last executing test programs: 4.349111424s ago: executing program 2 (id=6538): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000002fc0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x0, 0x0, {0xa}, [@RTA_DPORT={0x6}, @RTA_IP_PROTO={0x5}]}, 0x2c}}, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x8, @local, 0xb}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000180)=0x4, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) r5 = openat$cgroup_subtree(r4, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x30}, [@ldst={0x7, 0x3, 0x0, 0x0, 0xa}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) openat$ptp0(0xffffffffffffff9c, 0x0, 0x2440, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x14, 0x2, 0x3, 0x3, 0x0, 0x0, {0x5}}, 0x14}}, 0x0) write$cgroup_subtree(r5, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r5, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) setreuid(0xee00, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) 3.457231887s ago: executing program 2 (id=6544): r0 = socket$kcm(0x2, 0x3, 0x106) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x24, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xb, 0xfff3}, {}, {0x7, 0x300}}}, 0x24}, 0x1, 0x0, 0x0, 0x20045010}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x850}, 0x4040080) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000600)="b9ed29d8fe490a060b483f2dd090fc6889ae6b84", 0x14}], 0x1}, 0x0) 3.350227357s ago: executing program 2 (id=6545): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) lgetxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='system.posix_acl_default\x00', 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x8, 0xb, 0x400}, 0x48) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') read$char_usb(r1, &(0x7f0000000080)=""/139, 0x8b) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = syz_io_uring_setup(0x27cb, &(0x7f0000000540)={0x0, 0x800069ea, 0x3000, 0x3, 0x8000d}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$ARPT_SO_SET_REPLACE(r8, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0xb001, 0x4, 0x3ac, 0x0, 0x1ec, 0xe0, 0x2cc, 0x2cc, 0x2cc, 0x7fffffe, 0x0, {[{{@arp={@private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff, 0xff000000, 0x2, 0x1, {@empty, {[0x0, 0xff, 0x0, 0x0, 0xff, 0xff]}}, {@empty, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x8000, 0x401, 0x6, 0xa, 0x3ff, 0x9, 'dvmrp0\x00', 'vlan0\x00', {}, {0xff}, 0x0, 0x81}, 0xbc, 0xe0}, @unspec=@STANDARD={0x24, '\x00', 0x0, 0xfffffffffffffffc}}, {{@arp={@multicast2, @broadcast, 0xff, 0x0, 0x90, 0xf, {@empty, {[0xff, 0x0, 0x0, 0xff]}}, {@mac=@random="9b90ceb9f7a9", {[0x0, 0x0, 0xff, 0xff, 0xff]}}, 0x5, 0x2, 0x6, 0x40d, 0xf01, 0x5592, 'bridge0\x00', 'bridge_slave_1\x00', {}, {0x103}, 0x0, 0x302}, 0xbc, 0x10c, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @empty, @remote, @empty}}}, {{@uncond, 0xbc, 0xe0}, @unspec=@STANDARD={0x24, '\x00', 0x0, 0x1ec}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3f8) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000180), 0x1, 0x1, 0x1}) io_uring_enter(r4, 0x1, 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x7, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffff9, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2839d1}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r10, &(0x7f0000000580)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x220}, 0xc, &(0x7f0000000540)={&(0x7f0000000300)={0x224, 0x7, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0xa}, [@NFTA_RULE_POSITION_ID={0x8}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_EXPRESSIONS={0x1f8, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @range={{0xa}, @void}}, {0x118, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x108, 0x2, 0x0, 0x1, [@NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_RANGE_TO_DATA={0xa0, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6e, 0x1, "05e80f6b7463fb7922b6f9005bf380a3d9e601dcdccb1f779429d152be962e9c93dd67bcf4e056ee939ee59a8ec3e15126d2b00096d9659327fe847b602df0be885bfd8d5e0ab24db9bd8fc6a36aec06104f20ab6f339177c3213c82e633fd548b8807d26a7df809df00"}, @NFTA_DATA_VALUE={0x29, 0x1, "a13f08d88d58fb4aec123ab25c1dc315f6b9987622fc38b109a327ca6a8bd470f99b42888c"}]}, @NFTA_RANGE_TO_DATA={0x4c, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x7}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}, @NFTA_RANGE_OP={0x8}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}]}}}, {0x34, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x17}]}}}, {0x48, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_CT_DIRECTION={0x5}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0xa}, @NFTA_CT_DIRECTION={0x5}]}}}, {0x10, 0x1, 0x0, 0x1, @socket={{0xb}, @void}}, {0x40, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_RT_KEY={0x8}, @NFTA_RT_KEY={0x8}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}]}, 0x224}, 0x1, 0x0, 0x0, 0x4}, 0x10) r11 = fsopen(&(0x7f0000000700)='affs\x00', 0x1) r12 = fcntl$dupfd(r11, 0x0, r11) fsconfig$FSCONFIG_SET_STRING(r12, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) ioctl$sock_ifreq(r9, 0x891e, &(0x7f00000029c0)={'batadv_slave_1\x00', @ifru_settings={0x31c, 0x1, @fr_pvc_info=0x0}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.109961119s ago: executing program 2 (id=6546): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYRESOCT=r0, @ANYRES8=0xffffffffffffffff], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x20040000) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="460200000000000000d48464000000000800000000000000", @ANYRES32=r2, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f00000008c0)=[{{&(0x7f0000000300)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000001740)=[{&(0x7f00000005c0)="0c80b42f080000000000000000006600000000", 0x13}], 0x1}}, {{&(0x7f0000000540)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000980)='\x00', 0x1}, {&(0x7f00000001c0)="d7529f0716960d706c2356c072d28bb3f80a905e239cbc7a5373a99a53a78ad436bec72844a241ec22a4ef93b562500bcfedfc61d1ceae27f6a67e", 0x3b}], 0x2}}], 0x2, 0x4000800) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xc, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000080)={r5, 0x8}, 0x8) openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) listen(0xffffffffffffffff, 0x0) listen(0xffffffffffffffff, 0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) recvmmsg(r6, &(0x7f0000001e80), 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0xffffff81, 0x0, 0x9, 0x5, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYRES32=r3], 0xd4}}, 0x0) mremap(&(0x7f000054b000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000049000/0x1000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) io_uring_setup(0x549c, &(0x7f0000000000)={0x0, 0x70e6, 0x4000, 0x1, 0xf2}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="f572c10000a88c43c226f0a6380778c72739a0", @ANYBLOB="eb8e56713483af032f03885314d7cdc7fe5d4446ac23d4c53358d92d3ccb36cfb2d0a06b23864226d843aef258a28b269d50ce7e0e055cf859ee9f8a8bf6721dcdcf77266b09ddea302a21cd7390c48808dc24d8ea3f92cfcd0e3099fee3838834e2b6b4e710f8c04c694e62aa88c7c51ea38a380a3fb8ce522c38d093c7e043720de62d7b964e2be86ac2cd8f67f52df88c850aa9a9de352b4281fcf5ae10d18b461ca9afd7e942217e5fdc4974f6a2178348eacbed2085e2408dd5c5a42d6f12"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x94) syz_open_procfs(0xffffffffffffffff, 0x0) unshare(0x6a040000) 2.236121493s ago: executing program 2 (id=6553): syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109020301ffffbf000904000002070101000905010200"], 0x0) r0 = syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x6, 0x20, 0x9, "", [{{0x9, 0x4, 0x0, 0x75, 0x1, 0x7, 0x1, 0x2, 0xff, "", {{{0x9, 0x5, 0x1, 0x2, 0x3bf, 0xb, 0x81, 0x90}}, [{{0x9, 0x5, 0x82, 0x2, 0x20, 0xfb, 0x5, 0x40}}]}}}]}}]}}, &(0x7f0000000480)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x200, 0x5, 0x2, 0x2, 0x20, 0x7f}, 0x14b, &(0x7f0000000100)={0x5, 0xf, 0x14b, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x6, 0x7, 0x4}, @generic={0x9d, 0x10, 0x1, "bdc809ac3784176a8cfdae5427572e0ecf3f516d86674c979fdccfbd227837ada58e5cb39cd3352a9fcbb6e6b6856df6ab859db198a23058c312bfdfc9bea2f762195d1485566a22c925e3f7420b090645bd40e210966f6e085c08eb767b0422e2e9fe5b66762e12035f912b8790c5594022f49308fc5bc6d6b301ccc5b0658724e62cfce5e51011d03ea510bd70f86e059bc0211f87a9f14ce9"}, @generic={0x9f, 0x10, 0xd, "06260d774df45aa507858356c3e1d78603d87834b8fd8a81b868546914b03efcb09bc1a4acc40a846f5b3ffd9ec699e5f15a3ed0f16fe5db5fc3b344e69192469c01414dd769d5a1752598c6a9245186ea471cf1df2ab9f872fb0e72ac3606ee20bb3578233a8f18a0c7dd5a857e268ac33ee0db4cf5940d1566ecffa692f472e957a65a8a917e702c1f2e8d0f2bdcd306a75b64e0e8add36c9e7c0f"}]}, 0x2, [{0xff, &(0x7f0000000280)=@string={0xff, 0x3, "29a21ec391a59d5d84e57c2d81b3dbdb09c95a3fac280a9713489779c62af599990b8f9ca5dd40e99335ab5ec9e20d54f1d29d70f406b56b0378fb2e28d76aa167cc1d54b0deff5d17568ce0a69bb5d6456e1c5b5ac8bf5e82dbd3becd229f6c1f76f118c36fa0ea8dbadd46ff44c8583b2d58e6fac4885ca35d9d0e0efc9050a1b0c9ac2d1f075dd55cb44c44ea971bda4c4e6dcccd599facdc57d758b3b1faf01d8b2f532b9eb69530cbaf1c9d67c0214865888bbd233dcc91917baf1e8a16ce2da87addede98a510de60519f2f0f5fab05b364c8c411e72a637607c73bef2655b0264257b09b33a8ce71ed0ee2e8be14b13a664ac11f73f405286e9"}}, {0xd0, &(0x7f0000000380)=@string={0xd0, 0x3, "818caee0cf7c985f5976a118713d2a196026352d1da24bb1ab3cab3c51f32c498f30a6d64b04d95536c0ce266cb8524d36dec4c644a8f6cf49ba19557467ab058974cec9b819754bcd369d268af1c7b6ed2288767904e3555a6296e7ec59f6b955058cca6325c849f857d7e1b00c9dc785ed202bc6cf3116154aa29f4067bceb442ab4acd0778929680d039632e2bc4c8796d9befe5ead6d93ccadba4a85583df9d3f75e18b7a9a15dfcac2871a5a208b33b8519320eb94c8f548eea09a48ecd989659e230c4a8c1235473523522"}}]}) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000004c0)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x80000000, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) write$FUSE_INIT(r1, &(0x7f0000000200)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x0, 0x4008, 0x7, 0x7, 0x80000001, 0x1, 0x0, 0x0, 0x100, 0x3}}, 0x50) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000020c0)={0x44, r3, 0x1, 0x300, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_LEVEL={0x24, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8}]}]}, 0x44}}, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg(r5, &(0x7f0000000540)=[{{&(0x7f00000000c0)=@l2tp6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1d}, 0x8, 0x1}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)="c0f162cb25", 0x5}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0xc, 0x84, 0x6}], 0xc}}], 0x2, 0xc88c5) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r7 = dup3(r6, r4, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r8, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r8, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) write$FUSE_NOTIFY_RESEND(r7, &(0x7f0000000300)={0x14}, 0x14) connect$inet(r8, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r8, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r8, 0x0, 0x19, &(0x7f0000000180)=0x1f5, 0x4) recvmmsg(r8, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r9, 0x0) ppoll(&(0x7f0000000140)=[{r9, 0x2082}], 0x1, &(0x7f0000000240), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) 2.203685204s ago: executing program 3 (id=6554): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) write$dsp(r0, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x3000) acct(&(0x7f0000000040)='./cgroup.cpu/cgroup.procs\x00') 1.206988984s ago: executing program 1 (id=6558): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)={0x2, 0x6, 0x0, 0x0, 0x10, 0x0, 0x70bd28, 0x25dfdbfb, [@sadb_x_kmaddress={0x7, 0x19, 0x0, @in6={0xa, 0x4e22, 0xff, @private1={0xfc, 0x1, '\x00', 0x1}, 0xb}, @in={0x2, 0x4e24, @local}}, @sadb_ident={0x2, 0xa, 0xec, 0x0, 0xfffffffffffeffff}, @sadb_address={0x5, 0x0, 0x33, 0x80, 0x0, @in6={0xa, 0x4e24, 0xc0f9, @private0={0xfc, 0x0, '\x00', 0x1}, 0x4}}]}, 0x80}}, 0x80000) r2 = syz_io_uring_setup(0x3ff1, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x3de}, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000000)) io_uring_register$IORING_UNREGISTER_FILES(r2, 0x3, 0x2000000, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc7539(xts(serpent),crc32c-generic))\x00'}, 0x58) r3 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000080)='K', 0x1}], 0x1}}], 0x1, 0x44954) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r5 = socket(0x40000000015, 0x5, 0x0) connect$inet(r5, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) bind$inet(r5, &(0x7f0000000340)={0x2, 0x4, @loopback}, 0x10) setsockopt$SO_TIMESTAMP(r5, 0x1, 0x3f, &(0x7f0000000100)=0x5, 0x4) sendto$inet(r5, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r5, &(0x7f0000000d80), 0x36f, 0x20102, 0x0) r6 = socket$key(0xf, 0x3, 0x2) ioctl$sock_inet_SIOCGIFPFLAGS(r6, 0x8935, &(0x7f0000000180)={'vlan0\x00'}) ioctl$sock_SIOCGSKNS(r4, 0x894c, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r7, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) 893.945161ms ago: executing program 1 (id=6559): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000080)={0xfffa, [0xa587, 0xfffffffc]}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) (fail_nth: 9) connect$inet(0xffffffffffffffff, 0x0, 0x0) 713.57996ms ago: executing program 2 (id=6562): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) syslog(0x4, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000300)=[@increfs], 0x0, 0x0, 0x0}) ppoll(&(0x7f0000000040)=[{r1, 0x200}], 0x1, 0x0, 0x0, 0x0) r2 = openat$cdrom(0xffffffffffffff9c, &(0x7f00000017c0), 0xc0040, 0x0) ioctl$CDROM_SET_OPTIONS(r2, 0x5320, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x20, 0x0, &(0x7f0000000000)=[@request_death, @clear_death], 0xfc, 0x1000000, 0x0}) 713.224291ms ago: executing program 1 (id=6563): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000440)={0x38, r1, 0x1, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0x10, 0x70, [@NL80211_MESH_SETUP_AUTH_PROTOCOL={0x5}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004014}, 0x20000004) (fail_nth: 9) 552.840812ms ago: executing program 1 (id=6565): socket$inet6(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x51358383aa900f90) r0 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x40042) write$binfmt_aout(r0, 0x0, 0x125) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f000000b1c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000400)={0x50, 0x0, r4, {0x7, 0x2b, 0x10, 0x1c20040, 0x0, 0x0, 0xc0000000, 0x1, 0x0, 0x0, 0x100}}, 0x50) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0xfffffffffffffff5, 0xffffffedffffffff, {0x0, 0x0, 0x0, 0x100000006, 0x80002, 0x5, {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x8, 0x0, 0x6000, 0xd, r5, 0x0, 0x800000}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x3, {0x5, 0x0, 0xd04, 0xfffffffffffffffc, 0x0, 0x100000, {0x0, 0x8, 0xfffffffffffffffd, 0x3, 0x0, 0x0, 0x4, 0x4, 0x4, 0x2000, 0x101, r5, r6, 0xf0ee, 0xb}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) open(&(0x7f00000001c0)='./file0/file0\x00', 0x1802, 0x40) close_range(r2, 0xffffffffffffffff, 0x0) 549.419996ms ago: executing program 3 (id=6566): r0 = socket(0x2b, 0x80801, 0x1) add_key(&(0x7f0000000000)='ceph\x00', 0x0, &(0x7f00000002c0)="1d", 0x1, 0xfffffffffffffffe) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4, 0x2010000, @empty, 0x2}, 0x1c) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', &(0x7f00000001c0)='./file0\x00') rename(&(0x7f0000000580)='./file0\x00', &(0x7f0000000780)='./file2\x00') symlinkat(&(0x7f0000000080)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000000c0)) 537.474192ms ago: executing program 0 (id=6567): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r1, 0x0, 0xf, 0x0, &(0x7f0000000240)="6ebca58ce6ffffffffc9252388f74c", 0x0, 0x40002, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_change_link_key_complete={{0x9, 0x3}, {0x9, 0xc9}}}, 0x6) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) 400.293489ms ago: executing program 3 (id=6568): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000280)=0x11d01b99187acfe2) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000140)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f00000001c0)={{@host}, @host, 0x0, 0x6, 0x244c, 0xffffffffffffffff, 0x101, 0x0, 0xfffffffc}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'veth0_vlan\x00', 0x0}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000000)) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f0000000040)={@private2, r2}, 0x14) 399.328339ms ago: executing program 1 (id=6569): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000100)={0x2, 0x4e1d, @dev={0xac, 0x14, 0x14, 0x42}}, 0x67) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='htcp', 0x4) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_CMAP(r2, 0x4b71, &(0x7f00000000c0)={0x8, 0xa6, 0x2, 0x9, 0x3, 0xead}) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x50, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}]}]}, 0x50}}, 0x4000000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000070000000900010073797a300000000084000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff00080003400000000838001180090001006c61737400000000280002800c00024000000000000000090800014000000ba308000140000010000800014000003f5e980000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000006c0003806800008008000340000000025c0002800c00028008000340000000024c0002"], 0x164}, 0x1, 0x0, 0x0, 0x4000819}, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b0400000000000000000200fffe4c0004802800018007000100637400001c0002800800014000000002080002400000000e0500030000000000200001800700010063740000140002800800024000000003080004400000000c0900010073797a30000000000900020073797a320000000014000000110001"], 0xa0}, 0x1, 0x0, 0x0, 0x840}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaad8be17d192210800458e00280064000007069078ac1414bbac1414bb4e224e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="cdad9311736f6169"], 0x0) syz_emit_ethernet(0x36, &(0x7f0000001180)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x3, 0x28, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x6071, 0x0, 0xe7}}}}}}, 0x0) 398.9893ms ago: executing program 3 (id=6570): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000100)={0x2, 0x4e1d, @dev={0xac, 0x14, 0x14, 0x42}}, 0x67) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='htcp', 0x4) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_CMAP(r2, 0x4b71, &(0x7f00000000c0)={0x8, 0xa6, 0x2, 0x9, 0x3, 0xead}) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x50, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}]}]}, 0x50}}, 0x4000000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000070000000900010073797a300000000084000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff00080003400000000838001180090001006c61737400000000280002800c00024000000000000000090800014000000ba308000140000010000800014000003f5e980000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000006c0003806800008008000340000000025c0002800c00028008000340000000024c0002"], 0x164}, 0x1, 0x0, 0x0, 0x4000819}, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b0400000000000000000200fffe4c0004802800018007000100637400001c0002800800014000000002080002400000000e0500030000000000200001800700010063740000140002800800024000000003080004400000000c0900010073797a30000000000900020073797a320000000014000000110001"], 0xa0}, 0x1, 0x0, 0x0, 0x840}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaad8be17d192210800458e00280064000007069078ac1414bbac1414bb4e224e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="cdad9311736f6169"], 0x0) syz_emit_ethernet(0x36, &(0x7f0000001180)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x3, 0x28, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x6071, 0x0, 0xe7}}}}}}, 0x0) 396.97875ms ago: executing program 0 (id=6571): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x1, 0x8000}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'ip6tnl0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000180)="0b032200e0ff25110200475400f6a13bb10000a8884788004803", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r2}, 0x14) 351.831696ms ago: executing program 0 (id=6572): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[], 0x1c}], 0x1, 0x0, 0x0, 0xffff0000}, 0x0) 347.598664ms ago: executing program 3 (id=6573): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000080), 0x4) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0186405, &(0x7f0000000340)={0x7f, 0x90b, {0xffffffffffffffff}, {0xee01}, 0x6, 0xffffffff}) prlimit64(r1, 0x6, &(0x7f0000000380)={0xc2, 0x7}, &(0x7f00000003c0)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x7a) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x2, 0x0, &(0x7f0000000480)='\a\x00', 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x4c) write$binfmt_elf32(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c46000000000000000000000000030006000000000000000000380000000000000000191bda0000200001000000000280000000000003"], 0x69) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0x13, &(0x7f0000000ec0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000fe1f702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000017000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000b00)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r3, 0x0, 0xe, 0x53, &(0x7f00000002c0)="e0b9545dd30a2131677b2d0bfa91", 0x0, 0x27cb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffe}, 0x50) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@bridge_getneigh={0x20, 0x1e, 0x1, 0x70bd2d, 0x25dfdbfc, {0x7, 0x0, 0x0, 0x0, 0x10923}}, 0x20}}, 0x4004) execve(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r5, 0x84, 0x19, &(0x7f0000000a40)={0x0, 0xd}, 0x8) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @broadcast}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@ipv4_deladdr={0x17, 0x15, 0x1, 0x70bd2c, 0x25dfdbfc, {0x2, 0x38, 0x0, 0xff}, [@IFA_LABEL={0x14, 0x3, 'gre0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x7, 0x10}, 0xc) mount(&(0x7f0000000300)=@sg0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000740)='esdfs\x00', 0x880000, &(0x7f0000000a00)='\x00') bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000008c0)={r3, &(0x7f0000000640)="8344528b9faba10a690cca7ed140768bb4b2f8ba41ed4eb87d49f2d4d637cb18268743ad6184506267a2176ff17e6f12884d464c20756aba026c2c10d473e6ba653d9682eb3ff0fd80e2f583f52be4bb83337c71ac5d1f4891f98a6a4eec157de5192a79a9bb517f802738acc38c2cd07efc2d3afa21357c52c33c5326f0ebc2eef6a00a4a913fd81f5df91b0b583812fd05535a0862c4e9d4a44c7e6a57e2a52e56c96cf2d1f7c548c8eee72eff07ffb5fc0d7c22a57b544271a96219e78d14edca0b5a120ab8a64f98a24737e51a69d11b0f743215452c909a7a4bf73e74298cee829ca5f02467a9c90e", &(0x7f0000000840)=@buf="51545a8dc5fe65418a4315ad987d9cd87e39289485bbe39d3c5fd299f52b6bbc046f3a6282690fe09783de9575134f6a2422773349a54340ee63a0f0fb1adda2709865f5ff6827b3569a8269f3914610eb3df3d5307f40baa0102e1116ce5c1278ce5d", 0x2}, 0x1c) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1100000004000000040000000200000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000e7a6e899624604be37b70c905b9703e121afd13544f29430b973c63ab06ed681a62a712fd1360d1c59fe2087b61cfb3b50e41b3f28ac77f8bf971df277969d6710abad298db35cccc42d71dbac8aabb500a67d23a56afa9ca13cc622a78a07f3545d298e9d55ba016060c723c82ab97cca535b36fdf964a0737c8595f21d1752da3967b8e6f5e6b6f2828b9ecd98", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000003000000000000000600000085000000500000d8d5db8d00", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000820000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b70400000000000085000000330000009500000000000000"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r8, 0x2000012, 0xe, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) sendto$inet(r0, &(0x7f00000000c0)='}', 0x1, 0x60040850, &(0x7f00000001c0)={0x2, 0x4e23, @local}, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r3) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000e40)=@broute={'broute\x00', 0x20, 0x2, 0x228, [0x0, 0x0, 0x0, 0x0, 0x0, 0x80000c00], 0x0, &(0x7f0000000a80), &(0x7f0000000c00)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{0x5, 0x1, 0x8884, 'macvlan1\x00', 'ipvlan1\x00', 'gretap0\x00', 'batadv0\x00', @empty, [0x0, 0xff, 0x0, 0xff], @remote, [0x0, 0x0, 0x0, 0xff, 0x0, 0xff], 0x6e, 0x6e, 0xb6, [], [], @common=@log={'log\x00', 0x24, {{0xaf, "e9bc2553fc46c15388a27b8d94a81a24cefddee30d286690180b6a19b3ba", 0x2}}}}, {0xb254d1fb094add45, 0x52, 0x7, 'xfrm0\x00', 'vlan1\x00', 'batadv0\x00', 'rose0\x00', @random="a685cdaeead7", [0x0, 0x0, 0x0, 0xff], @local, [0xff, 0xff, 0x75df7359ecacec73, 0x0, 0xff], 0x6e, 0x96, 0xe2, [], [@common=@AUDIT={'AUDIT\x00', 0x4, {{0x1}}}], @common=@LED={'LED\x00', 0x28, {{'syz1\x00', 0x0, 0x3ff, {0x7fff}}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff}, {0x0, '\x00', 0x2, 0xfffffffffffffffc}]}, 0x278) sendmsg$NL80211_CMD_GET_STATION(r3, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="000829bd7000fbdbdf251100000006000300021600bd0002000500fdfffffff0850c002800b80702000000"], 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x400400c3) 345.431035ms ago: executing program 1 (id=6574): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x4) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_PIT(r0, 0x8048ae66, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000200)={[0x67a, 0x5, 0x4, 0x0, 0x1000, 0x2, 0x4002004c4, 0x1000, 0x0, 0x3, 0x10, 0x3, 0x2, 0x4, 0x63, 0x1ac], 0xeeee0000, 0x400}) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r5, 0x84, 0x83, 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x2, 0xc5fb, @value=0x3}) r6 = add_key$user(&(0x7f0000000000), &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135a56412a20d4363f5df408fc6441639e75c7470bb11f031bf8ed23da02f7a291fcc59c4382ecb", 0x41, 0xfffffffffffffffe) r7 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r6, r7, r7}, &(0x7f0000000540)=""/72, 0x48, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000500)={0xa, 0x4e20, 0x8bb6, @ipv4={'\x00', '\xff\xff', @local}, 0x3}, 0x1c) connect$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) setsockopt$inet6_buf(r8, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) 207.205696ms ago: executing program 0 (id=6575): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000140)={@local}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f0000000040)={&(0x7f0000000280)={{@local}, {@local}, 0x400, "787c2ce2fba15d4e9f8e96bc11e2ca247a20c3e26661b174fe1825253be9e8480cb4f3524914f59ba189c1429727ef39b4164f93bb821987b3b7f73495bc8e745304668e0e46798c7f5917ea8428d41cab5612336f04000000000000008e9c1c86a394feb64fb06f77dadbcb20fc62741432b7dca37007d68e98fe46135d6a1c5ed42102f58daa5211319db84aa9abac734be47c908dc3ffa3aa7b61ec16d3d1209fc618f6c4532ea582628502ac46d167db6d53d8f3184df68414e6b6ec0109664c570e155654e03d58dadd0e5a7bab42bbb4a9afdefc115eb1609e7b50dbd94b94ba09000000000000001c9e4a41d3e16af21d6c897a1121bc14de16e78d6d7f2ae79db44e302539fd926e0b91e0fc589e2fa19b218d0508b5ce3ad40d03936693ca5aa41ddc07cf492874569ab037e0530e38245b98131ae0c9afd871df5f51331938764f5a7dd96890edd467b2fbc335ed081729b5ea722a98b34d0dac6de995de4ee263c81b2567b3f87e0897857edd5d7e97d61fc67076eab4846010d4828cc879f95cddb69ff6438f2a109285c46d8224c36069d30c3c9cf4a6800ae224111136bd9c1e06c4bfc4685d7bb6a72345772b3ce9bf105490743dc4b700f24ce6b250b95e6c383fe44acaa55d140baf0ec339e3815b29a2246cb5c953048c43266485bbd9d0caecf00e9501a4433b54930cba54e06607ada2f5d818e4804294fcf53058e58e0d33d4aa6dc943811056908fe9116e65cdddac1d2fb24d1eacee389af38b7e5a7056d0de50c6b49fb38388cf28c2d6dd3dbbab84ffbef4b0c02a77f018e8a9749a557909e6aa96185d268dad7744b094d8c6134b8defe26674d65f908f9c3a8c201f661fc26efe0eff248d3a473fe32a5b3643bfad8f186c2af3fbaa1d38560c1244c79a0e48893eefb792af281650f34f6c2d9a6c622aba234b63586713cb66179a0897d98ee5228569c32c1a682807c8db7eb197ccbbd6549db86a6a9aebbf5dc14060f22e2b07d6166f43c25ae0c88be7a4dc38e7ed08972a355b0e5d6fc43b8e5594fa6b36a36a44bb94b75eaff11dc17105f54beda54da2a1ea1acfab354745057dd2e7725f2c8450b19fdf37e19f6ce43449e9191f5a5beb4a1bc176f6130052e83acefd8ff18d592bb75f15f86c9113e4bd67ad420c33ae706cdc10060277b83ef30a50d4ac19c9a791b309377aa20a4743bbb799abc3ba58071b628c9ba8103bbfe389939e55296ec9b4f8d3a03aff30ce9aa0dd6e5158a672be8f3da8349ed4ad82f6ca67ee29e8b234840cf7846e604e5b8135abd94d71fe0a79180e75d4e193ea8df466c087b660fe984943751a9f6df8545699701d478c2b3daa949155770e74835bcd972de27afd20b02ce0e504c15b0237437200"}, 0x418, 0x7fffffff}) ioctl$IOCTL_VMCI_DATAGRAM_RECEIVE(r0, 0x7ac, &(0x7f0000000000)={0x0, 0x418, 0xe5bb}) (fail_nth: 5) 206.673572ms ago: executing program 3 (id=6576): socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000300)=0x5, 0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0xe000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x38, 0xfff, 0x3fffc, 0x180, 0x2, 0x14, 0xf5, 0x2, 0x1000, 0x5, 0x81, 0x81, 0xfffffffffffffffd, 0x45, 0xfffffffffffffffd, 0xbdb], 0xdddd0000, 0x1c4217}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) keyctl$read(0xb, r5, &(0x7f0000000000)=""/107, 0x6b) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x3, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) pread64(r0, &(0x7f0000000340)=""/112, 0x70, 0x3) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) 206.443282ms ago: executing program 0 (id=6577): socket$inet6(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x51358383aa900f90) r0 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x40042) write$binfmt_aout(r0, 0x0, 0x125) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f000000b1c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000400)={0x50, 0x0, r4, {0x7, 0x2b, 0x10, 0x1c20040, 0x0, 0x0, 0xc0000000, 0x1, 0x0, 0x0, 0x100}}, 0x50) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0xfffffffffffffff5, 0xffffffedffffffff, {0x0, 0x0, 0x0, 0x100000006, 0x80002, 0x5, {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x8, 0x0, 0x6000, 0xd, r5, 0x0, 0x800000}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x3, {0x5, 0x0, 0xd04, 0xfffffffffffffffc, 0x0, 0x100000, {0x0, 0x8, 0xfffffffffffffffd, 0x3, 0x0, 0x0, 0x4, 0x4, 0x4, 0x2000, 0x101, r5, r6, 0xf0ee, 0xb}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) open(&(0x7f00000001c0)='./file0/file0\x00', 0x1802, 0x40) close_range(r2, 0xffffffffffffffff, 0x0) 0s ago: executing program 0 (id=6578): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) (async) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket(0x40000000015, 0x5, 0x0) (async) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) (async) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) (async) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x103ff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file0'}}]}) r3 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x2) getdents64(r3, &(0x7f0000000140)=""/46, 0x2e) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000000)='\x00', 0x0, r2) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000040)=0x4) (async) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000140)=@x86={0x7, 0xc, 0xc5, 0x0, 0x6, 0x9, 0x4, 0x6, 0x1, 0xf8, 0x0, 0x1, 0x0, 0x3, 0x400439, 0x6, 0x9, 0x4, 0x8, '\x00', 0x4, 0x4}) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) recvmmsg(r0, &(0x7f0000000e00)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x20010020, 0x0) r5 = gettid() ptrace$ARCH_MAP_VDSO_64(0x1e, r5, 0x31, 0x2003) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, 0x0) (async) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(0xffffffffffffffff, 0x3ba0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) (async) bind$inet(0xffffffffffffffff, 0x0, 0x0) kernel console output (not intermixed with test programs): 27205] RDX: 0000000000000042 RSI: 0000000000000000 RDI: 0000000000000000 [ 1081.250285][T27205] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1081.250294][T27205] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1081.250303][T27205] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1081.250323][T27205] [ 1081.250374][T27205] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1081.561779][T27207] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6181'. [ 1081.773751][T27214] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6184'. [ 1081.851545][T27178] Set syz1 is full, maxelem 65536 reached [ 1081.855213][T27211] wg2 speed is unknown, defaulting to 1000 [ 1082.151802][T22524] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 1082.867476][T27227] netlink: 'syz.0.6189': attribute type 1 has an invalid length. [ 1082.932366][T27227] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1082.939581][T27231] vlan0: entered allmulticast mode [ 1082.941463][T27231] bond3: entered allmulticast mode [ 1083.019025][T22524] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 1083.031111][T22524] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1083.035420][T22524] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1083.040716][T22524] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1083.044121][T27227] bond3: (slave geneve3): making interface the new active one [ 1083.047643][T27227] geneve3: entered allmulticast mode [ 1083.049744][T22524] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1083.052721][T22524] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1083.058618][T22524] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1083.060777][T27227] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 1083.064288][ T5893] usb 8-1: new high-speed USB device number 41 using dummy_hcd [ 1083.065602][T22524] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1083.070594][T22524] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1083.071064][ T9443] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1083.074276][T22524] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1083.094802][T22524] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1083.098204][T22524] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1083.100015][ T9443] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1083.102709][T22524] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1083.117899][T22524] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1083.121739][T22524] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1083.125176][ T9443] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1083.126868][T22524] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1083.138631][T22524] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1083.142319][T22524] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1083.146791][T22524] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1083.150013][ T9443] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1083.151044][T22524] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1083.160364][T22524] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1083.166314][T22524] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1083.173936][T22524] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1083.177620][T22524] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1083.181919][T22524] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1083.187879][T22524] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1083.191738][T22524] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1083.196063][T22524] usb 6-1: Product: syz [ 1083.197829][T22524] usb 6-1: Manufacturer: syz [ 1083.200034][T22524] usb 6-1: SerialNumber: syz [ 1083.204379][T22524] usb 6-1: config 0 descriptor?? [ 1083.212467][T22524] yurex 6-1:0.0: USB YUREX device now attached to Yurex #0 [ 1083.244321][ T5893] usb 8-1: Using ep0 maxpacket: 32 [ 1083.245719][T27224] wg2 speed is unknown, defaulting to 1000 [ 1083.299974][T27233] ceph: No mds server is up or the cluster is laggy [ 1083.302158][T22524] libceph: connect (1)[c::]:6789 error -101 [ 1083.304574][T22524] libceph: mon0 (1)[c::]:6789 connect error [ 1083.433458][ T6041] usb 6-1: USB disconnect, device number 113 [ 1083.453079][ T6041] yurex 6-1:0.0: USB YUREX #0 now disconnected [ 1083.511414][ T42] audit: type=1326 audit(1784173804.407:940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27248 comm="syz.0.6194" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 1084.708249][T27258] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6197'. [ 1085.202656][T27271] netlink: 'syz.1.6202': attribute type 1 has an invalid length. [ 1085.411551][T27281] fuse: fd is not a fuse device [ 1085.527428][T22790] Bluetooth: hci3: unexpected event for opcode 0x0c0d [ 1086.113329][ T5893] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1086.117681][ T5893] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 1086.120457][ T5893] usb 8-1: can't read configurations, error -71 [ 1086.185263][T27270] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6200'. [ 1086.331775][T27295] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6210'. [ 1086.335856][T27295] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6210'. [ 1086.470172][T27298] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6211'. [ 1086.594757][T27304] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 1086.745738][T27289] wg2 speed is unknown, defaulting to 1000 [ 1086.920296][T27296] wg2 speed is unknown, defaulting to 1000 [ 1087.371190][T22790] Bluetooth: hci3: unexpected event for opcode 0x0c0d [ 1087.422686][T27320] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6216'. [ 1087.976782][T27321] wg2 speed is unknown, defaulting to 1000 [ 1088.270153][T27350] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1088.273705][T27338] wg2 speed is unknown, defaulting to 1000 [ 1088.483149][T27355] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6224'. [ 1088.914783][T27354] wg2 speed is unknown, defaulting to 1000 [ 1088.963868][T27359] gretap1: entered allmulticast mode [ 1088.974505][T27359] team0: Port device gretap1 added [ 1089.012534][T27359] bridge0: port 4(team0) entered blocking state [ 1089.019531][T27359] bridge0: port 4(team0) entered disabled state [ 1089.027325][T27359] team0: entered allmulticast mode [ 1089.037458][T27359] team_slave_0: entered allmulticast mode [ 1089.048962][T27359] team_slave_1: entered allmulticast mode [ 1089.077812][T27359] team0: entered promiscuous mode [ 1089.081395][T27359] team_slave_0: entered promiscuous mode [ 1089.093011][T27359] team_slave_1: entered promiscuous mode [ 1089.105417][T27359] gretap1: entered promiscuous mode [ 1089.369989][T27372] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6228'. [ 1089.650745][T22790] Bluetooth: hci3: unexpected event for opcode 0x0c0d [ 1089.787716][T27383] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6230'. [ 1090.250925][T27372] wg2 speed is unknown, defaulting to 1000 [ 1090.865395][T27385] wg2 speed is unknown, defaulting to 1000 [ 1091.782436][T27410] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6236'. [ 1091.801745][T27410] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6236'. [ 1091.817938][T27410] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6236'. [ 1091.826730][T27410] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6236'. [ 1091.831709][T27410] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6236'. [ 1091.894301][T27412] 9p: Bad value for 'rfdno' [ 1092.164356][T21761] usb 7-1: new high-speed USB device number 111 using dummy_hcd [ 1092.326199][T21761] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1092.329917][T21761] usb 7-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 1092.337626][T21761] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1092.346316][T21761] usb 7-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1092.356862][T21761] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1092.364280][T21761] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1092.373233][T21761] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1092.376668][T21761] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1092.380011][T21761] usb 7-1: Product: syz [ 1092.381922][T21761] usb 7-1: Manufacturer: syz [ 1092.387919][T27414] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1092.392671][T21761] cdc_wdm 7-1:1.0: skipping garbage [ 1092.395648][T21761] cdc_wdm 7-1:1.0: skipping garbage [ 1092.399588][T21761] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 1092.402266][T21761] cdc_wdm 7-1:1.0: Unknown control protocol [ 1092.731660][T22790] Bluetooth: hci2: unexpected event for opcode 0x0c0d [ 1092.753137][T27428] FAULT_INJECTION: forcing a failure. [ 1092.753137][T27428] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1092.758741][T27428] CPU: 3 UID: 0 PID: 27428 Comm: syz.1.6243 Tainted: G L syzkaller #0 PREEMPT(full) [ 1092.758771][T27428] Tainted: [L]=SOFTLOCKUP [ 1092.758778][T27428] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1092.758789][T27428] Call Trace: [ 1092.758797][T27428] [ 1092.758805][T27428] dump_stack_lvl+0x100/0x190 [ 1092.758833][T27428] should_fail_ex.cold+0x5/0xa [ 1092.758855][T27428] _copy_from_iter+0x1f4/0x1690 [ 1092.758883][T27428] ? __asan_memset+0x23/0x50 [ 1092.758903][T27428] ? __pfx__copy_from_iter+0x10/0x10 [ 1092.758926][T27428] ? __pfx___alloc_skb+0x10/0x10 [ 1092.758959][T27428] netlink_sendmsg+0x808/0xda0 [ 1092.758990][T27428] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1092.759020][T27428] ? apparmor_socket_sendmsg+0x15b/0x270 [ 1092.759052][T27428] ____sys_sendmsg+0xa4d/0xbe0 [ 1092.759080][T27428] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1092.759108][T27428] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1092.759146][T27428] ___sys_sendmsg+0x190/0x1e0 [ 1092.759175][T27428] ? __pfx____sys_sendmsg+0x10/0x10 [ 1092.759214][T27428] ? find_held_lock+0x2b/0x80 [ 1092.759253][T27428] __sys_sendmsg+0x160/0x210 [ 1092.759275][T27428] ? __pfx___sys_sendmsg+0x10/0x10 [ 1092.759304][T27428] ? __pfx_ksys_write+0x10/0x10 [ 1092.759344][T27428] __do_fast_syscall_32+0xe7/0x970 [ 1092.759365][T27428] ? lockdep_hardirqs_on+0x78/0x100 [ 1092.759394][T27428] do_fast_syscall_32+0x32/0x70 [ 1092.759412][T27428] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1092.759436][T27428] RIP: 0023:0xf7f86fec [ 1092.759461][T27428] Code: Unable to access opcode bytes at 0xf7f86fc2. [ 1092.759470][T27428] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1092.759488][T27428] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 1092.759500][T27428] RDX: 0000000004000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1092.759511][T27428] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1092.759521][T27428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1092.759532][T27428] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1092.759556][T27428] [ 1092.762872][T27426] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6242'. [ 1093.061374][T27438] wg2 speed is unknown, defaulting to 1000 [ 1093.355252][T27441] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 1093.455471][T27452] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1093.520414][T27452] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1093.581185][T27458] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1093.655276][T27460] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6252'. [ 1094.849369][T27486] CIFS mount error: No usable UNC path provided in device string! [ 1094.849369][T27486] [ 1094.867527][T27486] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1094.929200][T21761] usb 7-1: USB disconnect, device number 111 [ 1095.045751][T27493] syzkaller0: entered promiscuous mode [ 1095.047515][T27493] syzkaller0: entered allmulticast mode [ 1095.059420][T27493] FAULT_INJECTION: forcing a failure. [ 1095.059420][T27493] name failslab, interval 1, probability 0, space 0, times 0 [ 1095.074578][T27493] CPU: 0 UID: 0 PID: 27493 Comm: syz.2.6260 Tainted: G L syzkaller #0 PREEMPT(full) [ 1095.074600][T27493] Tainted: [L]=SOFTLOCKUP [ 1095.074604][T27493] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1095.074612][T27493] Call Trace: [ 1095.074616][T27493] [ 1095.074621][T27493] dump_stack_lvl+0x100/0x190 [ 1095.074640][T27493] should_fail_ex.cold+0x5/0xa [ 1095.074652][T27493] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1095.074671][T27493] should_failslab+0xc2/0x120 [ 1095.074687][T27493] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1095.074702][T27493] ? skb_clone+0x190/0x400 [ 1095.074718][T27493] skb_clone+0x190/0x400 [ 1095.074732][T27493] netlink_deliver_tap+0xaed/0xcc0 [ 1095.074753][T27493] netlink_unicast+0x62b/0x850 [ 1095.074772][T27493] ? __pfx_netlink_unicast+0x10/0x10 [ 1095.074794][T27493] netlink_sendmsg+0x8b0/0xda0 [ 1095.074814][T27493] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1095.074833][T27493] ? apparmor_socket_sendmsg+0x15b/0x270 [ 1095.074854][T27493] ____sys_sendmsg+0xa4d/0xbe0 [ 1095.074870][T27493] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1095.074890][T27493] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1095.074914][T27493] ___sys_sendmsg+0x190/0x1e0 [ 1095.074932][T27493] ? __pfx____sys_sendmsg+0x10/0x10 [ 1095.074956][T27493] ? find_held_lock+0x2b/0x80 [ 1095.074979][T27493] __sys_sendmsg+0x160/0x210 [ 1095.074993][T27493] ? __pfx___sys_sendmsg+0x10/0x10 [ 1095.075010][T27493] ? __pfx_ksys_write+0x10/0x10 [ 1095.075031][T27493] __do_fast_syscall_32+0xe7/0x970 [ 1095.075044][T27493] ? lockdep_hardirqs_on+0x78/0x100 [ 1095.075063][T27493] do_fast_syscall_32+0x32/0x70 [ 1095.075075][T27493] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1095.075091][T27493] RIP: 0023:0xf7f12fec [ 1095.075107][T27493] Code: Unable to access opcode bytes at 0xf7f12fc2. [ 1095.075113][T27493] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1095.075124][T27493] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080004bc0 [ 1095.075131][T27493] RDX: 0000000000044084 RSI: 0000000000000000 RDI: 0000000000000000 [ 1095.075138][T27493] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1095.075145][T27493] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1095.075151][T27493] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1095.075165][T27493] [ 1095.075215][T27493] team0: No ports can be present during mode change [ 1095.634225][ T5893] usb 7-1: new high-speed USB device number 112 using dummy_hcd [ 1095.774261][ T5749] usb 6-1: new low-speed USB device number 114 using dummy_hcd [ 1095.785307][ T5893] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 1095.790620][ T5893] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1095.794714][ T5893] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1095.799111][ T5893] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1095.803486][ T5893] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1095.807726][ T5893] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1095.812376][ T5893] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1095.817017][ T5893] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1095.820797][ T5893] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1095.825756][ T5893] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1095.830012][ T5893] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1095.833752][ T5893] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1095.840496][ T5893] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1095.846540][ T5893] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1095.850318][ T5893] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1095.854960][ T5893] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1095.859045][ T5893] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1095.862833][ T5893] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1095.867612][ T5893] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1095.871858][ T5893] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1095.875664][ T5893] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1095.880225][ T5893] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1095.884482][ T5893] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1095.888255][ T5893] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1095.892698][ T5893] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1095.898293][ T5893] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1095.902100][ T5893] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1095.905739][ T5893] usb 7-1: Product: syz [ 1095.907531][ T5893] usb 7-1: Manufacturer: syz [ 1095.909551][ T5893] usb 7-1: SerialNumber: syz [ 1095.913805][ T5893] usb 7-1: config 0 descriptor?? [ 1095.922822][ T5893] yurex 7-1:0.0: USB YUREX device now attached to Yurex #0 [ 1095.935612][ T5749] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1095.939032][ T5749] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1095.942298][ T5749] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 1095.946727][ T5749] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 1095.950327][ T5749] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1095.955749][T27500] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1095.960298][ T5749] hub 6-1:1.0: bad descriptor, ignoring hub [ 1095.962703][ T5749] hub 6-1:1.0: probe with driver hub failed with error -5 [ 1095.966882][ T5749] cdc_wdm 6-1:1.0: skipping garbage [ 1095.968587][ T5749] cdc_wdm 6-1:1.0: skipping garbage [ 1095.970297][ T5749] cdc_wdm 6-1:1.0: skipping garbage [ 1095.972722][ T5749] cdc_wdm 6-1:1.0: cdc-wdm1: USB WDM device [ 1095.975018][ T5749] cdc_wdm 6-1:1.0: Unknown control protocol [ 1096.045853][T27502] IPVS: Unknown mcast interface: /kvm [ 1096.118304][T27507] syzkaller0: entered promiscuous mode [ 1096.123565][T27507] syzkaller0: entered allmulticast mode [ 1096.145193][ T5749] usb 7-1: USB disconnect, device number 112 [ 1096.158293][ T5749] yurex 7-1:0.0: USB YUREX #0 now disconnected [ 1096.171812][T27507] FAULT_INJECTION: forcing a failure. [ 1096.171812][T27507] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1096.177562][T27507] CPU: 1 UID: 0 PID: 27507 Comm: syz.3.6265 Tainted: G L syzkaller #0 PREEMPT(full) [ 1096.177592][T27507] Tainted: [L]=SOFTLOCKUP [ 1096.177599][T27507] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1096.177610][T27507] Call Trace: [ 1096.177645][T27507] [ 1096.177654][T27507] dump_stack_lvl+0x100/0x190 [ 1096.177682][T27507] should_fail_ex.cold+0x5/0xa [ 1096.177703][T27507] _copy_from_iter+0x1f4/0x1690 [ 1096.177730][T27507] ? _copy_from_iter+0x270/0x1690 [ 1096.177754][T27507] ? __pfx__copy_from_iter+0x10/0x10 [ 1096.177781][T27507] ? __pfx__copy_from_iter+0x10/0x10 [ 1096.177804][T27507] ? _copy_from_iter+0x270/0x1690 [ 1096.177832][T27507] copy_page_from_iter+0x238/0x300 [ 1096.177860][T27507] skb_copy_datagram_from_iter+0x399/0x720 [ 1096.177897][T27507] packet_sendmsg+0x227e/0x5100 [ 1096.177934][T27507] ? aa_sk_perm+0x309/0xaa0 [ 1096.177958][T27507] ? __pfx_aa_sk_perm+0x10/0x10 [ 1096.177980][T27507] ? __pfx_packet_sendmsg+0x10/0x10 [ 1096.177997][T27507] ? __might_fault+0xc5/0x140 [ 1096.178023][T27507] ? apparmor_socket_sendmsg+0x15b/0x270 [ 1096.178054][T27507] __sys_sendto+0x48b/0x4e0 [ 1096.178071][T27507] ? __pfx_packet_sendmsg+0x10/0x10 [ 1096.178090][T27507] ? __pfx___sys_sendto+0x10/0x10 [ 1096.178126][T27507] ? fput+0x79/0x100 [ 1096.178146][T27507] ? ksys_write+0x1ac/0x250 [ 1096.178174][T27507] __ia32_sys_sendto+0xdd/0x1b0 [ 1096.178192][T27507] ? __do_fast_syscall_32+0x98/0x970 [ 1096.178212][T27507] ? lockdep_hardirqs_on+0x78/0x100 [ 1096.178239][T27507] __do_fast_syscall_32+0xe7/0x970 [ 1096.178262][T27507] ? lockdep_hardirqs_on+0x78/0x100 [ 1096.178290][T27507] do_fast_syscall_32+0x32/0x70 [ 1096.178309][T27507] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1096.178332][T27507] RIP: 0023:0xf7f57fec [ 1096.178356][T27507] Code: Unable to access opcode bytes at 0xf7f57fc2. [ 1096.178364][T27507] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 1096.178383][T27507] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 1096.178395][T27507] RDX: 000000000000fce0 RSI: 0000000000000004 RDI: 0000000080000140 [ 1096.178405][T27507] RBP: 0000000000000014 R08: 0000000000000000 R09: 0000000000000000 [ 1096.178416][T27507] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1096.178427][T27507] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1096.178451][T27507] [ 1096.274515][T22524] usb 6-1: USB disconnect, device number 114 [ 1096.560515][T27536] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6270'. [ 1096.624170][ T5749] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 1096.758012][T27542] binder: 27541:27542 ioctl c0306201 0 returned -14 [ 1096.774368][ T5749] usb 6-1: Using ep0 maxpacket: 8 [ 1096.779839][ T5749] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1096.786661][ T5749] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1096.792066][ T5749] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 1096.799684][ T5749] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 1096.806715][ T5749] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 1096.812625][ T5749] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1096.831780][ T5749] hub 6-1:1.0: bad descriptor, ignoring hub [ 1096.838481][ T5749] hub 6-1:1.0: probe with driver hub failed with error -5 [ 1096.844887][ T5749] cdc_wdm 6-1:1.0: skipping garbage [ 1096.855253][ T5749] cdc_wdm 6-1:1.0: skipping garbage [ 1096.857557][ T5749] cdc_wdm 6-1:1.0: skipping garbage [ 1096.865215][ T5749] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 1096.867884][ T5749] cdc_wdm 6-1:1.0: Unknown control protocol [ 1096.872253][T27546] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6274'. [ 1097.114174][ T5829] usb 7-1: new full-speed USB device number 113 using dummy_hcd [ 1097.267470][T27555] IPVS: set_ctl: invalid protocol: 59 172.20.20.170:20003 [ 1097.283608][ T5829] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1097.289654][ T5829] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1097.294397][T22790] Bluetooth: hci2: unexpected event for opcode 0x0c0d [ 1097.298722][ T5829] usb 7-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1097.302327][ T5829] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1097.307625][ T5829] usb 7-1: config 0 descriptor?? [ 1097.313366][ T5829] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1097.316075][ T5829] dvb-usb: bulk message failed: -22 (3/0) [ 1097.323252][ T5829] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1097.329158][ T5829] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1097.331980][ T5829] usb 7-1: media controller created [ 1097.335692][ T5829] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1097.343944][T27556] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6275'. [ 1097.344762][ T5829] dvb-usb: bulk message failed: -22 (6/0) [ 1097.357354][ T5829] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1097.366490][ T5829] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb7/7-1/input/input93 [ 1097.375799][ T5829] dvb-usb: schedule remote query interval to 150 msecs. [ 1097.378521][ T5829] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1097.415968][T14072] udevd[14072]: symlink '../event3' '/dev/input/by-path/platform-dummy_hcd.2-usb-0:1-event-ir.tmp-c13:67' failed: Read-only file system [ 1097.522267][T21761] usb 7-1: USB disconnect, device number 113 [ 1097.555833][T21761] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1097.664512][ T5829] usb 6-1: USB disconnect, device number 115 [ 1097.706460][T27565] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6278'. [ 1097.707769][T27559] wg2 speed is unknown, defaulting to 1000 [ 1098.194321][ T6041] usb 6-1: new high-speed USB device number 116 using dummy_hcd [ 1098.354237][ T6041] usb 6-1: Using ep0 maxpacket: 8 [ 1098.357946][ T6041] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 1098.360786][ T6041] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1098.365328][ T6041] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1098.369394][ T6041] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1098.373019][ T6041] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1098.377453][ T6041] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1098.380718][ T6041] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1098.604825][ T6041] usb 6-1: usb_control_msg returned -32 [ 1098.606249][T27586] fuse: fd is not a fuse device [ 1098.611324][ T6041] usbtmc 6-1:16.0: can't read capabilities [ 1098.835006][ T5893] usb 6-1: USB disconnect, device number 116 [ 1099.064209][T27591] tipc: Started in network mode [ 1099.065984][T27591] tipc: Node identity c6bea223609c, cluster identity 4711 [ 1099.068486][T27591] tipc: Enabled bearer , priority 0 [ 1099.071777][T27591] syzkaller0: entered promiscuous mode [ 1099.073637][T27591] syzkaller0: entered allmulticast mode [ 1099.097322][T27591] xt_TCPMSS: Only works on TCP SYN packets [ 1099.101921][T27591] cgroup: name respecified [ 1099.106363][T27591] tipc: Resetting bearer [ 1099.112107][T27590] tipc: Resetting bearer [ 1099.133756][T27590] tipc: Disabling bearer [ 1099.210421][T27593] tipc: Enabled bearer , priority 0 [ 1099.213788][T27593] syzkaller0: entered promiscuous mode [ 1099.216182][T27593] syzkaller0: entered allmulticast mode [ 1099.228238][T27593] syzkaller0: mtu less than device minimum [ 1099.231854][T27592] tipc: Resetting bearer [ 1099.257668][T27592] tipc: Disabling bearer [ 1099.343302][T22790] Bluetooth: hci2: unexpected event for opcode 0x0c0d [ 1099.383290][T27599] netlink: 'syz.2.6289': attribute type 3 has an invalid length. [ 1099.383414][T27597] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6288'. [ 1099.390006][T27599] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6289'. [ 1099.437811][T27586] orangefs_mount: mount request failed with -4 [ 1099.984455][T27601] wg2 speed is unknown, defaulting to 1000 [ 1100.071356][T27603] netlink: 'syz.0.6290': attribute type 11 has an invalid length. [ 1100.399131][T27610] syzkaller0: entered promiscuous mode [ 1100.401662][T27610] syzkaller0: entered allmulticast mode [ 1100.531847][T27616] syzkaller0: entered promiscuous mode [ 1100.541388][T27616] syzkaller0: entered allmulticast mode [ 1100.708408][T27625] 9p: Bad value for 'dfltgid' [ 1100.709942][T27625] 9p: Bad value for 'dfltgid' [ 1100.974547][T22595] usb 7-1: new high-speed USB device number 114 using dummy_hcd [ 1101.047248][T27638] syzkaller0: left promiscuous mode [ 1101.049639][T27638] syzkaller0: left allmulticast mode [ 1101.135982][T22595] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1101.141650][T22595] usb 7-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 1101.145463][T22595] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1101.150739][T22595] usb 7-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1101.155902][T22595] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1101.160131][T22595] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1101.167536][T22595] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1101.172201][T22595] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1101.176682][T22595] usb 7-1: Product: syz [ 1101.178608][T22595] usb 7-1: Manufacturer: syz [ 1101.189994][T27627] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1101.205895][T22595] cdc_wdm 7-1:1.0: skipping garbage [ 1101.209087][T22595] cdc_wdm 7-1:1.0: skipping garbage [ 1101.212372][T22595] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 1101.214630][T22595] cdc_wdm 7-1:1.0: Unknown control protocol [ 1101.578617][T27641] wg2 speed is unknown, defaulting to 1000 [ 1101.596941][T27627] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6298'. [ 1101.624414][T27644] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1101.627537][T27627] team0 (unregistering): Port device team_slave_0 removed [ 1101.640096][T27627] team0 (unregistering): Port device team_slave_1 removed [ 1101.669842][T27642] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1101.673716][T27642] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1101.811582][T22595] usb 7-1: USB disconnect, device number 114 [ 1101.935782][T27650] FAULT_INJECTION: forcing a failure. [ 1101.935782][T27650] name failslab, interval 1, probability 0, space 0, times 0 [ 1101.939878][T27650] CPU: 1 UID: 0 PID: 27650 Comm: syz.3.6305 Tainted: G L syzkaller #0 PREEMPT(full) [ 1101.939899][T27650] Tainted: [L]=SOFTLOCKUP [ 1101.939903][T27650] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1101.939911][T27650] Call Trace: [ 1101.939916][T27650] [ 1101.939922][T27650] dump_stack_lvl+0x100/0x190 [ 1101.939940][T27650] should_fail_ex.cold+0x5/0xa [ 1101.939956][T27650] should_failslab+0xc2/0x120 [ 1101.939972][T27650] __kmalloc_cache_node_noprof+0x94/0x6c0 [ 1101.939988][T27650] ? __get_vm_area_node+0x101/0x330 [ 1101.940006][T27650] __get_vm_area_node+0x101/0x330 [ 1101.940023][T27650] __vmalloc_node_range_noprof+0x228/0x1630 [ 1101.940040][T27650] ? bpf_check+0x1cc/0xb7d0 [ 1101.940057][T27650] ? rcu_is_watching+0x12/0xc0 [ 1101.940073][T27650] ? bpf_check+0x1cc/0xb7d0 [ 1101.940087][T27650] ? rcu_read_unlock+0x17/0x60 [ 1101.940104][T27650] ? rcu_read_unlock+0x17/0x60 [ 1101.940121][T27650] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1101.940137][T27650] ? rcu_is_watching+0x12/0xc0 [ 1101.940151][T27650] ? rcu_is_watching+0x12/0xc0 [ 1101.940163][T27650] ? __kmalloc_large_node_noprof+0x5d/0x70 [ 1101.940178][T27650] ? find_held_lock+0x2b/0x80 [ 1101.940194][T27650] ? bpf_check+0x1cc/0xb7d0 [ 1101.940207][T27650] __vmalloc_node_noprof+0xad/0xf0 [ 1101.940223][T27650] ? bpf_check+0x1cc/0xb7d0 [ 1101.940238][T27650] bpf_check+0x1cc/0xb7d0 [ 1101.940252][T27650] ? trace_contention_end+0x126/0x160 [ 1101.940272][T27650] ? __css_rstat_updated+0x1ce/0x5a0 [ 1101.940290][T27650] ? __pfx___css_rstat_updated+0x10/0x10 [ 1101.940311][T27650] ? __lock_acquire+0x49f/0x1a40 [ 1101.940328][T27650] ? __mod_memcg_state+0x12b/0x500 [ 1101.940340][T27650] ? __pfx_bpf_check+0x10/0x10 [ 1101.940359][T27650] ? find_held_lock+0x2b/0x80 [ 1101.940372][T27650] ? bpf_prog_load+0x1933/0x2fa0 [ 1101.940393][T27650] ? __asan_memset+0x23/0x50 [ 1101.940403][T27650] ? lsm_blob_alloc+0x2b/0x90 [ 1101.940422][T27650] ? bpf_prog_load+0x244d/0x2fa0 [ 1101.940440][T27650] bpf_prog_load+0x244d/0x2fa0 [ 1101.940461][T27650] ? __pfx_bpf_prog_load+0x10/0x10 [ 1101.940480][T27650] ? __lock_acquire+0x49f/0x1a40 [ 1101.940508][T27650] __sys_bpf+0x18dc/0x4e80 [ 1101.940524][T27650] ? __pfx___sys_bpf+0x10/0x10 [ 1101.940535][T27650] ? find_held_lock+0x2b/0x80 [ 1101.940548][T27650] ? get_pid_task+0xfc/0x250 [ 1101.940561][T27650] ? get_pid_task+0xfc/0x250 [ 1101.940578][T27650] ? proc_fail_nth_write+0x9f/0x220 [ 1101.940593][T27650] ? find_held_lock+0x2b/0x80 [ 1101.940608][T27650] ? rcu_read_lock_any_held+0x6a/0xa0 [ 1101.940623][T27650] ? find_held_lock+0x2b/0x80 [ 1101.940635][T27650] ? ksys_write+0x190/0x250 [ 1101.940652][T27650] ? ksys_write+0x190/0x250 [ 1101.940679][T27650] ? fput+0x79/0x100 [ 1101.940692][T27650] ? __ia32_sys_bpf+0xcc/0x170 [ 1101.940702][T27650] __ia32_sys_bpf+0xcc/0x170 [ 1101.940713][T27650] ? __do_fast_syscall_32+0x98/0x970 [ 1101.940728][T27650] __do_fast_syscall_32+0xe7/0x970 [ 1101.940739][T27650] ? lockdep_hardirqs_on+0x78/0x100 [ 1101.940771][T27650] do_fast_syscall_32+0x32/0x70 [ 1101.940783][T27650] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1101.940799][T27650] RIP: 0023:0xf7f57fec [ 1101.940815][T27650] Code: Unable to access opcode bytes at 0xf7f57fc2. [ 1101.940820][T27650] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1101.940831][T27650] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000640 [ 1101.940839][T27650] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 1101.940845][T27650] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1101.940858][T27650] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1101.940865][T27650] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1101.940880][T27650] [ 1101.940972][T27650] syz.3.6305: vmalloc error: size 2040, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1102.064284][T27650] CPU: 1 UID: 0 PID: 27650 Comm: syz.3.6305 Tainted: G L syzkaller #0 PREEMPT(full) [ 1102.064312][T27650] Tainted: [L]=SOFTLOCKUP [ 1102.064318][T27650] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1102.064329][T27650] Call Trace: [ 1102.064336][T27650] [ 1102.064343][T27650] dump_stack_lvl+0x100/0x190 [ 1102.064367][T27650] warn_alloc.cold+0x94/0xa8 [ 1102.064384][T27650] ? __pfx_warn_alloc+0x10/0x10 [ 1102.064400][T27650] ? __kasan_kmalloc+0x8a/0xb0 [ 1102.064429][T27650] ? __get_vm_area_node+0x208/0x330 [ 1102.064452][T27650] __vmalloc_node_range_noprof+0xccd/0x1630 [ 1102.064478][T27650] ? rcu_is_watching+0x12/0xc0 [ 1102.064500][T27650] ? bpf_check+0x1cc/0xb7d0 [ 1102.064523][T27650] ? rcu_read_unlock+0x17/0x60 [ 1102.064542][T27650] ? rcu_read_unlock+0x17/0x60 [ 1102.064568][T27650] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1102.064590][T27650] ? rcu_is_watching+0x12/0xc0 [ 1102.064609][T27650] ? rcu_is_watching+0x12/0xc0 [ 1102.064623][T27650] ? __kmalloc_large_node_noprof+0x5d/0x70 [ 1102.064645][T27650] ? find_held_lock+0x2b/0x80 [ 1102.064668][T27650] ? bpf_check+0x1cc/0xb7d0 [ 1102.064687][T27650] __vmalloc_node_noprof+0xad/0xf0 [ 1102.064706][T27650] ? bpf_check+0x1cc/0xb7d0 [ 1102.064728][T27650] bpf_check+0x1cc/0xb7d0 [ 1102.064747][T27650] ? trace_contention_end+0x126/0x160 [ 1102.064776][T27650] ? __css_rstat_updated+0x1ce/0x5a0 [ 1102.064798][T27650] ? __pfx___css_rstat_updated+0x10/0x10 [ 1102.064829][T27650] ? __lock_acquire+0x49f/0x1a40 [ 1102.064856][T27650] ? __mod_memcg_state+0x12b/0x500 [ 1102.064872][T27650] ? __pfx_bpf_check+0x10/0x10 [ 1102.064898][T27650] ? find_held_lock+0x2b/0x80 [ 1102.064916][T27650] ? bpf_prog_load+0x1933/0x2fa0 [ 1102.064945][T27650] ? __asan_memset+0x23/0x50 [ 1102.064958][T27650] ? lsm_blob_alloc+0x2b/0x90 [ 1102.064985][T27650] ? bpf_prog_load+0x244d/0x2fa0 [ 1102.065008][T27650] bpf_prog_load+0x244d/0x2fa0 [ 1102.065037][T27650] ? __pfx_bpf_prog_load+0x10/0x10 [ 1102.065060][T27650] ? __lock_acquire+0x49f/0x1a40 [ 1102.065104][T27650] __sys_bpf+0x18dc/0x4e80 [ 1102.065123][T27650] ? __pfx___sys_bpf+0x10/0x10 [ 1102.065139][T27650] ? find_held_lock+0x2b/0x80 [ 1102.065157][T27650] ? get_pid_task+0xfc/0x250 [ 1102.065176][T27650] ? get_pid_task+0xfc/0x250 [ 1102.065200][T27650] ? proc_fail_nth_write+0x9f/0x220 [ 1102.065217][T27650] ? find_held_lock+0x2b/0x80 [ 1102.065241][T27650] ? rcu_read_lock_any_held+0x6a/0xa0 [ 1102.065260][T27650] ? find_held_lock+0x2b/0x80 [ 1102.065278][T27650] ? ksys_write+0x190/0x250 [ 1102.065299][T27650] ? ksys_write+0x190/0x250 [ 1102.065341][T27650] ? fput+0x79/0x100 [ 1102.065360][T27650] ? __ia32_sys_bpf+0xcc/0x170 [ 1102.065374][T27650] __ia32_sys_bpf+0xcc/0x170 [ 1102.065385][T27650] ? __do_fast_syscall_32+0x98/0x970 [ 1102.065400][T27650] __do_fast_syscall_32+0xe7/0x970 [ 1102.065416][T27650] ? lockdep_hardirqs_on+0x78/0x100 [ 1102.065443][T27650] do_fast_syscall_32+0x32/0x70 [ 1102.065459][T27650] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1102.065478][T27650] RIP: 0023:0xf7f57fec [ 1102.065495][T27650] Code: Unable to access opcode bytes at 0xf7f57fc2. [ 1102.065501][T27650] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1102.065512][T27650] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000640 [ 1102.065520][T27650] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 1102.065526][T27650] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1102.065558][T27650] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1102.065568][T27650] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1102.065592][T27650] [ 1102.065598][T27650] Mem-Info: [ 1102.201579][T27650] active_anon:2062 inactive_anon:1486 isolated_anon:0 [ 1102.201579][T27650] active_file:3018 inactive_file:24116 isolated_file:0 [ 1102.201579][T27650] unevictable:3815 dirty:316 writeback:32 [ 1102.201579][T27650] slab_reclaimable:6956 slab_unreclaimable:68165 [ 1102.201579][T27650] mapped:26084 shmem:1786 pagetables:1585 [ 1102.201579][T27650] sec_pagetables:333 bounce:0 [ 1102.201579][T27650] kernel_misc_reclaimable:0 [ 1102.201579][T27650] free:33788 free_pcp:14089 free_cma:0 [ 1102.220852][T27650] Node 0 active_anon:32kB inactive_anon:16kB active_file:0kB inactive_file:424kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:104kB dirty:0kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7744kB pagetables:1172kB sec_pagetables:1128kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1102.234172][T27650] Node 1 active_anon:8216kB inactive_anon:5928kB active_file:12072kB inactive_file:95784kB unevictable:11724kB isolated(anon):0kB isolated(file):0kB mapped:104232kB dirty:1264kB writeback:128kB shmem:3608kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6540kB pagetables:5168kB sec_pagetables:204kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1102.246346][T27650] Node 0 DMA free:2700kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1102.259349][T27650] lowmem_reserve[]: 0 280 280 280 280 [ 1102.261720][T27650] Node 0 DMA32 free:31824kB boost:18432kB min:31208kB low:34400kB high:37592kB reserved_highatomic:0KB free_highatomic:0KB active_anon:32kB inactive_anon:16kB active_file:0kB inactive_file:424kB unevictable:3536kB writepending:0kB zspages:880kB present:1032196kB managed:287104kB mlocked:0kB bounce:0kB free_pcp:10924kB local_pcp:3272kB free_cma:0kB [ 1102.273619][T27650] lowmem_reserve[]: 0 0 0 0 0 [ 1102.275191][T27650] Node 1 DMA32 free:100884kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:8216kB inactive_anon:5928kB active_file:12072kB inactive_file:95784kB unevictable:11724kB writepending:1392kB zspages:4836kB present:1048432kB managed:948212kB mlocked:8192kB bounce:0kB free_pcp:45820kB local_pcp:9372kB free_cma:0kB [ 1102.286818][T27650] lowmem_reserve[]: 0 0 0 0 0 [ 1102.288866][T27650] Node 0 DMA: 59*4kB (UE) 26*8kB (UE) 13*16kB (UE) 12*32kB (UE) 4*64kB (UE) 1*128kB (E) 1*256kB (E) 0*512kB 1*1024kB (E) 0*2048kB 0*4096kB = 2700kB [ 1102.296782][T27650] Node 0 DMA32: 468*4kB (UME) 438*8kB (UME) 139*16kB (UE) 227*32kB (UME) 61*64kB (UME) 22*128kB (UME) 6*256kB (UME) 1*512kB (M) 2*1024kB (UM) 3*2048kB (UM) 0*4096kB = 31824kB [ 1102.303958][T27650] Node 1 DMA32: 157*4kB (UME) 716*8kB (UME) 352*16kB (UME) 320*32kB (UME) 203*64kB (UME) 46*128kB (UME) 34*256kB (UME) 18*512kB (ME) 29*1024kB (UM) 2*2048kB (U) 2*4096kB (UM) = 101012kB [ 1102.311661][T27650] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1102.315709][T27650] Node 0 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 1102.319229][T27650] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1102.322261][T27650] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1102.327047][T27650] 29643 total pagecache pages [ 1102.328922][T27650] 822 pages in swap cache [ 1102.330562][T27650] Free swap = 104752kB [ 1102.331866][T27650] Total swap = 124996kB [ 1102.333189][T27650] 524155 pages RAM [ 1102.335054][T27650] 0 pages HighMem/MovableOnly [ 1102.336626][T27650] 211486 pages reserved [ 1102.337982][T27650] 0 pages cma reserved [ 1102.631033][T27663] netlink: 216 bytes leftover after parsing attributes in process `syz.2.6307'. [ 1102.780797][T27666] FAULT_INJECTION: forcing a failure. [ 1102.780797][T27666] name failslab, interval 1, probability 0, space 0, times 0 [ 1102.788141][T27666] CPU: 1 UID: 0 PID: 27666 Comm: syz.2.6310 Tainted: G L syzkaller #0 PREEMPT(full) [ 1102.788172][T27666] Tainted: [L]=SOFTLOCKUP [ 1102.788180][T27666] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1102.788190][T27666] Call Trace: [ 1102.788197][T27666] [ 1102.788204][T27666] dump_stack_lvl+0x100/0x190 [ 1102.788232][T27666] should_fail_ex.cold+0x5/0xa [ 1102.788254][T27666] should_failslab+0xc2/0x120 [ 1102.788276][T27666] __kmalloc_noprof+0xfc/0x820 [ 1102.788297][T27666] ? kobject_get_path+0xcf/0x2c0 [ 1102.788325][T27666] kobject_get_path+0xcf/0x2c0 [ 1102.788350][T27666] kobject_uevent_env+0x287/0x18b0 [ 1102.788378][T27666] ? bus_to_subsys+0x114/0x150 [ 1102.788411][T27666] device_del+0x605/0x9b0 [ 1102.788435][T27666] ? __pfx_device_del+0x10/0x10 [ 1102.788462][T27666] device_unregister+0x1d/0xe0 [ 1102.788481][T27666] bdi_unregister+0x445/0x630 [ 1102.788503][T27666] ? __pfx_bdi_unregister+0x10/0x10 [ 1102.788522][T27666] ? generic_shutdown_super+0x1f2/0x360 [ 1102.788551][T27666] ? up_write+0x2e5/0x5c0 [ 1102.788571][T27666] generic_shutdown_super+0x2a8/0x360 [ 1102.788595][T27666] kill_anon_super+0x3a/0x60 [ 1102.788618][T27666] fuse_kill_sb_anon+0x1e8/0x350 [ 1102.788648][T27666] deactivate_locked_super+0xc1/0x1b0 [ 1102.788672][T27666] deactivate_super+0xe7/0x110 [ 1102.788702][T27666] cleanup_mnt+0x21f/0x450 [ 1102.788729][T27666] task_work_run+0x150/0x240 [ 1102.788770][T27666] ? __pfx_task_work_run+0x10/0x10 [ 1102.788799][T27666] exit_to_user_mode_loop+0x1d8/0x6f0 [ 1102.788826][T27666] ? rcu_is_watching+0x12/0xc0 [ 1102.788847][T27666] __do_fast_syscall_32+0x701/0x970 [ 1102.788862][T27666] ? lockdep_hardirqs_on+0x78/0x100 [ 1102.788887][T27666] do_fast_syscall_32+0x32/0x70 [ 1102.788903][T27666] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1102.788923][T27666] RIP: 0023:0xf7f12fec [ 1102.788944][T27666] Code: Unable to access opcode bytes at 0xf7f12fc2. [ 1102.788951][T27666] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000034 [ 1102.788968][T27666] RAX: 0000000000000000 RBX: 0000000080000140 RCX: 0000000000000003 [ 1102.788978][T27666] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1102.788988][T27666] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1102.788997][T27666] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1102.789008][T27666] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1102.789032][T27666] [ 1102.910720][T27670] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6312'. [ 1102.969095][T27673] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1102.981936][T27673] fuse: Bad value for 'fd' [ 1103.030983][T27677] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6313'. [ 1103.749233][T27697] overlayfs: failed to clone upperpath [ 1104.235743][T21761] usb 8-1: new high-speed USB device number 43 using dummy_hcd [ 1104.439264][T21761] usb 8-1: config 0 has no interfaces? [ 1104.442007][T21761] usb 8-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 1104.449407][T21761] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1104.518278][T21761] usb 8-1: config 0 descriptor?? [ 1104.736078][T21761] usb 8-1: USB disconnect, device number 43 [ 1105.305467][T27723] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1105.758752][T27725] fuse: fd is not a fuse device [ 1106.699084][T27735] overlayfs: failed to clone upperpath [ 1106.750138][T27737] fuse: fd is not a fuse device [ 1106.837438][T27746] comedi comedi3: comedi_parport: I/O port conflict (0x1004f24,3) [ 1106.882665][T27755] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6339'. [ 1106.971119][T27755] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6339'. [ 1107.047876][T27764] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6341'. [ 1107.050955][T27764] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6341'. [ 1107.070999][T27764] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1107.082036][T27764] bond2: (slave bond0): making interface the new active one [ 1107.087714][T27764] bond2: (slave bond0): Enslaving as an active interface with an up link [ 1107.099132][T27775] syzkaller1: entered promiscuous mode [ 1107.101149][T27764] netlink: 'syz.2.6341': attribute type 4 has an invalid length. [ 1107.102745][T27775] syzkaller1: entered allmulticast mode [ 1107.104866][T27764] netlink: 152 bytes leftover after parsing attributes in process `syz.2.6341'. [ 1107.136042][T27764] .`: renamed from bond0 (while UP) [ 1107.166493][T27764] netlink: 'syz.2.6341': attribute type 8 has an invalid length. [ 1107.831639][T27791] wg2 speed is unknown, defaulting to 1000 [ 1108.154950][T27801] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6351'. [ 1108.184154][T21761] usb 7-1: new high-speed USB device number 115 using dummy_hcd [ 1108.315837][T27774] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 1108.344274][T21761] usb 7-1: Using ep0 maxpacket: 16 [ 1108.352215][T21761] usb 7-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 1108.360561][T21761] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1108.365976][T21761] usb 7-1: Product: syz [ 1108.367596][T21761] usb 7-1: Manufacturer: syz [ 1108.373912][T21761] usb 7-1: SerialNumber: syz [ 1108.397040][T27809] batadv1: entered promiscuous mode [ 1108.435944][T27813] netlink: 'syz.0.6356': attribute type 3 has an invalid length. [ 1108.591983][T21761] usb 7-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 1108.605342][T21761] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1108.609975][T21761] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 1108.613859][T21761] usb 7-1: media controller created [ 1108.626156][T21761] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1108.724208][T23547] usb 8-1: new high-speed USB device number 44 using dummy_hcd [ 1108.803029][T27798] netlink: 'syz.2.6350': attribute type 1 has an invalid length. [ 1108.804827][T27821] FAULT_INJECTION: forcing a failure. [ 1108.804827][T27821] name failslab, interval 1, probability 0, space 0, times 0 [ 1108.812869][T27821] CPU: 0 UID: 0 PID: 27821 Comm: syz.1.6360 Tainted: G L syzkaller #0 PREEMPT(full) [ 1108.812899][T27821] Tainted: [L]=SOFTLOCKUP [ 1108.812920][T27821] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1108.812932][T27821] Call Trace: [ 1108.812939][T27821] [ 1108.812947][T27821] dump_stack_lvl+0x100/0x190 [ 1108.812991][T27821] should_fail_ex.cold+0x5/0xa [ 1108.813013][T27821] should_failslab+0xc2/0x120 [ 1108.813037][T27821] __kmalloc_cache_noprof+0x91/0x6c0 [ 1108.813065][T27821] ? __tcf_proto_lookup_ops+0xcf/0x100 [ 1108.813088][T27821] ? fl_init+0x45/0x2c0 [ 1108.813110][T27821] ? __pfx_fl_classify+0x10/0x10 [ 1108.813130][T27821] fl_init+0x45/0x2c0 [ 1108.813150][T27821] tc_new_tfilter+0x105c/0x24a0 [ 1108.813186][T27821] ? rcu_is_cpu_rrupt_from_idle+0x240/0x270 [ 1108.813217][T27821] ? kasan_quarantine_put+0x104/0x240 [ 1108.813236][T27821] ? lockdep_hardirqs_on+0x78/0x100 [ 1108.813265][T27821] ? __pfx_tc_new_tfilter+0x10/0x10 [ 1108.813293][T27821] ? kmem_cache_free+0x127/0x6b0 [ 1108.813341][T27821] ? find_held_lock+0x2b/0x80 [ 1108.813363][T27821] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 1108.813388][T27821] ? __pfx_tc_new_tfilter+0x10/0x10 [ 1108.813415][T27821] rtnetlink_rcv_msg+0x95e/0xe90 [ 1108.813465][T27821] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1108.813495][T27821] ? ref_tracker_free+0x37e/0x6c0 [ 1108.813525][T27821] netlink_rcv_skb+0x159/0x420 [ 1108.813553][T27821] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1108.813577][T27821] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1108.813614][T27821] ? netlink_deliver_tap+0x1ae/0xcc0 [ 1108.813645][T27821] netlink_unicast+0x585/0x850 [ 1108.813675][T27821] ? __pfx_netlink_unicast+0x10/0x10 [ 1108.813708][T27821] netlink_sendmsg+0x8b0/0xda0 [ 1108.813738][T27821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1108.813767][T27821] ? apparmor_socket_sendmsg+0x15b/0x270 [ 1108.813796][T27821] ____sys_sendmsg+0xa4d/0xbe0 [ 1108.813819][T27821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1108.813846][T27821] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1108.813881][T27821] ___sys_sendmsg+0x190/0x1e0 [ 1108.813908][T27821] ? __pfx____sys_sendmsg+0x10/0x10 [ 1108.813944][T27821] ? find_held_lock+0x2b/0x80 [ 1108.813979][T27821] __sys_sendmsg+0x160/0x210 [ 1108.814002][T27821] ? __pfx___sys_sendmsg+0x10/0x10 [ 1108.814028][T27821] ? __pfx_ksys_write+0x10/0x10 [ 1108.814061][T27821] __do_fast_syscall_32+0xe7/0x970 [ 1108.814080][T27821] ? lockdep_hardirqs_on+0x78/0x100 [ 1108.814108][T27821] do_fast_syscall_32+0x32/0x70 [ 1108.814126][T27821] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1108.814150][T27821] RIP: 0023:0xf7f86fec [ 1108.814174][T27821] Code: Unable to access opcode bytes at 0xf7f86fc2. [ 1108.814184][T27821] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1108.814210][T27821] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080006040 [ 1108.814222][T27821] RDX: 0000000020040054 RSI: 0000000000000000 RDI: 0000000000000000 [ 1108.814233][T27821] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1108.814242][T27821] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1108.814252][T27821] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1108.814277][T27821] [ 1108.932705][T21761] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1108.950097][T21761] dvb_usb_gl861 7-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 1108.964476][T23547] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 1108.970671][T23547] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1108.974127][T23547] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1108.978598][T23547] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1108.982310][T23547] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1108.986119][T23547] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1108.991499][T23547] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1108.993761][T27798] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1108.995532][T23547] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1108.999976][T23547] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1109.004451][T27823] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1109.007472][T23547] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1109.010288][T27823] bond0: (slave batadv1): making interface the new active one [ 1109.011288][T27823] bond0: (slave batadv1): Enslaving as an active interface with an up link [ 1109.025641][T27825] bond0 (unregistering): (slave batadv1): Releasing active interface [ 1109.032801][T27825] bond0 (unregistering): Released all slaves [ 1109.035993][T23547] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1109.039544][T23547] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1109.043910][T23547] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1109.048107][T23547] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1109.051782][T23547] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1109.056223][T23547] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1109.060250][T23547] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1109.063884][T23547] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1109.069783][T23547] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1109.074484][T23547] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1109.078367][T23547] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1109.086908][T23547] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1109.091037][T23547] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1109.094549][T23547] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1109.098047][T23547] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1109.098141][T27828] binder: BINDER_SET_CONTEXT_MGR already set [ 1109.101899][T23547] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1109.103341][T27828] binder: 27827:27828 ioctl 40046207 0 returned -16 [ 1109.105842][T23547] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1109.105857][T23547] usb 8-1: Product: syz [ 1109.105866][T23547] usb 8-1: Manufacturer: syz [ 1109.105875][T23547] usb 8-1: SerialNumber: syz [ 1109.107201][T23547] usb 8-1: config 0 descriptor?? [ 1109.121347][T23547] yurex 8-1:0.0: USB YUREX device now attached to Yurex #0 [ 1109.140047][T27828] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6361'. [ 1109.157392][T27828] binder: BINDER_SET_CONTEXT_MGR already set [ 1109.167944][T23547] usb 7-1: USB disconnect, device number 115 [ 1109.191479][T27828] binder: 27827:27828 ioctl 40046207 0 returned -16 [ 1109.269092][T27836] netlink: 144 bytes leftover after parsing attributes in process `syz.1.6363'. [ 1109.335169][T23547] usb 8-1: USB disconnect, device number 44 [ 1109.339179][T23547] yurex 8-1:0.0: USB YUREX #0 now disconnected [ 1109.893546][T27855] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6369'. [ 1110.031840][ T175] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1110.032710][T27858] FAULT_INJECTION: forcing a failure. [ 1110.032710][T27858] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1110.041800][T27858] CPU: 1 UID: 0 PID: 27858 Comm: syz.2.6370 Tainted: G L syzkaller #0 PREEMPT(full) [ 1110.041829][T27858] Tainted: [L]=SOFTLOCKUP [ 1110.041838][T27858] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1110.041849][T27858] Call Trace: [ 1110.041855][T27858] [ 1110.041862][T27858] dump_stack_lvl+0x100/0x190 [ 1110.041887][T27858] should_fail_ex.cold+0x5/0xa [ 1110.041907][T27858] _copy_from_user+0x2e/0xd0 [ 1110.041932][T27858] kstrtouint_from_user+0xd6/0x1d0 [ 1110.041950][T27858] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1110.041970][T27858] ? __lock_acquire+0x49f/0x1a40 [ 1110.042009][T27858] proc_fail_nth_write+0x83/0x220 [ 1110.042035][T27858] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1110.042066][T27858] vfs_write+0x2aa/0x1050 [ 1110.042096][T27858] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1110.042119][T27858] ? __pfx_vfs_write+0x10/0x10 [ 1110.042144][T27858] ? find_held_lock+0x2b/0x80 [ 1110.042170][T27858] ? __fget_files+0x215/0x3d0 [ 1110.042203][T27858] ? __fget_files+0x21f/0x3d0 [ 1110.042233][T27858] ksys_write+0x12a/0x250 [ 1110.042256][T27858] ? __pfx_ksys_write+0x10/0x10 [ 1110.042286][T27858] do_int80_emulation+0x14b/0x720 [ 1110.042310][T27858] asm_int80_emulation+0x1a/0x20 [ 1110.042330][T27858] RIP: 0023:0xf71171eb [ 1110.042346][T27858] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1110.042365][T27858] RSP: 002b:00000000f53b54bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 1110.042383][T27858] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00000000f53b55d0 [ 1110.042394][T27858] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1110.042404][T27858] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1110.042413][T27858] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1110.042422][T27858] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1110.042445][T27858] [ 1110.401368][T27879] binder: 27870:27879 ioctl 6612 0 returned -22 [ 1110.834340][T22595] usb 7-1: new full-speed USB device number 116 using dummy_hcd [ 1110.996190][T22595] usb 7-1: config 255 has an invalid interface number: 133 but max is 0 [ 1110.999507][T22595] usb 7-1: config 255 has no interface number 0 [ 1111.001932][T22595] usb 7-1: config 255 interface 133 has no altsetting 0 [ 1111.007708][T22595] usb 7-1: New USB device found, idVendor=1943, idProduct=2255, bcdDevice=d7.fb [ 1111.011336][T22595] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1111.015631][T22595] usb 7-1: Product: syz [ 1111.017396][T22595] usb 7-1: Manufacturer: syz [ 1111.019248][T22595] usb 7-1: SerialNumber: syz [ 1111.119907][T27893] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1111.293267][T22595] s2255 7-1:255.133: Could not find bulk-in endpoint [ 1111.304251][T22595] Sensoray 2255 driver load failed: 0xfffffff4 [ 1111.306686][T22595] s2255 7-1:255.133: probe with driver s2255 failed with error -12 [ 1111.310084][T22595] usbhid 7-1:255.133: couldn't find an input interrupt endpoint [ 1111.322993][T22595] usb 7-1: USB disconnect, device number 116 [ 1111.473717][T27920] FAULT_INJECTION: forcing a failure. [ 1111.473717][T27920] name failslab, interval 1, probability 0, space 0, times 0 [ 1111.479510][T27920] CPU: 3 UID: 0 PID: 27920 Comm: syz.3.6384 Tainted: G L syzkaller #0 PREEMPT(full) [ 1111.479533][T27920] Tainted: [L]=SOFTLOCKUP [ 1111.479538][T27920] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1111.479545][T27920] Call Trace: [ 1111.479550][T27920] [ 1111.479555][T27920] dump_stack_lvl+0x100/0x190 [ 1111.479574][T27920] should_fail_ex.cold+0x5/0xa [ 1111.479588][T27920] should_failslab+0xc2/0x120 [ 1111.479603][T27920] __kvmalloc_node_noprof+0x116/0x970 [ 1111.479619][T27920] ? __kvm_mmu_topup_memory_cache+0x455/0x5f0 [ 1111.479635][T27920] __kvm_mmu_topup_memory_cache+0x455/0x5f0 [ 1111.479649][T27920] ? find_held_lock+0x2b/0x80 [ 1111.479665][T27920] mmu_topup_memory_caches+0x25/0x170 [ 1111.479683][T27920] kvm_mmu_load+0xd6/0x23e0 [ 1111.479698][T27920] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 1111.479718][T27920] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 1111.479738][T27920] ? __pfx_kvm_mmu_load+0x10/0x10 [ 1111.479751][T27920] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 1111.479764][T27920] ? kvm_check_and_inject_events+0x961/0x1070 [ 1111.479780][T27920] ? record_steal_time+0x3b0/0xbb0 [ 1111.479800][T27920] vcpu_run+0x3a57/0x5d50 [ 1111.479821][T27920] ? __pfx_vcpu_run+0x10/0x10 [ 1111.479841][T27920] ? rcu_is_watching+0x12/0xc0 [ 1111.479858][T27920] ? kvm_arch_vcpu_ioctl_run+0x5b6/0x1890 [ 1111.479873][T27920] kvm_arch_vcpu_ioctl_run+0x5b6/0x1890 [ 1111.479893][T27920] kvm_vcpu_ioctl+0x730/0x1700 [ 1111.479905][T27920] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1111.479917][T27920] ? tomoyo_path_number_perm+0x188/0x580 [ 1111.479933][T27920] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1111.479946][T27920] ? get_pid_task+0x106/0x250 [ 1111.479963][T27920] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1111.479980][T27920] ? do_vfs_ioctl+0x226/0x13e0 [ 1111.479996][T27920] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1111.480017][T27920] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 1111.480030][T27920] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 1111.480042][T27920] ? __fget_files+0x21f/0x3d0 [ 1111.480061][T27920] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 1111.480073][T27920] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1111.480091][T27920] __do_fast_syscall_32+0xe7/0x970 [ 1111.480104][T27920] ? lockdep_hardirqs_on+0x78/0x100 [ 1111.480123][T27920] do_fast_syscall_32+0x32/0x70 [ 1111.480139][T27920] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1111.480159][T27920] RIP: 0023:0xf7f57fec [ 1111.480182][T27920] Code: Unable to access opcode bytes at 0xf7f57fc2. [ 1111.480192][T27920] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1111.480209][T27920] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 1111.480219][T27920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1111.480225][T27920] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1111.480232][T27920] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1111.480239][T27920] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1111.480254][T27920] [ 1111.722793][T27926] batman_adv: batadv0: Adding interface: gretap2 [ 1111.734210][T27926] batman_adv: batadv0: The MTU of interface gretap2 is too small (1442) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1111.742303][T27926] batman_adv: batadv0: Interface activated: gretap2 [ 1112.122689][T27934] FAULT_INJECTION: forcing a failure. [ 1112.122689][T27934] name failslab, interval 1, probability 0, space 0, times 0 [ 1112.126972][T27934] CPU: 0 UID: 0 PID: 27934 Comm: syz.3.6389 Tainted: G L syzkaller #0 PREEMPT(full) [ 1112.127000][T27934] Tainted: [L]=SOFTLOCKUP [ 1112.127007][T27934] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1112.127017][T27934] Call Trace: [ 1112.127022][T27934] [ 1112.127029][T27934] dump_stack_lvl+0x100/0x190 [ 1112.127047][T27934] should_fail_ex.cold+0x5/0xa [ 1112.127061][T27934] should_failslab+0xc2/0x120 [ 1112.127077][T27934] __kvmalloc_node_noprof+0x116/0x970 [ 1112.127094][T27934] ? __kvm_mmu_topup_memory_cache+0x455/0x5f0 [ 1112.127110][T27934] __kvm_mmu_topup_memory_cache+0x455/0x5f0 [ 1112.127125][T27934] ? find_held_lock+0x2b/0x80 [ 1112.127140][T27934] mmu_topup_memory_caches+0x25/0x170 [ 1112.127158][T27934] kvm_mmu_load+0xd6/0x23e0 [ 1112.127173][T27934] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 1112.127192][T27934] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 1112.127216][T27934] ? kvm_deliver_exception_payload+0x129/0x210 [ 1112.127230][T27934] ? __pfx_kvm_mmu_load+0x10/0x10 [ 1112.127243][T27934] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 1112.127256][T27934] ? kvm_check_and_inject_events+0x961/0x1070 [ 1112.127274][T27934] vcpu_run+0x3a57/0x5d50 [ 1112.127289][T27934] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 1112.127313][T27934] ? __pfx_vcpu_run+0x10/0x10 [ 1112.127334][T27934] ? rcu_is_watching+0x12/0xc0 [ 1112.127349][T27934] ? kvm_arch_vcpu_ioctl_run+0x5b6/0x1890 [ 1112.127365][T27934] kvm_arch_vcpu_ioctl_run+0x5b6/0x1890 [ 1112.127385][T27934] kvm_vcpu_ioctl+0x730/0x1700 [ 1112.127398][T27934] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1112.127409][T27934] ? tomoyo_path_number_perm+0x188/0x580 [ 1112.127424][T27934] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1112.127438][T27934] ? get_pid_task+0x106/0x250 [ 1112.127456][T27934] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1112.127474][T27934] ? do_vfs_ioctl+0x226/0x13e0 [ 1112.127489][T27934] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1112.127511][T27934] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 1112.127523][T27934] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 1112.127535][T27934] ? __fget_files+0x21f/0x3d0 [ 1112.127555][T27934] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 1112.127566][T27934] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1112.127584][T27934] __do_fast_syscall_32+0xe7/0x970 [ 1112.127597][T27934] ? lockdep_hardirqs_on+0x78/0x100 [ 1112.127616][T27934] do_fast_syscall_32+0x32/0x70 [ 1112.127628][T27934] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1112.127644][T27934] RIP: 0023:0xf7f57fec [ 1112.127662][T27934] Code: Unable to access opcode bytes at 0xf7f57fc2. [ 1112.127667][T27934] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1112.127679][T27934] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 1112.127686][T27934] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1112.127693][T27934] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1112.127699][T27934] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1112.127706][T27934] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1112.127720][T27934] [ 1112.544198][ T6041] usb 7-1: new high-speed USB device number 117 using dummy_hcd [ 1112.554238][ T5749] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 1112.697024][ T6041] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1112.700719][ T6041] usb 7-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 1112.704180][ T5749] usb 8-1: Using ep0 maxpacket: 32 [ 1112.705163][ T6041] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1112.710548][ T6041] usb 7-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1112.715492][ T6041] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1112.716243][ T5749] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1112.720036][ T6041] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1112.729342][ T6041] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1112.733059][ T6041] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1112.735315][ T5749] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 1112.736404][ T6041] usb 7-1: Product: syz [ 1112.739239][ T5749] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 1112.740817][ T6041] usb 7-1: Manufacturer: syz [ 1112.743759][ T5749] usb 8-1: config 14 has no interface number 0 [ 1112.749498][T27939] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1112.754168][ T5749] usb 8-1: config 14 has no interface number 1 [ 1112.756574][ T5749] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1112.759660][ T6041] cdc_wdm 7-1:1.0: skipping garbage [ 1112.760663][ T5749] usb 8-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1112.762610][ T6041] cdc_wdm 7-1:1.0: skipping garbage [ 1112.770183][ T6041] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 1112.772931][ T6041] cdc_wdm 7-1:1.0: Unknown control protocol [ 1112.784174][ T5749] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 1112.788501][ T5749] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 1112.792615][ T5749] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 1112.804187][ T5749] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1112.811270][ T5749] usb 8-1: config 14 interface 57 has no altsetting 0 [ 1112.824214][ T5749] usb 8-1: config 14 interface 228 has no altsetting 0 [ 1112.828622][ T5749] usb 8-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1112.831456][ T5749] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1112.835061][ T5749] usb 8-1: Product: syz [ 1112.836702][ T5749] usb 8-1: Manufacturer: syz [ 1112.844170][ T5749] usb 8-1: SerialNumber: syz [ 1112.967309][T27939] input: syz0 as /devices/virtual/input/input94 [ 1113.049307][T23547] usb 7-1: USB disconnect, device number 117 [ 1113.213362][T27943] tipc: Started in network mode [ 1113.215528][T27943] tipc: Node identity c2493401c8d2, cluster identity 4711 [ 1113.218534][T27943] tipc: Enabled bearer , priority 30 [ 1113.278211][ T5749] legousbtower 8-1:14.57: interrupt endpoints not found [ 1113.443816][T27947] overlayfs: failed to resolve './cgroup': -2 [ 1113.490361][ T5829] usb 7-1: new full-speed USB device number 118 using dummy_hcd [ 1113.646529][ T5829] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1113.648976][ T5829] usb 7-1: config 1 has an invalid descriptor of length 121, skipping remainder of the config [ 1113.652019][ T5829] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1113.661443][ T5829] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1113.670856][ T5829] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1113.674895][ T5829] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1113.677805][ T5829] usb 7-1: Product: syz [ 1113.679348][ T5829] usb 7-1: Manufacturer: syz [ 1113.696447][T27939] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1113.705876][ T5829] cdc_wdm 7-1:1.0: skipping garbage [ 1113.709690][ T5829] cdc_wdm 7-1:1.0: probe with driver cdc_wdm failed with error -22 [ 1113.728288][ T5749] legousbtower 8-1:14.228: get version request failed: -121 [ 1113.734573][ T5749] legousbtower 8-1:14.228: probe with driver legousbtower failed with error -121 [ 1113.814196][ T6041] usb 6-1: new high-speed USB device number 117 using dummy_hcd [ 1113.927102][T21761] usb 7-1: USB disconnect, device number 118 [ 1113.929163][T22595] usb 8-1: USB disconnect, device number 45 [ 1113.977579][ T6041] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1113.983468][ T6041] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1113.991589][ T6041] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1113.999561][ T6041] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1114.005610][ T6041] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1114.012790][T27955] wg2 speed is unknown, defaulting to 1000 [ 1114.017111][ T6041] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1114.021705][ T6041] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1114.026433][ T6041] usb 6-1: Product: syz [ 1114.027763][ T6041] usb 6-1: Manufacturer: syz [ 1114.036525][ T6041] cdc_wdm 6-1:1.0: skipping garbage [ 1114.040178][ T6041] cdc_wdm 6-1:1.0: skipping garbage [ 1114.052311][ T6041] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 1114.054310][ T6041] cdc_wdm 6-1:1.0: Unknown control protocol [ 1114.214881][T21761] tipc: Node number set to 177943553 [ 1114.635051][T27966] netlink: 'syz.3.6400': attribute type 21 has an invalid length. [ 1114.637823][T27966] netlink: 128 bytes leftover after parsing attributes in process `syz.3.6400'. [ 1114.641387][T27966] netlink: 'syz.3.6400': attribute type 5 has an invalid length. [ 1114.644268][T27966] netlink: 'syz.3.6400': attribute type 6 has an invalid length. [ 1114.646683][T27966] netlink: 3 bytes leftover after parsing attributes in process `syz.3.6400'. [ 1114.744472][ T6041] usb 7-1: new full-speed USB device number 119 using dummy_hcd [ 1114.893829][T27973] FAULT_INJECTION: forcing a failure. [ 1114.893829][T27973] name failslab, interval 1, probability 0, space 0, times 0 [ 1114.893857][T27973] CPU: 0 UID: 0 PID: 27973 Comm: syz.3.6401 Tainted: G L syzkaller #0 PREEMPT(full) [ 1114.893874][T27973] Tainted: [L]=SOFTLOCKUP [ 1114.893879][T27973] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1114.893886][T27973] Call Trace: [ 1114.893891][T27973] [ 1114.893897][T27973] dump_stack_lvl+0x100/0x190 [ 1114.893915][T27973] should_fail_ex.cold+0x5/0xa [ 1114.893929][T27973] should_failslab+0xc2/0x120 [ 1114.893946][T27973] __kmalloc_cache_noprof+0x91/0x6c0 [ 1114.893965][T27973] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1114.893984][T27973] ? con_insert_unipair+0x1c0/0x270 [ 1114.894005][T27973] con_insert_unipair+0x1c0/0x270 [ 1114.894025][T27973] con_set_unimap+0x40e/0x640 [ 1114.894060][T27973] vt_compat_ioctl+0x319/0x4e0 [ 1114.894089][T27973] ? __pfx_vt_compat_ioctl+0x10/0x10 [ 1114.894116][T27973] ? hook_file_ioctl_common+0x140/0x440 [ 1114.894142][T27973] ? __fget_files+0x21f/0x3d0 [ 1114.894172][T27973] ? __pfx_vt_compat_ioctl+0x10/0x10 [ 1114.894201][T27973] tty_compat_ioctl+0x1b4/0x420 [ 1114.894224][T27973] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 1114.894245][T27973] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1114.894274][T27973] __do_fast_syscall_32+0xe7/0x970 [ 1114.894294][T27973] ? lockdep_hardirqs_on+0x78/0x100 [ 1114.894325][T27973] do_fast_syscall_32+0x32/0x70 [ 1114.894345][T27973] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1114.894371][T27973] RIP: 0023:0xf7f57fec [ 1114.894394][T27973] Code: Unable to access opcode bytes at 0xf7f57fc2. [ 1114.894403][T27973] RSP: 002b:00000000f541650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1114.894421][T27973] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000004b67 [ 1114.894433][T27973] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 1114.894445][T27973] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1114.894457][T27973] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1114.894468][T27973] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1114.894491][T27973] [ 1114.923317][ T6041] usb 7-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1114.991969][ T6041] usb 7-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1114.995792][ T6041] usb 7-1: Product: syz [ 1114.997528][ T6041] usb 7-1: Manufacturer: syz [ 1114.999633][ T6041] usb 7-1: SerialNumber: syz [ 1115.003958][ T6041] usb 7-1: config 0 descriptor?? [ 1115.324286][T21761] usb 8-1: new high-speed USB device number 46 using dummy_hcd [ 1115.367076][T27904] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1115.372474][T27904] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1115.484361][T21761] usb 8-1: Using ep0 maxpacket: 32 [ 1115.487747][T21761] usb 8-1: config index 0 descriptor too short (expected 29220, got 36) [ 1115.491481][T21761] usb 8-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1115.498329][T21761] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1115.502134][T21761] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1115.509815][T21761] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1115.516683][T21761] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1115.526013][T21761] usb 8-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1115.531720][T21761] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1115.540704][T21761] usb 8-1: config 0 descriptor?? [ 1115.748361][T21761] usblp 8-1:0.0: usblp1: USB Bidirectional printer dev 46 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1115.755316][T21761] usb 8-1: USB disconnect, device number 46 [ 1115.759916][T21761] usblp1: removed [ 1115.796567][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.799567][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.184267][T21761] usb 8-1: new high-speed USB device number 47 using dummy_hcd [ 1116.344220][T21761] usb 8-1: Using ep0 maxpacket: 32 [ 1116.348206][T21761] usb 8-1: config index 0 descriptor too short (expected 29220, got 36) [ 1116.350858][T21761] usb 8-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1116.354136][T21761] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1116.357590][T21761] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1116.361624][T21761] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1116.365484][T21761] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1116.369862][T21761] usb 8-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1116.373005][T21761] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1116.378348][T21761] usb 8-1: config 0 descriptor?? [ 1116.493265][ T5893] usb 6-1: USB disconnect, device number 117 [ 1116.590552][T21761] usblp 8-1:0.0: usblp0: USB Bidirectional printer dev 47 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1116.696887][T27985] wg2 speed is unknown, defaulting to 1000 [ 1116.772243][T27999] loop6: detected capacity change from 0 to 2640 [ 1116.775676][T27999] buffer_io_error: 332 callbacks suppressed [ 1116.775687][T27999] Buffer I/O error on dev loop6, logical block 0, async page read [ 1116.780038][T27999] Buffer I/O error on dev loop6, logical block 0, async page read [ 1116.782570][T27999] Buffer I/O error on dev loop6, logical block 0, async page read [ 1116.786630][T27999] Buffer I/O error on dev loop6, logical block 0, async page read [ 1116.789173][T27999] Buffer I/O error on dev loop6, logical block 0, async page read [ 1116.791840][T27999] Buffer I/O error on dev loop6, logical block 0, async page read [ 1116.794471][T27999] Buffer I/O error on dev loop6, logical block 0, async page read [ 1116.797109][T27999] Buffer I/O error on dev loop6, logical block 0, async page read [ 1116.799609][T27999] ldm_validate_partition_table(): Disk read failed. [ 1116.801777][T27999] Buffer I/O error on dev loop6, logical block 0, async page read [ 1116.804318][T27999] Buffer I/O error on dev loop6, logical block 0, async page read [ 1116.806893][T27999] Dev loop6: unable to read RDB block 0 [ 1116.809018][T27999] loop6: unable to read partition table [ 1116.810968][T27999] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 1116.827082][T14072] udevd[14072]: symlink '../../loop6' '/dev/disk/by-diskseq/125.tmp-b7:6' failed: Read-only file system [ 1116.846868][T14072] udevd[14072]: symlink '../../loop6' '/dev/disk/by-diskseq/125.tmp-b7:6' failed: Read-only file system [ 1116.861569][T14072] udevd[14072]: symlink '../../loop6' '/dev/disk/by-diskseq/125.tmp-b7:6' failed: Read-only file system [ 1116.985973][T28009] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6411'. [ 1117.524955][ T5893] usb 7-1: USB disconnect, device number 119 [ 1117.924212][ T5893] usb 7-1: new high-speed USB device number 120 using dummy_hcd [ 1118.084201][ T5893] usb 7-1: Using ep0 maxpacket: 32 [ 1118.088809][ T5893] usb 7-1: config index 0 descriptor too short (expected 15270, got 18) [ 1118.098436][ T5893] usb 7-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 1118.104017][ T5893] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1118.119091][ T5893] usb 7-1: Product: syz [ 1118.120646][ T5893] usb 7-1: Manufacturer: syz [ 1118.122161][ T5893] usb 7-1: SerialNumber: syz [ 1118.136545][ T5893] usb 7-1: config 0 descriptor?? [ 1118.147088][ T5893] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 1118.155136][ T5893] dvb-usb: bulk message failed: -22 (4/0) [ 1118.160405][ T5893] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1118.169714][ T5893] dvb-usb: bulk message failed: -22 (5/0) [ 1118.183055][ T5893] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1118.204004][ T5893] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1118.220337][ T5893] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 1118.231961][ T5893] usb 7-1: media controller created [ 1118.239418][ T5893] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1118.249497][ T5893] usb 7-1: selecting invalid altsetting 3 [ 1118.251834][ T5893] ttusb2: set interface to alts=3 failed [ 1118.259793][T28021] futex_wake_op: syz.1.6415 tries to shift op by -1; fix this program [ 1118.265995][ T5749] usb 8-1: USB disconnect, device number 47 [ 1118.281719][ T5749] usblp0: removed [ 1118.282688][ T5893] DVB: Unable to find symbol tda10086_attach() [ 1118.285891][ T5893] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 1118.288965][ T5893] dvb-usb: bulk message failed: -22 (4/0) [ 1118.290871][ T5893] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1118.294022][ T5893] dvb-usb: bulk message failed: -22 (5/0) [ 1118.297007][ T5893] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1118.301182][ T5893] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 1118.347284][ T5893] usb 7-1: USB disconnect, device number 120 [ 1118.372738][ T5893] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 1118.393943][T28027] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6414'. [ 1118.403187][T28027] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6414'. [ 1118.689635][T28041] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6421'. [ 1118.738822][T28045] comedi comedi3: c6xdigio: a I/O base address must be specified [ 1118.883273][T28047] netlink: 'syz.1.6424': attribute type 10 has an invalid length. [ 1118.926819][T28052] fuse: fd is not a fuse device [ 1119.424225][ T6041] usb 8-1: new full-speed USB device number 48 using dummy_hcd [ 1119.430434][T28078] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1119.606662][ T6041] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1119.611242][ T6041] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1119.615784][ T6041] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 1119.622469][ T6041] usb 8-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1119.626363][ T6041] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1119.629564][ T6041] usb 8-1: Product: syz [ 1119.631235][ T6041] usb 8-1: Manufacturer: syz [ 1119.633246][ T6041] usb 8-1: SerialNumber: syz [ 1119.637702][ T6041] usb 8-1: config 0 descriptor?? [ 1119.645604][T28070] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1119.717771][ T6041] rc_core: IR keymap rc-streamzap not found [ 1119.720539][ T6041] Registered IR keymap rc-empty [ 1119.724270][ T6041] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0 [ 1119.732646][ T6041] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0/input96 [ 1119.830906][T14072] udevd[14072]: symlink '../event3' '/dev/input/by-id/usb-syz_syz_syz-event-if00.tmp-c13:67' failed: Read-only file system [ 1119.840917][T14072] udevd[14072]: symlink '../event3' '/dev/input/by-path/platform-dummy_hcd.3-usb-0:1:0.0-event.tmp-c13:67' failed: Read-only file system [ 1120.066967][T28070] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1120.078535][T28070] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1120.091004][ T5749] usb 8-1: USB disconnect, device number 48 [ 1120.097899][T28091] wg2 speed is unknown, defaulting to 1000 [ 1120.559174][T28102] fuse: Unknown parameter '0x0000000000000004' [ 1120.606276][T28102] bridge0: port 3(erspan0) entered blocking state [ 1120.608904][T28102] bridge0: port 3(erspan0) entered disabled state [ 1120.611546][T28102] erspan0: entered allmulticast mode [ 1120.631597][T28102] erspan0: left allmulticast mode [ 1121.565009][ T42] audit: type=1326 audit(2000000015.259:941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28125 comm="syz.0.6448" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf706efec code=0x0 [ 1121.962873][T28138] netlink: 'syz.3.6452': attribute type 1 has an invalid length. [ 1121.982666][T28138] bond3: entered promiscuous mode [ 1121.987197][T28138] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1121.998948][T28138] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1122.001594][T28138] bond3: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 1122.005412][T28138] bond3: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 1122.010319][T28138] bond3: (slave ip6gre1): making interface the new active one [ 1122.015353][T28138] ip6gre1: entered promiscuous mode [ 1122.018647][T28138] bond3: (slave ip6gre1): Enslaving as an active interface with an up link [ 1122.078930][T28144] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6453'. [ 1122.121743][T28146] sit0: entered promiscuous mode [ 1122.141691][ T42] audit: type=1326 audit(2000000015.829:942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28145 comm="syz.3.6454" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57fec code=0x7ffc0000 [ 1122.149096][ T42] audit: type=1326 audit(2000000015.839:943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28145 comm="syz.3.6454" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57fec code=0x7ffc0000 [ 1122.159865][ T42] audit: type=1326 audit(2000000015.839:944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28145 comm="syz.3.6454" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57fec code=0x7ffc0000 [ 1122.174694][ T42] audit: type=1326 audit(2000000015.839:945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28145 comm="syz.3.6454" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57fec code=0x7ffc0000 [ 1122.195308][ T42] audit: type=1326 audit(2000000015.839:946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28145 comm="syz.3.6454" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf7f57fec code=0x7ffc0000 [ 1122.204297][ T42] audit: type=1326 audit(2000000015.839:947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28145 comm="syz.3.6454" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57fec code=0x7ffc0000 [ 1122.214160][ T42] audit: type=1326 audit(2000000015.839:948): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28145 comm="syz.3.6454" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57fec code=0x7ffc0000 [ 1122.222189][ T42] audit: type=1326 audit(2000000015.849:949): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28145 comm="syz.3.6454" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57fec code=0x7ffc0000 [ 1122.230912][ T42] audit: type=1326 audit(2000000015.849:950): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28145 comm="syz.3.6454" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f57fec code=0x7ffc0000 [ 1122.930143][T28162] FAULT_INJECTION: forcing a failure. [ 1122.930143][T28162] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1122.944688][T28162] CPU: 2 UID: 0 PID: 28162 Comm: syz.2.6459 Tainted: G L syzkaller #0 PREEMPT(full) [ 1122.944719][T28162] Tainted: [L]=SOFTLOCKUP [ 1122.944728][T28162] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1122.944739][T28162] Call Trace: [ 1122.944747][T28162] [ 1122.944755][T28162] dump_stack_lvl+0x100/0x190 [ 1122.944785][T28162] should_fail_ex.cold+0x5/0xa [ 1122.944814][T28162] _copy_to_user+0x32/0xd0 [ 1122.944847][T28162] simple_read_from_buffer+0xcb/0x170 [ 1122.944882][T28162] proc_fail_nth_read+0x1af/0x230 [ 1122.944910][T28162] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1122.944937][T28162] ? rw_verify_area+0xce/0x6d0 [ 1122.944964][T28162] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1122.944988][T28162] vfs_read+0x1e4/0xb40 [ 1122.945019][T28162] ? __pfx_vfs_read+0x10/0x10 [ 1122.945044][T28162] ? find_held_lock+0x2b/0x80 [ 1122.945069][T28162] ? __fget_files+0x215/0x3d0 [ 1122.945102][T28162] ? __fget_files+0x21f/0x3d0 [ 1122.945137][T28162] ksys_read+0x12a/0x250 [ 1122.945165][T28162] ? __pfx_ksys_read+0x10/0x10 [ 1122.945199][T28162] do_int80_emulation+0x14b/0x720 [ 1122.945228][T28162] asm_int80_emulation+0x1a/0x20 [ 1122.945286][T28162] RIP: 0023:0xf71171eb [ 1122.945303][T28162] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1122.945321][T28162] RSP: 002b:00000000f53d64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1122.945342][T28162] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000f53d65d0 [ 1122.945353][T28162] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1122.945365][T28162] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1122.945377][T28162] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1122.945389][T28162] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1122.945416][T28162] [ 1123.108165][T28170] FAULT_INJECTION: forcing a failure. [ 1123.108165][T28170] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1123.113650][T28170] CPU: 2 UID: 0 PID: 28170 Comm: syz.1.6460 Tainted: G L syzkaller #0 PREEMPT(full) [ 1123.113681][T28170] Tainted: [L]=SOFTLOCKUP [ 1123.113688][T28170] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1123.113699][T28170] Call Trace: [ 1123.113706][T28170] [ 1123.113714][T28170] dump_stack_lvl+0x100/0x190 [ 1123.113741][T28170] should_fail_ex.cold+0x5/0xa [ 1123.113761][T28170] _copy_from_user+0x2e/0xd0 [ 1123.113789][T28170] snd_seq_oss_write+0x53c/0x8b0 [ 1123.113823][T28170] ? __pfx_snd_seq_oss_write+0x10/0x10 [ 1123.113854][T28170] ? apparmor_file_permission+0x13f/0x1c0 [ 1123.113880][T28170] ? bpf_lsm_file_permission+0x9/0x10 [ 1123.113911][T28170] odev_write+0x51/0xa0 [ 1123.113935][T28170] vfs_write+0x2aa/0x1050 [ 1123.113963][T28170] ? __pfx_odev_write+0x10/0x10 [ 1123.113988][T28170] ? __pfx_vfs_write+0x10/0x10 [ 1123.114012][T28170] ? find_held_lock+0x2b/0x80 [ 1123.114033][T28170] ? __fget_files+0x215/0x3d0 [ 1123.114074][T28170] ? __fget_files+0x215/0x3d0 [ 1123.114103][T28170] ? __fget_files+0x21f/0x3d0 [ 1123.114137][T28170] ksys_write+0x12a/0x250 [ 1123.114163][T28170] ? __pfx_ksys_write+0x10/0x10 [ 1123.114188][T28170] ? ksys_write+0x1ac/0x250 [ 1123.114213][T28170] ? __pfx_ksys_write+0x10/0x10 [ 1123.114244][T28170] __do_fast_syscall_32+0xe7/0x970 [ 1123.114264][T28170] ? lockdep_hardirqs_on+0x78/0x100 [ 1123.114294][T28170] do_fast_syscall_32+0x32/0x70 [ 1123.114312][T28170] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1123.114335][T28170] RIP: 0023:0xf7f86fec [ 1123.114358][T28170] Code: Unable to access opcode bytes at 0xf7f86fc2. [ 1123.114366][T28170] RSP: 002b:00000000f542550c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 1123.114383][T28170] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000500 [ 1123.114395][T28170] RDX: 0000000000000052 RSI: 0000000000000000 RDI: 0000000000000000 [ 1123.114406][T28170] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1123.114417][T28170] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1123.114427][T28170] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1123.114452][T28170] [ 1124.401681][T28190] macsec1: entered promiscuous mode [ 1124.404792][T28190] virt_wifi0: entered promiscuous mode [ 1124.650291][T28201] overlayfs: failed to resolve './file2': -2 [ 1124.872174][T28216] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6477'. [ 1124.931089][T28218] FAULT_INJECTION: forcing a failure. [ 1124.931089][T28218] name failslab, interval 1, probability 0, space 0, times 0 [ 1124.937177][T28218] CPU: 1 UID: 0 PID: 28218 Comm: syz.2.6475 Tainted: G L syzkaller #0 PREEMPT(full) [ 1124.937232][T28218] Tainted: [L]=SOFTLOCKUP [ 1124.937240][T28218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1124.937251][T28218] Call Trace: [ 1124.937259][T28218] [ 1124.937267][T28218] dump_stack_lvl+0x100/0x190 [ 1124.937296][T28218] should_fail_ex.cold+0x5/0xa [ 1124.937313][T28218] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1124.937345][T28218] should_failslab+0xc2/0x120 [ 1124.937370][T28218] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1124.937393][T28218] ? skb_clone+0x190/0x400 [ 1124.937420][T28218] skb_clone+0x190/0x400 [ 1124.937443][T28218] netlink_deliver_tap+0xaed/0xcc0 [ 1124.937471][T28218] ? netlink_unicast+0x3e0/0x850 [ 1124.937501][T28218] netlink_unicast+0x62b/0x850 [ 1124.937532][T28218] ? __pfx_netlink_unicast+0x10/0x10 [ 1124.937593][T28218] netlink_sendmsg+0x8b0/0xda0 [ 1124.937625][T28218] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1124.937657][T28218] ? apparmor_socket_sendmsg+0x15b/0x270 [ 1124.937691][T28218] ____sys_sendmsg+0xa4d/0xbe0 [ 1124.937716][T28218] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1124.937742][T28218] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1124.937779][T28218] ___sys_sendmsg+0x190/0x1e0 [ 1124.937809][T28218] ? __pfx____sys_sendmsg+0x10/0x10 [ 1124.937849][T28218] ? find_held_lock+0x2b/0x80 [ 1124.937888][T28218] __sys_sendmsg+0x160/0x210 [ 1124.937911][T28218] ? __pfx___sys_sendmsg+0x10/0x10 [ 1124.937940][T28218] ? __pfx_ksys_write+0x10/0x10 [ 1124.937978][T28218] __do_fast_syscall_32+0xe7/0x970 [ 1124.937999][T28218] ? lockdep_hardirqs_on+0x78/0x100 [ 1124.938027][T28218] do_fast_syscall_32+0x32/0x70 [ 1124.938046][T28218] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1124.938087][T28218] RIP: 0023:0xf7f12fec [ 1124.938111][T28218] Code: Unable to access opcode bytes at 0xf7f12fc2. [ 1124.938119][T28218] RSP: 002b:00000000f539450c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1124.938136][T28218] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000080 [ 1124.938148][T28218] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1124.938158][T28218] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1124.938168][T28218] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1124.938178][T28218] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1124.938202][T28218] [ 1124.952038][T28220] fuse: fd is not a fuse device [ 1125.076308][T28212] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 1125.223328][T28223] wg2 speed is unknown, defaulting to 1000 [ 1126.715846][T28257] overlayfs: failed to clone upperpath [ 1126.924384][T23547] usb 8-1: new high-speed USB device number 49 using dummy_hcd [ 1127.093067][T28265] wg2 speed is unknown, defaulting to 1000 [ 1127.104114][T23547] usb 8-1: Using ep0 maxpacket: 32 [ 1127.109422][T23547] usb 8-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1127.124203][T23547] usb 8-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1127.128711][T23547] usb 8-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1127.133014][T23547] usb 8-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1127.149528][T23547] usb 8-1: New USB device found, idVendor=1500, idProduct=ffdc, bcdDevice=bd.30 [ 1127.153248][T23547] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1127.160900][T23547] usb 8-1: Product: syz [ 1127.162617][T23547] usb 8-1: Manufacturer: syz [ 1127.167237][T23547] usb 8-1: SerialNumber: syz [ 1127.304492][T28272] FAULT_INJECTION: forcing a failure. [ 1127.304492][T28272] name failslab, interval 1, probability 0, space 0, times 0 [ 1127.308660][T28272] CPU: 3 UID: 0 PID: 28272 Comm: syz.2.6493 Tainted: G L syzkaller #0 PREEMPT(full) [ 1127.308680][T28272] Tainted: [L]=SOFTLOCKUP [ 1127.308684][T28272] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1127.308692][T28272] Call Trace: [ 1127.308696][T28272] [ 1127.308702][T28272] dump_stack_lvl+0x100/0x190 [ 1127.308720][T28272] should_fail_ex.cold+0x5/0xa [ 1127.308735][T28272] should_failslab+0xc2/0x120 [ 1127.308751][T28272] __kmalloc_cache_noprof+0x91/0x6c0 [ 1127.308770][T28272] ? rcu_is_watching+0x12/0xc0 [ 1127.308783][T28272] ? binder_alloc_new_buf+0x1929/0x3050 [ 1127.308804][T28272] binder_alloc_new_buf+0x1929/0x3050 [ 1127.308827][T28272] ? __pfx_binder_alloc_new_buf+0x10/0x10 [ 1127.308847][T28272] binder_transaction+0x1ebc/0x9bb0 [ 1127.308873][T28272] ? __lock_acquire+0x49f/0x1a40 [ 1127.308892][T28272] ? __pfx_binder_transaction+0x10/0x10 [ 1127.308916][T28272] ? __lock_acquire+0x49f/0x1a40 [ 1127.308942][T28272] ? __lock_acquire+0x49f/0x1a40 [ 1127.308959][T28272] ? __lock_acquire+0x49f/0x1a40 [ 1127.308976][T28272] ? __pfx_widen_string+0x10/0x10 [ 1127.308996][T28272] ? find_held_lock+0x2b/0x80 [ 1127.309008][T28272] ? __might_fault+0xc5/0x140 [ 1127.309019][T28272] ? __might_fault+0xc5/0x140 [ 1127.309035][T28272] binder_thread_write+0x12f4/0x4db0 [ 1127.309052][T28272] ? kasan_save_track+0x14/0x30 [ 1127.309064][T28272] ? kasan_save_free_info+0x3b/0x70 [ 1127.309085][T28272] ? __pfx_binder_thread_write+0x10/0x10 [ 1127.309101][T28272] ? binder_debug+0xe0/0x190 [ 1127.309113][T28272] ? __pfx_binder_debug+0x10/0x10 [ 1127.309125][T28272] ? binder_debug+0xe0/0x190 [ 1127.309137][T28272] ? __pfx_binder_debug+0x10/0x10 [ 1127.309157][T28272] ? __pfx_binder_ioctl+0x10/0x10 [ 1127.309195][T28272] binder_ioctl+0x28ca/0x74a0 [ 1127.309215][T28272] ? tomoyo_path_number_perm+0x28f/0x580 [ 1127.309229][T28272] ? tomoyo_path_number_perm+0x28f/0x580 [ 1127.309245][T28272] ? tomoyo_path_number_perm+0x188/0x580 [ 1127.309258][T28272] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1127.309272][T28272] ? __pfx_binder_ioctl+0x10/0x10 [ 1127.309289][T28272] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1127.309307][T28272] ? do_vfs_ioctl+0x226/0x13e0 [ 1127.309327][T28272] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1127.309346][T28272] ? find_held_lock+0x2b/0x80 [ 1127.309359][T28272] ? __fget_files+0x215/0x3d0 [ 1127.309375][T28272] ? hook_file_ioctl_common+0x140/0x440 [ 1127.309391][T28272] ? __fget_files+0x21f/0x3d0 [ 1127.309420][T28272] ? __pfx_binder_ioctl+0x10/0x10 [ 1127.309441][T28272] compat_ptr_ioctl+0x6e/0xa0 [ 1127.309462][T28272] ? __pfx_compat_ptr_ioctl+0x10/0x10 [ 1127.309484][T28272] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1127.309511][T28272] __do_fast_syscall_32+0xe7/0x970 [ 1127.309530][T28272] ? lockdep_hardirqs_on+0x78/0x100 [ 1127.309560][T28272] do_fast_syscall_32+0x32/0x70 [ 1127.309576][T28272] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1127.309592][T28272] RIP: 0023:0xf7f12fec [ 1127.309607][T28272] Code: Unable to access opcode bytes at 0xf7f12fc2. [ 1127.309613][T28272] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1127.309625][T28272] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0306201 [ 1127.309632][T28272] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 1127.309639][T28272] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1127.309646][T28272] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1127.309653][T28272] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1127.309668][T28272] [ 1127.402517][T23547] usb 8-1: USB disconnect, device number 49 [ 1128.906326][T28311] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6505'. [ 1129.067261][T28308] wg2 speed is unknown, defaulting to 1000 [ 1129.266612][T19804] usb 7-1: new high-speed USB device number 121 using dummy_hcd [ 1129.275243][T28319] binder: BINDER_SET_CONTEXT_MGR already set [ 1129.277397][T28319] binder: 28318:28319 ioctl 4018620d 80000240 returned -16 [ 1129.283070][T28319] binder: BINDER_SET_CONTEXT_MGR already set [ 1129.286819][T28319] binder: 28318:28319 ioctl 4018620d 80000040 returned -16 [ 1129.424838][T19804] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 1129.428181][T19804] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1129.431016][T19804] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1129.434872][T19804] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1129.437882][T19804] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1129.440782][T19804] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1129.444880][T19804] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1129.448115][T19804] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1129.451743][T19804] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1129.456253][T19804] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1129.459363][T19804] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1129.462537][T19804] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1129.468419][T19804] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1129.493056][T19804] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1129.495903][T19804] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1129.499299][T19804] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1129.502140][T19804] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1129.505271][T19804] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1129.508541][T19804] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1129.511484][T19804] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1129.514398][T19804] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1129.519425][T19804] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1129.522489][T19804] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1129.525833][T19804] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1129.529566][T19804] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1129.533993][T19804] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1129.537451][T19804] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1129.540255][T19804] usb 7-1: Product: syz [ 1129.541713][T19804] usb 7-1: Manufacturer: syz [ 1129.543323][T19804] usb 7-1: SerialNumber: syz [ 1129.551593][T19804] usb 7-1: config 0 descriptor?? [ 1129.563995][T19804] yurex 7-1:0.0: USB YUREX device now attached to Yurex #0 [ 1129.814297][T23547] usb 7-1: USB disconnect, device number 121 [ 1129.840940][T23547] yurex 7-1:0.0: USB YUREX #0 now disconnected [ 1129.864247][T19804] usb 6-1: new high-speed USB device number 118 using dummy_hcd [ 1129.894833][T28325] binder: BINDER_SET_CONTEXT_MGR already set [ 1129.896794][T28325] binder: 28324:28325 ioctl 4018620d 80004a80 returned -16 [ 1130.004320][T28328] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 1130.014928][T19804] usb 6-1: too many configurations: 13, using maximum allowed: 8 [ 1130.018860][T19804] usb 6-1: config 0 has no interfaces? [ 1130.021321][T19804] usb 6-1: config 0 has no interfaces? [ 1130.023780][T19804] usb 6-1: config 0 has no interfaces? [ 1130.027383][T19804] usb 6-1: config 0 has no interfaces? [ 1130.030108][T19804] usb 6-1: config 0 has no interfaces? [ 1130.032621][T19804] usb 6-1: config 0 has no interfaces? [ 1130.035382][T19804] usb 6-1: config 0 has no interfaces? [ 1130.038039][T19804] usb 6-1: config 0 has no interfaces? [ 1130.041558][T19804] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1130.044386][T19804] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1130.046928][T19804] usb 6-1: Product: syz [ 1130.048336][T19804] usb 6-1: Manufacturer: syz [ 1130.049837][T19804] usb 6-1: SerialNumber: syz [ 1130.052666][T19804] usb 6-1: config 0 descriptor?? [ 1130.485760][ T5749] usb 6-1: USB disconnect, device number 118 [ 1130.506497][T28333] netlink: 'syz.2.6512': attribute type 11 has an invalid length. [ 1131.064282][ T5749] usb 6-1: new high-speed USB device number 119 using dummy_hcd [ 1131.166516][T28347] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6517'. [ 1131.172165][T28347] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6517'. [ 1131.177562][T28337] wg2 speed is unknown, defaulting to 1000 [ 1131.182004][T28347] netlink: 72 bytes leftover after parsing attributes in process `syz.2.6517'. [ 1131.234376][ T5749] usb 6-1: Using ep0 maxpacket: 32 [ 1131.243678][ T5749] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1131.259191][ T5749] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1131.263484][ T5749] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1131.266786][ T5749] usb 6-1: Product: syz [ 1131.268811][ T5749] usb 6-1: Manufacturer: syz [ 1131.270575][ T5749] usb 6-1: SerialNumber: syz [ 1131.277338][ T5749] usb 6-1: config 0 descriptor?? [ 1131.282733][T28331] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1131.524232][T23547] usb 7-1: new high-speed USB device number 122 using dummy_hcd [ 1131.543124][T28360] IPVS: Error connecting to the multicast addr [ 1131.674730][T23547] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 1131.689708][T23547] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1131.694931][T23547] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1131.699904][T23547] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1131.703070][T23547] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1131.707317][T23547] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1131.711746][T23547] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1131.716720][T23547] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1131.720406][T23547] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1131.725033][T23547] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1131.729094][T23547] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1131.732951][T23547] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1131.738345][T23547] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1131.742712][T23547] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1131.746936][T23547] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1131.751429][T23547] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1131.755844][T23547] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1131.759316][T23547] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1131.761976][T28366] batman_adv: batadv0: Adding interface: macvtap1 [ 1131.763259][T23547] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1131.764472][T23547] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1131.767908][T28366] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1131.767928][T28366] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 1131.782606][T23547] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1131.787559][T23547] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1131.791564][T23547] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1131.798633][T23547] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1131.809983][T23547] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1131.814294][T23547] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1131.820029][T23547] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1131.822643][T23547] usb 7-1: Product: syz [ 1131.823843][T23547] usb 7-1: Manufacturer: syz [ 1131.826458][T28365] batman_adv: batadv0: Removing interface: macvtap1 [ 1131.830874][T23547] usb 7-1: SerialNumber: syz [ 1131.847777][T23547] usb 7-1: config 0 descriptor?? [ 1131.878902][T23547] yurex 7-1:0.0: USB YUREX device now attached to Yurex #1 [ 1132.081504][T22595] usb 7-1: USB disconnect, device number 122 [ 1132.092225][T22595] yurex 7-1:0.0: USB YUREX #1 now disconnected [ 1132.497815][T28373] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6524'. [ 1132.650640][T28378] FAULT_INJECTION: forcing a failure. [ 1132.650640][T28378] name failslab, interval 1, probability 0, space 0, times 0 [ 1132.665340][T28378] CPU: 1 UID: 0 PID: 28378 Comm: syz.3.6526 Tainted: G L syzkaller #0 PREEMPT(full) [ 1132.665374][T28378] Tainted: [L]=SOFTLOCKUP [ 1132.665388][T28378] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1132.665400][T28378] Call Trace: [ 1132.665407][T28378] [ 1132.665415][T28378] dump_stack_lvl+0x100/0x190 [ 1132.665444][T28378] should_fail_ex.cold+0x5/0xa [ 1132.665466][T28378] should_failslab+0xc2/0x120 [ 1132.665491][T28378] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1132.665510][T28378] ? __pfx_map_id_range_down+0x10/0x10 [ 1132.665538][T28378] ? security_inode_alloc+0x3b/0x2c0 [ 1132.665563][T28378] security_inode_alloc+0x3b/0x2c0 [ 1132.665582][T28378] inode_init_always_gfp+0xc77/0xfb0 [ 1132.665614][T28378] alloc_inode+0x8e/0x250 [ 1132.665635][T28378] new_inode+0x22/0x1c0 [ 1132.665658][T28378] __debugfs_create_file+0x105/0x4f0 [ 1132.665687][T28378] debugfs_create_file_full+0x41/0x60 [ 1132.665713][T28378] ref_tracker_dir_debugfs+0x19e/0x2e0 [ 1132.665739][T28378] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 1132.665785][T28378] ? lockdep_init_map_type+0x5c/0x250 [ 1132.665815][T28378] ? __pfx_bond_setup+0x10/0x10 [ 1132.665839][T28378] alloc_netdev_mqs+0x314/0x15c0 [ 1132.665869][T28378] rtnl_create_link+0xc13/0xf80 [ 1132.665896][T28378] rtnl_newlink+0x13bd/0x2380 [ 1132.665927][T28378] ? __pfx_rtnl_newlink+0x10/0x10 [ 1132.665947][T28378] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1132.665972][T28378] ? __kernel_text_address+0xd/0x30 [ 1132.665997][T28378] ? unwind_get_return_address+0x59/0xa0 [ 1132.666042][T28378] ? __pfx_stack_trace_save+0x10/0x10 [ 1132.666073][T28378] ? find_held_lock+0x2b/0x80 [ 1132.666093][T28378] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 1132.666114][T28378] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 1132.666137][T28378] ? __pfx_rtnl_newlink+0x10/0x10 [ 1132.666159][T28378] rtnetlink_rcv_msg+0x95e/0xe90 [ 1132.666184][T28378] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1132.666211][T28378] ? __lock_acquire+0x49f/0x1a40 [ 1132.666241][T28378] netlink_rcv_skb+0x159/0x420 [ 1132.666269][T28378] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1132.666293][T28378] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1132.666328][T28378] ? netlink_deliver_tap+0x1ae/0xcc0 [ 1132.666377][T28378] netlink_unicast+0x585/0x850 [ 1132.666416][T28378] ? __pfx_netlink_unicast+0x10/0x10 [ 1132.666449][T28378] netlink_sendmsg+0x8b0/0xda0 [ 1132.666479][T28378] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1132.666509][T28378] ? apparmor_socket_sendmsg+0x15b/0x270 [ 1132.666541][T28378] ____sys_sendmsg+0xa4d/0xbe0 [ 1132.666565][T28378] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1132.666593][T28378] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1132.666630][T28378] ___sys_sendmsg+0x190/0x1e0 [ 1132.666657][T28378] ? __pfx____sys_sendmsg+0x10/0x10 [ 1132.666695][T28378] ? find_held_lock+0x2b/0x80 [ 1132.666737][T28378] __sys_sendmsg+0x160/0x210 [ 1132.666758][T28378] ? __pfx___sys_sendmsg+0x10/0x10 [ 1132.666786][T28378] ? __pfx_ksys_write+0x10/0x10 [ 1132.666818][T28378] __do_fast_syscall_32+0xe7/0x970 [ 1132.666837][T28378] ? lockdep_hardirqs_on+0x78/0x100 [ 1132.666865][T28378] do_fast_syscall_32+0x32/0x70 [ 1132.666883][T28378] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1132.666907][T28378] RIP: 0023:0xf7f57fec [ 1132.666931][T28378] Code: Unable to access opcode bytes at 0xf7f57fc2. [ 1132.666940][T28378] RSP: 002b:00000000f53f550c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 1132.666958][T28378] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000240 [ 1132.666969][T28378] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1132.666980][T28378] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1132.666990][T28378] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1132.667001][T28378] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1132.667025][T28378] [ 1132.667317][T28378] debugfs: out of free dentries, can not create file 'netdev@ffff88802ae10700' [ 1132.846079][T28378] bond4: entered promiscuous mode [ 1132.848471][T28378] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1132.874752][T28383] syzkaller0: entered promiscuous mode [ 1132.884030][T28383] syzkaller0: entered allmulticast mode [ 1132.898372][T28383] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6528'. [ 1132.916555][T28383] tipc: Enabled bearer , priority 0 [ 1132.930341][T28383] tipc: Resetting bearer [ 1132.937162][ T5749] usb 6-1: USB disconnect, device number 119 [ 1132.960066][T28382] tipc: Resetting bearer [ 1132.993314][T28382] tipc: Disabling bearer [ 1133.025450][T28400] binder: BINDER_SET_CONTEXT_MGR already set [ 1133.027528][T28400] binder: 28399:28400 ioctl 4018620d 80000100 returned -16 [ 1133.231018][T28405] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6534'. [ 1133.396026][T28411] 9p: Bad value for 'rfdno' [ 1133.668762][T28405] wg2 speed is unknown, defaulting to 1000 [ 1133.904965][T28396] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 1134.353414][ T5829] usb 8-1: new high-speed USB device number 50 using dummy_hcd [ 1134.505214][ T5829] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 1134.508962][ T5829] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1134.514154][ T5829] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1134.520749][ T5829] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1134.527005][ T5829] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1134.531697][ T5829] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1134.541836][ T5829] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1134.545330][ T5829] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1134.552640][ T5829] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1134.558370][ T5829] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1134.563895][ T5829] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1134.567032][ T5829] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1134.570790][ T5829] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1134.573971][ T5829] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1134.578100][ T5829] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1134.581569][ T5829] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1134.584810][ T5829] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1134.587790][ T5829] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1134.591200][ T5829] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1134.594241][ T5829] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1134.597203][ T5829] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1134.600485][ T5829] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1134.603428][ T5829] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1134.606391][ T5829] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1134.609820][ T5829] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1134.613623][ T5829] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1134.617119][ T5829] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1134.619737][ T5829] usb 8-1: Product: syz [ 1134.621140][ T5829] usb 8-1: Manufacturer: syz [ 1134.622628][ T5829] usb 8-1: SerialNumber: syz [ 1134.630705][ T5829] usb 8-1: config 0 descriptor?? [ 1134.639826][ T5829] yurex 8-1:0.0: USB YUREX device now attached to Yurex #0 [ 1134.684378][T28435] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6546'. [ 1134.842444][ T5791] usb 8-1: USB disconnect, device number 50 [ 1134.855966][ T5791] yurex 8-1:0.0: USB YUREX #0 now disconnected [ 1134.938797][T28440] trusted_key: encrypted_key: insufficient parameters specified [ 1134.940098][T28436] wg2 speed is unknown, defaulting to 1000 [ 1135.289038][T28453] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6551'. [ 1135.854191][ T5791] usb 7-1: new high-speed USB device number 123 using dummy_hcd [ 1136.063311][ T5791] usb 7-1: config index 0 descriptor too short (expected 259, got 27) [ 1136.084025][ T5791] usb 7-1: config 255 has too many interfaces: 255, using maximum allowed: 32 [ 1136.088830][ T5791] usb 7-1: config 255 contains an unexpected descriptor of type 0x1, skipping [ 1136.092853][ T5791] usb 7-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 1136.097811][ T5791] usb 7-1: config 255 has 0 interfaces, different from the descriptor's value: 255 [ 1136.107970][ T5791] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 1136.113408][ T5791] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 1136.116368][ T5791] usb 7-1: Product: syz [ 1136.118022][ T5791] usb 7-1: Manufacturer: syz [ 1136.119992][ T5791] usb 7-1: SerialNumber: syz [ 1136.335872][T28460] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1136.341380][T28460] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1136.550863][ T5791] usb 7-1: USB disconnect, device number 123 [ 1136.934362][T28491] FAULT_INJECTION: forcing a failure. [ 1136.934362][T28491] name failslab, interval 1, probability 0, space 0, times 0 [ 1136.938383][T28491] CPU: 0 UID: 0 PID: 28491 Comm: syz.1.6559 Tainted: G L syzkaller #0 PREEMPT(full) [ 1136.938402][T28491] Tainted: [L]=SOFTLOCKUP [ 1136.938406][T28491] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1136.938413][T28491] Call Trace: [ 1136.938418][T28491] [ 1136.938424][T28491] dump_stack_lvl+0x100/0x190 [ 1136.938442][T28491] should_fail_ex.cold+0x5/0xa [ 1136.938456][T28491] should_failslab+0xc2/0x120 [ 1136.938472][T28491] __kmalloc_cache_node_noprof+0x94/0x6c0 [ 1136.938487][T28491] ? lockdep_init_map_type+0x5c/0x250 [ 1136.938505][T28491] ? __alloc_workqueue+0x781/0x1940 [ 1136.938522][T28491] __alloc_workqueue+0x781/0x1940 [ 1136.938539][T28491] alloc_workqueue_noprof+0xc7/0x130 [ 1136.938552][T28491] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 1136.938565][T28491] ? __pfx_dev_set_name+0x10/0x10 [ 1136.938586][T28491] ? __kasan_kmalloc+0xaa/0xb0 [ 1136.938601][T28491] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1136.938623][T28491] hci_register_dev+0x1cd/0xc90 [ 1136.938646][T28491] hci_uart_tty_ioctl+0x8fd/0xcb0 [ 1136.938663][T28491] ? __pfx_hci_uart_tty_ioctl+0x10/0x10 [ 1136.938679][T28491] tty_compat_ioctl+0x24d/0x420 [ 1136.938694][T28491] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 1136.938708][T28491] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1136.938726][T28491] __do_fast_syscall_32+0xe7/0x970 [ 1136.938739][T28491] ? lockdep_hardirqs_on+0x78/0x100 [ 1136.938757][T28491] do_fast_syscall_32+0x32/0x70 [ 1136.938769][T28491] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1136.938784][T28491] RIP: 0023:0xf7f86fec [ 1136.938800][T28491] Code: Unable to access opcode bytes at 0xf7f86fc2. [ 1136.938805][T28491] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1136.938817][T28491] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000400455c8 [ 1136.938825][T28491] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1136.938831][T28491] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1136.938837][T28491] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1136.938844][T28491] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1136.938859][T28491] [ 1136.938883][T28491] Bluetooth: Can't register HCI device [ 1137.136892][T28498] FAULT_INJECTION: forcing a failure. [ 1137.136892][T28498] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1137.142031][T28498] CPU: 2 UID: 0 PID: 28498 Comm: syz.1.6563 Tainted: G L syzkaller #0 PREEMPT(full) [ 1137.142059][T28498] Tainted: [L]=SOFTLOCKUP [ 1137.142066][T28498] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1137.142077][T28498] Call Trace: [ 1137.142085][T28498] [ 1137.142094][T28498] dump_stack_lvl+0x100/0x190 [ 1137.142122][T28498] should_fail_ex.cold+0x5/0xa [ 1137.142145][T28498] _copy_to_user+0x32/0xd0 [ 1137.142174][T28498] simple_read_from_buffer+0xcb/0x170 [ 1137.142205][T28498] proc_fail_nth_read+0x1af/0x230 [ 1137.142231][T28498] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1137.142255][T28498] ? rw_verify_area+0xce/0x6d0 [ 1137.142280][T28498] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1137.142302][T28498] vfs_read+0x1e4/0xb40 [ 1137.142331][T28498] ? __pfx_vfs_read+0x10/0x10 [ 1137.142355][T28498] ? find_held_lock+0x2b/0x80 [ 1137.142377][T28498] ? __fget_files+0x215/0x3d0 [ 1137.142409][T28498] ? __fget_files+0x21f/0x3d0 [ 1137.142442][T28498] ksys_read+0x12a/0x250 [ 1137.142468][T28498] ? __pfx_ksys_read+0x10/0x10 [ 1137.142502][T28498] do_int80_emulation+0x14b/0x720 [ 1137.142526][T28498] asm_int80_emulation+0x1a/0x20 [ 1137.142546][T28498] RIP: 0023:0xf71871eb [ 1137.142563][T28498] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1137.142580][T28498] RSP: 002b:00000000f54464bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1137.142599][T28498] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54465d0 [ 1137.142611][T28498] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1137.142622][T28498] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1137.142633][T28498] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1137.142644][T28498] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1137.142669][T28498] [ 1137.183329][T28502] bond4: entered promiscuous mode [ 1137.209072][T28504] binder: 28499:28504 ioctl c0306201 80000480 returned -14 [ 1137.212948][T28502] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1137.219492][T28462] Process accounting resumed [ 1137.446448][T28523] netlink: 64 bytes leftover after parsing attributes in process `syz.3.6570'. [ 1137.451306][T28524] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6569'. [ 1137.623764][T28534] trusted_key: encrypted_key: insufficient parameters specified [ 1137.677509][T28538] fuse: fd is not a fuse device [ 1137.875758][ T103] ------------[ cut here ]------------ [ 1137.882652][ T103] time_after(jiffies, timeout) [ 1137.882669][ T103] WARNING: io_uring/io_uring.c:2365 at io_ring_exit_work+0x479/0xd7a, CPU#0: kworker/u33:5/103 [ 1137.889232][ T103] Modules linked in: [ 1137.891471][ T103] CPU: 0 UID: 0 PID: 103 Comm: kworker/u33:5 Tainted: G L syzkaller #0 PREEMPT(full) [ 1137.895137][ T103] Tainted: [L]=SOFTLOCKUP [ 1137.896605][ T103] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1137.899928][ T103] Workqueue: iou_exit io_ring_exit_work [ 1137.901759][ T103] RIP: 0010:io_ring_exit_work+0x479/0xd7a [ 1137.904628][ T103] Code: 8e e8 eb 59 43 01 48 8b 05 04 a4 4b 0d 4c 8b 7c 24 38 31 ff 49 29 c7 4c 89 fe e8 d2 d4 d3 00 4d 85 ff 79 12 e8 28 da d3 00 90 <0f> 0b 90 48 c7 44 24 20 70 17 00 00 e8 16 da d3 00 48 8b 74 24 20 [ 1137.914347][ T103] RSP: 0000:ffffc9000109faa0 EFLAGS: 00010293 [ 1137.917106][ T103] RAX: 0000000000000000 RBX: ffff888045f56710 RCX: ffffffff81354e8e [ 1137.920458][ T103] RDX: ffff888022498000 RSI: ffffffff81354e98 RDI: ffff888022498000 [ 1137.923819][ T103] RBP: ffffc9000109fc38 R08: 0000000000000007 R09: 0000000000000000 [ 1137.927389][ T103] R10: fffffffffffffffb R11: 0000000000000000 R12: ffff888045f56000 [ 1137.930679][ T103] R13: dffffc0000000000 R14: 0000000045f56700 R15: fffffffffffffffb [ 1137.933965][ T103] FS: 0000000000000000(0000) GS:ffff888096bf1000(0000) knlGS:0000000000000000 [ 1137.937228][ T103] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1137.939368][ T103] CR2: 0000000080004280 CR3: 000000000e992000 CR4: 0000000000352ef0 [ 1137.941903][ T103] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002 [ 1137.944401][ T103] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1137.946973][ T103] Call Trace: [ 1137.948159][ T103] [ 1137.949133][ T103] ? __pfx_io_ring_exit_work+0x10/0x10 [ 1137.950899][ T103] ? __pfx___schedule+0x10/0x10 [ 1137.952516][ T103] ? preempt_schedule_thunk+0x16/0x40 [ 1137.954513][ T103] process_one_work+0xa23/0x1940 [ 1137.956742][ T103] ? __pfx_process_one_work+0x10/0x10 [ 1137.958959][ T103] ? __pfx_io_ring_exit_work+0x10/0x10 [ 1137.961261][ T103] worker_thread+0x5ef/0xe50 [ 1137.963125][ T103] ? __pfx_worker_thread+0x10/0x10 [ 1137.964845][ T103] ? kthread+0x13a/0x450 [ 1137.966577][ T103] ? __pfx_worker_thread+0x10/0x10 [ 1137.968629][ T103] kthread+0x370/0x450 [ 1137.970331][ T103] ? __pfx_kthread+0x10/0x10 [ 1137.972255][ T103] ret_from_fork+0x72b/0xd50 [ 1137.974216][ T103] ? __pfx_ret_from_fork+0x10/0x10 [ 1137.975973][ T103] ? __switch_to+0x800/0x10f0 [ 1137.977606][ T103] ? __pfx_kthread+0x10/0x10 [ 1137.979199][ T103] ret_from_fork_asm+0x1a/0x30 [ 1137.980761][ T103] [ 1137.981787][ T103] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1137.984207][ T103] CPU: 0 UID: 0 PID: 103 Comm: kworker/u33:5 Tainted: G L syzkaller #0 PREEMPT(full) [ 1137.987631][ T103] Tainted: [L]=SOFTLOCKUP [ 1137.988983][ T103] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1137.992108][ T103] Workqueue: iou_exit io_ring_exit_work [ 1137.993925][ T103] Call Trace: [ 1137.994984][ T103] [ 1137.995927][ T103] dump_stack_lvl+0x100/0x190 [ 1137.997417][ T103] vpanic+0x552/0x970 [ 1137.998696][ T103] ? __pfx_vpanic+0x10/0x10 [ 1138.000123][ T103] panic+0xd1/0xe0 [ 1138.001308][ T103] ? __pfx_panic+0x10/0x10 [ 1138.002716][ T103] ? check_panic_on_warn+0x1f/0x90 [ 1138.004367][ T103] check_panic_on_warn.cold+0x19/0x34 [ 1138.006418][ T103] ? io_ring_exit_work+0x479/0xd7a [ 1138.008420][ T103] __warn.cold+0x191/0x318 [ 1138.010197][ T103] __report_bug+0x30f/0x440 [ 1138.012019][ T103] ? io_ring_exit_work+0x479/0xd7a [ 1138.014032][ T103] ? __pfx___report_bug+0x10/0x10 [ 1138.016047][ T103] ? rcu_is_watching+0x12/0xc0 [ 1138.017951][ T103] ? trace_contention_end+0x126/0x160 [ 1138.019995][ T103] ? __mutex_lock+0x26d/0x1bd0 [ 1138.021880][ T103] ? io_ring_exit_work+0x422/0xd7a [ 1138.023857][ T103] ? find_held_lock+0x2b/0x80 [ 1138.025352][ T103] ? io_ring_exit_work+0x434/0xd7a [ 1138.026988][ T103] ? io_ring_exit_work+0x479/0xd7a [ 1138.028692][ T103] report_bug+0xb2/0x220 [ 1138.030078][ T103] ? io_ring_exit_work+0x479/0xd7a [ 1138.031679][ T103] handle_bug+0x16a/0x2a0 [ 1138.033050][ T103] exc_invalid_op+0x17/0x50 [ 1138.034508][ T103] asm_exc_invalid_op+0x1a/0x20 [ 1138.036145][ T103] RIP: 0010:io_ring_exit_work+0x479/0xd7a [ 1138.038006][ T103] Code: 8e e8 eb 59 43 01 48 8b 05 04 a4 4b 0d 4c 8b 7c 24 38 31 ff 49 29 c7 4c 89 fe e8 d2 d4 d3 00 4d 85 ff 79 12 e8 28 da d3 00 90 <0f> 0b 90 48 c7 44 24 20 70 17 00 00 e8 16 da d3 00 48 8b 74 24 20 [ 1138.044231][ T103] RSP: 0000:ffffc9000109faa0 EFLAGS: 00010293 [ 1138.046221][ T103] RAX: 0000000000000000 RBX: ffff888045f56710 RCX: ffffffff81354e8e [ 1138.048737][ T103] RDX: ffff888022498000 RSI: ffffffff81354e98 RDI: ffff888022498000 [ 1138.051185][ T103] RBP: ffffc9000109fc38 R08: 0000000000000007 R09: 0000000000000000 [ 1138.053668][ T103] R10: fffffffffffffffb R11: 0000000000000000 R12: ffff888045f56000 [ 1138.056115][ T103] R13: dffffc0000000000 R14: 0000000045f56700 R15: fffffffffffffffb [ 1138.058583][ T103] ? io_ring_exit_work+0x46e/0xd7a [ 1138.060157][ T103] ? io_ring_exit_work+0x478/0xd7a [ 1138.061781][ T103] ? __pfx_io_ring_exit_work+0x10/0x10 [ 1138.063504][ T103] ? __pfx___schedule+0x10/0x10 [ 1138.065250][ T103] ? preempt_schedule_thunk+0x16/0x40 [ 1138.066940][ T103] process_one_work+0xa23/0x1940 [ 1138.068566][ T103] ? __pfx_process_one_work+0x10/0x10 [ 1138.070253][ T103] ? __pfx_io_ring_exit_work+0x10/0x10 [ 1138.071921][ T103] worker_thread+0x5ef/0xe50 [ 1138.073367][ T103] ? __pfx_worker_thread+0x10/0x10 [ 1138.074979][ T103] ? kthread+0x13a/0x450 [ 1138.076380][ T103] ? __pfx_worker_thread+0x10/0x10 [ 1138.078036][ T103] kthread+0x370/0x450 [ 1138.079351][ T103] ? __pfx_kthread+0x10/0x10 [ 1138.080910][ T103] ret_from_fork+0x72b/0xd50 [ 1138.082709][ T103] ? __pfx_ret_from_fork+0x10/0x10 [ 1138.084693][ T103] ? __switch_to+0x800/0x10f0 [ 1138.086596][ T103] ? __pfx_kthread+0x10/0x10 [ 1138.088217][ T103] ret_from_fork_asm+0x1a/0x30 [ 1138.089812][ T103] [ 1138.091503][ T103] Kernel Offset: disabled [ 1138.092980][ T103] Rebooting in 86400 seconds..