] ? __fget_files+0x21f/0x3d0 [ 351.195967][T10026] ksys_read+0x12a/0x250 [ 351.195985][T10026] ? __pfx_ksys_read+0x10/0x10 [ 351.196009][T10026] do_int80_emulation+0x14b/0x720 [ 351.196036][T10026] asm_int80_emulation+0x1a/0x20 [ 351.196055][T10026] RIP: 0023:0xf71972eb [ 351.196071][T10026] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 351.196088][T10026] RSP: 002b:00000000f544d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 351.196107][T10026] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f544d5d0 [ 351.196120][T10026] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 351.196130][T10026] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 351.196141][T10026] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 351.196152][T10026] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 351.196176][T10026] [ 352.586376][T10045] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1035'. [ 352.602114][T10048] geneve2: entered promiscuous mode [ 352.607006][T10048] geneve2: entered allmulticast mode [ 352.867011][T10055] ehci-pci 0000:00:1d.7: remove, state 1 [ 352.867083][T10055] usb usb1: USB disconnect, device number 1 [ 352.867098][T10055] usb 1-1: USB disconnect, device number 2 [ 353.014413][T10058] netlink: 'syz.2.1037': attribute type 3 has an invalid length. [ 353.028261][T10058] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1037'. [ 353.187335][T10055] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 353.202123][T10060] random: crng reseeded on system resumption [ 353.429166][T10056] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1038'. [ 353.447006][ T2322] usb 2-1: new full-speed USB device number 68 using uhci_hcd [ 353.463129][T10056] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(9) [ 353.465164][T10056] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 353.468175][T10056] vhci_hcd vhci_hcd.0: Device attached [ 353.616321][T10074] vhci_hcd: connection closed [ 353.621148][ T5820] vhci_hcd vhci_hcd.3: stop threads [ 353.638790][ T5820] vhci_hcd vhci_hcd.3: release socket [ 353.640710][ T5820] vhci_hcd vhci_hcd.3: disconnect device [ 353.666765][ T2322] usb 2-1: not running at top speed; connect to a high speed hub [ 353.713477][ T2322] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 353.734303][ T2322] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 353.767079][ T2322] usb 2-1: Product: QEMU USB Tablet [ 353.780614][ T2322] usb 2-1: Manufacturer: QEMU [ 353.832055][ T2322] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 354.220230][ T2322] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0068/input/input128 [ 354.395884][T10081] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1045'. [ 354.448735][ T5758] Bluetooth: hci3: ACL packet for unknown connection handle 3 [ 354.499436][ T2322] hid-generic 0003:0627:0001.0068: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 354.532451][T10057] usb 2-1: USB disconnect, device number 68 [ 354.588352][T10086] netlink: 'syz.3.1046': attribute type 1 has an invalid length. [ 354.604692][T10086] 8021q: adding VLAN 0 to HW filter on device bond1 [ 354.638324][T10084] fido_id[10084]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/2-1/report_descriptor': No such file or directory [ 354.689380][T10088] gretap1: entered promiscuous mode [ 354.716039][T10088] bond1: (slave gretap1): making interface the new active one [ 354.726471][T10088] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 354.750582][T10057] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 354.757105][T10057] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 354.761576][T10057] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 354.786403][T10057] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 354.793515][T10057] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 354.797814][T10057] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 354.800614][T10057] usb usb1: Product: EHCI Host Controller [ 354.802663][T10057] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 354.804759][T10057] usb usb1: SerialNumber: 0000:00:1d.7 [ 354.811921][T10057] hub 1-0:1.0: USB hub found [ 354.814854][T10057] hub 1-0:1.0: 6 ports detected [ 354.868449][T10057] hub 2-0:1.0: USB hub found [ 354.870602][T10057] hub 2-0:1.0: 2 ports detected [ 354.907959][T10057] hub 3-0:1.0: USB hub found [ 354.909983][T10057] hub 3-0:1.0: 2 ports detected [ 354.947878][T10057] hub 4-0:1.0: USB hub found [ 354.949862][T10057] hub 4-0:1.0: 2 ports detected [ 355.085325][ T5835] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 355.269964][ T5835] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 355.275977][ T5835] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 355.278692][ T5835] usb 1-1: Product: QEMU USB Tablet [ 355.280381][ T5835] usb 1-1: Manufacturer: QEMU [ 355.281918][ T5835] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 355.304355][ T5835] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0069/input/input129 [ 355.370521][ T5835] hid-generic 0003:0627:0001.0069: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 355.664495][ T5758] Bluetooth: hci1: unexpected event for opcode 0x202d [ 355.671621][ T5758] Bluetooth: hci1: SCO packet for unknown connection handle 201 [ 355.727736][ T5758] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 356.823733][T10117] ehci-pci 0000:00:1d.7: remove, state 1 [ 356.826166][T10117] usb usb1: USB disconnect, device number 1 [ 356.828496][T10117] usb 1-1: USB disconnect, device number 2 [ 356.972575][T10120] netlink: 'syz.3.1054': attribute type 3 has an invalid length. [ 356.986570][T10120] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1054'. [ 357.390876][T10117] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 357.675265][ T5836] usb 2-1: new full-speed USB device number 69 using uhci_hcd [ 357.874864][ T5836] usb 2-1: not running at top speed; connect to a high speed hub [ 357.913384][ T5836] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 357.920313][ T5836] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 357.928431][ T5836] usb 2-1: Product: QEMU USB Tablet [ 357.938330][ T5836] usb 2-1: Manufacturer: QEMU [ 357.944406][ T5836] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 358.173816][ T5836] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.006A/input/input130 [ 358.334935][ T5836] hid-generic 0003:0627:0001.006A: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 358.368433][ T8400] ffs_data_put(): freeing [ 358.381090][T10119] usb 2-1: USB disconnect, device number 69 [ 358.548499][T10136] fido_id[10136]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 358.591407][T10119] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 358.601282][T10119] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 358.623854][T10119] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 358.659248][T10119] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 358.664412][T10119] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 358.669730][T10119] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 358.673131][T10119] usb usb1: Product: EHCI Host Controller [ 358.675551][T10119] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 358.678144][T10119] usb usb1: SerialNumber: 0000:00:1d.7 [ 358.692146][T10119] hub 1-0:1.0: USB hub found [ 358.695683][T10119] hub 1-0:1.0: 6 ports detected [ 358.747607][T10119] hub 2-0:1.0: USB hub found [ 358.769780][T10119] hub 2-0:1.0: 2 ports detected [ 358.834324][T10119] hub 3-0:1.0: USB hub found [ 358.844331][T10119] hub 3-0:1.0: 2 ports detected [ 358.868369][T10146] /dev/sg0: Can't lookup blockdev [ 358.893151][T10119] hub 4-0:1.0: USB hub found [ 358.907732][T10119] hub 4-0:1.0: 2 ports detected [ 358.924003][T10150] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1064'. [ 358.985603][ T5835] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 359.170026][ T5835] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 359.175231][ T5835] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 359.185329][ T5835] usb 1-1: Product: QEMU USB Tablet [ 359.187587][ T5835] usb 1-1: Manufacturer: QEMU [ 359.189595][ T5835] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 359.217549][ T5835] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.006B/input/input131 [ 359.280582][ T5835] hid-generic 0003:0627:0001.006B: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 359.788354][T10161] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1067'. [ 360.433421][T10177] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 360.435493][T10177] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 360.439348][T10177] vhci_hcd vhci_hcd.0: Device attached [ 360.477363][T10177] macvlan2: entered promiscuous mode [ 360.479535][T10177] bridge0: entered promiscuous mode [ 360.735761][ T5836] usb 42-1: SetAddress Request (30) to port 0 [ 360.737779][ T5836] usb 42-1: new SuperSpeed USB device number 30 using vhci_hcd [ 360.911872][T10178] vhci_hcd: connection reset by peer [ 360.921352][ T9571] vhci_hcd vhci_hcd.2: stop threads [ 360.923634][ T9571] vhci_hcd vhci_hcd.2: release socket [ 360.929458][ T9571] vhci_hcd vhci_hcd.2: disconnect device [ 361.434188][T10182] ehci-pci 0000:00:1d.7: remove, state 1 [ 361.437156][T10182] usb usb1: USB disconnect, device number 1 [ 361.439706][T10182] usb 1-1: USB disconnect, device number 2 [ 361.641435][T10184] netlink: 'syz.0.1071': attribute type 3 has an invalid length. [ 361.664836][T10184] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1071'. [ 361.954914][T10182] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 362.225296][ T6436] usb 2-1: new full-speed USB device number 70 using uhci_hcd [ 362.242787][T10196] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1074'. [ 362.400915][ T6436] usb 2-1: not running at top speed; connect to a high speed hub [ 362.426625][ T6436] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 362.432076][ T6436] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 362.440277][ T6436] usb 2-1: Product: QEMU USB Tablet [ 362.444299][ T6436] usb 2-1: Manufacturer: QEMU [ 362.450323][ T6436] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 362.813911][ T6436] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.006C/input/input132 [ 363.024517][ T6436] hid-generic 0003:0627:0001.006C: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 363.109100][T10183] usb 2-1: USB disconnect, device number 70 [ 363.536140][T10183] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 363.655891][T10183] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 363.702058][T10183] ehci-pci 0000:00:1d.7: irq 19, io mem 0x80000000 [ 363.737322][T10183] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 363.805235][T10183] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 363.822594][T10183] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 363.835316][T10183] usb usb1: Product: EHCI Host Controller [ 363.844190][T10183] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 363.847922][T10206] fido_id[10206]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 363.849260][T10183] usb usb1: SerialNumber: 0000:00:1d.7 [ 363.902144][T10183] hub 1-0:1.0: USB hub found [ 363.913332][T10183] hub 1-0:1.0: 6 ports detected [ 363.967245][ T5742] ffs_data_put(): freeing [ 363.992656][T10212] typec_fusb302 0-0022: supply vbus not found, using dummy regulator [ 364.007398][T10212] typec_fusb302 0-0022: failed to request gpio_int_n [ 364.007848][T10183] hub 2-0:1.0: USB hub found [ 364.033585][T10183] hub 2-0:1.0: 2 ports detected [ 364.042945][T10214] typec_fusb302 1-0022: I2C/SMBus block functionality not supported! [ 364.043562][T10212] typec_fusb302 0-0022: probe with driver typec_fusb302 failed with error -2 [ 364.047281][T10214] i2c i2c-1: new_device: Instantiated device typec_fusb302 at 0x22 [ 364.054983][T10212] i2c i2c-0: new_device: Instantiated device typec_fusb302 at 0x22 [ 364.267013][T10183] hub 3-0:1.0: USB hub found [ 364.280992][T10183] hub 3-0:1.0: 2 ports detected [ 364.316847][ T1487] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 364.387652][T10183] hub 4-0:1.0: USB hub found [ 364.419650][T10183] hub 4-0:1.0: 2 ports detected [ 365.126695][ T1487] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 365.132732][ T1487] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 365.136200][ T1487] usb 1-1: Product: QEMU USB Tablet [ 365.138801][ T1487] usb 1-1: Manufacturer: QEMU [ 365.140759][ T1487] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 365.265864][T10227] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1082'. [ 365.307067][ T1487] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.006D/input/input133 [ 365.524891][ T1487] hid-generic 0003:0627:0001.006D: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 365.919177][ T5836] usb 42-1: device descriptor read/8, error -110 [ 366.180955][T10238] syzkaller0: entered promiscuous mode [ 366.183359][T10238] syzkaller0: entered allmulticast mode [ 366.208380][T10238] Mass Storage Function, version: 2009/09/11 [ 366.211946][T10238] LUN: removable file: (no medium) [ 366.217686][T10238] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 366.220598][T10238] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 366.223779][T10238] ================================================================== [ 366.227048][T10238] BUG: KASAN: slab-out-of-bounds in dummy_free_request+0x8a/0x90 [ 366.230244][T10238] Read of size 8 at addr ffff888012d74af0 by task syz.2.1087/10238 [ 366.234938][T10238] [ 366.236060][T10238] CPU: 3 UID: 0 PID: 10238 Comm: syz.2.1087 Tainted: G L syzkaller #0 PREEMPT(full) [ 366.236091][T10238] Tainted: [L]=SOFTLOCKUP [ 366.236098][T10238] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 366.236110][T10238] Call Trace: [ 366.236118][T10238] [ 366.236126][T10238] dump_stack_lvl+0x100/0x190 [ 366.236149][T10238] print_report+0x13d/0x4b0 [ 366.236178][T10238] ? __virt_addr_valid+0x239/0x430 [ 366.236201][T10238] ? dummy_free_request+0x8a/0x90 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 366.236229][T10238] kasan_report+0xdf/0x1c0 [ 366.236256][T10238] ? dummy_free_request+0x8a/0x90 [ 366.236287][T10238] dummy_free_request+0x8a/0x90 [ 366.236315][T10238] uvc_function_bind+0x181a/0x1939 [ 366.236337][T10238] ? __pfx_uvc_function_bind+0x10/0x10 [ 366.236358][T10238] usb_add_function+0x219/0x890 [ 366.236386][T10238] configfs_composite_bind+0xd83/0x1960 [ 366.236417][T10238] gadget_bind_driver+0x28c/0xbf0 [ 366.236435][T10238] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 366.236462][T10238] ? __pfx_gadget_bind_driver+0x10/0x10 [ 366.236482][T10238] really_probe+0x241/0xa60 [ 366.236508][T10238] __driver_probe_device+0x20e/0x450 [ 366.236532][T10238] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 366.236558][T10238] driver_probe_device+0x4a/0x140 [ 366.236583][T10238] __driver_attach+0x21f/0x5b0 [ 366.236608][T10238] ? __pfx___driver_attach+0x10/0x10 [ 366.236632][T10238] bus_for_each_dev+0x13e/0x1d0 [ 366.236651][T10238] ? __pfx_bus_for_each_dev+0x10/0x10 [ 366.236670][T10238] ? bus_add_driver+0x2b5/0x5b0 [ 366.236694][T10238] bus_add_driver+0x305/0x5b0 [ 366.236716][T10238] driver_register+0x1e2/0x360 [ 366.236743][T10238] usb_gadget_register_driver_owner+0x132/0x210 [ 366.236764][T10238] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 366.236790][T10238] configfs_write_iter+0x302/0x4e0 [ 366.236816][T10238] vfs_write+0x6ac/0x1050 [ 366.236835][T10238] ? __pfx_configfs_write_iter+0x10/0x10 [ 366.236855][T10238] ? __pfx_vfs_write+0x10/0x10 [ 366.236872][T10238] ? find_held_lock+0x2b/0x80 [ 366.236904][T10238] ksys_write+0x12a/0x250 [ 366.236922][T10238] ? __pfx_ksys_write+0x10/0x10 [ 366.236943][T10238] __do_fast_syscall_32+0xe7/0x970 [ 366.236969][T10238] do_fast_syscall_32+0x32/0x70 [ 366.236991][T10238] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 366.237012][T10238] RIP: 0023:0xf705efec [ 366.237033][T10238] Code: Unable to access opcode bytes at 0xf705efc2. [ 366.237043][T10238] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 366.237060][T10238] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 0000000080000d00 [ 366.237073][T10238] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 366.237086][T10238] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 366.237097][T10238] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 366.237110][T10238] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 366.237127][T10238] [ 366.237135][T10238] [ 366.353782][T10238] Allocated by task 8400: [ 366.355585][T10238] kasan_save_stack+0x30/0x50 [ 366.357557][T10238] kasan_save_track+0x14/0x30 [ 366.359578][T10238] __kasan_kmalloc+0xaa/0xb0 [ 366.361528][T10238] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 366.363756][T10238] __hw_addr_create+0x57/0x220 [ 366.365747][T10238] __hw_addr_add_ex+0x32b/0x650 [ 366.367777][T10238] dev_addr_init+0x161/0x250 [ 366.369735][T10238] alloc_netdev_mqs+0x363/0x15c0 [ 366.371787][T10238] rtnl_create_link+0xc13/0xf80 [ 366.373799][T10238] rtnl_newlink+0x13bd/0x2380 [ 366.375767][T10238] rtnetlink_rcv_msg+0x95e/0xe90 [ 366.377845][T10238] netlink_rcv_skb+0x159/0x420 [ 366.379810][T10238] netlink_unicast+0x585/0x850 [ 366.381810][T10238] netlink_sendmsg+0x8b0/0xda0 [ 366.383790][T10238] __sys_sendto+0x48b/0x4e0 [ 366.385673][T10238] __ia32_compat_sys_socketcall+0x59a/0x770 [ 366.388114][T10238] do_int80_emulation+0x14b/0x720 [ 366.390219][T10238] asm_int80_emulation+0x1a/0x20 [ 366.392267][T10238] [ 366.393287][T10238] The buggy address belongs to the object at ffff888012d74a00 [ 366.393287][T10238] which belongs to the cache kmalloc-128 of size 128 [ 366.398948][T10238] The buggy address is located 136 bytes to the right of [ 366.398948][T10238] allocated 104-byte region [ffff888012d74a00, ffff888012d74a68) [ 366.404713][T10238] [ 366.405750][T10238] The buggy address belongs to the physical page: [ 366.408400][T10238] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12d74 [ 366.411919][T10238] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 366.414735][T10238] page_type: f5(slab) [ 366.416403][T10238] raw: 00fff00000000000 ffff88801bc42a00 dead000000000100 dead000000000122 [ 366.419879][T10238] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 366.423343][T10238] page dumped because: kasan: bad access detected [ 366.425967][T10238] page_owner tracks the page as allocated [ 366.428291][T10238] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5742, tgid 5742 (syz-executor), ts 134711762301, free_ts 117366831516 [ 366.435723][T10238] post_alloc_hook+0xfd/0x120 [ 366.436381][ T5836] usb usb42-port1: attempt power cycle [ 366.437698][T10238] get_page_from_freelist+0xf48/0x3530 [ 366.437724][T10238] __alloc_frozen_pages_noprof+0x6ab/0x2dc0 [ 366.444183][T10238] new_slab+0xa2/0x650 [ 366.445900][T10238] ___slab_alloc+0x5d1/0x800 [ 366.447818][T10238] __kmalloc_flags_noprof+0x466/0x890 [ 366.450083][T10238] alloc_slab_obj_exts+0xb2/0x250 [ 366.452100][T10238] __memcg_slab_post_alloc_hook+0x3d4/0x1160 [ 366.454583][T10238] kmem_cache_alloc_noprof+0x587/0x6a0 [ 366.456861][T10238] copy_process+0x2e05/0x8030 [ 366.458838][T10238] kernel_clone+0x176/0x9d0 [ 366.460726][T10238] __do_compat_sys_ia32_clone+0xd4/0x120 [ 366.463042][T10238] __do_fast_syscall_32+0xe7/0x970 [ 366.465135][T10238] do_fast_syscall_32+0x32/0x70 [ 366.467150][T10238] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 366.469763][T10238] page last free pid 5926 tgid 5926 stack trace: [ 366.472326][T10238] __free_frozen_pages+0x79f/0x1090 [ 366.474477][T10238] qlist_free_all+0x47/0xf0 [ 366.476377][T10238] kasan_quarantine_reduce+0x1a0/0x1f0 [ 366.478635][T10238] __kasan_slab_alloc+0x69/0x90 [ 366.480666][T10238] __kmalloc_cache_noprof+0x265/0x6c0 [ 366.482894][T10238] usb_control_msg+0xbc/0x4b0 [ 366.484844][T10238] hub_ext_port_status+0x152/0x600 [ 366.486987][T10238] hub_port_reset+0x344/0x1bd0 [ 366.488996][T10238] hub_port_init+0x1f2/0x37f0 [ 366.490964][T10238] hub_event+0x2e7d/0x4a60 [ 366.492839][T10238] process_one_work+0xa23/0x1940 [ 366.494858][T10238] worker_thread+0x5ef/0xe50 [ 366.496723][T10238] kthread+0x370/0x450 [ 366.498409][T10238] ret_from_fork+0x72b/0xd50 [ 366.500280][T10238] ret_from_fork_asm+0x1a/0x30 [ 366.502268][T10238] [ 366.503288][T10238] Memory state around the buggy address: [ 366.505618][T10238] ffff888012d74980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 366.508898][T10238] ffff888012d74a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 366.512174][T10238] >ffff888012d74a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 366.515402][T10238] ^ [ 366.518559][T10238] ffff888012d74b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 366.521846][T10238] ffff888012d74b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 366.525182][T10238] ================================================================== [ 366.531575][T10238] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 366.534847][T10238] CPU: 3 UID: 0 PID: 10238 Comm: syz.2.1087 Tainted: G L syzkaller #0 PREEMPT(full) [ 366.539243][T10238] Tainted: [L]=SOFTLOCKUP [ 366.541036][T10238] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 366.545053][T10238] Call Trace: [ 366.546448][T10238] [ 366.547688][T10238] dump_stack_lvl+0x100/0x190 [ 366.549646][T10238] vpanic+0x552/0x970 [ 366.551303][T10238] ? __pfx_vpanic+0x10/0x10 [ 366.553165][T10238] ? mark_held_locks+0x40/0x70 [ 366.555072][T10238] ? dummy_free_request+0x8a/0x90 [ 366.557144][T10238] panic+0xd1/0xe0 [ 366.558720][T10238] ? __pfx_panic+0x10/0x10 [ 366.560563][T10238] ? dummy_free_request+0x8a/0x90 [ 366.562694][T10238] ? preempt_schedule_common+0x42/0xc0 [ 366.564927][T10238] check_panic_on_warn.cold+0x19/0x34 [ 366.567158][T10238] end_report.part.0+0x3a/0x90 [ 366.569163][T10238] kasan_report.cold+0xe/0x18 [ 366.571158][T10238] ? dummy_free_request+0x8a/0x90 [ 366.573266][T10238] dummy_free_request+0x8a/0x90 [ 366.575281][T10238] uvc_function_bind+0x181a/0x1939 [ 366.577396][T10238] ? __pfx_uvc_function_bind+0x10/0x10 [ 366.579652][T10238] usb_add_function+0x219/0x890 [ 366.581687][T10238] configfs_composite_bind+0xd83/0x1960 [ 366.583984][T10238] gadget_bind_driver+0x28c/0xbf0 [ 366.586111][T10238] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 366.588495][T10238] ? __pfx_gadget_bind_driver+0x10/0x10 [ 366.590743][T10238] really_probe+0x241/0xa60 [ 366.592627][T10238] __driver_probe_device+0x20e/0x450 [ 366.594804][T10238] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 366.597256][T10238] driver_probe_device+0x4a/0x140 [ 366.598924][T10238] __driver_attach+0x21f/0x5b0 [ 366.600360][T10238] ? __pfx___driver_attach+0x10/0x10 [ 366.601908][T10238] bus_for_each_dev+0x13e/0x1d0 [ 366.603333][T10238] ? __pfx_bus_for_each_dev+0x10/0x10 [ 366.604971][T10238] ? bus_add_driver+0x2b5/0x5b0 [ 366.606467][T10238] bus_add_driver+0x305/0x5b0 [ 366.607913][T10238] driver_register+0x1e2/0x360 [ 366.609387][T10238] usb_gadget_register_driver_owner+0x132/0x210 [ 366.611298][T10238] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 366.613021][T10238] configfs_write_iter+0x302/0x4e0 [ 366.614593][T10238] vfs_write+0x6ac/0x1050 [ 366.615932][T10238] ? __pfx_configfs_write_iter+0x10/0x10 [ 366.617680][T10238] ? __pfx_vfs_write+0x10/0x10 [ 366.619165][T10238] ? find_held_lock+0x2b/0x80 [ 366.620617][T10238] ksys_write+0x12a/0x250 [ 366.621958][T10238] ? __pfx_ksys_write+0x10/0x10 [ 366.623447][T10238] __do_fast_syscall_32+0xe7/0x970 [ 366.625043][T10238] do_fast_syscall_32+0x32/0x70 [ 366.626548][T10238] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 366.628478][T10238] RIP: 0023:0xf705efec [ 366.629722][T10238] Code: Unable to access opcode bytes at 0xf705efc2. [ 366.631654][T10238] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 366.634073][T10238] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 0000000080000d00 [ 366.636483][T10238] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000000 [ 366.638888][T10238] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 366.641287][T10238] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 366.643682][T10238] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 366.645977][T10238] [ 366.647654][T10238] Kernel Offset: disabled [ 366.648916][T10238] Rebooting in 86400 seconds.. VM DIAGNOSIS: 02:54:04 Registers: info registers vcpu 0 CPU#0 RAX=000000000102b67d RBX=ffffffff8e891480 RCX=ffffffff8bb832d5 RDX=0000000000000000 RSI=ffffffff8e1a7b8e RDI=ffffffff8c400880 RBP=fffffbfff1d12290 RSP=ffffffff8e807e10 R8 =0000000000000001 R9 =ffffed100564678d R10=ffff88802b233c6b R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffffffff1d00fc6 R15=dffffc0000000000 RIP=ffffffff8bb8189f RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096be6000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f73d33ec CR3=0000000069f2c000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000014000000000 0000000400000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=000000000142abf5 RBX=ffff88801cb4a540 RCX=ffffffff8bb832d5 RDX=0000000000000000 RSI=ffffffff8e1a7b8e RDI=ffffffff8c400880 RBP=ffffed10039694a8 RSP=ffffc9000046fe00 R8 =0000000000000001 R9 =ffffed100566678d R10=ffff88802b333c6b R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff9200008dfc4 R15=dffffc0000000000 RIP=ffffffff8bb8189f RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096ce6000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000800bd01c CR3=0000000064f92000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000007 RBX=0000000037701ce8 RCX=ffffffff851c76f4 RDX=0000000000000000 RSI=00000000000008d7 RDI=0000000000000000 RBP=ffff888059f71729 RSP=ffffc900043e7160 R8 =0000000000000007 R9 =0000000000000000 R10=00000000000008d8 R11=0000000000000000 R12=dffffc0000000000 R13=00000000000008d7 R14=00000000000008d6 R15=0000000000000000 RIP=ffffffff8209a360 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f91c2223300 ffffffff 00c00000 GS =0000 ffff888096de6000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000557f81acb000 CR3=0000000051280000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fcffc200 Opmask01=000000000000ffff Opmask02=00000000ffffffff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000001 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000003bf12 0000003000000012 0004000000080024 0000000000280034 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000449 0000001400000000 0000000000000000 0000000000000015 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 636f72702f01ffff ffffffffffffc708 0380031e0000158a 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 08800201c7080008 044c920065727573 736572705f79726f 6d656d2e74657375 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 706301ffffffffff ffffffd108088003 00080007c0b80800 048002060278e600 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 23706f6f6c2f7665 642f01ffffffffff ffffffe908048003 0004000208000380 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0201c7080008004e 88006d656d775f70 63742f347670692f 74656e2f7379732f ZMM24=1501014215010142 1501014215010142 1501014215010142 1501014215010142 1501014215010142 1501014215010142 1501014215010142 1501014215010142 ZMM25=8d176e268d176e26 8d176e268d176e26 8d176e268d176e26 8d176e268d176e26 8d176e268d176e26 8d176e268d176e26 8d176e268d176e26 8d176e268d176e26 ZMM26=1d8318a21d8318a2 1d8318a21d8318a2 1d8318a21d8318a2 1d8318a21d8318a2 1d8318a21d8318a2 1d8318a21d8318a2 1d8318a21d8318a2 1d8318a21d8318a2 ZMM27=a698eccca698eccc a698eccca698eccc a698eccca698eccc a698eccca698eccc a698eccca698eccc a698eccca698eccc a698eccca698eccc a698eccca698eccc ZMM28=000000600000005f 0000005e0000005d 0000005c0000005b 0000005a00000059 0000005800000057 0000005600000055 0000005400000053 0000005200000051 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=790b0000790b0000 790b0000790b0000 790b0000790b0000 790b0000790b0000 790b0000790b0000 790b0000790b0000 790b0000790b0000 790b0000790b0000 info registers vcpu 3 CPU#3 RAX=000000000000007a RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85a10995 RDI=ffffffff9b9f01a0 RBP=ffffffff9b9f0160 RSP=ffffc90000a0f298 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3130383838666666 R12=0000000000000000 R13=000000000000007a R14=ffffffff9b6f0229 R15=ffffffff85a10930 RIP=ffffffff85a109bf RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096ee6000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f74134fc CR3=000000004c815000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffff000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000