program: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt(r0, 0x0, 0x482, &(0x7f0000000100)="110000007f0000014e2100000000000074776f730000000000000000000000000000000000000000ffffffff", 0x2c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x4, 0x4, 0x4, 0xc, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB="18120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000008000023bfa400000000000007040000f8ffffffb705000008000000850000001900000095"], &(0x7f00000002c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$TCSETS(r4, 0x5402, &(0x7f0000000040)={0x1000, 0x5, 0x8, 0x3, 0xb, "9591c289333bef7d35119544ed641462d4304c"}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r2, 0x0, 0xe, 0x0, &(0x7f0000000500)="11223344556677889900aabbccdd", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$inet_udp(0x2, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000002880), r5) r7 = io_uring_setup(0xf08, &(0x7f0000000780)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) io_uring_register$IORING_REGISTER_FILES(r7, 0x25, &(0x7f0000000000)=[r7], 0x1) sendmsg$BATADV_CMD_GET_ORIGINATORS(r5, &(0x7f0000002940)={0x0, 0x0, &(0x7f0000002900)={&(0x7f00000028c0)={0x24, r6, 0x301, 0x70bd2a, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x48c5}, 0x24008040) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r8, &(0x7f0000000400)='md0\n', 0x4) r9 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r9, &(0x7f0000000600)='1.0\n\x00', 0x4) syz_emit_ethernet(0x66, &(0x7f0000000280)=ANY=[], 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./file0\x00', 0x42, 0x1ff) ftruncate(r10, 0x200000) pwrite64(r10, &(0x7f0000001000)="fc4e2ba90100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006400000000000000010000000000000000080000000000004000000002000000000000000000000000000000000000000000000000000000000000000000000000000000f00f000000000000f00f000000000000000000000000000000000000000000000000000000000000000000006400000001000000000000000000000000000000ec772ca90200"/199, 0xc7, 0x1fe000) syz_open_dev$loop(&(0x7f0000000800), 0x0, 0x2) [ 93.446097][ T5275] Bluetooth: hci0: command tx timeout [ 93.465328][ T10] cfg80211: failed to load regulatory.db [ 93.585906][ T10] IPVS: starting estimator thread 0... [ 93.678898][ T5321] IPVS: using max 58 ests per chain, 139200 per kthread [ 93.789322][ T1363] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.939756][ T1363] usb 5-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 93.945571][ T1363] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 93.952705][ T1363] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 93.957811][ T1363] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.996625][ T1363] spcp8x5 5-1:1.0: SPCP8x5 converter detected [ 94.015411][ T1363] usb 5-1: SPCP8x5 converter now attached to ttyUSB0 [ 94.349465][ T5316] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 94.352688][ T5316] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 94.357288][ T5316] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 94.451249][ T5316] SPCP8x5 ttyUSB0: Set UART format 0xb failed (error = -32) [ 94.539633][ T5317] Zero length message leads to an empty skb [ 94.567234][ T5317] ------------[ cut here ]------------ [ 94.570697][ T5317] do not call blocking ops when !TASK_RUNNING; state=1 set at [] prepare_to_wait+0x174/0x210 [ 94.576062][ T5317] WARNING: kernel/sched/core.c:9129 at __might_sleep+0x92/0xf0, CPU#0: syz.0.0/5317 [ 94.580402][ T5317] Modules linked in: [ 94.582224][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.585993][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.590235][ T5317] RIP: 0010:__might_sleep+0xac/0xf0 [ 94.592538][ T5317] Code: 00 00 48 89 3c 24 41 89 f5 4c 8d 35 ee 14 c5 0e 43 80 3c 3c 00 74 08 48 89 df e8 df 67 a0 00 48 8b 0b 4c 89 f7 89 ee 48 89 ca <67> 48 0f b9 3a 44 89 ee 48 8b 3c 24 eb b5 44 89 f1 80 e1 07 80 c1 [ 94.600835][ T5317] RSP: 0018:ffffc9000efe7550 EFLAGS: 00010246 [ 94.603378][ T5317] RAX: 0000000000000000 RBX: ffff88803eabe380 RCX: ffffffff819f93c4 [ 94.606523][ T5317] RDX: ffffffff819f93c4 RSI: 0000000000000001 RDI: ffffffff905b2570 [ 94.609658][ T5317] RBP: 0000000000000001 R08: ffffc9000efe7358 R09: 0000000000000020 [ 94.612779][ T5317] R10: 0000000000000000 R11: ffffffff81a316e0 R12: 1ffff11007d57c70 [ 94.616002][ T5317] R13: 0000000000000143 R14: ffffffff905b2570 R15: dffffc0000000000 [ 94.619264][ T5317] FS: 00007ff8681816c0(0000) GS:ffff88808c533000(0000) knlGS:0000000000000000 [ 94.622791][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.625699][ T5317] CR2: 0000200000000700 CR3: 0000000043752000 CR4: 0000000000352ef0 [ 94.629188][ T5317] Call Trace: [ 94.630678][ T5317] [ 94.632019][ T5317] __kmalloc_cache_noprof+0x94/0x660 [ 94.634392][ T5317] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 94.636756][ T5317] ? spcp8x5_get_msr+0xd3/0x2d0 [ 94.639064][ T5317] ? spcp8x5_get_msr+0xd3/0x2d0 [ 94.641242][ T5317] spcp8x5_get_msr+0xd3/0x2d0 [ 94.643314][ T5317] ? __pfx_spcp8x5_carrier_raised+0x10/0x10 [ 94.645939][ T5317] spcp8x5_carrier_raised+0x30/0x80 [ 94.648155][ T5317] serial_port_carrier_raised+0x8c/0xc0 [ 94.650665][ T5317] tty_port_block_til_ready+0x44d/0x890 [ 94.653040][ T5317] ? __pfx_tty_port_block_til_ready+0x10/0x10 [ 94.655778][ T5317] ? __pfx_autoremove_wake_function+0x10/0x10 [ 94.658534][ T5317] ? _raw_spin_unlock_irq_enable+0x4f/0xa0 [ 94.661061][ T5317] ? tty_port_open+0x234/0x2b0 [ 94.663159][ T5317] tty_open+0x48a/0xcc0 [ 94.665990][ T5317] ? __pfx_tty_open+0x10/0x10 [ 94.668126][ T5317] ? do_raw_spin_unlock+0x4d/0x200 [ 94.673093][ T5317] chrdev_open+0x4d9/0x600 [ 94.675928][ T5317] ? __pfx_chrdev_open+0x10/0x10 [ 94.678069][ T5317] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 94.682189][ T5317] ? __pfx_chrdev_open+0x10/0x10 [ 94.684472][ T5317] do_dentry_open+0x816/0x1380 [ 94.686628][ T5317] vfs_open+0x3b/0x340 [ 94.688463][ T5317] ? path_openat+0x1428/0x1d60 [ 94.690519][ T5317] path_openat+0x1443/0x1d60 [ 94.692587][ T5317] do_file_open+0x23e/0x4a0 [ 94.694581][ T5317] ? __pfx_do_file_open+0x10/0x10 [ 94.696787][ T5317] ? _raw_spin_unlock+0x28/0x50 [ 94.699052][ T5317] ? alloc_fd+0x651/0x6c0 [ 94.700942][ T5317] do_sys_openat2+0x115/0x200 [ 94.703044][ T5317] ? __se_sys_futex+0x3a8/0x450 [ 94.705250][ T5317] ? __pfx_do_sys_openat2+0x10/0x10 [ 94.707457][ T5317] ? rcu_is_watching+0x16/0xb0 [ 94.709640][ T5317] __x64_sys_openat+0x138/0x170 [ 94.711785][ T5317] do_syscall_64+0x166/0x520 [ 94.713854][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.716598][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.718818][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.721428][ T5317] RIP: 0033:0x7ff86739e0d9 [ 94.723493][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.731391][ T5317] RSP: 002b:00007ff868180fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 94.734933][ T5317] RAX: ffffffffffffffda RBX: 00007ff867626090 RCX: 00007ff86739e0d9 [ 94.738265][ T5317] RDX: 0000000000000042 RSI: 0000200000000700 RDI: ffffffffffffff9c [ 94.742319][ T5317] RBP: 00007ff867435024 R08: 0000000000000000 R09: 0000000000000000 [ 94.745685][ T5317] R10: 00000000000001ff R11: 0000000000000246 R12: 0000000000000000 [ 94.749082][ T5317] R13: 00007ff867626128 R14: 00007ff867626090 R15: 00007ffd307ae098 [ 94.752563][ T5317] [ 94.753998][ T5317] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.757125][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.760866][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.765064][ T5317] Call Trace: [ 94.766527][ T5317] [ 94.767705][ T5317] vpanic+0x56d/0xa60 [ 94.769397][ T5317] ? __pfx__printk+0x10/0x10 [ 94.771347][ T5317] ? __pfx_vpanic+0x10/0x10 [ 94.773294][ T5317] ? is_bpf_text_address+0x292/0x2b0 [ 94.775396][ T5317] ? is_bpf_text_address+0x26/0x2b0 [ 94.777463][ T5317] panic+0xc5/0xd0 [ 94.779032][ T5317] ? __pfx_panic+0x10/0x10 [ 94.780884][ T5317] __warn+0x315/0x4c0 [ 94.782636][ T5317] ? __might_sleep+0x92/0xf0 [ 94.784655][ T5317] ? __might_sleep+0x92/0xf0 [ 94.786626][ T5317] __report_bug+0x276/0x570 [ 94.788449][ T5317] ? __might_sleep+0x92/0xf0 [ 94.790335][ T5317] ? __pfx___report_bug+0x10/0x10 [ 94.792420][ T5317] ? prepare_to_wait+0x174/0x210 [ 94.794531][ T5317] ? prepare_to_wait+0x174/0x210 [ 94.796514][ T5317] ? irqentry_exit+0x218/0x910 [ 94.798513][ T5317] report_bug_entry+0x19b/0x290 [ 94.800453][ T5317] ? __might_sleep+0xac/0xf0 [ 94.802431][ T5317] ? __might_sleep+0xb1/0xf0 [ 94.804457][ T5317] handle_bug+0xce/0x200 [ 94.806282][ T5317] exc_invalid_op+0x1a/0x50 [ 94.808288][ T5317] asm_exc_invalid_op+0x1a/0x20 [ 94.810376][ T5317] RIP: 0010:__might_sleep+0xac/0xf0 [ 94.812584][ T5317] Code: 00 00 48 89 3c 24 41 89 f5 4c 8d 35 ee 14 c5 0e 43 80 3c 3c 00 74 08 48 89 df e8 df 67 a0 00 48 8b 0b 4c 89 f7 89 ee 48 89 ca <67> 48 0f b9 3a 44 89 ee 48 8b 3c 24 eb b5 44 89 f1 80 e1 07 80 c1 [ 94.820582][ T5317] RSP: 0018:ffffc9000efe7550 EFLAGS: 00010246 [ 94.823169][ T5317] RAX: 0000000000000000 RBX: ffff88803eabe380 RCX: ffffffff819f93c4 [ 94.826419][ T5317] RDX: ffffffff819f93c4 RSI: 0000000000000001 RDI: ffffffff905b2570 [ 94.829761][ T5317] RBP: 0000000000000001 R08: ffffc9000efe7358 R09: 0000000000000020 [ 94.833172][ T5317] R10: 0000000000000000 R11: ffffffff81a316e0 R12: 1ffff11007d57c70 [ 94.836594][ T5317] R13: 0000000000000143 R14: ffffffff905b2570 R15: dffffc0000000000 [ 94.839828][ T5317] ? __pfx_hlock_conflict+0x10/0x10 [ 94.841933][ T5317] ? prepare_to_wait+0x174/0x210 [ 94.843818][ T5317] ? prepare_to_wait+0x174/0x210 [ 94.845994][ T5317] __kmalloc_cache_noprof+0x94/0x660 [ 94.848228][ T5317] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 94.850446][ T5317] ? spcp8x5_get_msr+0xd3/0x2d0 [ 94.852424][ T5317] ? spcp8x5_get_msr+0xd3/0x2d0 [ 94.854447][ T5317] spcp8x5_get_msr+0xd3/0x2d0 [ 94.856420][ T5317] ? __pfx_spcp8x5_carrier_raised+0x10/0x10 [ 94.858926][ T5317] spcp8x5_carrier_raised+0x30/0x80 [ 94.861135][ T5317] serial_port_carrier_raised+0x8c/0xc0 [ 94.863417][ T5317] tty_port_block_til_ready+0x44d/0x890 [ 94.865814][ T5317] ? __pfx_tty_port_block_til_ready+0x10/0x10 [ 94.868282][ T5317] ? __pfx_autoremove_wake_function+0x10/0x10 [ 94.870720][ T5317] ? _raw_spin_unlock_irq_enable+0x4f/0xa0 [ 94.873146][ T5317] ? tty_port_open+0x234/0x2b0 [ 94.875145][ T5317] tty_open+0x48a/0xcc0 [ 94.876869][ T5317] ? __pfx_tty_open+0x10/0x10 [ 94.878820][ T5317] ? do_raw_spin_unlock+0x4d/0x200 [ 94.880886][ T5317] chrdev_open+0x4d9/0x600 [ 94.882771][ T5317] ? __pfx_chrdev_open+0x10/0x10 [ 94.884899][ T5317] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 94.887551][ T5317] ? __pfx_chrdev_open+0x10/0x10 [ 94.889830][ T5317] do_dentry_open+0x816/0x1380 [ 94.891902][ T5317] vfs_open+0x3b/0x340 [ 94.893604][ T5317] ? path_openat+0x1428/0x1d60 [ 94.895693][ T5317] path_openat+0x1443/0x1d60 [ 94.897577][ T5317] do_file_open+0x23e/0x4a0 [ 94.899553][ T5317] ? __pfx_do_file_open+0x10/0x10 [ 94.901625][ T5317] ? _raw_spin_unlock+0x28/0x50 [ 94.903754][ T5317] ? alloc_fd+0x651/0x6c0 [ 94.905765][ T5317] do_sys_openat2+0x115/0x200 [ 94.907815][ T5317] ? __se_sys_futex+0x3a8/0x450 [ 94.909896][ T5317] ? __pfx_do_sys_openat2+0x10/0x10 [ 94.912002][ T5317] ? rcu_is_watching+0x16/0xb0 [ 94.914081][ T5317] __x64_sys_openat+0x138/0x170 [ 94.916167][ T5317] do_syscall_64+0x166/0x520 [ 94.918186][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.920701][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.922651][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.925096][ T5317] RIP: 0033:0x7ff86739e0d9 [ 94.926975][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.934805][ T5317] RSP: 002b:00007ff868180fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 94.938209][ T5317] RAX: ffffffffffffffda RBX: 00007ff867626090 RCX: 00007ff86739e0d9 [ 94.941286][ T5317] RDX: 0000000000000042 RSI: 0000200000000700 RDI: ffffffffffffff9c [ 94.944471][ T5317] RBP: 00007ff867435024 R08: 0000000000000000 R09: 0000000000000000 [ 94.947583][ T5317] R10: 00000000000001ff R11: 0000000000000246 R12: 0000000000000000 [ 94.950692][ T5317] R13: 00007ff867626128 R14: 00007ff867626090 R15: 00007ffd307ae098 [ 94.953552][ T5317] [ 94.955191][ T5317] Kernel Offset: disabled [ 94.956849][ T5317] Rebooting in 86400 seconds..