last executing test programs: 3.564696723s ago: executing program 2 (id=2370): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000080)={0x1, 0x0, 0x2}) ptrace$setopts(0x4200, r0, 0x0, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0x4212, r0, 0x58, &(0x7f0000000080)) 3.343203888s ago: executing program 2 (id=2371): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x0, @local}, {0x2, 0x4e23, @loopback}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x8}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 3.307253617s ago: executing program 2 (id=2373): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000180)=[@in6={0xa, 0x4e20, 0x0, @loopback}]}, &(0x7f00000002c0)=0xc) 3.249973576s ago: executing program 2 (id=2374): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)={0x1c, r3, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4040040}, 0x44) sendmsg$NL80211_CMD_ABORT_SCAN(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000540)={0x1c, r0, 0xd9b2794f6a139537, 0x0, 0xe7030000, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}}, 0x0) 737.009569ms ago: executing program 2 (id=2398): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x10, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r2, {}, {0x5}, {0xfff3}}}, 0x24}}, 0x0) pwritev2(r0, &(0x7f00000005c0)=[{&(0x7f0000000380)="92ee7bcb", 0x4}], 0x1, 0x4, 0x11, 0x15) 516.554108ms ago: executing program 3 (id=2405): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/console\x00', 0x1, 0x94) ioctl$TCSBRKP(r1, 0x5425, 0x30580000000000) 472.639465ms ago: executing program 3 (id=2406): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000640)={'batadv0\x00', 0x0}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000040)={0x2c, r3, 0x1, 0x70bd28, 0x0, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x2c}}, 0x80) sendmsg$nl_route_sched(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, r2, {0xffe0, 0x1}, {0xe, 0xfff3}, {0xfff1}}}, 0x24}}, 0x4) 457.782532ms ago: executing program 2 (id=2407): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000600)=ANY=[@ANYBLOB="140100002d0001000000000000000000030100800c0000000000000000000000140001000000000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94", @ANYRES32=0x0], 0x114}], 0x1}, 0x11) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000005c0)={0x0}}, 0x40804) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="6c000000020603000000000000000000070000001c00078008000840000000e2050015000200000008001240000000040500010006000000050005000200000005000400050000000900020073797a310000000015000300686173683a69702c706f72742c6e657400"], 0x6c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, 0xd, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048090}, 0x8080) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x5c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010100}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x5064}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/my_zoned_dev\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/my_zoned_dev/memory_backed\x00', 0x101002, 0x0) write(r1, &(0x7f00000001c0)='1\x00', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nullb/my_zoned_dev/zoned\x00', 0x2, 0xb96e0453b2f36300) r3 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797afc3c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000010b615cd89f1b3621c000340000000022c00b3120e0a1f0200000000000000000a0000000900010073797a31000000000900020073797a310000000014000000110001"], 0xcc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x128}, 0x1, 0x0, 0x0, 0x4000}, 0x842) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="180100003000010003000000fbdbdf2506"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) sendto$inet6(r3, &(0x7f0000000040)="800037bbfa9ba1ce", 0xe80b, 0x0, 0x0, 0x0) recvfrom$inet6(r3, &(0x7f0000000080)=""/240, 0xfffffffffffffcea, 0x10020, 0x0, 0x0) write(r2, &(0x7f0000000240)='1\x00', 0x1) r5 = syz_open_procfs(0x0, 0x0) readv(r5, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/140, 0x8c}], 0x100000000000002a) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r6, 0x8946, &(0x7f0000000100)) r7 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/my_zoned_dev/power\x00', 0x2, 0x0) write(r7, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000340)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./dev/my_zoned_dev\x00', 0x2, 0x110) 442.610399ms ago: executing program 1 (id=2408): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./mnt\x00', 0x24) mount(&(0x7f00000003c0)=@filename='./dev/sda1\x00', &(0x7f0000000400)='./mnt\x00', &(0x7f0000000440)='ext4\x00', 0x8410, 0x0) r0 = open$dir(&(0x7f0000000480)='./mnt\x00', 0x0, 0x2) r1 = add_key$fscrypt_provisioning(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)={0x1, 0x0, @c}, 0x29, 0xfffffffffffffffb) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f00000008c0)={@id={0x2, 0x0, @c}, 0x0, r1}) 439.112785ms ago: executing program 0 (id=2409): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote}, 0x1c) shutdown(r0, 0x1) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0xff, @remote, @local, {[], {{0x4e22, 0x4e22, 0x0, 0x41424344, 0x0, 0x0, 0x5, 0x18, 0x1000, 0x0, 0x10}}}}}}}, 0x0) 375.868785ms ago: executing program 1 (id=2410): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x65) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000200)={{0x3, 0x1, 0x1, 0x1}, 'syz0\x00', 0x1}) ioctl$UI_DEV_CREATE(r0, 0x5501) write$input_event(r0, &(0x7f0000000380)={{}, 0x1, 0x65, 0x1}, 0x18) write$input_event(r0, &(0x7f00000003c0), 0x18) 375.706527ms ago: executing program 0 (id=2411): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000180)=@file={0x1}, 0x6e) listen(r0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) connect$unix(r1, &(0x7f0000000000)=@file={0x1}, 0x6e) connect$unix(r1, &(0x7f0000000080)=@file={0x1}, 0x6e) accept4(r0, 0x0, 0x0, 0x0) 332.406061ms ago: executing program 3 (id=2412): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x80, 0x51}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xb}, {}, {0xfff2, 0xa}}, [@filter_kind_options=@f_bpf={{0x8}, {0x10, 0x2, [@TCA_BPF_OPS={{0x6}, {0x4}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) 331.442097ms ago: executing program 1 (id=2413): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x2000b, 0x1000005, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="30000000240001040100000000000000000000000100000000000000ffffffff000000000a0001007465716c30000000", 0x30) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x3, 0xff, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) 296.415246ms ago: executing program 0 (id=2414): socket$inet_udp(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0xf) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000002c0)='mounts\x00') io_submit(0x0, 0x1, &(0x7f0000000280)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0xfffe, r1, 0x0}]) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="20000000110001"], 0x20}}, 0x2000e844) 270.241241ms ago: executing program 1 (id=2415): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000600)=ANY=[@ANYBLOB="140100002d0001000000000000000000030100800c0000000000000000000000140001000000000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94", @ANYRES32=0x0], 0x114}], 0x1}, 0x11) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000005c0)={0x0}}, 0x40804) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="6c000000020603000000000000000000070000001c00078008000840000000e2050015000200000008001240000000040500010006000000050005000200000005000400050000000900020073797a310000000015000300686173683a69702c706f72742c6e657400"], 0x6c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, 0xd, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048090}, 0x8080) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x5c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010100}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x5064}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/my_zoned_dev\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/my_zoned_dev/memory_backed\x00', 0x101002, 0x0) write(r1, &(0x7f00000001c0)='1\x00', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nullb/my_zoned_dev/zoned\x00', 0x2, 0xb96e0453b2f36300) r3 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797afc3c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000010b615cd89f1b3621c000340000000022c00b3120e0a1f"], 0xcc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYRES16, @ANYBLOB="c258a9cfeae8b8dca4f51ece5ba102389844d3f4cf267379a6f007931a39db0fbf24747e36d88865a83ffcbe74217c28dd8c426248b37de75848f2f551141d4f61968d68de485a4a020e6431b8e6e57787775bfc84dc86c0edc5b0bc0a97e63b72a228f8a9d21a21e0f9f70ab78ee6cfbdeb8873db5aa48aabb522d5e818a42b95946b5b2ef3ec993e17f7f74fc79533e37aa1ef96964d176f9fe77f80b6125989e55a287a9e2b47a01eaa6d98afb2564140dd80ba64029e2b522eace5d78c02161d4b525665f70b03ed352c4b3082b085ee27cdb79865cbac1eb17e09308d3240ef74ff9e07c066c9534d20cc56b64922cc24dcbd5a8b802222239d", @ANYBLOB="bba249dfe9e1fe4649087e887b0a44d5a5b3d51029", @ANYRESDEC], 0x128}, 0x1, 0x0, 0x0, 0x4000}, 0x842) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="180100003000010003000000fbdbdf2506"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) sendto$inet6(r3, &(0x7f0000000040)="800037bbfa9ba1ce", 0xe80b, 0x0, 0x0, 0x0) recvfrom$inet6(r3, &(0x7f0000000080)=""/240, 0xfffffffffffffcea, 0x10020, 0x0, 0x0) write(r2, &(0x7f0000000240)='1\x00', 0x1) r5 = syz_open_procfs(0x0, 0x0) readv(r5, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/140, 0x8c}], 0x100000000000002a) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r6, 0x8946, &(0x7f0000000100)) r7 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/my_zoned_dev/power\x00', 0x2, 0x0) write(r7, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000340)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./dev/my_zoned_dev\x00', 0x2, 0x110) 261.868478ms ago: executing program 0 (id=2416): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000140)={{0xffff1000, 0xeeee8000, 0x4, 0xf6, 0x1, 0xf3, 0x1c, 0x8, 0x7, 0x41, 0x7, 0x1}, {0x50000, 0xffe, 0xd, 0x8, 0x3, 0x8, 0x5, 0x0, 0x80, 0xfc, 0xfc, 0x4}, {0x200000, 0x6000, 0xb, 0x6, 0xff, 0xb0, 0x0, 0x6, 0xef, 0x27, 0xd5, 0x2}, {0x41000, 0x6000, 0x9, 0x9, 0x8f, 0x7, 0x81, 0xfc, 0xb, 0x1, 0x9, 0x3}, {0xffffffff, 0x0, 0xe, 0x2, 0x6, 0x1, 0x9, 0xea, 0x3, 0x3, 0x3, 0xe4}, {0x200000, 0xffff1000, 0xc, 0x0, 0x3, 0x0, 0xde, 0x9, 0x3, 0x0, 0x4, 0x30}, {0xdddd0000, 0x9000, 0x4, 0x3, 0x8, 0x3, 0xda, 0x9, 0x91, 0x4, 0x9, 0x88}, {0x8000000, 0x0, 0x10, 0x6, 0xc2, 0x6, 0x6, 0x4, 0x7, 0x3, 0x80, 0x68}, {0x6000, 0x8000}, {0xb000, 0x8001}, 0x40040, 0x0, 0x2ffc, 0x600580, 0x6, 0x8000, 0xeeef0000, [0x6, 0x5, 0x4, 0xe]}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x3, 0x80, 0x9, 0x8, 0x0, 0x0, 0x7, 0xeb, 0x7f, 0x0, 0x0, '\x00', 0x0, 0x80000001}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0xffe, 0x7, 0x10001, 0xfffffffd, 0x0, [{0x9, 0x16, 0x86, '\x00', 0xc}, {0x9, 0x8, 0x2, '\x00', 0x2}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x2, 0xf5, '\x00', 0xf}, {0x9, 0x89, 0xc, '\x00', 0xfb}, {0x0, 0x5, 0x54, '\x00', 0xff}, {0x71, 0x3, 0x3, '\x00', 0x7f}, {0x3, 0x4, 0x1, '\x00', 0x8}, {0x7f, 0xe, 0xb, '\x00', 0x8}, {0xdb, 0xd, 0x8, '\x00', 0xa}, {0x0, 0x28, 0x7, '\x00', 0xda}, {0x48, 0x1, 0x5, '\x00', 0x2}, {0xfd, 0x9, 0x26, '\x00', 0xfd}, {0xcf, 0xfa, 0xd, '\x00', 0x8}, {0xf, 0x6, 0x5, '\x00', 0x10}, {0x39, 0x2, 0x3, '\x00', 0x8}, {0x9, 0x3, 0xff, '\x00', 0x8}, {0x5, 0x25, 0x5, '\x00', 0xc}, {0x7, 0x1, 0x7}, {0x0, 0x80, 0x1, '\x00', 0x81}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x3, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x4, 0x4, '\x00', 0x8}]}}) 207.719475ms ago: executing program 3 (id=2417): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SMI(r2, 0xaeb7) ioctl$KVM_RUN(r2, 0xae80, 0x0) 147.156292ms ago: executing program 1 (id=2418): r0 = io_uring_setup(0xa86, &(0x7f0000000300)={0x0, 0xf12b, 0x10000, 0x40000, 0x800003d7}) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f00000000c0)=0x81) syz_io_uring_setup(0xf08, &(0x7f0000000400)={0x0, 0x8000595d, 0x1000, 0x3, 0x24e}, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) readv(r1, &(0x7f0000000400)=[{0x0}], 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 123.725564ms ago: executing program 0 (id=2419): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x4, 0xffffffffffffffff}) socket(0x2, 0x80805, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f00000001c0)=@attr_riscv64=@attr_addr={0x0, 0x1, @imsic=0x2, &(0x7f0000000000)=0x7}) 34.21645ms ago: executing program 3 (id=2420): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000600)=ANY=[@ANYBLOB="140100002d0001000000000000000000030100800c0000000000000000000000140001000000000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94", @ANYRES32=0x0], 0x114}], 0x1}, 0x11) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000005c0)={0x0}}, 0x40804) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="6c000000020603000000000000000000070000001c00078008000840000000e2050015000200000008001240000000040500010006000000050005000200000005000400050000000900020073797a310000000015000300686173683a69702c706f72742c6e657400"], 0x6c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, 0xd, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048090}, 0x8080) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x5c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010100}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x5064}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/my_zoned_dev\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/my_zoned_dev/memory_backed\x00', 0x101002, 0x0) write(r1, &(0x7f00000001c0)='1\x00', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nullb/my_zoned_dev/zoned\x00', 0x2, 0xb96e0453b2f36300) r3 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797afc3c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000010b615cd89f1b3621c000340000000022c00b3120e0a1f0200000000000000000a0000000900010073797a3100"], 0xcc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYRES16, @ANYBLOB="c258a9cfeae8b8dca4f51ece5ba102389844d3f4cf267379a6f007931a39db0fbf24747e36d88865a83ffcbe74217c28dd8c426248b37de75848f2f551141d4f61968d68de485a4a020e6431b8e6e57787775bfc84dc86c0edc5b0bc0a97e63b72a228f8a9d21a21e0f9f70ab78ee6cfbdeb8873db5aa48aabb522d5e818a42b95946b5b2ef3ec993e17f7f74fc79533e37aa1ef96964d176f9fe77f80b6125989e55a287a9e2b47a01eaa6d98afb2564140dd80ba64029e2b522eace5d78c02161d4b525665f70b03ed352c4b3082b085ee27cdb79865cbac1eb17e09308d3240ef74ff9e07c066c9534d20cc56b64922cc24dcbd5a8b802222239d", @ANYBLOB="bba249dfe9e1fe4649087e887b0a44d5a5b3d51029", @ANYRESDEC], 0x128}, 0x1, 0x0, 0x0, 0x4000}, 0x842) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="180100003000010003000000fbdbdf2506"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) sendto$inet6(r3, &(0x7f0000000040)="800037bbfa9ba1ce", 0xe80b, 0x0, 0x0, 0x0) recvfrom$inet6(r3, &(0x7f0000000080)=""/240, 0xfffffffffffffcea, 0x10020, 0x0, 0x0) write(r2, &(0x7f0000000240)='1\x00', 0x1) r5 = syz_open_procfs(0x0, 0x0) readv(r5, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/140, 0x8c}], 0x100000000000002a) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r6, 0x8946, &(0x7f0000000100)) r7 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/my_zoned_dev/power\x00', 0x2, 0x0) write(r7, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000340)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./dev/my_zoned_dev\x00', 0x2, 0x110) 34.015422ms ago: executing program 0 (id=2421): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x4c, 0x2c, 0xc3f, 0x70bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r3, {0x3, 0x2}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8100}, @TCA_FLOWER_KEY_VLAN_ETH_TYPE={0x6, 0x19, 0x88a8}, @TCA_FLOWER_KEY_CVLAN_ETH_TYPE={0x6, 0x4f, 0x8100}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000810}, 0x20084084) 21.454686ms ago: executing program 3 (id=2422): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r2 = fanotify_init(0x200, 0x0) fanotify_mark(r2, 0x1, 0x40000033, r1, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x0) sendfile(r1, r3, 0x0, 0x4) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 1 (id=2423): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/nd/devices/pfn0.0/namespace\x00', 0x40641, 0x0) write(r0, &(0x7f0000000140)='namespace0.0', 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') read$FUSE(r1, 0x0, 0x4a) kernel console output (not intermixed with test programs): 145][T10126] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1389'. [ 280.412671][T10128] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1390'. [ 280.565782][T10142] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1396'. [ 281.395099][T10155] ªªªªªª: renamed from vlan0 (while UP) [ 281.467329][T10163] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1405'. [ 281.488970][T10165] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1406'. [ 282.582262][T10182] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1414'. [ 282.584173][T10182] netlink: 'syz.1.1414': attribute type 12 has an invalid length. [ 282.626608][T10187] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1416'. [ 282.825716][T10203] block nbd0: shutting down sockets [ 283.093267][T10201] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 283.093474][T10201] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 285.220413][T10252] __nla_validate_parse: 3 callbacks suppressed [ 285.220433][T10252] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1440'. [ 286.398097][T10278] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1450'. [ 287.160677][T10290] block nbd3: shutting down sockets [ 287.416467][ T43] usb 8-1: new high-speed USB device number 38 using dummy_hcd [ 287.572228][ T43] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 287.575223][ T43] usb 8-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 287.576095][ T43] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 287.576734][ T43] usb 8-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 287.576755][ T43] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 287.716198][ T43] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 287.726261][ T43] usb 8-1: invalid MIDI out EP 0 [ 288.151065][T10304] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1459'. [ 288.339841][ T43] snd-usb-audio 8-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 288.801406][ T43] usb 8-1: USB disconnect, device number 38 [ 289.264946][T10330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 289.266937][T10330] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 289.417391][T10335] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1472'. [ 289.966579][T10357] block nbd0: shutting down sockets [ 289.983128][T10355] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 289.986847][T10355] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 291.115398][ T30] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 291.276748][ T30] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 291.276907][ T30] usb 6-1: too many configurations: 40, using maximum allowed: 8 [ 291.292831][ T30] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.292845][ T30] usb 6-1: Product: syz [ 291.292853][ T30] usb 6-1: Manufacturer: syz [ 291.292860][ T30] usb 6-1: SerialNumber: syz [ 291.527387][ T30] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 291.527415][ T30] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 291.527425][ T30] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 291.533588][ T30] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 291.536646][ T30] usb 6-1: USB disconnect, device number 38 [ 292.635144][T10416] capability: warning: `syz.2.1508' uses 32-bit capabilities (legacy support in use) [ 292.724618][T10420] block nbd1: shutting down sockets [ 292.985612][ T43] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 293.137078][ T43] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 293.138783][ T43] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 293.138931][ T43] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 293.139025][ T43] usb 6-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 293.139196][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 293.164621][ T43] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 293.173140][ T43] usb 6-1: invalid MIDI out EP 0 [ 293.511574][ T44] kauditd_printk_skb: 4 callbacks suppressed [ 293.511587][ T44] audit: type=1326 audit(1791791638.945:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10428 comm="syz.3.1514" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 293.511761][ T44] audit: type=1326 audit(1791791638.945:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10428 comm="syz.3.1514" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 293.512539][ T44] audit: type=1326 audit(1791791638.945:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10428 comm="syz.3.1514" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 293.514233][ T44] audit: type=1326 audit(1791791638.945:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10428 comm="syz.3.1514" exe="/syz-executor" sig=0 arch=40000003 syscall=397 compat=1 ip=0xf73befec code=0x7ffc0000 [ 293.514278][ T44] audit: type=1326 audit(1791791638.945:367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10428 comm="syz.3.1514" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 293.514314][ T44] audit: type=1326 audit(1791791638.945:368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10428 comm="syz.3.1514" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 293.514380][ T44] audit: type=1326 audit(1791791638.945:369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10428 comm="syz.3.1514" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 293.514850][ T44] audit: type=1326 audit(1791791638.945:370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10428 comm="syz.3.1514" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 293.515047][ T44] audit: type=1326 audit(1791791638.945:371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10428 comm="syz.3.1514" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 293.515210][ T44] audit: type=1326 audit(1791791638.945:372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10428 comm="syz.3.1514" exe="/syz-executor" sig=0 arch=40000003 syscall=398 compat=1 ip=0xf73befec code=0x7ffc0000 [ 293.614697][ T43] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 293.643347][T10436] kAFS: Invalid Command on /proc/fs/afs/cells file [ 293.718550][T10444] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1519'. [ 293.978831][T10461] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1527'. [ 294.058260][T10463] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1528'. [ 294.653691][ T35] usb 6-1: USB disconnect, device number 39 [ 294.802626][T10468] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1529'. [ 294.850554][T10476] tipc: Enabling of bearer rejected, already enabled [ 294.958958][T10490] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 295.074066][T10496] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1541'. [ 295.940514][T10509] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1547'. [ 296.022325][T10514] bridge0: port 1(syz_tun) entered blocking state [ 296.022372][T10514] bridge0: port 1(syz_tun) entered disabled state [ 296.022455][T10514] syz_tun: entered allmulticast mode [ 296.023262][T10514] syz_tun: entered promiscuous mode [ 296.023714][T10514] bridge0: port 1(syz_tun) entered blocking state [ 296.023873][T10514] bridge0: port 1(syz_tun) entered forwarding state [ 296.135184][T10525] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1554'. [ 296.189470][T10529] i2c i2c-0: Invalid 7-bit I2C address 0x00 [ 296.967295][ T5739] Bluetooth: hci2: connection err: -111 [ 297.110658][T10547] bridge0: port 1(syz_tun) entered blocking state [ 297.110779][T10547] bridge0: port 1(syz_tun) entered disabled state [ 297.110898][T10547] syz_tun: entered allmulticast mode [ 297.112159][T10547] syz_tun: entered promiscuous mode [ 297.114110][T10547] bridge0: port 1(syz_tun) entered blocking state [ 297.114187][T10547] bridge0: port 1(syz_tun) entered forwarding state [ 297.245628][T10551] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1566'. [ 297.587394][T10561] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x50000 [ 297.587423][T10561] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 297.587447][T10561] raw: 04fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 297.587466][T10561] raw: ffff888000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 297.587495][T10561] page dumped because: unmovable page [ 297.587506][T10561] page_owner tracks the page as allocated [ 297.587512][T10561] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 5740, tgid 5740 (syz-executor), ts 293468677121 [ 297.587540][T10561] post_alloc_hook+0xfd/0x120 [ 297.587564][T10561] get_page_from_freelist+0x110d/0x35d0 [ 297.587584][T10561] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 297.587607][T10561] alloc_pages_bulk_noprof+0x5e1/0x13c0 [ 297.587630][T10561] __kasan_populate_vmalloc+0xf0/0x210 [ 297.587655][T10561] alloc_vmap_area+0x95d/0x2bb0 [ 297.587678][T10561] __get_vm_area_node+0x1ed/0x350 [ 297.587702][T10561] __vmalloc_node_range_noprof+0x268/0x1420 [ 297.587729][T10561] __vmalloc_node_noprof+0xad/0xf0 [ 297.587755][T10561] compat_get_entries+0x3b0/0x860 [ 297.587777][T10561] do_ip6t_get_ctl+0x5c1/0xb00 [ 297.587795][T10561] nf_getsockopt+0x7c/0xe0 [ 297.587817][T10561] ipv6_getsockopt+0x207/0x2a0 [ 297.587841][T10561] tcp_getsockopt+0xa1/0x110 [ 297.587862][T10561] do_sock_getsockopt+0x50a/0x6e0 [ 297.587887][T10561] __sys_getsockopt+0x133/0x1d0 [ 297.587905][T10561] page last free pid 15 tgid 15 ts 292805715980 stack trace: [ 297.587917][T10561] __free_frozen_pages+0x79f/0x10f0 [ 297.587934][T10561] tlb_remove_table_rcu+0x2cf/0x380 [ 297.587952][T10561] rcu_core+0x5f0/0x1260 [ 297.587968][T10561] handle_softirqs+0x1e6/0x9d0 [ 297.587994][T10561] run_ksoftirqd+0x38/0x60 [ 297.588018][T10561] smpboot_thread_fn+0x3d3/0xab0 [ 297.588037][T10561] kthread+0x373/0x450 [ 297.588055][T10561] ret_from_fork+0x730/0xd60 [ 297.588072][T10561] ret_from_fork_asm+0x1a/0x30 [ 297.708347][T10566] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1570'. [ 297.788577][ T5739] Bluetooth: hci2: unexpected event for opcode 0x0c5a [ 298.030479][T10575] block nbd0: shutting down sockets [ 298.048064][T10574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 298.050108][T10574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 299.999415][ T44] kauditd_printk_skb: 14 callbacks suppressed [ 299.999433][ T44] audit: type=1326 audit(1791791645.435:387): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10582 comm="syz.1.1577" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744efec code=0x7ffc0000 [ 299.999649][ T44] audit: type=1326 audit(1791791645.435:388): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10582 comm="syz.1.1577" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744efec code=0x7ffc0000 [ 300.002051][ T44] audit: type=1326 audit(1791791645.435:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10582 comm="syz.1.1577" exe="/syz-executor" sig=0 arch=40000003 syscall=397 compat=1 ip=0xf744efec code=0x7ffc0000 [ 300.002078][ T44] audit: type=1326 audit(1791791645.435:391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10582 comm="syz.1.1577" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744efec code=0x7ffc0000 [ 300.002099][ T44] audit: type=1326 audit(1791791645.435:392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10582 comm="syz.1.1577" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744efec code=0x7ffc0000 [ 300.002170][ T44] audit: type=1326 audit(1791791645.435:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10582 comm="syz.1.1577" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744efec code=0x7ffc0000 [ 300.002318][ T44] audit: type=1326 audit(1791791645.435:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10582 comm="syz.1.1577" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744efec code=0x7ffc0000 [ 300.002406][ T44] audit: type=1326 audit(1791791645.435:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10582 comm="syz.1.1577" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744efec code=0x7ffc0000 [ 300.002734][ T44] audit: type=1326 audit(1791791645.435:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10582 comm="syz.1.1577" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf744efec code=0x7ffc0000 [ 300.002996][ T44] audit: type=1326 audit(1791791645.435:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10582 comm="syz.1.1577" exe="/syz-executor" sig=0 arch=40000003 syscall=398 compat=1 ip=0xf744efec code=0x7ffc0000 [ 300.664318][T10610] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1586'. [ 300.703858][T10613] ima: Unable to open file: / (-22) [ 300.704060][T10612] ima: policy update failed [ 300.847702][T10619] ftl_cs: FTL header not found. [ 300.883639][T10619] block2mtd: mtd1: [/dev/ram0] erase_size = 4KiB [4096] [ 301.110166][T10635] block nbd0: shutting down sockets [ 301.123412][T10634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 301.129615][T10634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 301.719979][ T5739] Bluetooth: hci2: unexpected event for opcode 0x0c5a [ 301.944986][T10642] vhci_hcd vhci_hcd.0: failed to lookup sock [ 302.223051][T10650] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1603'. [ 303.165531][ C3] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 303.415177][T10665] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1609'. [ 303.557109][T10673] program syz.2.1608 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 303.611280][T10678] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1612'. [ 303.651520][T10681] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 303.651734][T10681] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 303.752072][T10687] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1618'. [ 303.947131][T10692] block nbd3: shutting down sockets [ 304.215466][ T5969] usb 8-1: new high-speed USB device number 39 using dummy_hcd [ 304.366977][ T5969] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 304.371996][ T5969] usb 8-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 304.372049][ T5969] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 304.372063][ T5969] usb 8-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 304.372274][ T5969] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.411048][ T5969] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 304.418219][ T5969] usb 8-1: invalid MIDI out EP 0 [ 304.635518][ T5822] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 304.805944][ T5822] usb 7-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 304.806929][ T5822] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 304.806943][ T5822] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 304.808506][ T5822] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 304.808519][ T5822] usb 7-1: Product: syz [ 304.808526][ T5822] usb 7-1: Manufacturer: syz [ 304.808534][ T5822] usb 7-1: SerialNumber: syz [ 305.017262][ T5969] snd-usb-audio 8-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 305.031245][ T5822] usblp 7-1:1.0: usblp0: USB Bidirectional printer dev 38 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 305.049370][T10707] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1624'. [ 305.280487][T10718] macvlan0: entered promiscuous mode [ 305.280905][T10718] netlink: 'syz.1.1630': attribute type 1 has an invalid length. [ 305.280919][T10718] netlink: 'syz.1.1630': attribute type 2 has an invalid length. [ 305.301072][ T5822] usb 7-1: USB disconnect, device number 38 [ 305.308150][ T5822] usblp0: removed [ 306.189372][T10735] kvm: kvm [10733]: vcpu2, guest rIP: 0xfff0 Unhandled WRMSR(0x4000008d) = 0x40 [ 306.203892][ T5969] usb 8-1: USB disconnect, device number 39 [ 306.372040][T10743] jffs2: notice: (10743) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 306.638943][T10757] block nbd2: shutting down sockets [ 306.905655][ T25] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 307.059247][ T25] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 307.063139][ T25] usb 7-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 307.063785][ T25] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 307.063800][ T25] usb 7-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 307.064298][ T25] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 307.151252][ T25] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 307.158062][ T25] usb 7-1: invalid MIDI out EP 0 [ 307.160846][T10759] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1646'. [ 307.183970][T10761] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1648'. [ 307.391755][T10769] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1647'. [ 307.461536][T10771] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1652'. [ 307.787744][T10781] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1657'. [ 307.938069][ T25] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 308.013121][T10789] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1662'. [ 308.487833][ T6017] usb 7-1: USB disconnect, device number 39 [ 308.989658][T10827] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1677'. [ 309.177909][T10843] Bluetooth: MGMT ver 1.23 [ 309.425438][ T30] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 309.585950][ T30] usb 6-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 309.587179][ T30] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 309.587201][ T30] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 309.587217][ T30] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 309.587233][ T30] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 309.587255][ T30] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 309.590129][T10842] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 309.590247][T10842] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 309.592766][ T30] pl2303 6-1:1.0: pl2303 converter detected [ 309.595252][ T30] usb 6-1: pl2303 converter now attached to ttyUSB0 [ 309.813450][T10847] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1685'. [ 309.895533][T10842] pl2303 6-1:1.0: pl2303_vendor_write - failed to write [0007]: -110 [ 309.895833][T10842] pl2303 ttyUSB0: pl2303_get_line_request - failed: -32 [ 309.896101][T10842] pl2303 ttyUSB0: pl2303_set_line_request - failed: -32 [ 309.896797][T10842] pl2303 6-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 309.896840][T10842] pl2303 ttyUSB0: failed to submit interrupt urb: -90 [ 309.897859][ T5822] usb 6-1: USB disconnect, device number 40 [ 309.913087][ T5822] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 309.913389][ T5822] pl2303 6-1:1.0: device disconnected [ 310.064755][T10861] block nbd2: shutting down sockets [ 310.248753][T10870] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1695'. [ 310.340524][ T30] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 310.509182][ T30] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 310.513548][ T30] usb 7-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 310.513602][ T30] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 310.513917][ T30] usb 7-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 310.514255][ T30] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 310.593359][T10880] block nbd0: shutting down sockets [ 310.601580][T10880] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 310.604028][T10880] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 310.706052][ T30] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 310.738873][ T30] usb 7-1: invalid MIDI out EP 0 [ 311.997582][ T30] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 312.004098][ T30] usb 7-1: USB disconnect, device number 40 [ 312.225430][ T5969] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 312.230709][T10892] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1704'. [ 312.317198][T10896] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1706'. [ 312.386024][ T5969] usb 6-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 312.386858][ T5969] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 312.386872][ T5969] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 312.389106][ T5969] usb 6-1: string descriptor 0 read error: -22 [ 312.389162][ T5969] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 312.396845][ T5969] etas_es58x 6-1:1.0: Starting (null) (null) (Serial Number (null)) [ 312.396942][ T5969] etas_es58x 6-1:1.0: could not retrieve the product info string [ 312.599661][T10884] etas_es58x 6-1:1.0 can0: es58x_submit_urb: USB send urb failure: -EMSGSIZE [ 312.600154][ C3] etas_es58x 6-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 312.600353][ C3] etas_es58x 6-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 312.600540][ C3] etas_es58x 6-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 312.600717][ C3] etas_es58x 6-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 312.600892][ C3] etas_es58x 6-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 312.600931][T10884] etas_es58x 6-1:1.0 can0: es58x_open: Could not open the network device: -EMSGSIZE [ 312.601189][ T5452] etas_es58x 6-1:1.0: es58x_set_realtime_diff_ns: Previous request to set timestamp has not completed yet [ 312.601279][ C0] etas_es58x 6-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 312.601478][ C0] etas_es58x 6-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 312.601735][ C0] etas_es58x 6-1:1.0: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 312.601799][ C0] etas_es58x 6-1:1.0: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 312.601857][ C0] etas_es58x 6-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 312.601939][ T5452] etas_es58x 6-1:1.0 can0: es58x_open: Could not open the network device: -EBUSY [ 312.602258][ T5969] usb 6-1: USB disconnect, device number 41 [ 312.605769][ T5969] etas_es58x 6-1:1.0: Disconnecting (null) (null) [ 312.839557][T10925] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1712'. [ 312.908520][T10928] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1713'. [ 312.941020][T10933] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1715'. [ 312.949137][T10936] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1714'. [ 313.003690][T10942] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 313.004616][T10942] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 313.586057][T10957] block nbd2: shutting down sockets [ 313.637646][T10960] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1723'. [ 313.854452][T10967] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1725'. [ 313.895514][T10969] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1726'. [ 313.917464][ T6017] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 313.948368][T10973] input: syz1 as /devices/virtual/input/input19 [ 314.077051][ T6017] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 314.084811][ T6017] usb 7-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 314.084868][ T6017] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 314.085249][ T6017] usb 7-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 314.092645][T10978] ima: policy update failed [ 314.092786][ T44] kauditd_printk_skb: 6 callbacks suppressed [ 314.092800][ T44] audit: type=1802 audit(1791791659.525:403): pid=10978 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.1730" res=0 errno=0 [ 314.093142][ T6017] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.220860][ T6017] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 314.236274][ T6017] usb 7-1: invalid MIDI out EP 0 [ 314.250020][T10982] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1732'. [ 314.422927][T10986] block nbd1: shutting down sockets [ 314.726785][ T30] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 314.894710][ T30] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 314.903643][ T30] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 314.903685][ T30] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 314.903740][ T30] usb 6-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 314.904004][ T30] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.213141][T10294] udevd[10294]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb7/7-1/7-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 315.264916][ T6017] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 315.280156][ T30] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 315.308030][ T30] usb 6-1: invalid MIDI out EP 0 [ 315.724035][ T25] usb 7-1: USB disconnect, device number 41 [ 316.159589][ T30] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 316.612405][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.809172][ T5848] usb 6-1: USB disconnect, device number 42 [ 317.053735][T11035] input: syz0 as /devices/virtual/input/input20 [ 317.928247][T11057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 317.928922][T11057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 318.152607][T11068] block nbd2: shutting down sockets [ 318.207629][T11070] __nla_validate_parse: 2 callbacks suppressed [ 318.207648][T11070] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1769'. [ 318.396405][ T5969] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 318.566577][ T5969] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 318.567840][ T5969] usb 7-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 318.567868][ T5969] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 318.567882][ T5969] usb 7-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 318.567901][ T5969] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 318.574751][ T5969] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 318.575189][ T5969] usb 7-1: invalid MIDI out EP 0 [ 318.993082][T11081] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 319.012512][ T6412] Bluetooth: hci4: Frame reassembly failed (-84) [ 319.049684][ T5969] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 319.218533][T11089] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1778'. [ 319.445565][ T25] usb 8-1: new high-speed USB device number 40 using dummy_hcd [ 319.606035][ T25] usb 8-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 319.606908][ T25] usb 8-1: config index 0 descriptor too short (expected 23569, got 27) [ 319.606933][ T25] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 319.607770][ T25] usb 8-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 319.607787][ T25] usb 8-1: Manufacturer: syz [ 319.609091][ T25] usb 8-1: config 0 descriptor?? [ 319.675678][ T25] rc_core: IR keymap rc-hauppauge not found [ 319.675690][ T25] Registered IR keymap rc-empty [ 319.677352][ T25] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0 [ 319.678336][ T25] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0/input21 [ 319.754073][T11109] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1787'. [ 319.819727][T11087] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 319.820242][T11087] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 319.831178][ T6017] usb 8-1: USB disconnect, device number 40 [ 319.870544][T11113] netlink: 'syz.1.1789': attribute type 1 has an invalid length. [ 320.037050][ T5821] usb 7-1: USB disconnect, device number 42 [ 320.736308][T11142] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1803'. [ 320.919001][T11166] netlink: 200 bytes leftover after parsing attributes in process `syz.1.1814'. [ 321.006521][ T5739] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 321.131213][T11178] dummy0: entered promiscuous mode [ 321.144621][T11178] dummy0: left promiscuous mode [ 321.256002][T11186] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1823'. [ 321.397469][T11199] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1829'. [ 321.493584][T11206] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1832'. [ 321.510650][T11208] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1833'. ƶÿ[ 321.566803][T11212] device-mapper: ioctl: name not supplied when creating device [ 321.633117][T11218] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1838'. [ 321.876864][T11241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 321.877241][T11241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 syzkaller syzkaller login: [ 323.988926][T11294] __nla_validate_parse: 6 callbacks suppressed [ 323.988939][T11294] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1871'. [ 323.997200][T11297] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1874'. [ 324.034678][T11301] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1875'. [ 324.040691][T11302] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1876'. [ 324.150573][T11314] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1881'. [ 324.207957][T11320] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1884'. [ 324.230119][T11322] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1885'. [ 324.251903][T11324] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1886'. [ 324.411947][T11336] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1891'. [ 324.489805][ T30] hid-generic 0000:0000:0001.0003: unknown main item tag 0x0 [ 324.489841][ T30] hid-generic 0000:0000:0001.0003: unknown main item tag 0x0 [ 324.489860][ T30] hid-generic 0000:0000:0001.0003: unknown main item tag 0x0 [ 324.489878][ T30] hid-generic 0000:0000:0001.0003: unknown main item tag 0x0 [ 324.489896][ T30] hid-generic 0000:0000:0001.0003: unknown main item tag 0x0 [ 324.489913][ T30] hid-generic 0000:0000:0001.0003: unknown main item tag 0x0 [ 324.489931][ T30] hid-generic 0000:0000:0001.0003: unknown main item tag 0x0 [ 324.489949][ T30] hid-generic 0000:0000:0001.0003: unknown main item tag 0x0 [ 324.493597][ T30] hid-generic 0000:0000:0001.0003: hidraw1: HID v0.10 Device [syz0] on syz1 [ 324.555688][T11339] fido_id[11339]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 324.670404][T11344] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1894'. [ 325.966612][T11407] device-mapper: ioctl: name not supplied when creating device [ 325.966946][T11408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 325.967156][T11408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 326.685935][ T35] usb 6-1: new full-speed USB device number 43 using dummy_hcd [ 326.846601][ T35] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 326.847832][ T35] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 326.847848][ T35] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 326.847867][ T35] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 327.052933][ T35] usb 6-1: GET_CAPABILITIES returned 0 [ 327.052957][ T35] usbtmc 6-1:16.0: can't read capabilities [ 327.260805][ T35] usb 6-1: USB disconnect, device number 43 [ 327.375042][T11456] misc userio: Invalid payload size [ 327.793370][T11461] bond0: ARP target 170.170.170.170 is already present [ 327.793452][T11461] bond0: option arp_ip_target: invalid value (2863311530) [ 328.465662][T11484] ip6erspan0: entered allmulticast mode [ 328.705041][T11502] LUN: removable file: (no medium) [ 329.418854][T11514] hugetlbfs: syz.3.1968 (11514): Using mlock ulimits for SHM_HUGETLB is obsolete [ 329.492425][T11518] __nla_validate_parse: 28 callbacks suppressed [ 329.492444][T11518] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1970'. [ 329.685433][ T5821] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 329.777926][T11527] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1974'. [ 329.865406][ T5821] usb 7-1: Using ep0 maxpacket: 8 [ 329.866025][ T5821] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 329.866858][ T5821] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 329.866881][ T5821] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.868158][ T5821] usb 7-1: config 0 descriptor?? [ 329.993086][T11531] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1975'. [ 330.075382][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 330.137662][ T5821] iowarrior 7-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 330.325554][ T25] usb 7-1: USB disconnect, device number 43 [ 330.533542][T11544] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1980'. [ 330.971721][T11552] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1983'. [ 331.061038][T11556] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1986'. [ 331.168027][T11561] netlink: 'syz.0.1987': attribute type 8 has an invalid length. [ 331.168042][T11561] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1987'. [ 331.199795][T11563] IPVS: rr: UDP 127.0.0.1:5060 - no destination available [ 331.238805][T11566] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1989'. [ 331.377826][T11572] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1992'. [ 332.213990][T11588] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1999'. [ 332.340447][T11592] veth0_vlan: entered allmulticast mode [ 332.340779][T11592] batadv_slave_0: entered promiscuous mode [ 332.341107][T11591] batadv_slave_0: left promiscuous mode [ 332.341288][T11591] veth0_vlan: left allmulticast mode [ 332.448257][T11596] bond0 (unregistering): Released all slaves [ 332.496619][ T5821] usb 8-1: new high-speed USB device number 41 using dummy_hcd [ 332.529552][ T5739] Bluetooth: hci3: unexpected event for opcode 0x0c5a [ 332.706251][ T5821] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 332.707185][ T5821] usb 8-1: config index 0 descriptor too short (expected 39, got 27) [ 332.707208][ T5821] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 332.707219][ T5821] usb 8-1: config 0 interface 0 has no altsetting 0 [ 332.712553][ T5821] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 332.712600][ T5821] usb 8-1: Product: syz [ 332.712613][ T5821] usb 8-1: Manufacturer: syz [ 332.712624][ T5821] usb 8-1: SerialNumber: syz [ 332.715792][ T5821] usb 8-1: config 0 descriptor?? [ 332.720977][ T5821] hub 8-1:0.0: bad descriptor, ignoring hub [ 332.720997][ T5821] hub 8-1:0.0: probe with driver hub failed with error -5 [ 332.723725][ T5821] usb 8-1: selecting invalid altsetting 0 [ 333.679541][T11590] usb 8-1: reset high-speed USB device number 41 using dummy_hcd [ 334.142975][T11628] netlink: 'syz.1.2016': attribute type 11 has an invalid length. [ 334.279326][ T35] usb 8-1: USB disconnect, device number 41 [ 334.483066][T11644] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.527527][T11647] __nla_validate_parse: 9 callbacks suppressed [ 334.527541][T11647] netlink: 200 bytes leftover after parsing attributes in process `syz.2.2023'. [ 335.432342][T11661] netlink: 200 bytes leftover after parsing attributes in process `syz.0.2030'. [ 335.439406][T11663] netlink: 200 bytes leftover after parsing attributes in process `syz.2.2028'. [ 335.508068][T11674] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2035'. [ 336.372536][T11689] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2041'. [ 336.538226][T11696] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2044'. [ 336.570245][T11697] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2043'. [ 336.575534][T11696] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2044'. [ 336.627437][T11703] ovs-dp0: entered promiscuous mode [ 336.671603][T11705] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2047'. [ 337.084134][T11713] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2050'. [ 338.634882][T11749] syzkaller1: entered promiscuous mode [ 338.634897][T11749] syzkaller1: entered allmulticast mode [ 339.716372][T11785] jffs2: notice: (11785) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 339.898199][T11788] netlink: 'syz.3.2081': attribute type 14 has an invalid length. [ 339.898213][T11788] __nla_validate_parse: 2 callbacks suppressed [ 339.898219][T11788] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2081'. [ 339.907365][T11792] netlink: 260 bytes leftover after parsing attributes in process `syz.0.2078'. [ 339.925471][ T5793] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 339.925504][ T5793] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 339.925523][ T5793] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 339.925565][ T5793] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 339.933370][T11788] netlink: 'syz.3.2081': attribute type 14 has an invalid length. [ 339.933389][T11788] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2081'. [ 341.070008][T11822] netlink: 260 bytes leftover after parsing attributes in process `syz.3.2090'. [ 341.206168][ T9110] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 341.365819][ T9110] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 341.366966][ T9110] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 341.366992][ T9110] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 341.367005][ T9110] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 341.367017][ T9110] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 341.367035][ T9110] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.369176][T11819] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 341.369317][T11819] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 341.370900][ T9110] keyspan 6-1:1.0: Keyspan 2 port adapter converter detected [ 341.372273][ T9110] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 84 [ 341.372309][ T9110] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 341.373523][ T9110] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 341.374368][ T9110] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 88 [ 341.374429][ T9110] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 6 [ 341.376864][ T9110] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 341.688552][ T43] usb 6-1: USB disconnect, device number 44 [ 341.696300][ T43] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 341.698073][ T43] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 341.698441][ T43] keyspan 6-1:1.0: device disconnected [ 341.896831][ T5821] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 342.055464][ T5821] usb 7-1: Using ep0 maxpacket: 32 [ 342.060204][ T5821] usb 7-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 342.061028][ T5821] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 342.061042][ T5821] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 342.061052][ T5821] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 342.061072][ T5821] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 342.061083][ T5821] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 342.061094][ T5821] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 342.061113][ T5821] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 342.062265][ T5821] usb 7-1: config 0 descriptor?? [ 342.093125][T11841] netlink: 260 bytes leftover after parsing attributes in process `syz.0.2098'. [ 342.270557][ T5821] usblp 7-1:0.0: usblp0: USB Bidirectional printer dev 44 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 342.523255][ T5822] usb 7-1: USB disconnect, device number 44 [ 342.525380][ T5822] usblp0: removed [ 343.044799][T11855] netlink: 260 bytes leftover after parsing attributes in process `syz.0.2102'. [ 344.751519][T11882] bridge0: port 3(erspan0) entered blocking state [ 344.751652][T11882] bridge0: port 3(erspan0) entered disabled state [ 344.751773][T11882] erspan0: entered allmulticast mode [ 344.756365][T11882] erspan0: entered promiscuous mode [ 344.757415][T11882] bridge0: port 3(erspan0) entered blocking state [ 344.757495][T11882] bridge0: port 3(erspan0) entered forwarding state [ 344.759414][T11882] erspan0: left allmulticast mode [ 344.759432][T11882] erspan0: left promiscuous mode [ 344.759641][T11882] bridge0: port 3(erspan0) entered disabled state [ 344.801743][T11885] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2113'. [ 344.876289][T11888] smpboot: CPU 1 is now offline [ 344.902433][T11893] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 345.285471][ T5848] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 345.445373][ T5848] usb 7-1: Using ep0 maxpacket: 8 [ 345.445860][ T5848] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 345.446752][ T5848] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 345.446773][ T5848] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.448670][ T5848] usb 7-1: config 0 descriptor?? [ 345.657634][ T5848] iowarrior 7-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 345.938491][T11908] FAULT_INJECTION: forcing a failure. [ 345.938491][T11908] name failslab, interval 1, probability 0, space 0, times 0 [ 345.938525][T11908] CPU: 0 UID: 0 PID: 11908 Comm: syz.3.2123 Tainted: G L syzkaller #0 PREEMPT(full) [ 345.938550][T11908] Tainted: [L]=SOFTLOCKUP [ 345.938556][T11908] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 345.938567][T11908] Call Trace: [ 345.938573][T11908] [ 345.938580][T11908] dump_stack_lvl+0x100/0x190 [ 345.938608][T11908] should_fail_ex.cold+0x5/0xa [ 345.938630][T11908] should_failslab+0xc2/0x120 [ 345.938659][T11908] __kmalloc_noprof+0xfc/0x840 [ 345.938685][T11908] ? udpv6_init_sock+0x24e/0x450 [ 345.938717][T11908] udpv6_init_sock+0x24e/0x450 [ 345.938744][T11908] ? __pfx_udpv6_init_sock+0x10/0x10 [ 345.938774][T11908] inet6_create+0xb1a/0x12b0 [ 345.938796][T11908] ? inet6_create+0x7f/0x12b0 [ 345.938818][T11908] __sock_create+0x339/0x860 [ 345.938853][T11908] __sys_socket+0x14d/0x260 [ 345.938878][T11908] ? xfd_validate_state+0x129/0x190 [ 345.938908][T11908] ? __pfx___sys_socket+0x10/0x10 [ 345.938943][T11908] __ia32_sys_socket+0x72/0xb0 [ 345.938967][T11908] ? lockdep_hardirqs_on+0x7d/0x110 [ 345.938998][T11908] __do_fast_syscall_32+0x13a/0x8b0 [ 345.939022][T11908] do_fast_syscall_32+0x32/0x70 [ 345.939043][T11908] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 345.939067][T11908] RIP: 0023:0xf73befec [ 345.939088][T11908] Code: Unable to access opcode bytes at 0xf73befc2. [ 345.939097][T11908] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 345.939117][T11908] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000000000002 [ 345.939130][T11908] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 345.939142][T11908] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 345.939154][T11908] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 345.939166][T11908] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 345.939193][T11908] [ 346.164407][ T5822] usb 7-1: USB disconnect, device number 45 [ 346.202777][T11922] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2128'. [ 346.923908][T11932] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2132'. [ 348.035005][T11949] netlink: 260 bytes leftover after parsing attributes in process `syz.0.2139'. [ 348.285706][ T7263] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 348.447330][ T7263] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 348.452297][ T7263] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 348.453201][ T7263] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 348.453497][ T7263] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 348.454234][ T7263] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.516723][ T7263] usb 7-1: config 0 descriptor?? [ 348.994238][T11960] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2142'. [ 348.996500][ T7263] plantronics 0003:047F:FFFF.0004: reserved main item tag 0xd [ 349.059401][ T7263] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 349.285847][ T7263] usb 7-1: USB disconnect, device number 46 [ 349.633003][T11969] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2145'. [ 349.829796][T11972] netlink: 200 bytes leftover after parsing attributes in process `syz.2.2146'. [ 350.140641][T11983] netlink: 260 bytes leftover after parsing attributes in process `syz.0.2149'. [ 350.745411][ T6017] usb 8-1: new high-speed USB device number 42 using dummy_hcd [ 350.905919][ T6017] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 350.906717][ T6017] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 350.906732][ T6017] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 350.906743][ T6017] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 350.906762][ T6017] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 350.908592][ T6017] usb 8-1: config 0 descriptor?? [ 351.338025][ T6017] plantronics 0003:047F:FFFF.0005: reserved main item tag 0xd [ 351.349075][ T6017] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 351.608851][ T43] usb 8-1: USB disconnect, device number 42 [ 351.872049][T12009] FAULT_INJECTION: forcing a failure. [ 351.872049][T12009] name failslab, interval 1, probability 0, space 0, times 0 [ 351.872084][T12009] CPU: 3 UID: 0 PID: 12009 Comm: syz.1.2158 Tainted: G L syzkaller #0 PREEMPT(full) [ 351.872113][T12009] Tainted: [L]=SOFTLOCKUP [ 351.872120][T12009] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 351.872142][T12009] Call Trace: [ 351.872150][T12009] [ 351.872157][T12009] dump_stack_lvl+0x100/0x190 [ 351.872190][T12009] should_fail_ex.cold+0x5/0xa [ 351.872219][T12009] should_failslab+0xc2/0x120 [ 351.872250][T12009] __kmalloc_noprof+0xfc/0x840 [ 351.872277][T12009] ? raw_event_queue_add+0x82/0x220 [ 351.872313][T12009] raw_event_queue_add+0x82/0x220 [ 351.872346][T12009] gadget_bind+0x422/0x660 [ 351.872373][T12009] gadget_bind_driver+0x28c/0xbf0 [ 351.872396][T12009] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 351.872427][T12009] ? __pfx_gadget_bind_driver+0x10/0x10 [ 351.872451][T12009] really_probe+0x241/0xa60 [ 351.872478][T12009] __driver_probe_device+0x210/0x460 [ 351.872507][T12009] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 351.872539][T12009] driver_probe_device+0x4a/0x140 [ 351.872561][T12009] __driver_attach+0x21f/0x5b0 [ 351.872582][T12009] ? __pfx___driver_attach+0x10/0x10 [ 351.872604][T12009] bus_for_each_dev+0x13e/0x1d0 [ 351.872633][T12009] ? __pfx_bus_for_each_dev+0x10/0x10 [ 351.872659][T12009] ? bus_add_driver+0x2b5/0x5b0 [ 351.872685][T12009] bus_add_driver+0x305/0x5b0 [ 351.872707][T12009] driver_register+0x1e2/0x360 [ 351.872729][T12009] ? rcu_is_watching+0x13/0xc0 [ 351.872754][T12009] usb_gadget_register_driver_owner+0x132/0x210 [ 351.872777][T12009] raw_ioctl+0x1a85/0x2b80 [ 351.872801][T12009] ? __pfx_raw_ioctl+0x10/0x10 [ 351.872825][T12009] ? __pfx_raw_ioctl+0x10/0x10 [ 351.872842][T12009] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 351.872868][T12009] __do_fast_syscall_32+0x13a/0x8b0 [ 351.872891][T12009] do_fast_syscall_32+0x32/0x70 [ 351.872910][T12009] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 351.872933][T12009] RIP: 0023:0xf744efec [ 351.872955][T12009] Code: Unable to access opcode bytes at 0xf744efc2. [ 351.872964][T12009] RSP: 002b:00000000f5464424 EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 351.872983][T12009] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000005501 [ 351.872995][T12009] RDX: 0000000000000000 RSI: 00000000f743aff4 RDI: 00000000f54654c0 [ 351.873006][T12009] RBP: 00000000f743aff4 R08: 0000000000000000 R09: 0000000000000000 [ 351.873017][T12009] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 351.873029][T12009] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 351.873054][T12009] [ 351.873067][T12009] raw-gadget.0 gadget.1: failed to queue connect event [ 351.873082][T12009] udc dummy_udc.1: failed to start USB Raw Gadget: -12 [ 351.873100][T12009] raw-gadget.0 gadget.1: probe with driver raw-gadget.0 failed with error -12 [ 351.874502][T12009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 351.874895][T12009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 352.206490][T12019] jffs2: notice: (12019) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 352.262002][T12024] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2165'. [ 352.545422][ T7263] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 352.724079][ T7263] usb 7-1: New USB device found, idVendor=13d8, idProduct=0010, bcdDevice= 0.00 [ 352.728755][ T7263] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 352.729320][ T7263] usb 7-1: config 1 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 352.729880][ T7263] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.999913][ T7263] usb 7-1: Direct firmware load for usbduxfast_firmware.bin failed with error -2 [ 352.999930][ T7263] usb 7-1: Falling back to sysfs fallback for: usbduxfast_firmware.bin [ 353.172763][T12022] firmware usbduxfast_firmware.bin: firmware_loading_store: unexpected value (0) [ 353.198486][ T7263] usbduxfast 7-1:1.0: driver 'usbduxfast' failed to auto-configure device. [ 353.206751][ T7263] usbduxfast 7-1:1.0: probe with driver usbduxfast failed with error -2 [ 353.208363][ T7263] usb 7-1: USB disconnect, device number 47 [ 354.506190][T12057] A link change request failed with some changes committed already. Interface sit1 may have been left with an inconsistent configuration, please check. [ 354.587938][T12066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 354.589009][T12066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 354.592361][T12066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 354.592568][T12066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.140651][ T5739] Bluetooth: hci3: unexpected event for opcode 0x0c5a [ 356.792668][T12047] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 356.796926][T12059] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2175'. [ 356.993364][T12093] input: syz0 as /devices/virtual/input/input24 [ 357.961203][T12115] bridge0: port 3(macsec0) entered blocking state [ 357.961291][T12115] bridge0: port 3(macsec0) entered disabled state [ 357.961349][T12115] macsec0: entered allmulticast mode [ 357.961358][T12115] bridge0: entered allmulticast mode [ 357.961423][T12115] bridge0: entered promiscuous mode [ 357.970889][T12115] macsec0: left allmulticast mode [ 357.970903][T12115] bridge0: left allmulticast mode [ 357.989379][ T44] audit: type=1326 audit(1791791703.425:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12118 comm="syz.3.2199" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 357.989686][ T44] audit: type=1326 audit(1791791703.425:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12118 comm="syz.3.2199" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 357.989780][ T43] bridge0: left promiscuous mode [ 357.992308][ T44] audit: type=1326 audit(1791791703.425:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12118 comm="syz.3.2199" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf73befec code=0x7ffc0000 [ 357.992336][ T44] audit: type=1326 audit(1791791703.425:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12118 comm="syz.3.2199" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 357.992356][ T44] audit: type=1326 audit(1791791703.425:408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12118 comm="syz.3.2199" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 357.992999][ T44] audit: type=1326 audit(1791791703.425:409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12118 comm="syz.3.2199" exe="/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf73befec code=0x7ffc0000 [ 357.993059][ T44] audit: type=1326 audit(1791791703.425:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12118 comm="syz.3.2199" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 357.993423][ T44] audit: type=1326 audit(1791791703.425:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12118 comm="syz.3.2199" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 357.993814][ T44] audit: type=1326 audit(1791791703.425:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12118 comm="syz.3.2199" exe="/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf73befec code=0x7ffc0000 [ 357.994691][ T44] audit: type=1326 audit(1791791703.425:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12118 comm="syz.3.2199" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73befec code=0x7ffc0000 [ 358.348794][T12143] netlink: 'syz.0.2206': attribute type 8 has an invalid length. [ 358.348808][T12143] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2206'. [ 358.518329][T12152] netlink: 200 bytes leftover after parsing attributes in process `syz.0.2209'. [ 358.574488][T12154] netlink: 260 bytes leftover after parsing attributes in process `syz.0.2210'. [ 359.299633][T12168] tipc: Started in network mode [ 359.299661][T12168] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 359.299834][T12168] tipc: Enabled bearer , priority 0 [ 359.405847][T12172] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2219'. [ 359.458111][T12175] netlink: 260 bytes leftover after parsing attributes in process `syz.0.2220'. [ 359.475549][ T5969] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 359.625839][ T5969] usb 6-1: New USB device found, idVendor=16c0, idProduct=05e1, bcdDevice= 0.00 [ 359.626691][ T5969] usb 6-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 359.626708][ T5969] usb 6-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 359.626721][ T5969] usb 6-1: config 0 interface 0 has no altsetting 0 [ 359.626736][ T5969] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.630950][ T5969] usb 6-1: config 0 descriptor?? [ 360.048619][ T5969] input: HID 16c0:05e1 as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.0/0003:16C0:05E1.0006/input/input25 [ 360.130457][ T5969] xinmo 0003:16C0:05E1.0006: input,hiddev0,hidraw1: USB HID v0.00 Device [HID 16c0:05e1] on usb-dummy_hcd.1-1/input0 [ 360.419986][ T5969] tipc: Node number set to 43690 [ 360.603208][ T5969] usb 6-1: USB disconnect, device number 45 [ 360.612673][T12205] netlink: 200 bytes leftover after parsing attributes in process `syz.2.2230'. [ 360.715281][T12209] bridge0: port 2(macsec0) entered blocking state [ 360.715434][T12209] bridge0: port 2(macsec0) entered disabled state [ 360.715531][T12209] macsec0: entered allmulticast mode [ 360.715544][T12209] bridge0: entered allmulticast mode [ 360.715567][T12209] bridge0: entered promiscuous mode [ 360.717521][T12209] macsec0: left allmulticast mode [ 360.717579][T12209] bridge0: left allmulticast mode [ 360.720740][T12211] netlink: 200 bytes leftover after parsing attributes in process `syz.2.2240'. [ 360.738966][ T43] bridge0: left promiscuous mode [ 361.653998][T12231] netlink: 260 bytes leftover after parsing attributes in process `syz.0.2241'. [ 361.684320][T12233] hsr_slave_0: left promiscuous mode [ 361.684872][T12233] hsr_slave_1: left promiscuous mode [ 361.753556][T12236] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2242'. [ 362.625417][ T7263] usb 8-1: new high-speed USB device number 43 using dummy_hcd [ 362.786339][ T7263] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 362.787526][ T7263] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 362.787550][ T7263] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 362.787567][ T7263] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 362.787597][ T7263] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 362.790568][ T7263] usb 8-1: config 0 descriptor?? [ 363.200737][ T7263] plantronics 0003:047F:FFFF.0007: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 363.382843][ T5739] Bluetooth: hci3: SCO packet for unknown connection handle 201 [ 364.518264][ C1] plantronics 0003:047F:FFFF.0007: usb_submit_urb(ctrl) failed: -1 [ 364.959882][T12273] syzkaller1: entered promiscuous mode [ 364.959897][T12273] syzkaller1: entered allmulticast mode [ 365.184995][T12279] block nbd3: shutting down sockets [ 365.189656][T12238] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 365.189789][T12265] netlink: 200 bytes leftover after parsing attributes in process `syz.0.2252'. [ 365.483453][ T44] kauditd_printk_skb: 8 callbacks suppressed [ 365.483557][ T44] audit: type=1800 audit(1791791710.915:422): pid=12288 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2261" name="file0" dev="overlay" ino=2895 res=0 errno=0 [ 366.605983][T12305] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2266'. [ 366.680549][T12315] netlink: 'syz.1.2270': attribute type 10 has an invalid length. [ 366.693148][T12315] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 366.694154][T12315] team0: Port device netdevsim1 added [ 366.777603][T12318] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3345044383 (214082840512 ns) > initial count (60632714432 ns). Using initial count to start timer. [ 366.966226][ T25] usb 8-1: reset high-speed USB device number 43 using dummy_hcd [ 367.136552][ T25] usb 8-1: device firmware changed [ 367.142480][ T5969] usb 8-1: USB disconnect, device number 43 [ 367.285465][ T5969] usb 8-1: new high-speed USB device number 44 using dummy_hcd [ 367.436546][ T5969] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 367.437872][ T5969] usb 8-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 367.437906][ T5969] usb 8-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 367.437938][ T5969] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 367.445817][ T5969] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 367.500055][ T5969] snd-usb-audio 8-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 367.659897][ T5969] usb 8-1: USB disconnect, device number 44 [ 367.805562][ C3] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 367.815962][ T5822] usb 7-1: new full-speed USB device number 48 using dummy_hcd [ 367.966147][ T5822] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 367.967222][ T5822] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 367.967247][ T5822] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 367.967267][ T5822] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 367.968111][ T5822] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 367.968123][ T5822] usb 7-1: SerialNumber: syz [ 367.969948][T12334] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 367.970109][T12334] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 368.179648][T12334] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 368.179757][T12334] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 368.363549][T12340] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2281'. [ 368.435444][ T0] NOHZ tick-stop error: local softirq work is pending, handler #108!!! [ 368.465448][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 368.485352][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 368.599946][ T5822] cdc_ether 7-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.2-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 368.815851][ T2391] usb 7-1: USB disconnect, device number 48 [ 368.820520][ T2391] cdc_ether 7-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.2-1, CDC Ethernet Device [ 369.649153][T12308] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 369.649310][T12329] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2276'. [ 369.652807][T12347] netlink: 260 bytes leftover after parsing attributes in process `syz.2.2283'. [ 369.720860][ T6338] IPVS: starting estimator thread 0... [ 369.815553][T12353] IPVS: using max 43 ests per chain, 103200 per kthread [ 369.987551][T12370] FAULT_INJECTION: forcing a failure. [ 369.987551][T12370] name failslab, interval 1, probability 0, space 0, times 0 [ 369.987573][T12370] CPU: 0 UID: 0 PID: 12370 Comm: syz.0.2289 Tainted: G L syzkaller #0 PREEMPT(full) [ 369.987589][T12370] Tainted: [L]=SOFTLOCKUP [ 369.987594][T12370] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 369.987601][T12370] Call Trace: [ 369.987606][T12370] [ 369.987610][T12370] dump_stack_lvl+0x100/0x190 [ 369.987689][T12370] should_fail_ex.cold+0x5/0xa [ 369.987718][T12370] should_failslab+0xc2/0x120 [ 369.987759][T12370] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 369.987777][T12370] ? shmem_alloc_inode+0x25/0x50 [ 369.987795][T12370] ? __pfx_shmem_alloc_inode+0x10/0x10 [ 369.987811][T12370] shmem_alloc_inode+0x25/0x50 [ 369.987826][T12370] alloc_inode+0x68/0x250 [ 369.987838][T12370] new_inode+0x22/0x1c0 [ 369.987852][T12370] shmem_get_inode+0x1e3/0xf70 [ 369.987869][T12370] ? __pfx_shmem_get_inode+0x10/0x10 [ 369.987886][T12370] ? lockdep_init_map_type+0x5c/0x250 [ 369.987907][T12370] shmem_fill_super+0xb31/0x13e0 [ 369.987926][T12370] ? __pfx_shmem_fill_super+0x10/0x10 [ 369.987945][T12370] ? apparmor_capable+0x1d7/0x4d0 [ 369.987960][T12370] ? __pfx_shmem_fill_super+0x10/0x10 [ 369.987976][T12370] get_tree_nodev+0xdd/0x190 [ 369.987991][T12370] vfs_get_tree+0x92/0x320 [ 369.988004][T12370] path_mount+0x7d0/0x2850 [ 369.988021][T12370] ? __pfx_path_mount+0x10/0x10 [ 369.988036][T12370] ? lockdep_hardirqs_on+0x7d/0x110 [ 369.988094][T12370] ? putname+0xb1/0x110 [ 369.988120][T12370] ? kmem_cache_free+0x127/0x6c0 [ 369.988152][T12370] ? __ia32_sys_mount+0x292/0x310 [ 369.988168][T12370] __ia32_sys_mount+0x292/0x310 [ 369.988182][T12370] ? __pfx___ia32_sys_mount+0x10/0x10 [ 369.988198][T12370] __do_fast_syscall_32+0x13a/0x8b0 [ 369.988212][T12370] do_fast_syscall_32+0x32/0x70 [ 369.988223][T12370] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 369.988238][T12370] RIP: 0023:0xf743efec [ 369.988252][T12370] Code: Unable to access opcode bytes at 0xf743efc2. [ 369.988258][T12370] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 369.988269][T12370] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000780 [ 369.988284][T12370] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 369.988291][T12370] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 369.988297][T12370] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 369.988304][T12370] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 369.988319][T12370] [ 370.049804][T12373] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2290'. [ 370.226428][T12384] FAULT_INJECTION: forcing a failure. [ 370.226428][T12384] name failslab, interval 1, probability 0, space 0, times 0 [ 370.226461][T12384] CPU: 2 UID: 0 PID: 12384 Comm: syz.0.2291 Tainted: G L syzkaller #0 PREEMPT(full) [ 370.226486][T12384] Tainted: [L]=SOFTLOCKUP [ 370.226493][T12384] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 370.226503][T12384] Call Trace: [ 370.226510][T12384] [ 370.226517][T12384] dump_stack_lvl+0x100/0x190 [ 370.226547][T12384] should_fail_ex.cold+0x5/0xa [ 370.226571][T12384] should_failslab+0xc2/0x120 [ 370.226600][T12384] kmem_cache_alloc_noprof+0x92/0x6a0 [ 370.226623][T12384] ? __pfx_map_id_range_down+0x10/0x10 [ 370.226649][T12384] ? security_inode_alloc+0x3b/0x2c0 [ 370.226673][T12384] security_inode_alloc+0x3b/0x2c0 [ 370.226692][T12384] inode_init_always_gfp+0xc6f/0xfb0 [ 370.226720][T12384] alloc_inode+0x8e/0x250 [ 370.226739][T12384] path_from_stashed+0x25b/0x760 [ 370.226765][T12384] ? do_raw_spin_unlock+0x145/0x1e0 [ 370.226790][T12384] ns_get_path+0x60/0x80 [ 370.226816][T12384] proc_ns_get_link+0x260/0x2e0 [ 370.226843][T12384] ? __pfx_proc_ns_get_link+0x10/0x10 [ 370.226870][T12384] ? atime_needs_update+0x8b/0x760 [ 370.226893][T12384] pick_link+0xd17/0x13c0 [ 370.226912][T12384] ? rcu_is_watching+0x13/0xc0 [ 370.226933][T12384] ? __pfx_proc_ns_get_link+0x10/0x10 [ 370.226961][T12384] step_into_slowpath+0x9b3/0x1150 [ 370.226981][T12384] ? proc_ns_dir_lookup+0x1da/0x390 [ 370.227011][T12384] ? __pfx_step_into_slowpath+0x10/0x10 [ 370.227043][T12384] path_openat+0xfab/0x2440 [ 370.227071][T12384] ? __pfx_path_openat+0x10/0x10 [ 370.227102][T12384] do_file_open+0x20e/0x430 [ 370.227129][T12384] ? __pfx_do_file_open+0x10/0x10 [ 370.227212][T12384] ? _raw_spin_unlock+0x28/0x50 [ 370.227246][T12384] ? alloc_fd+0x471/0x7a0 [ 370.227278][T12384] do_sys_openat2+0x10f/0x1e0 [ 370.227297][T12384] ? __pfx_do_sys_openat2+0x10/0x10 [ 370.227319][T12384] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 370.227345][T12384] __ia32_compat_sys_openat+0x12d/0x210 [ 370.227366][T12384] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 370.227395][T12384] do_int80_emulation+0x166/0x650 [ 370.227416][T12384] asm_int80_emulation+0x1a/0x20 [ 370.227435][T12384] RIP: 0023:0xf719762b [ 370.227450][T12384] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 370.227467][T12384] RSP: 002b:00000000f545642c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 370.227487][T12384] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f7262145 [ 370.227499][T12384] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 370.227510][T12384] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 370.227521][T12384] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 370.227531][T12384] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 370.227555][T12384] [ 370.252055][T12385] block nbd3: shutting down sockets [ 370.585527][ T5822] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 370.680345][T12396] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 370.694136][T12396] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 370.739906][ T5822] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 370.754192][ T5822] usb 8-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 370.755220][ T5822] usb 8-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 370.756201][ T5822] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.999527][ T5822] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 371.139492][ T5822] snd-usb-audio 8-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 371.289539][ T5822] usb 8-1: USB disconnect, device number 45 [ 371.621388][T12416] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2302'. [ 371.882802][T12420] batman_adv: batadv0: Adding interface: syzkaller0 [ 371.882818][T12420] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 371.882842][T12420] batman_adv: batadv0: Interface activated: syzkaller0 [ 372.169463][T12419] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 372.183676][T12419] batman_adv: batadv0: Removing interface: syzkaller0 [ 372.236750][T12424] FAULT_INJECTION: forcing a failure. [ 372.236750][T12424] name failslab, interval 1, probability 0, space 0, times 0 [ 372.236783][T12424] CPU: 3 UID: 0 PID: 12424 Comm: syz.3.2306 Tainted: G L syzkaller #0 PREEMPT(full) [ 372.236811][T12424] Tainted: [L]=SOFTLOCKUP [ 372.236817][T12424] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 372.236829][T12424] Call Trace: [ 372.236836][T12424] [ 372.236844][T12424] dump_stack_lvl+0x100/0x190 [ 372.236874][T12424] should_fail_ex.cold+0x5/0xa [ 372.236898][T12424] should_failslab+0xc2/0x120 [ 372.236928][T12424] __kmalloc_noprof+0xfc/0x840 [ 372.236951][T12424] ? __register_sysctl_table+0xbc8/0x1650 [ 372.236970][T12424] ? __register_sysctl_table+0xbe4/0x1650 [ 372.236993][T12424] __register_sysctl_table+0xbe4/0x1650 [ 372.237018][T12424] ? __pfx___register_sysctl_table+0x10/0x10 [ 372.237036][T12424] ? is_module_address+0x5f/0xf0 [ 372.237056][T12424] ? is_module_address+0x5f/0xf0 [ 372.237080][T12424] register_net_sysctl_sz+0x325/0x420 [ 372.237108][T12424] __devinet_sysctl_register+0x1b9/0x360 [ 372.237174][T12424] ? __kasan_kmalloc+0xaa/0xb0 [ 372.237202][T12424] ? __pfx___devinet_sysctl_register+0x10/0x10 [ 372.237232][T12424] ? __asan_memcpy+0x3c/0x60 [ 372.237258][T12424] devinet_init_net+0x303/0x8d0 [ 372.237285][T12424] ? __pfx_devinet_init_net+0x10/0x10 [ 372.237309][T12424] ops_init+0x1e2/0x5f0 [ 372.237335][T12424] setup_net+0x118/0x3a0 [ 372.237357][T12424] ? __pfx_setup_net+0x10/0x10 [ 372.237387][T12424] copy_net_ns+0x345/0x7a0 [ 372.237414][T12424] create_new_namespaces+0x3ea/0xac0 [ 372.237446][T12424] unshare_nsproxy_namespaces+0xf2/0x220 [ 372.237475][T12424] ksys_unshare+0x4a2/0xb30 [ 372.237495][T12424] ? __pfx_ksys_unshare+0x10/0x10 [ 372.237523][T12424] __ia32_sys_unshare+0x30/0x40 [ 372.237542][T12424] __do_fast_syscall_32+0x13a/0x8b0 [ 372.237564][T12424] do_fast_syscall_32+0x32/0x70 [ 372.237583][T12424] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 372.237604][T12424] RIP: 0023:0xf73befec [ 372.237624][T12424] Code: Unable to access opcode bytes at 0xf73befc2. [ 372.237632][T12424] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000136 [ 372.237651][T12424] RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 0000000000000000 [ 372.237670][T12424] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 372.237682][T12424] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 372.237693][T12424] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 372.237704][T12424] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 372.237730][T12424] [ 372.237738][T12424] sysctl could not get directory: /net/ipv4/conf -12 [ 372.307206][T12426] FAULT_INJECTION: forcing a failure. [ 372.307206][T12426] name failslab, interval 1, probability 0, space 0, times 0 [ 372.307234][T12426] CPU: 1 UID: 0 PID: 12426 Comm: syz.0.2307 Tainted: G L syzkaller #0 PREEMPT(full) [ 372.307257][T12426] Tainted: [L]=SOFTLOCKUP [ 372.307263][T12426] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 372.307276][T12426] Call Trace: [ 372.307282][T12426] [ 372.307291][T12426] dump_stack_lvl+0x100/0x190 [ 372.307323][T12426] should_fail_ex.cold+0x5/0xa [ 372.307350][T12426] should_failslab+0xc2/0x120 [ 372.307380][T12426] __kmalloc_cache_node_noprof+0x94/0x720 [ 372.307410][T12426] ? sbitmap_queue_init_node+0x291/0x4a0 [ 372.307447][T12426] sbitmap_queue_init_node+0x291/0x4a0 [ 372.307483][T12426] blk_mq_init_tags+0x1ba/0x300 [ 372.307512][T12426] blk_mq_alloc_map_and_rqs+0x244/0xe30 [ 372.307541][T12426] ? blk_mq_update_queue_map+0x227/0x3a0 [ 372.307572][T12426] blk_mq_alloc_tag_set+0x848/0x1330 [ 372.307606][T12426] loop_add+0x3b7/0xb60 [ 372.307637][T12426] ? __pfx_loop_add+0x10/0x10 [ 372.307682][T12426] ? __fget_files+0x34/0x3d0 [ 372.307709][T12426] ? find_held_lock+0x2b/0x80 [ 372.307732][T12426] ? __fget_files+0x215/0x3d0 [ 372.307768][T12426] loop_control_ioctl+0xae/0x620 [ 372.307790][T12426] ? __pfx_loop_control_ioctl+0x10/0x10 [ 372.307815][T12426] ? __pfx_loop_control_ioctl+0x10/0x10 [ 372.307836][T12426] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 372.307865][T12426] __do_fast_syscall_32+0x13a/0x8b0 [ 372.307891][T12426] do_fast_syscall_32+0x32/0x70 [ 372.307912][T12426] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 372.307936][T12426] RIP: 0023:0xf743efec [ 372.307957][T12426] Code: Unable to access opcode bytes at 0xf743efc2. [ 372.307967][T12426] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 372.307988][T12426] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000004c80 [ 372.308002][T12426] RDX: 0000000007000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 372.308014][T12426] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 372.308026][T12426] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 372.308038][T12426] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 372.308066][T12426] [ 372.308219][T12426] blk-mq: reduced tag depth (128 -> 64) [ 372.523376][T12434] syzkaller1: entered promiscuous mode [ 372.523399][T12434] syzkaller1: entered allmulticast mode [ 372.603271][T12441] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2308'. [ 372.825461][ T9110] usb 8-1: new high-speed USB device number 46 using dummy_hcd [ 372.976161][ T9110] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 372.977168][ T9110] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 372.977224][ T9110] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 372.977236][ T9110] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 372.977256][ T9110] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.979759][ T9110] usb 8-1: config 0 descriptor?? [ 373.419326][ T9110] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw1: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 373.444640][T12454] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 373.581028][T12457] batman_adv: batadv0: Adding interface: syzkaller0 [ 373.581041][T12457] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 373.581057][T12457] batman_adv: batadv0: Interface activated: syzkaller0 [ 373.586083][T12456] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 373.601820][T12456] batman_adv: batadv0: Removing interface: syzkaller0 [ 373.712433][T12459] FAULT_INJECTION: forcing a failure. [ 373.712433][T12459] name failslab, interval 1, probability 0, space 0, times 0 [ 373.712456][T12459] CPU: 3 UID: 0 PID: 12459 Comm: syz.2.2321 Tainted: G L syzkaller #0 PREEMPT(full) [ 373.712474][T12459] Tainted: [L]=SOFTLOCKUP [ 373.712479][T12459] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 373.712487][T12459] Call Trace: [ 373.712491][T12459] [ 373.712496][T12459] dump_stack_lvl+0x100/0x190 [ 373.712516][T12459] should_fail_ex.cold+0x5/0xa [ 373.712533][T12459] should_failslab+0xc2/0x120 [ 373.712552][T12459] kmem_cache_alloc_noprof+0x92/0x6a0 [ 373.712569][T12459] ? fdb_create+0x22f/0x1920 [ 373.712586][T12459] fdb_create+0x22f/0x1920 [ 373.712601][T12459] ? br_fdb_find+0x77/0x240 [ 373.712617][T12459] ? __pfx_fdb_create+0x10/0x10 [ 373.712634][T12459] fdb_add_local+0x155/0x1c0 [ 373.712651][T12459] br_fdb_changeaddr+0x27e/0x520 [ 373.712670][T12459] br_device_event+0x866/0xa00 [ 373.712681][T12459] ? __pfx_br_device_event+0x10/0x10 [ 373.712694][T12459] ? lockdep_rtnl_is_held+0x26/0x40 [ 373.712708][T12459] notifier_call_chain+0x99/0x3f0 [ 373.712725][T12459] call_netdevice_notifiers_info+0xbe/0x110 [ 373.712742][T12459] call_netdevice_notifiers+0x7c/0xb0 [ 373.712759][T12459] ? __pfx_call_netdevice_notifiers+0x10/0x10 [ 373.712779][T12459] dev_ifsioc+0x128e/0x1ee0 [ 373.712794][T12459] ? __pfx_dev_ifsioc+0x10/0x10 [ 373.712811][T12459] ? __pfx___mutex_lock+0x10/0x10 [ 373.712825][T12459] ? lock_acquire+0x1d1/0x380 [ 373.712843][T12459] ? dev_load+0x8e/0x240 [ 373.712855][T12459] ? dev_load+0x8e/0x240 [ 373.712871][T12459] dev_ioctl+0x342/0x1070 [ 373.712886][T12459] sock_do_ioctl+0x1a0/0x280 [ 373.712902][T12459] ? __pfx_sock_do_ioctl+0x10/0x10 [ 373.712921][T12459] ? do_vfs_ioctl+0x226/0x13e0 [ 373.712934][T12459] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 373.712951][T12459] ? __pfx_unix_compat_ioctl+0x10/0x10 [ 373.712964][T12459] ? unix_ioctl+0x9c/0x570 [ 373.712976][T12459] compat_sock_ioctl+0x568/0x760 [ 373.712996][T12459] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 373.713013][T12459] ? hook_file_ioctl_common+0x140/0x440 [ 373.713030][T12459] ? __fget_files+0x21f/0x3d0 [ 373.713047][T12459] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 373.713066][T12459] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 373.713081][T12459] __do_fast_syscall_32+0x13a/0x8b0 [ 373.713095][T12459] do_fast_syscall_32+0x32/0x70 [ 373.713107][T12459] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 373.713121][T12459] RIP: 0023:0xf744efec [ 373.713135][T12459] Code: Unable to access opcode bytes at 0xf744efc2. [ 373.713146][T12459] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 373.713158][T12459] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000008937 [ 373.713167][T12459] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 373.713174][T12459] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 373.713182][T12459] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 373.713216][T12459] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 373.713243][T12459] [ 373.769883][T12461] FAULT_INJECTION: forcing a failure. [ 373.769883][T12461] name failslab, interval 1, probability 0, space 0, times 0 [ 373.769947][T12461] CPU: 3 UID: 0 PID: 12461 Comm: syz.2.2322 Tainted: G L syzkaller #0 PREEMPT(full) [ 373.769964][T12461] Tainted: [L]=SOFTLOCKUP [ 373.769968][T12461] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 373.769975][T12461] Call Trace: [ 373.769979][T12461] [ 373.769985][T12461] dump_stack_lvl+0x100/0x190 [ 373.770006][T12461] should_fail_ex.cold+0x5/0xa [ 373.770021][T12461] should_failslab+0xc2/0x120 [ 373.770052][T12461] kmem_cache_alloc_noprof+0x92/0x6a0 [ 373.770069][T12461] ? dev_queue_xmit_nit+0x38/0xa60 [ 373.770082][T12461] ? skb_clone+0x190/0x400 [ 373.770099][T12461] skb_clone+0x190/0x400 [ 373.770113][T12461] dev_queue_xmit_nit+0x255/0xa60 [ 373.770132][T12461] dev_hard_start_xmit+0x2f5/0x760 [ 373.770158][T12461] __dev_queue_xmit+0x1c25/0x4a40 [ 373.770174][T12461] ? __pfx___dev_queue_xmit+0x10/0x10 [ 373.770200][T12461] ? rcu_is_watching+0x13/0xc0 [ 373.770228][T12461] ? __skb_clone+0x570/0x760 [ 373.770255][T12461] netlink_deliver_tap+0xa4d/0xcc0 [ 373.770281][T12461] netlink_unicast+0x62b/0x850 [ 373.770305][T12461] ? __pfx_netlink_unicast+0x10/0x10 [ 373.770327][T12461] netlink_sendmsg+0x8b0/0xda0 [ 373.770341][T12461] ? __pfx_netlink_sendmsg+0x10/0x10 [ 373.770355][T12461] ? apparmor_socket_sendmsg+0x165/0x280 [ 373.770369][T12461] ____sys_sendmsg+0xa4d/0xbe0 [ 373.770385][T12461] ? __pfx_netlink_sendmsg+0x10/0x10 [ 373.770398][T12461] ? __pfx_____sys_sendmsg+0x10/0x10 [ 373.770421][T12461] ___sys_sendmsg+0x190/0x1e0 [ 373.770440][T12461] ? __pfx____sys_sendmsg+0x10/0x10 [ 373.770457][T12461] ? futex_wait+0x11e/0x370 [ 373.770478][T12461] ? find_held_lock+0x2b/0x80 [ 373.770501][T12461] __sys_sendmsg+0x160/0x210 [ 373.770516][T12461] ? __pfx___sys_sendmsg+0x10/0x10 [ 373.770537][T12461] __do_fast_syscall_32+0x13a/0x8b0 [ 373.770551][T12461] do_fast_syscall_32+0x32/0x70 [ 373.770563][T12461] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 373.770578][T12461] RIP: 0023:0xf744efec [ 373.770592][T12461] Code: Unable to access opcode bytes at 0xf744efc2. [ 373.770597][T12461] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 373.770610][T12461] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800009c0 [ 373.770617][T12461] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 373.770624][T12461] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 373.770630][T12461] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 373.770637][T12461] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 373.770653][T12461] [ 373.919575][T12468] netlink: 200 bytes leftover after parsing attributes in process `syz.0.2324'. [ 374.347542][T12471] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2325'. [ 375.255240][T12483] FAULT_INJECTION: forcing a failure. [ 375.255240][T12483] name failslab, interval 1, probability 0, space 0, times 0 [ 375.255264][T12483] CPU: 2 UID: 0 PID: 12483 Comm: syz.3.2329 Tainted: G L syzkaller #0 PREEMPT(full) [ 375.255281][T12483] Tainted: [L]=SOFTLOCKUP [ 375.255286][T12483] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 375.255298][T12483] Call Trace: [ 375.255314][T12483] [ 375.255319][T12483] dump_stack_lvl+0x100/0x190 [ 375.255341][T12483] should_fail_ex.cold+0x5/0xa [ 375.255357][T12483] should_failslab+0xc2/0x120 [ 375.255376][T12483] __kmalloc_cache_node_noprof+0x94/0x720 [ 375.255395][T12483] ? sbitmap_queue_init_node+0x291/0x4a0 [ 375.255417][T12483] sbitmap_queue_init_node+0x291/0x4a0 [ 375.255437][T12483] blk_mq_init_tags+0x1ba/0x300 [ 375.255454][T12483] blk_mq_alloc_map_and_rqs+0x244/0xe30 [ 375.255470][T12483] ? blk_mq_update_queue_map+0x227/0x3a0 [ 375.255487][T12483] blk_mq_alloc_tag_set+0x848/0x1330 [ 375.255506][T12483] loop_add+0x3b7/0xb60 [ 375.255525][T12483] ? __pfx_loop_add+0x10/0x10 [ 375.255550][T12483] ? __fget_files+0x34/0x3d0 [ 375.255566][T12483] ? find_held_lock+0x2b/0x80 [ 375.255579][T12483] ? __fget_files+0x215/0x3d0 [ 375.255596][T12483] loop_control_ioctl+0xae/0x620 [ 375.255608][T12483] ? __pfx_loop_control_ioctl+0x10/0x10 [ 375.255622][T12483] ? __pfx_loop_control_ioctl+0x10/0x10 [ 375.255633][T12483] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 375.255648][T12483] __do_fast_syscall_32+0x13a/0x8b0 [ 375.255663][T12483] do_fast_syscall_32+0x32/0x70 [ 375.255674][T12483] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 375.255689][T12483] RIP: 0023:0xf73befec [ 375.255702][T12483] Code: Unable to access opcode bytes at 0xf73befc2. [ 375.255707][T12483] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 375.255718][T12483] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000004c80 [ 375.255726][T12483] RDX: 0000000007000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 375.255732][T12483] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 375.255739][T12483] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 375.255745][T12483] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 375.255761][T12483] [ 375.256143][T12483] blk-mq: reduced tag depth (128 -> 64) [ 375.370434][T12488] FAULT_INJECTION: forcing a failure. [ 375.370434][T12488] name failslab, interval 1, probability 0, space 0, times 0 [ 375.370468][T12488] CPU: 0 UID: 0 PID: 12488 Comm: syz.3.2331 Tainted: G L syzkaller #0 PREEMPT(full) [ 375.370496][T12488] Tainted: [L]=SOFTLOCKUP [ 375.370504][T12488] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 375.370516][T12488] Call Trace: [ 375.370522][T12488] [ 375.370529][T12488] dump_stack_lvl+0x100/0x190 [ 375.370558][T12488] should_fail_ex.cold+0x5/0xa [ 375.370586][T12488] should_failslab+0xc2/0x120 [ 375.370617][T12488] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 375.370660][T12488] ? kstrdup_const+0x63/0x80 [ 375.370688][T12488] kstrdup+0x51/0xe0 [ 375.370713][T12488] kstrdup_const+0x63/0x80 [ 375.370736][T12488] __kernfs_new_node+0x9b/0xa10 [ 375.370758][T12488] ? __pfx___kernfs_new_node+0x10/0x10 [ 375.370781][T12488] ? lock_acquire+0x1d1/0x380 [ 375.370808][T12488] ? kernfs_root+0x23/0x2a0 [ 375.370835][T12488] ? find_held_lock+0x2b/0x80 [ 375.370854][T12488] ? kernfs_root+0xee/0x2a0 [ 375.370879][T12488] ? kernfs_root+0xee/0x2a0 [ 375.370912][T12488] kernfs_new_node+0x117/0x150 [ 375.370935][T12488] kernfs_create_link+0xcc/0x240 [ 375.370960][T12488] sysfs_do_create_link_sd+0x90/0x140 [ 375.370988][T12488] sysfs_create_link+0x61/0xc0 [ 375.371014][T12488] device_add+0x675/0x1970 [ 375.371039][T12488] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 375.371068][T12488] ? __pfx_device_add+0x10/0x10 [ 375.371092][T12488] ? lockdep_init_map_type+0x5c/0x250 [ 375.371188][T12488] ? __init_waitqueue_head+0xca/0x150 [ 375.371227][T12488] netdev_register_kobject+0x1df/0x410 [ 375.371264][T12488] register_netdevice+0x15b6/0x25a0 [ 375.371295][T12488] ? __pfx_register_netdevice+0x10/0x10 [ 375.371321][T12488] ? slip_open+0xb49/0x1120 [ 375.371339][T12488] ? kfree+0x1e5/0x6d0 [ 375.371359][T12488] ? __local_bh_enable_ip+0xa5/0x120 [ 375.371390][T12488] slip_open+0xb8a/0x1120 [ 375.371413][T12488] ? __pfx_slip_open+0x10/0x10 [ 375.371435][T12488] ? down_write+0x146/0x1f0 [ 375.371459][T12488] ? __pfx_slip_open+0x10/0x10 [ 375.371477][T12488] tty_ldisc_open+0xa2/0x120 [ 375.371507][T12488] tty_set_ldisc+0x325/0x740 [ 375.371530][T12488] tty_ioctl+0x695/0x1800 [ 375.371553][T12488] ? __pfx_tty_ioctl+0x10/0x10 [ 375.371593][T12488] ? do_vfs_ioctl+0x226/0x13e0 [ 375.371618][T12488] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 375.371647][T12488] ? __fget_files+0x34/0x3d0 [ 375.371671][T12488] ? find_held_lock+0x2b/0x80 [ 375.371692][T12488] ? __fget_files+0x215/0x3d0 [ 375.371714][T12488] ? hook_file_ioctl_common+0x140/0x440 [ 375.371743][T12488] ? __fget_files+0x21f/0x3d0 [ 375.371771][T12488] tty_compat_ioctl+0x2b3/0x420 [ 375.371792][T12488] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 375.371814][T12488] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 375.371839][T12488] __do_fast_syscall_32+0x13a/0x8b0 [ 375.371863][T12488] do_fast_syscall_32+0x32/0x70 [ 375.371883][T12488] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 375.371904][T12488] RIP: 0023:0xf73befec [ 375.371926][T12488] Code: Unable to access opcode bytes at 0xf73befc2. [ 375.371934][T12488] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 375.371954][T12488] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000005423 [ 375.371966][T12488] RDX: 0000000080000480 RSI: 0000000000000000 RDI: 0000000000000000 [ 375.371978][T12488] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 375.371988][T12488] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 375.371998][T12488] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 375.372023][T12488] [ 375.468950][ T5969] usb 8-1: USB disconnect, device number 46 [ 375.575733][ T5739] Bluetooth: hci2: unexpected event for opcode 0x0c5a [ 375.587310][T12494] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 375.587310][T12494] [ 375.587519][T12494] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 375.591977][T12494] CIFS: Attempting to mount //172.20.20.170/share [ 375.642827][T12494] CIFS: VFS: cifs_mount failed w/return code = -112 [ 375.844769][T12500] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2335'. [ 376.185409][ T9110] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 376.335984][ T9110] usb 6-1: New USB device found, idVendor=04b3, idProduct=3100, bcdDevice= 0.00 [ 376.336875][ T9110] usb 6-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 32, changing to 9 [ 376.336899][ T9110] usb 6-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 376.336919][ T9110] usb 6-1: config 0 interface 0 has no altsetting 0 [ 376.336943][ T9110] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 376.339862][ T9110] usb 6-1: config 0 descriptor?? [ 376.364355][T12510] Invalid source name [ 376.364367][T12510] UBIFS error (pid: 12510): cannot open "./file0", error -22 [ 376.644307][ T9110] usbhid 6-1:0.0: can't add hid device: -71 [ 376.644383][ T9110] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 376.659741][ T9110] usb 6-1: USB disconnect, device number 46 [ 376.767310][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 376.865888][T12519] overlayfs: statfs failed on './file0' [ 377.720101][T12549] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 378.583539][ T44] audit: type=1326 audit(1791791724.015:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12556 comm="syz.3.2355" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf73befec code=0x0 [ 379.460314][T12560] input: syz1 as /devices/virtual/input/input27 [ 380.198827][T12534] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 380.199795][T12543] netlink: 200 bytes leftover after parsing attributes in process `syz.2.2347'. [ 380.203878][T12553] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2354'. [ 380.204073][T12562] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2357'. [ 380.268712][T12565] FAULT_INJECTION: forcing a failure. [ 380.268712][T12565] name fail_futex, interval 1, probability 0, space 0, times 1 [ 380.268745][T12565] CPU: 0 UID: 0 PID: 12565 Comm: syz.0.2359 Tainted: G L syzkaller #0 PREEMPT(full) [ 380.268770][T12565] Tainted: [L]=SOFTLOCKUP [ 380.268775][T12565] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 380.268783][T12565] Call Trace: [ 380.268787][T12565] [ 380.268792][T12565] dump_stack_lvl+0x100/0x190 [ 380.268812][T12565] should_fail_ex.cold+0x5/0xa [ 380.268836][T12565] get_futex_key+0x1d0/0x14f0 [ 380.268860][T12565] ? __pfx_get_futex_key+0x10/0x10 [ 380.268882][T12565] ? ___sys_sendmsg+0x127/0x1e0 [ 380.268908][T12565] futex_wake+0xf4/0x5e0 [ 380.268930][T12565] ? futex_wait+0x11e/0x370 [ 380.268957][T12565] ? __pfx_futex_wake+0x10/0x10 [ 380.268985][T12565] ? find_held_lock+0x2b/0x80 [ 380.269006][T12565] do_futex+0x2b2/0x440 [ 380.269027][T12565] ? __pfx_do_futex+0x10/0x10 [ 380.269050][T12565] ? fput+0x7c/0x100 [ 380.269079][T12565] __ia32_sys_futex_time32+0x2f4/0x470 [ 380.269100][T12565] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 380.269132][T12565] __do_fast_syscall_32+0x13a/0x8b0 [ 380.269156][T12565] do_fast_syscall_32+0x32/0x70 [ 380.269174][T12565] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 380.269192][T12565] RIP: 0023:0xf743efec [ 380.269211][T12565] Code: Unable to access opcode bytes at 0xf743efc2. [ 380.269220][T12565] RSP: 002b:00000000f54565cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 380.269238][T12565] RAX: ffffffffffffffda RBX: 00000000f7464f8c RCX: 0000000000000081 [ 380.269250][T12565] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 380.269261][T12565] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 380.269272][T12565] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 380.269282][T12565] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 380.269304][T12565] [ 380.306362][T12571] batman_adv: batadv0: Adding interface: syzkaller0 [ 380.306373][T12571] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 380.306389][T12571] batman_adv: batadv0: Interface activated: syzkaller0 [ 380.551552][T12570] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 380.567045][T12570] batman_adv: batadv0: Removing interface: syzkaller0 [ 380.570522][T12584] input: syz0 as /devices/virtual/input/input28 [ 380.685016][T12586] batman_adv: batadv0: Adding interface: syzkaller0 [ 380.685033][T12586] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 380.685060][T12586] batman_adv: batadv0: Interface activated: syzkaller0 [ 380.699551][T12585] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 380.710766][T12585] batman_adv: batadv0: Removing interface: syzkaller0 [ 380.730813][T12588] loop5: detected capacity change from 0 to 7 [ 380.747962][T12588] loop5: [ 380.747985][T12588] loop5: partition table partially beyond EOD, truncated [ 380.815257][T12598] binder: 12597:12598 ioctl 402c542c 0 returned -22 [ 381.167562][T12608] FAULT_INJECTION: forcing a failure. [ 381.167562][T12608] name failslab, interval 1, probability 0, space 0, times 0 [ 381.167584][T12608] CPU: 0 UID: 0 PID: 12608 Comm: syz.2.2373 Tainted: G L syzkaller #0 PREEMPT(full) [ 381.167600][T12608] Tainted: [L]=SOFTLOCKUP [ 381.167605][T12608] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 381.167611][T12608] Call Trace: [ 381.167617][T12608] [ 381.167622][T12608] dump_stack_lvl+0x100/0x190 [ 381.167643][T12608] should_fail_ex.cold+0x5/0xa [ 381.167658][T12608] should_failslab+0xc2/0x120 [ 381.167678][T12608] __kmalloc_cache_noprof+0x91/0x6d0 [ 381.167692][T12608] ? sctp_add_bind_addr+0xae/0x3e0 [ 381.167712][T12608] sctp_add_bind_addr+0xae/0x3e0 [ 381.167731][T12608] sctp_copy_local_addr_list+0x349/0x550 [ 381.167745][T12608] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 381.167762][T12608] ? sctp_auth_asoc_copy_shkeys+0x2a5/0x360 [ 381.167776][T12608] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 381.167812][T12608] sctp_bind_addr_copy+0xe0/0x530 [ 381.167835][T12608] sctp_connect_new_asoc+0x1c9/0x770 [ 381.167852][T12608] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 381.167869][T12608] ? __ipv6_addr_type+0x1eb/0x2e0 [ 381.167885][T12608] ? __ipv6_addr_type+0x1eb/0x2e0 [ 381.167903][T12608] __sctp_connect+0x3e7/0xc70 [ 381.167919][T12608] ? lock_acquire+0x1d1/0x380 [ 381.167938][T12608] ? __pfx___sctp_connect+0x10/0x10 [ 381.167958][T12608] __sctp_setsockopt_connectx+0x100/0x190 [ 381.167975][T12608] sctp_getsockopt+0x3e91/0x70e0 [ 381.167993][T12608] ? aa_inet_opt_perm+0x30d/0x970 [ 381.168023][T12608] ? __pfx_sctp_getsockopt+0x10/0x10 [ 381.168047][T12608] ? lock_acquire+0x1d1/0x380 [ 381.168076][T12608] ? find_held_lock+0x2b/0x80 [ 381.168097][T12608] ? futex_unqueue+0x133/0x2c0 [ 381.168116][T12608] ? futex_unqueue+0x133/0x2c0 [ 381.168145][T12608] ? __futex_wait+0x256/0x300 [ 381.168181][T12608] ? __pfx_futex_wake_mark+0x10/0x10 [ 381.168213][T12608] ? find_held_lock+0x2b/0x80 [ 381.168238][T12608] ? aa_sock_opt_perm+0x114/0x1e0 [ 381.168269][T12608] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 381.168299][T12608] do_sock_getsockopt+0x50a/0x6e0 [ 381.168331][T12608] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 381.168365][T12608] ? __fget_files+0x34/0x3d0 [ 381.168391][T12608] ? find_held_lock+0x2b/0x80 [ 381.168412][T12608] ? __fget_files+0x21f/0x3d0 [ 381.168431][T12608] __sys_getsockopt+0x133/0x1d0 [ 381.168449][T12608] ? __ia32_sys_getsockopt+0xbc/0x160 [ 381.168462][T12608] __ia32_sys_getsockopt+0xbc/0x160 [ 381.168474][T12608] ? __do_fast_syscall_32+0xb3/0x8b0 [ 381.168486][T12608] ? lockdep_hardirqs_on+0x7d/0x110 [ 381.168503][T12608] __do_fast_syscall_32+0x13a/0x8b0 [ 381.168517][T12608] do_fast_syscall_32+0x32/0x70 [ 381.168529][T12608] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 381.168544][T12608] RIP: 0023:0xf744efec [ 381.168558][T12608] Code: Unable to access opcode bytes at 0xf744efc2. [ 381.168563][T12608] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 000000000000016d [ 381.168575][T12608] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000084 [ 381.168582][T12608] RDX: 000000000000006f RSI: 0000000080000280 RDI: 00000000800002c0 [ 381.168589][T12608] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 381.168595][T12608] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 381.168602][T12608] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 381.168617][T12608] [ 381.748838][T12640] FAULT_INJECTION: forcing a failure. [ 381.748838][T12640] name failslab, interval 1, probability 0, space 0, times 0 [ 381.748870][T12640] CPU: 1 UID: 0 PID: 12640 Comm: syz.0.2382 Tainted: G L syzkaller #0 PREEMPT(full) [ 381.748897][T12640] Tainted: [L]=SOFTLOCKUP [ 381.748905][T12640] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 381.748916][T12640] Call Trace: [ 381.748922][T12640] [ 381.748930][T12640] dump_stack_lvl+0x100/0x190 [ 381.748961][T12640] should_fail_ex.cold+0x5/0xa [ 381.748988][T12640] should_failslab+0xc2/0x120 [ 381.749021][T12640] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 381.749049][T12640] ? nfs_get_client+0x87b/0x1230 [ 381.749076][T12640] ? nfs4_set_client+0x3f6/0x640 [ 381.749101][T12640] ? nfs4_init_server.isra.0+0x5ad/0xf60 [ 381.749129][T12640] ? kstrdup_const+0x63/0x80 [ 381.749156][T12640] kstrdup+0x51/0xe0 [ 381.749178][T12640] kstrdup_const+0x63/0x80 [ 381.749200][T12640] __kernfs_new_node+0x9b/0xa10 [ 381.749231][T12640] ? __pfx___kernfs_new_node+0x10/0x10 [ 381.749253][T12640] ? lock_acquire+0x1d1/0x380 [ 381.749282][T12640] ? kernfs_root+0x23/0x2a0 [ 381.749311][T12640] ? find_held_lock+0x2b/0x80 [ 381.749335][T12640] ? kernfs_root+0xee/0x2a0 [ 381.749363][T12640] ? kernfs_root+0xee/0x2a0 [ 381.749397][T12640] kernfs_create_dir_ns+0xa6/0x2b0 [ 381.749421][T12640] sysfs_create_dir_ns+0x13a/0x2b0 [ 381.749450][T12640] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 381.749476][T12640] ? find_held_lock+0x2b/0x80 [ 381.749497][T12640] ? kobject_add_internal+0x25f/0x930 [ 381.749520][T12640] ? kobject_add_internal+0x25f/0x930 [ 381.749545][T12640] ? rpc_sysfs_xprt_switch_namespace+0xd/0x40 [ 381.749579][T12640] kobject_add_internal+0x2c8/0x930 [ 381.749608][T12640] kobject_init_and_add+0x121/0x180 [ 381.749634][T12640] ? __pfx_kobject_init_and_add+0x10/0x10 [ 381.749661][T12640] ? __kasan_kmalloc+0xaa/0xb0 [ 381.749687][T12640] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 381.749711][T12640] ? rpc_sysfs_xprt_switch_setup+0xe0/0x370 [ 381.749737][T12640] rpc_sysfs_xprt_switch_setup+0x189/0x370 [ 381.749761][T12640] xprt_switch_alloc+0x28e/0x3c0 [ 381.749788][T12640] rpc_create_xprt+0x2dc/0x440 [ 381.749817][T12640] rpc_create+0x46e/0x7f0 [ 381.749843][T12640] ? lock_acquire+0x1d1/0x380 [ 381.749870][T12640] ? __pfx_rpc_create+0x10/0x10 [ 381.749924][T12640] ? net_generic+0xea/0x2a0 [ 381.749949][T12640] ? net_generic+0xea/0x2a0 [ 381.749981][T12640] nfs_create_rpc_client+0x6a1/0x8f0 [ 381.750009][T12640] ? __pfx_nfs_create_rpc_client+0x10/0x10 [ 381.750049][T12640] ? lockdep_init_map_type+0x5c/0x250 [ 381.750081][T12640] ? lockdep_init_map_type+0x5c/0x250 [ 381.750113][T12640] nfs4_alloc_client+0x8f0/0xd70 [ 381.750144][T12640] ? __pfx_nfs4_alloc_client+0x10/0x10 [ 381.750181][T12640] ? lock_acquire+0x1d1/0x380 [ 381.750206][T12640] ? net_generic+0x25/0x2a0 [ 381.750242][T12640] ? nfs_get_client+0x849/0x1230 [ 381.750288][T12640] ? nfs_get_client+0x849/0x1230 [ 381.750323][T12640] nfs_get_client+0x87b/0x1230 [ 381.750351][T12640] ? do_raw_spin_lock+0x128/0x260 [ 381.750379][T12640] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 381.750410][T12640] nfs4_set_client+0x3f6/0x640 [ 381.750440][T12640] nfs4_init_server.isra.0+0x5ad/0xf60 [ 381.750468][T12640] ? __pfx___debug_object_init+0x10/0x10 [ 381.750492][T12640] ? __pfx_nfs4_init_server.isra.0+0x10/0x10 [ 381.750537][T12640] ? __rpc_init_priority_wait_queue+0x38a/0x500 [ 381.750566][T12640] nfs4_create_server+0x185/0x2b0 [ 381.750599][T12640] nfs4_try_get_tree+0x93/0x140 [ 381.750629][T12640] nfs_get_tree+0xa61/0x1450 [ 381.750654][T12640] vfs_get_tree+0x92/0x320 [ 381.750675][T12640] path_mount+0x7d0/0x2850 [ 381.750698][T12640] ? __pfx_path_mount+0x10/0x10 [ 381.750715][T12640] ? lockdep_hardirqs_on+0x7d/0x110 [ 381.750746][T12640] ? putname+0xb1/0x110 [ 381.750773][T12640] ? kmem_cache_free+0x127/0x6c0 [ 381.750805][T12640] ? __ia32_sys_mount+0x292/0x310 [ 381.750824][T12640] __ia32_sys_mount+0x292/0x310 [ 381.750843][T12640] ? __pfx___ia32_sys_mount+0x10/0x10 [ 381.750871][T12640] __do_fast_syscall_32+0x13a/0x8b0 [ 381.750895][T12640] do_fast_syscall_32+0x32/0x70 [ 381.750914][T12640] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 381.750939][T12640] RIP: 0023:0xf743efec [ 381.750960][T12640] Code: Unable to access opcode bytes at 0xf743efc2. [ 381.750969][T12640] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 381.750989][T12640] RAX: ffffffffffffffda RBX: 0000000080000080 RCX: 00000000800000c0 [ 381.751002][T12640] RDX: 0000000080000100 RSI: 0000000000000048 RDI: 0000000080000140 [ 381.751014][T12640] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 381.751025][T12640] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 381.751035][T12640] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 381.751060][T12640] [ 381.751222][T12640] kobject: kobject_add_internal failed for switch-0 (error: -12 parent: xprt-switches) [ 381.877631][T12643] FAULT_INJECTION: forcing a failure. [ 381.877631][T12643] name failslab, interval 1, probability 0, space 0, times 0 [ 381.877654][T12643] CPU: 1 UID: 0 PID: 12643 Comm: syz.0.2383 Tainted: G L syzkaller #0 PREEMPT(full) [ 381.877670][T12643] Tainted: [L]=SOFTLOCKUP [ 381.877674][T12643] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 381.877681][T12643] Call Trace: [ 381.877685][T12643] [ 381.877690][T12643] dump_stack_lvl+0x100/0x190 [ 381.877710][T12643] should_fail_ex.cold+0x5/0xa [ 381.877733][T12643] should_failslab+0xc2/0x120 [ 381.877753][T12643] __kmalloc_cache_node_noprof+0x94/0x720 [ 381.877775][T12643] ? find_held_lock+0x2b/0x80 [ 381.877788][T12643] ? __get_vm_area_node+0x124/0x350 [ 381.877808][T12643] __get_vm_area_node+0x124/0x350 [ 381.877828][T12643] __vmalloc_node_range_noprof+0x268/0x1420 [ 381.877847][T12643] ? vc_uniscr_check+0x1a0/0x5a0 [ 381.877860][T12643] ? find_held_lock+0x2b/0x80 [ 381.877875][T12643] ? mark_held_locks+0x40/0x70 [ 381.877892][T12643] ? vc_uniscr_check+0x1a0/0x5a0 [ 381.877907][T12643] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 381.877926][T12643] ? build_attr+0xcf/0x390 [ 381.877945][T12643] ? vc_uniscr_check+0x1a0/0x5a0 [ 381.877956][T12643] __vmalloc_node_noprof+0xad/0xf0 [ 381.877974][T12643] ? vc_uniscr_check+0x1a0/0x5a0 [ 381.877987][T12643] vc_uniscr_check+0x1a0/0x5a0 [ 381.878003][T12643] do_con_write+0x66b/0x4ae0 [ 381.878026][T12643] ? __pfx_do_con_write+0x10/0x10 [ 381.878044][T12643] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 381.878064][T12643] con_write+0x23/0xb0 [ 381.878077][T12643] n_tty_write+0x431/0x1160 [ 381.878100][T12643] ? __pfx_n_tty_write+0x10/0x10 [ 381.878115][T12643] ? __kasan_kmalloc+0xaa/0xb0 [ 381.878131][T12643] ? __pfx_woken_wake_function+0x10/0x10 [ 381.878144][T12643] ? rcu_is_watching+0x13/0xc0 [ 381.878157][T12643] ? file_tty_write.isra.0+0x694/0x890 [ 381.878169][T12643] ? kfree+0x1e5/0x6d0 [ 381.878181][T12643] ? __pfx_n_tty_write+0x10/0x10 [ 381.878197][T12643] file_tty_write.isra.0+0x4d2/0x890 [ 381.878214][T12643] vfs_write+0x6af/0x1050 [ 381.878229][T12643] ? __pfx_tty_write+0x10/0x10 [ 381.878242][T12643] ? __pfx_vfs_write+0x10/0x10 [ 381.878256][T12643] ? find_held_lock+0x2b/0x80 [ 381.878279][T12643] ksys_write+0x12a/0x250 [ 381.878293][T12643] ? __pfx_ksys_write+0x10/0x10 [ 381.878313][T12643] __do_fast_syscall_32+0x13a/0x8b0 [ 381.878325][T12643] ? lockdep_hardirqs_on+0x7d/0x110 [ 381.878344][T12643] do_fast_syscall_32+0x32/0x70 [ 381.878356][T12643] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 381.878371][T12643] RIP: 0023:0xf743efec [ 381.878384][T12643] Code: Unable to access opcode bytes at 0xf743efc2. [ 381.878408][T12643] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 381.878420][T12643] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001980 [ 381.878428][T12643] RDX: 0000000000001006 RSI: 0000000000000000 RDI: 0000000000000000 [ 381.878435][T12643] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 381.878441][T12643] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 381.878448][T12643] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 381.878465][T12643] [ 381.878685][T12643] syz.0.2383: vmalloc error: size 1456, align 0x1, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 381.878753][T12643] CPU: 1 UID: 0 PID: 12643 Comm: syz.0.2383 Tainted: G L syzkaller #0 PREEMPT(full) [ 381.878769][T12643] Tainted: [L]=SOFTLOCKUP [ 381.878773][T12643] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 381.878779][T12643] Call Trace: [ 381.878783][T12643] [ 381.878788][T12643] dump_stack_lvl+0x100/0x190 [ 381.878806][T12643] warn_alloc.cold+0x9e/0xb2 [ 381.878820][T12643] ? __pfx_warn_alloc+0x10/0x10 [ 381.878834][T12643] ? __kasan_kmalloc+0x8a/0xb0 [ 381.878852][T12643] ? find_held_lock+0x2b/0x80 [ 381.878870][T12643] ? __get_vm_area_node+0x22b/0x350 [ 381.878891][T12643] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 381.878910][T12643] ? find_held_lock+0x2b/0x80 [ 381.878925][T12643] ? mark_held_locks+0x40/0x70 [ 381.878942][T12643] ? vc_uniscr_check+0x1a0/0x5a0 [ 381.878958][T12643] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 381.878977][T12643] ? build_attr+0xcf/0x390 [ 381.878995][T12643] ? vc_uniscr_check+0x1a0/0x5a0 [ 381.879007][T12643] __vmalloc_node_noprof+0xad/0xf0 [ 381.879024][T12643] ? vc_uniscr_check+0x1a0/0x5a0 [ 381.879038][T12643] vc_uniscr_check+0x1a0/0x5a0 [ 381.879054][T12643] do_con_write+0x66b/0x4ae0 [ 381.879075][T12643] ? __pfx_do_con_write+0x10/0x10 [ 381.879118][T12643] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 381.879140][T12643] con_write+0x23/0xb0 [ 381.879154][T12643] n_tty_write+0x431/0x1160 [ 381.879177][T12643] ? __pfx_n_tty_write+0x10/0x10 [ 381.879192][T12643] ? __kasan_kmalloc+0xaa/0xb0 [ 381.879209][T12643] ? __pfx_woken_wake_function+0x10/0x10 [ 381.879222][T12643] ? rcu_is_watching+0x13/0xc0 [ 381.879234][T12643] ? file_tty_write.isra.0+0x694/0x890 [ 381.879246][T12643] ? kfree+0x1e5/0x6d0 [ 381.879259][T12643] ? __pfx_n_tty_write+0x10/0x10 [ 381.879274][T12643] file_tty_write.isra.0+0x4d2/0x890 [ 381.879291][T12643] vfs_write+0x6af/0x1050 [ 381.879306][T12643] ? __pfx_tty_write+0x10/0x10 [ 381.879319][T12643] ? __pfx_vfs_write+0x10/0x10 [ 381.879332][T12643] ? find_held_lock+0x2b/0x80 [ 381.879355][T12643] ksys_write+0x12a/0x250 [ 381.879369][T12643] ? __pfx_ksys_write+0x10/0x10 [ 381.879388][T12643] __do_fast_syscall_32+0x13a/0x8b0 [ 381.879400][T12643] ? lockdep_hardirqs_on+0x7d/0x110 [ 381.879418][T12643] do_fast_syscall_32+0x32/0x70 [ 381.879430][T12643] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 381.879444][T12643] RIP: 0023:0xf743efec [ 381.879456][T12643] Code: Unable to access opcode bytes at 0xf743efc2. [ 381.879461][T12643] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 381.879472][T12643] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001980 [ 381.879479][T12643] RDX: 0000000000001006 RSI: 0000000000000000 RDI: 0000000000000000 [ 381.879485][T12643] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 381.879492][T12643] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 381.879498][T12643] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 381.879513][T12643] [ 381.879518][T12643] Mem-Info: [ 381.879523][T12643] active_anon:590 inactive_anon:1160 isolated_anon:0 [ 381.879523][T12643] active_file:12048 inactive_file:11909 isolated_file:0 [ 381.879523][T12643] unevictable:1000 dirty:449 writeback:0 [ 381.879523][T12643] slab_reclaimable:6242 slab_unreclaimable:57309 [ 381.879523][T12643] mapped:23170 shmem:1004 pagetables:1410 [ 381.879523][T12643] sec_pagetables:322 bounce:0 [ 381.879523][T12643] kernel_misc_reclaimable:0 [ 381.879523][T12643] free:31461 free_pcp:8497 free_cma:0 [ 381.879551][T12643] Node 0 active_anon:0kB inactive_anon:32kB active_file:60kB inactive_file:76kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:32kB dirty:4kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7960kB pagetables:1028kB sec_pagetables:1104kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 381.879658][T12643] Node 1 active_anon:2360kB inactive_anon:4608kB active_file:48132kB inactive_file:47560kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:92648kB dirty:1792kB writeback:0kB shmem:2016kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5660kB pagetables:4612kB sec_pagetables:184kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 381.879691][T12643] Node 0 DMA free:2560kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:4kB unevictable:0kB writepending:4kB zspages:28kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 381.879727][T12643] lowmem_reserve[]: 0 259 259 259 259 [ 381.879746][T12643] Node 0 DMA32 free:16588kB boost:18432kB min:30136kB low:33060kB high:35984kB reserved_highatomic:2048kB free_highatomic:1580kB active_anon:0kB inactive_anon:32kB active_file:60kB inactive_file:72kB unevictable:2000kB writepending:0kB zspages:1968kB present:1032196kB managed:265360kB mlocked:0kB bounce:0kB free_pcp:2696kB local_pcp:952kB free_cma:0kB [ 381.879779][T12643] lowmem_reserve[]: 0 0 0 0 0 [ 381.879799][T12643] Node 1 DMA32 free:106696kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0kB free_highatomic:0kB active_anon:2360kB inactive_anon:4608kB active_file:48132kB inactive_file:47560kB unevictable:2000kB writepending:1792kB zspages:3780kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:31284kB local_pcp:2836kB free_cma:0kB [ 381.879832][T12643] lowmem_reserve[]: 0 0 0 0 0 [ 381.879851][T12643] Node 0 DMA: 62*4kB (UM) 25*8kB (UM) 8*16kB (UM) 18*32kB (UM) 10*64kB (UM) 0*128kB 1*256kB (M) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 2560kB [ 381.879942][T12643] Node 0 DMA32: 191*4kB (UMEH) 70*8kB (UMEH) 64*16kB (UMEH) 103*32kB (UMEH) 41*64kB (UMEH) 9*128kB (UME) 6*256kB (MH) 7*512kB (M) 2*1024kB (MH) 0*2048kB 0*4096kB = 16588kB [ 381.880029][T12643] Node 1 DMA32: 738*4kB (ME) 521*8kB (UME) 537*16kB (UME) 297*32kB (M) 241*64kB (UME) 123*128kB (UME) 72*256kB (UME) 26*512kB (UME) 8*1024kB (UM) 1*2048kB (U) 2*4096kB (U) = 106560kB [ 381.880122][T12643] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 381.880131][T12643] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=3 hugepages_size=2048kB [ 381.880139][T12643] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 381.880148][T12643] Node 1 hugepages_total=5 hugepages_free=5 hugepages_surp=5 hugepages_size=2048kB [ 381.880156][T12643] 25834 total pagecache pages [ 381.880160][T12643] 874 pages in swap cache [ 381.880164][T12643] Free swap = 101940kB [ 381.880168][T12643] Total swap = 124996kB [ 381.880173][T12643] 524155 pages RAM [ 381.880176][T12643] 0 pages HighMem/MovableOnly [ 381.880180][T12643] 216923 pages reserved [ 381.880184][T12643] 0 pages cma reserved [ 381.954863][T12645] FAULT_INJECTION: forcing a failure. [ 381.954863][T12645] name failslab, interval 1, probability 0, space 0, times 0 [ 381.954885][T12645] CPU: 1 UID: 0 PID: 12645 Comm: syz.0.2384 Tainted: G L syzkaller #0 PREEMPT(full) [ 381.954901][T12645] Tainted: [L]=SOFTLOCKUP [ 381.954905][T12645] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 381.954912][T12645] Call Trace: [ 381.954916][T12645] [ 381.954921][T12645] dump_stack_lvl+0x100/0x190 [ 381.954942][T12645] should_fail_ex.cold+0x5/0xa [ 381.954977][T12645] should_failslab+0xc2/0x120 [ 381.954998][T12645] __kmalloc_cache_noprof+0x91/0x6d0 [ 381.955014][T12645] ? ucma_open+0x4a/0x1f0 [ 381.955030][T12645] ucma_open+0x4a/0x1f0 [ 381.955042][T12645] ? __pfx_ucma_open+0x10/0x10 [ 381.955054][T12645] misc_open+0x26d/0x450 [ 381.955066][T12645] ? __pfx_misc_open+0x10/0x10 [ 381.955076][T12645] chrdev_open+0x234/0x6a0 [ 381.955113][T12645] ? __pfx_apparmor_file_open+0x10/0x10 [ 381.955130][T12645] ? __pfx_chrdev_open+0x10/0x10 [ 381.955148][T12645] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 381.955165][T12645] do_dentry_open+0x6ab/0x14d0 [ 381.955181][T12645] ? __pfx_chrdev_open+0x10/0x10 [ 381.955201][T12645] vfs_open+0x82/0x3f0 [ 381.955216][T12645] path_openat+0x19fa/0x2440 [ 381.955236][T12645] ? __pfx_path_openat+0x10/0x10 [ 381.955257][T12645] do_file_open+0x20e/0x430 [ 381.955274][T12645] ? __pfx_do_file_open+0x10/0x10 [ 381.955301][T12645] ? _raw_spin_unlock+0x28/0x50 [ 381.955317][T12645] ? alloc_fd+0x471/0x7a0 [ 381.955336][T12645] do_sys_openat2+0x10f/0x1e0 [ 381.955348][T12645] ? __pfx_do_sys_openat2+0x10/0x10 [ 381.955365][T12645] __ia32_compat_sys_openat+0x12d/0x210 [ 381.955378][T12645] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 381.955397][T12645] __do_fast_syscall_32+0x13a/0x8b0 [ 381.955411][T12645] do_fast_syscall_32+0x32/0x70 [ 381.955422][T12645] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 381.955437][T12645] RIP: 0023:0xf743efec [ 381.955450][T12645] Code: Unable to access opcode bytes at 0xf743efc2. [ 381.955455][T12645] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 381.955466][T12645] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800004c0 [ 381.955474][T12645] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 381.955481][T12645] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 381.955487][T12645] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 381.955494][T12645] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 381.955509][T12645] [ 382.210488][T12657] FAULT_INJECTION: forcing a failure. [ 382.210488][T12657] name failslab, interval 1, probability 0, space 0, times 0 [ 382.210522][T12657] CPU: 0 UID: 0 PID: 12657 Comm: syz.0.2388 Tainted: G L syzkaller #0 PREEMPT(full) [ 382.210548][T12657] Tainted: [L]=SOFTLOCKUP [ 382.210555][T12657] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 382.210568][T12657] Call Trace: [ 382.210574][T12657] [ 382.210582][T12657] dump_stack_lvl+0x100/0x190 [ 382.210614][T12657] should_fail_ex.cold+0x5/0xa [ 382.210642][T12657] should_failslab+0xc2/0x120 [ 382.210674][T12657] __kmalloc_cache_noprof+0x91/0x6d0 [ 382.210700][T12657] ? input_alloc_absinfo+0x84/0xf0 [ 382.210734][T12657] input_alloc_absinfo+0x84/0xf0 [ 382.210762][T12657] uinput_write+0x562/0xf60 [ 382.210789][T12657] ? __pfx_uinput_write+0x10/0x10 [ 382.210811][T12657] ? bpf_lsm_file_permission+0x9/0x10 [ 382.210840][T12657] ? security_file_permission+0x76/0x210 [ 382.210866][T12657] ? rw_verify_area+0xce/0x6d0 [ 382.210892][T12657] vfs_write+0x2aa/0x1050 [ 382.210916][T12657] ? __pfx_uinput_write+0x10/0x10 [ 382.210935][T12657] ? lock_acquire+0x1d1/0x380 [ 382.210963][T12657] ? __fget_files+0x34/0x3d0 [ 382.210988][T12657] ? __pfx_vfs_write+0x10/0x10 [ 382.211010][T12657] ? find_held_lock+0x2b/0x80 [ 382.211032][T12657] ? __fget_files+0x215/0x3d0 [ 382.211056][T12657] ? __fget_files+0x215/0x3d0 [ 382.211115][T12657] ? __fget_files+0x21f/0x3d0 [ 382.211151][T12657] ksys_write+0x1f8/0x250 [ 382.211177][T12657] ? __pfx_ksys_write+0x10/0x10 [ 382.211211][T12657] __do_fast_syscall_32+0x13a/0x8b0 [ 382.211236][T12657] do_fast_syscall_32+0x32/0x70 [ 382.211258][T12657] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 382.211283][T12657] RIP: 0023:0xf743efec [ 382.211303][T12657] Code: Unable to access opcode bytes at 0xf743efc2. [ 382.211312][T12657] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 382.211330][T12657] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800004c0 [ 382.211342][T12657] RDX: 000000000000045c RSI: 0000000000000000 RDI: 0000000000000000 [ 382.211354][T12657] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 382.211366][T12657] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 382.211378][T12657] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 382.211405][T12657] [ 382.211417][T12657] input input29: input_alloc_absinfo: unable to allocate memory [ 382.273335][T12659] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2390'. [ 382.405933][T12663] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 382.406076][T12663] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 383.687056][T12592] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 383.700126][T12661] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2391'. [ 383.743159][T12680] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2398'. [ 383.897346][ T44] audit: type=1800 audit(1791791729.335:424): pid=12692 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2403" name="file0" dev="overlay" ino=3088 res=0 errno=0 [ 384.023391][T12703] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2406'. [ 384.035045][T12706] netlink: 200 bytes leftover after parsing attributes in process `syz.2.2407'. [ 384.079429][T12713] input: syz0 as /devices/virtual/input/input30 [ 384.216381][ T5848] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.229492][T12731] kvm: Disabled LAPIC found during irq injection [ 384.257924][T12732] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2415'. [ 384.262181][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.262201][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.262212][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.262222][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.262231][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.262241][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.262251][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.262260][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.262270][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.400831][T12746] netlink: 200 bytes leftover after parsing attributes in process `syz.3.2420'. [ 384.445855][ T5739] Bluetooth: hci3: command 0x0c1a tx timeout [ 384.445879][ T5739] Bluetooth: hci2: ** replaying previous printk message ** [ 384.445879][ T5739] Bluetooth: hci2: command 0x0c1a tx timeout [ 384.459562][T12751] [ 384.464552][T12751] ====================================================== [ 384.467481][T12751] WARNING: possible circular locking dependency detected [ 384.470467][T12751] syzkaller #0 Tainted: G L [ 384.473427][T12751] ------------------------------------------------------ [ 384.476295][T12751] syz.3.2422/12751 is trying to acquire lock: [ 384.478774][T12751] ffff88801502fb98 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 [ 384.482198][T12751] [ 384.482198][T12751] but task is already holding lock: [ 384.485181][T12751] ffff888015214860 (&pipe->mutex){+.+.}-{4:4}, at: pipe_lock+0x69/0x80 [ 384.488709][T12751] [ 384.488709][T12751] which lock already depends on the new lock. [ 384.488709][T12751] [ 384.492923][T12751] [ 384.492923][T12751] the existing dependency chain (in reverse order) is: [ 384.496489][T12751] [ 384.496489][T12751] -> #3 (&pipe->mutex){+.+.}-{4:4}: [ 384.499395][T12751] lock_acquire+0x1d1/0x380 [ 384.501443][T12751] __mutex_lock+0x1a4/0x1bd0 [ 384.503556][T12751] anon_pipe_prefill_and_lock+0x16c/0x580 [ 384.506163][T12751] anon_pipe_write+0x164/0x1b50 [ 384.508384][T12751] __kernel_write_iter+0x6bb/0x930 [ 384.510705][T12751] __kernel_write+0xf6/0x140 [ 384.512843][T12751] autofs_notify_daemon+0x50d/0xd90 [ 384.515260][T12751] autofs_wait+0x10fd/0x1b50 [ 384.517501][T12751] autofs_mount_wait+0x132/0x3b0 [ 384.519771][T12751] autofs_d_automount+0x490/0x950 [ 384.522075][T12751] __traverse_mounts+0x1b9/0x8a0 [ 384.524321][T12751] step_into_slowpath+0xcb4/0x1150 [ 384.526611][T12751] path_lookupat+0x58b/0xc40 [ 384.528731][T12751] filename_lookup+0x202/0x590 [ 384.530905][T12751] kern_path+0x37/0x50 [ 384.532834][T12751] lookup_bdev+0xd8/0x2a0 [ 384.534889][T12751] resume_store+0x1d6/0x460 [ 384.536990][T12751] kobj_attr_store+0x58/0x80 [ 384.539153][T12751] sysfs_kf_write+0xf2/0x150 [ 384.541281][T12751] kernfs_fop_write_iter+0x3e0/0x5f0 [ 384.543697][T12751] vfs_write+0x6af/0x1050 [ 384.545704][T12751] ksys_write+0x12a/0x250 [ 384.547638][T12751] __do_fast_syscall_32+0x13a/0x8b0 [ 384.549820][T12751] do_fast_syscall_32+0x32/0x70 [ 384.551872][T12751] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 384.554517][T12751] [ 384.554517][T12751] -> #2 (&sbi->pipe_mutex){+.+.}-{4:4}: [ 384.557485][T12751] lock_acquire+0x1d1/0x380 [ 384.559460][T12751] __mutex_lock+0x1a4/0x1bd0 [ 384.561482][T12751] autofs_notify_daemon+0x4f8/0xd90 [ 384.563735][T12751] autofs_wait+0x10fd/0x1b50 [ 384.565762][T12751] autofs_mount_wait+0x132/0x3b0 [ 384.567964][T12751] autofs_d_automount+0x490/0x950 [ 384.570110][T12751] __traverse_mounts+0x1b9/0x8a0 [ 384.572323][T12751] step_into_slowpath+0xcb4/0x1150 [ 384.574625][T12751] path_lookupat+0x58b/0xc40 [ 384.576755][T12751] filename_lookup+0x202/0x590 [ 384.578915][T12751] kern_path+0x37/0x50 [ 384.580840][T12751] lookup_bdev+0xd8/0x2a0 [ 384.582782][T12751] resume_store+0x1d6/0x460 [ 384.584916][T12751] kobj_attr_store+0x58/0x80 [ 384.587020][T12751] sysfs_kf_write+0xf2/0x150 [ 384.589132][T12751] kernfs_fop_write_iter+0x3e0/0x5f0 [ 384.591534][T12751] vfs_write+0x6af/0x1050 [ 384.593539][T12751] ksys_write+0x12a/0x250 [ 384.595570][T12751] __do_fast_syscall_32+0x13a/0x8b0 [ 384.597917][T12751] do_fast_syscall_32+0x32/0x70 [ 384.600116][T12751] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 384.602868][T12751] [ 384.602868][T12751] -> #1 (&of->mutex){+.+.}-{4:4}: [ 384.605822][T12751] lock_acquire+0x1d1/0x380 [ 384.607898][T12751] __mutex_lock+0x1a4/0x1bd0 [ 384.609995][T12751] kernfs_seq_start+0x4f/0x2a0 [ 384.612170][T12751] seq_read_iter+0x2c1/0x1270 [ 384.614294][T12751] kernfs_fop_read_iter+0x46c/0x610 [ 384.616613][T12751] copy_splice_read+0x4ba/0xbb0 [ 384.618795][T12751] do_splice_read+0x285/0x370 [ 384.620934][T12751] splice_direct_to_actor+0x2a1/0xa30 [ 384.623390][T12751] do_splice_direct+0x174/0x240 [ 384.625643][T12751] do_sendfile+0xadc/0xe20 [ 384.627685][T12751] __ia32_compat_sys_sendfile+0x1e5/0x220 [ 384.630227][T12751] __do_fast_syscall_32+0x13a/0x8b0 [ 384.632567][T12751] do_fast_syscall_32+0x32/0x70 [ 384.634767][T12751] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 384.637569][T12751] [ 384.637569][T12751] -> #0 (&p->lock){+.+.}-{4:4}: [ 384.640463][T12751] check_prev_add+0xeb/0xe60 [ 384.642590][T12751] __lock_acquire+0x1528/0x1f40 [ 384.644810][T12751] lock_acquire+0x1d1/0x380 [ 384.646881][T12751] __mutex_lock+0x1a4/0x1bd0 [ 384.648979][T12751] seq_read_iter+0xe1/0x1270 [ 384.651026][T12751] kernfs_fop_read_iter+0x46c/0x610 [ 384.653365][T12751] copy_splice_read+0x4ba/0xbb0 [ 384.655584][T12751] do_splice_read+0x285/0x370 [ 384.657711][T12751] splice_file_to_pipe+0x82/0x120 [ 384.659996][T12751] do_sendfile+0x366/0xe20 [ 384.662064][T12751] __ia32_compat_sys_sendfile+0x1e5/0x220 [ 384.664635][T12751] __do_fast_syscall_32+0x13a/0x8b0 [ 384.666964][T12751] do_fast_syscall_32+0x32/0x70 [ 384.669167][T12751] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 384.671967][T12751] [ 384.671967][T12751] other info that might help us debug this: [ 384.671967][T12751] [ 384.675920][T12751] Chain exists of: [ 384.675920][T12751] &p->lock --> &sbi->pipe_mutex --> &pipe->mutex [ 384.675920][T12751] [ 384.680845][T12751] Possible unsafe locking scenario: [ 384.680845][T12751] [ 384.683866][T12751] CPU0 CPU1 [ 384.686039][T12751] ---- ---- [ 384.688226][T12751] lock(&pipe->mutex); [ 384.689938][T12751] lock(&sbi->pipe_mutex); [ 384.692789][T12751] lock(&pipe->mutex); [ 384.695533][T12751] lock(&p->lock); [ 384.697124][T12751] [ 384.697124][T12751] *** DEADLOCK *** [ 384.697124][T12751] [ 384.700392][T12751] locks held by syz.3.2422/12751: 1, last CPU#3: [ 384.702961][T12751] #0: ffff888015214860 (&pipe->mutex){+.+.}-{4:4}, at: pipe_lock+0x69/0x80 [ 384.706504][T12751] [ 384.706504][T12751] stack backtrace: [ 384.708912][T12751] CPU: 3 UID: 0 PID: 12751 Comm: syz.3.2422 Tainted: G L syzkaller #0 PREEMPT(full) [ 384.713300][T12751] Tainted: [L]=SOFTLOCKUP [ 384.715083][T12751] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 384.719045][T12751] Call Trace: [ 384.720403][T12751] [ 384.721623][T12751] dump_stack_lvl+0x100/0x190 [ 384.723589][T12751] print_circular_bug.cold+0x178/0x1be [ 384.725835][T12751] check_noncircular+0x146/0x160 [ 384.727888][T12751] check_prev_add+0xeb/0xe60 [ 384.729808][T12751] __lock_acquire+0x1528/0x1f40 [ 384.731857][T12751] lock_acquire+0x1d1/0x380 [ 384.733740][T12751] ? seq_read_iter+0xe1/0x1270 [ 384.735746][T12751] ? __pfx___might_resched+0x10/0x10 [ 384.737915][T12751] __mutex_lock+0x1a4/0x1bd0 [ 384.739830][T12751] ? seq_read_iter+0xe1/0x1270 [ 384.741800][T12751] ? seq_read_iter+0xe1/0x1270 [ 384.743805][T12751] ? __pfx___mutex_lock+0x10/0x10 [ 384.745876][T12751] ? alloc_pages_bulk_noprof+0x66b/0x13c0 [ 384.748218][T12751] ? seq_read_iter+0xe1/0x1270 [ 384.750085][T12751] seq_read_iter+0xe1/0x1270 [ 384.752017][T12751] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 384.754464][T12751] kernfs_fop_read_iter+0x46c/0x610 [ 384.756639][T12751] copy_splice_read+0x4ba/0xbb0 [ 384.758607][T12751] ? __pfx_copy_splice_read+0x10/0x10 [ 384.760825][T12751] ? lock_acquire+0x1d1/0x380 [ 384.762797][T12751] ? __fget_files+0x215/0x3d0 [ 384.764754][T12751] ? __pfx_copy_splice_read+0x10/0x10 [ 384.766945][T12751] do_splice_read+0x285/0x370 [ 384.768894][T12751] splice_file_to_pipe+0x82/0x120 [ 384.770964][T12751] do_sendfile+0x366/0xe20 [ 384.772876][T12751] ? __pfx_do_sendfile+0x10/0x10 [ 384.774938][T12751] ? __pfx___seccomp_filter+0x10/0x10 [ 384.777150][T12751] __ia32_compat_sys_sendfile+0x1e5/0x220 [ 384.779445][T12751] ? __pfx___ia32_compat_sys_sendfile+0x10/0x10 [ 384.781909][T12751] __do_fast_syscall_32+0x13a/0x8b0 [ 384.784029][T12751] do_fast_syscall_32+0x32/0x70 [ 384.786040][T12751] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 384.788548][T12751] RIP: 0023:0xf73befec [ 384.790230][T12751] Code: Unable to access opcode bytes at 0xf73befc2. [ 384.792865][T12751] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 00000000000000bb [ 384.796310][T12751] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000004 [ 384.799467][T12751] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 [ 384.802696][T12751] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 384.805949][T12751] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 384.809169][T12751] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 384.812407][T12751] [ 389.325500][ C3] net_ratelimit: 57 callbacks suppressed [ 389.325519][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 389.325702][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 389.415445][ T5848] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 390.365459][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 390.365515][ T9110] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 390.365621][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 390.456176][ T7263] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 391.405541][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 391.405868][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 391.485749][ T7263] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog