last executing test programs: 2m30.488245512s ago: executing program 0 (id=581): ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "d607f8f9951e76c13f64323723e7eecdf40c363423eb3d259266ec9c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468b257ff2424852548deb01efd54f11ed2c41d078b9cf1fc8f72566153c97e4af37017ea6b16b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2213f9d5c3b90400000000000000c279f03558083906666827d61dcc3a633bffff0e0b5a293e3877adc1660edbc9a0307a25720a70e419dc44febf7ddc73fd4a5a0b6c28667f7f46c7084e17c809268103a2584ab40a68e528329d97afc3612e325c1eb4a3ab2e156a97444800", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c87738d9679d3acc032a16fbefc64776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a5ee0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b417354335f8cf20d0d96ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000090003007379"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e000000000000000000140000001100"], 0x80}}, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000001040)={@local, @random="66834092317d", @val={@void, {0x8100, 0x2}}, {@ipv4={0x8100, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2, 0x200, 0x0, 0xffff}}}}}}, 0x0) 2m30.487881459s ago: executing program 0 (id=582): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x181, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f00000001c0)=[@enable_nested={0x12c, 0x18}, @uexit={0x0, 0x18, 0x2}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @control_area=0x84, 0x5, 0x3, 0x9e}}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0xb6, 0x5, 0x2, 0x3}}, @nested_vmresume={0x130, 0x18, 0x1}, @nested_load_code={0x12e, 0x5e, {0x2, "c4e35d787651f1400f95cd66b8c3000f00d0b9800000c00f3235000100000f30460f017cb71d65430f01c866baf80cb8ee168183ef66bafc0c66ed36dd8f9ee4c2a40f350f32"}}, @in_dx={0x69, 0x20, {0x4e93, 0x4}}, @rdmsr={0x66, 0x18, {0xb1f}}, @out_dx={0x6a, 0x28, {0x5646, 0x5, 0x2}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @control_nat=0x6008, 0x800, 0x9}}, @in_dx={0x69, 0x20, {0xe15a, 0x4}}, @nested_amd_set_intercept={0x181, 0x30, {0x2, 0x9, 0x76ae, 0x1}}, @in_dx={0x69, 0x20, {0x6be, 0x3}}, @nested_amd_stgi={0x17e, 0x10}, @code={0xa, 0x5e, {"c4e1796eb4d727cb000064470fc76802460f30c442353afb26400f01ca2ef30f090f232366baa100b006ee66baf80cb8dcaca28bef66bafc0cedc744240021000000c744240200500000ff1c24"}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @control_area=0x36, 0x1e, 0x2, 0x9}}, @set_irq_handler={0xc8, 0x20, {0xa7}}, @nested_amd_vmsave={0x183, 0x18, 0x3}, @nested_load_code={0x12e, 0x4f, {0x9, "66ba6100ed470f01ca0f07c4210dd2ef4b0fc72a672edc7700f3440f1efb460f01ca36440f0d0cce66baf80cb88805288def66bafc0ced"}}, @nested_amd_stgi={0x17e, 0x10}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest_nat=0x6808, 0x7, 0x5}}, @nested_amd_vmsave={0x183, 0x18}, @nested_create_vm={0x12d, 0x18, 0x1}, @in_dx={0x69, 0x20, {0xe18c, 0x3}}], 0x3e3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r1, 0x4068aea3, &(0x7f0000000140)={0xdf, 0x0, 0x1000}) (async) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x3a, 0x0, 0x4}]}) (async) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000040)={0x0, 'veth1_to_batadv\x00', {0x3}, 0xff00}) (async) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f00000000c0)={'veth1_to_batadv\x00', &(0x7f0000000000)=@ethtool_sset_info={0x37, 0x0, 0xbf8a}}) 2m30.378092123s ago: executing program 0 (id=583): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000f00)=@nat={'nat\x00', 0x670, 0x5, 0x4f0, 0x2c8, 0x1b8, 0xffffffff, 0x0, 0x2c8, 0x458, 0x458, 0xffffffff, 0x458, 0x458, 0x5, 0x0, {[{{@uncond, 0x0, 0x180, 0x1b8, 0x48, {}, [@common=@unspec=@conntrack3={{0xc8}, {{@ipv4=@rand_addr=0x64010102, [0xffffff00, 0xff, 0xffffffff, 0xff000000], @ipv4=@rand_addr=0x64010100, [0xffffffff, 0x0, 0xffffff00, 0xffffff00], @ipv6=@local, [0xff, 0xff, 0xffffffff, 0xffffffff], @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0xffffffff, 0xff, 0xffffffff, 0xff000000], 0xc9, 0x4, 0x0, 0x4e24, 0x4e24, 0x4e21, 0x4e22, 0x1800, 0x100}, 0x40, 0x800, 0x4e24, 0x4e24, 0x4e23, 0x4e22}}, @common=@unspec=@helper={{0x48}, {0x0, 'tftp-20000\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x19, @multicast2, @loopback, @icmp_id=0x66, @port=0x4e24}}}}, {{@ip={@broadcast, @remote, 0xff, 0xff, 'nicvf0\x00', 'ipvlan1\x00', {0xff}, {}, 0xc, 0x0, 0x30}, 0x0, 0xc8, 0x110, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gre0\x00', {0x8, 0x5, 0xfffffffc, 0x8, 0x8, 0x51f2, 0x6dc0}, {0xff}}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x11, @ipv6=@mcast1, @ipv4=@loopback, @icmp_id=0x64, @port=0x4e23}}}, {{@ip={@multicast2, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'team_slave_0\x00'}, 0x0, 0xa0, 0xe8, 0x0, {}, [@common=@addrtype={{0x30}, {0x890, 0x218, 0x0, 0x1}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xe, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @icmp_id=0x65, @gre_key}}}, {{@ip={@broadcast, @rand_addr=0x1, 0x0, 0x0, 'nicvf0\x00', 'pim6reg\x00', {}, {0xff}, 0x1}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0xc0000000, {0x21, @broadcast, @dev={0xac, 0x14, 0x14, 0x1c}, @gre_key=0x40, @port=0x4e23}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x550) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) mount$tmpfs(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x200000, 0x0) move_mount(0xffffffffffffff9c, &(0x7f0000000380)='.\x00', 0xffffffffffffff9c, 0x0, 0x262) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000f00)=@nat={'nat\x00', 0x670, 0x5, 0x4f0, 0x2c8, 0x1b8, 0xffffffff, 0x0, 0x2c8, 0x458, 0x458, 0xffffffff, 0x458, 0x458, 0x5, 0x0, {[{{@uncond, 0x0, 0x180, 0x1b8, 0x48, {}, [@common=@unspec=@conntrack3={{0xc8}, {{@ipv4=@rand_addr=0x64010102, [0xffffff00, 0xff, 0xffffffff, 0xff000000], @ipv4=@rand_addr=0x64010100, [0xffffffff, 0x0, 0xffffff00, 0xffffff00], @ipv6=@local, [0xff, 0xff, 0xffffffff, 0xffffffff], @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0xffffffff, 0xff, 0xffffffff, 0xff000000], 0xc9, 0x4, 0x0, 0x4e24, 0x4e24, 0x4e21, 0x4e22, 0x1800, 0x100}, 0x40, 0x800, 0x4e24, 0x4e24, 0x4e23, 0x4e22}}, @common=@unspec=@helper={{0x48}, {0x0, 'tftp-20000\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x19, @multicast2, @loopback, @icmp_id=0x66, @port=0x4e24}}}}, {{@ip={@broadcast, @remote, 0xff, 0xff, 'nicvf0\x00', 'ipvlan1\x00', {0xff}, {}, 0xc, 0x0, 0x30}, 0x0, 0xc8, 0x110, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gre0\x00', {0x8, 0x5, 0xfffffffc, 0x8, 0x8, 0x51f2, 0x6dc0}, {0xff}}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x11, @ipv6=@mcast1, @ipv4=@loopback, @icmp_id=0x64, @port=0x4e23}}}, {{@ip={@multicast2, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'team_slave_0\x00'}, 0x0, 0xa0, 0xe8, 0x0, {}, [@common=@addrtype={{0x30}, {0x890, 0x218, 0x0, 0x1}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xe, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @icmp_id=0x65, @gre_key}}}, {{@ip={@broadcast, @rand_addr=0x1, 0x0, 0x0, 'nicvf0\x00', 'pim6reg\x00', {}, {0xff}, 0x1}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0xc0000000, {0x21, @broadcast, @dev={0xac, 0x14, 0x14, 0x1c}, @gre_key=0x40, @port=0x4e23}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x550) (async) getpid() (async) syz_pidfd_open(r1, 0x0) (async) setns(r2, 0x24020000) (async) mount$tmpfs(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000180), 0x200000, 0x0) (async) move_mount(0xffffffffffffff9c, &(0x7f0000000380)='.\x00', 0xffffffffffffff9c, 0x0, 0x262) (async) 2m30.377842183s ago: executing program 0 (id=584): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) mount(&(0x7f00000001c0)=@nullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='btrfs\x00', 0x4418, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000140)={&(0x7f0000000100)=[0x0, 0x0, 0x0], 0x3, 0x800, 0x0, 0xffffffffffffffff}) ioctl$VHOST_VDPA_SET_VRING_ENABLE(r1, 0x4008af75, &(0x7f0000000280)={0x2, 0x3}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[], 0x184}}, 0x8044000) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0b00000000010000000100000900000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000180), &(0x7f0000000180), 0xe5d, r2}, 0x38) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x40000, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001080)={0x14, 0x17, 0x301, 0x270bd24, 0x25dfdbfa, {0x1}}, 0x14}}, 0x0) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f00000000c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000001c0)={[0x6e, 0x0, 0x401, 0x4000000020, 0x3, 0x0, 0x40000000000106c, 0x100, 0x8000000000000, 0x80000004000080, 0x0, 0x5, 0x0, 0x8, 0x0, 0x6], 0x70000, 0x3c4210}) ioctl$KVM_RUN(r6, 0xae80, 0x0) fremovexattr(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='@']) 2m30.308374504s ago: executing program 0 (id=585): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) close_range(r3, r4, 0x2) r5 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r5, &(0x7f0000000140)={0x18, 0x2, {0x1, @loopback}}, 0x1e) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB="04000000040000000400000001"], 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r6, 0x58, &(0x7f0000000340)={0x0, 0x0}}, 0x10) r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r7, 0x6, 0x8}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000003c0)={r8, &(0x7f00000000c0)="983ec5a7", &(0x7f00000002c0)=""/255}, 0x20) connect$pptp(r5, &(0x7f0000000240)={0x18, 0x2, {0x0, @multicast2}}, 0x1e) (async, rerun: 32) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000040)={0x38, r2, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) (async, rerun: 32) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r2, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000011}, 0x4000810) 2m30.057342483s ago: executing program 0 (id=587): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) timer_settime(r1, 0x1, &(0x7f0000000140)={{0x0, 0x989680}, {r2, r3+10000000}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r5, r4, &(0x7f00000000c0)=0x58, 0x5) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x38, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x0) 2m15.056800861s ago: executing program 32 (id=587): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) timer_settime(r1, 0x1, &(0x7f0000000140)={{0x0, 0x989680}, {r2, r3+10000000}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r5, r4, &(0x7f00000000c0)=0x58, 0x5) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x38, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x0) 5.63639082s ago: executing program 4 (id=2632): bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(0xffffffffffffffff, 0x90004) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c9", @ANYRES8], 0x16) 5.635867624s ago: executing program 4 (id=2633): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0xea}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x40, 0x2004, @fd=r1, 0x3, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) bind$bt_l2cap(r0, &(0x7f00000000c0)={0x1f, 0xaf8, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0xfff8, 0x2}, 0xe) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000001c0), 0x100, 0x0) r8 = openat$cgroup_ro(r7, &(0x7f0000000140)='cpuacct.usage_user\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0x2a, &(0x7f0000000100)=r8, 0x4) sendmsg$unix(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000002c0)='g', 0x1}], 0x1, 0x0, 0x0, 0x40}, 0x40000) recvmsg$unix(r5, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x40) mount$tmpfs(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000480)={[{@mpol={'mpol', 0x3d, {'prefer'}}}]}) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xd) sendfile(r9, r9, 0x0, 0x200000) writev(r9, &(0x7f0000000000)=[{&(0x7f0000000280)="edc08818", 0x4}, {0x0, 0x13}], 0x2) 5.55884577s ago: executing program 4 (id=2634): r0 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0xa) fchdir(r1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r2, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x1, 0x353a, 0x1}}, 0x20) r4 = dup(r3) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@generic={&(0x7f0000000040)='./file0\x00', r4}, 0x18) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000140)=@generic={&(0x7f0000000100)='./file0\x00'}, 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x104) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x802, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x103841, 0x186) lseek(r5, 0x0, 0x1) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x8000, &(0x7f0000000140)={[{@volatile}]}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/bus/input/devices\x00', 0x0, 0x0) openat(r6, &(0x7f0000000240)='./file2\x00', 0x0, 0x21) 5.558657816s ago: executing program 4 (id=2635): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r0, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) (fail_nth: 2) 5.397543679s ago: executing program 4 (id=2637): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) 5.396987658s ago: executing program 4 (id=2639): syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) timer_create(0x5, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = dup3(r0, r2, 0x80000) r4 = dup(r3) pwrite64(r0, &(0x7f0000000040)="46f4b58982ede3e19e", 0x9, 0x4) read(r4, &(0x7f00000014c0)=""/4096, 0x1000) timer_settime(r1, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 1.832324982s ago: executing program 1 (id=2708): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$binder(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x1000810, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) chroot(&(0x7f0000000200)='./file0\x00') (async) chroot(&(0x7f0000000200)='./file0\x00') umount2(&(0x7f0000000000)='./file0\x00', 0x0) (async) umount2(&(0x7f0000000000)='./file0\x00', 0x0) waitid(0x2, 0x0, 0x0, 0x4, 0x0) 1.63568634s ago: executing program 2 (id=2711): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r1, &(0x7f00000004c0)=""/57, 0x39) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r3, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="0600cd00000000006c003300"], 0x90}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 1.634490065s ago: executing program 1 (id=2712): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rf', @ANYRESHEX=r2, @ANYBLOB]) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000100)=0x1000000, 0x4) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="14030000300001000001000004000000070300800c0001"], 0x314}], 0x1}, 0x800) sendmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r1], 0x18, 0x4000840}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5421, &(0x7f00000000c0)=0x96) sendmmsg$unix(r4, &(0x7f00000011c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[], 0x18, 0x20000010}}], 0x1, 0x40) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e1fcb4b20"], 0xf) 1.588079688s ago: executing program 1 (id=2713): prlimit64(0x0, 0xe, 0x0, 0x0) getpid() r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) readv(r0, &(0x7f00000003c0)=[{&(0x7f0000000000)=""/100, 0x64}, {&(0x7f0000000080)=""/173, 0xad}, {&(0x7f0000000140)=""/46, 0x2e}, {&(0x7f0000000180)=""/60, 0x3c}, {&(0x7f0000000200)=""/83, 0x53}], 0x5) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0xb7, 0x8, 0xfffffffe}}, 0xe8) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x1c) 1.587766694s ago: executing program 2 (id=2714): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000dc0)=ANY=[@ANYBLOB="7a0af8ff7525757cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c80000040000000000b1a297cfddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1ae9f2cfe401dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd853eb3f12225bfcca581f04f317c8301b43267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4800b3c26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692f01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8f9f3bc282deb43a03409f8e6972f3f720d045923702cede0f7e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c662003"], &(0x7f0000000100)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x2800000002000000, 0xe, 0x55, &(0x7f0000000140)="a06ad876d56a0064d082778c3938", &(0x7f0000000380)=""/85, 0x600, 0x4000020}, 0x28) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000440)={'dt2814\x00', [0x300, 0x80000000, 0x2, 0x400, 0xe, 0x800005, 0x7, 0x6, 0x8, 0xfd, 0xffffffff, 0x1, 0x1, 0xfffffffc, 0x10000b, 0xfd, 0x5, 0x4007a, 0x3, 0x3, 0x89, 0x12, 0x7f, 0x0, 0x5, 0xe66, 0x1, 0x2000008, 0xa6b3, 0x0, 0x5]}) 626.997546ms ago: executing program 1 (id=2731): bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(0xffffffffffffffff, 0x90004) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES8], 0x16) 626.697781ms ago: executing program 1 (id=2732): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/arp\x00') preadv(r0, &(0x7f0000000600)=[{&(0x7f0000000280)=""/215, 0xd7}], 0x1, 0x6c, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.sectors\x00', 0x26e1, 0x0) close(r1) ioctl$SIOCSIFHWADDR(r1, 0x8b26, &(0x7f0000000140)={'wlan1\x00', @random="000000060100"}) r2 = syz_open_dev$sg(&(0x7f0000000200), 0x0, 0x0) ioctl$SG_SET_DEBUG(r2, 0x227e, &(0x7f0000000000)=0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x461}) 563.047396ms ago: executing program 1 (id=2733): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000940)=ANY=[@ANYBLOB="12010000226aa140070ad0001310010203010902240001000000000904000002bd22f00009050303000000000009058aff"], 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000005c0)={0x14, 0x0, &(0x7f0000000580)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r2, &(0x7f0000000000)=""/104, 0x68) close_range(r0, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000080), 0x100d, 0xde8bef52389a5434) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f0000000280)={r3, 0x0, {0x0, 0x0, 0x0, 0x2000000000, 0x4000000000000004, 0x0, 0x0, 0x12, 0x14, "996a78edc5cac93c3e473f65d9eb5297f0ca82d56dcddb164e29606b4f2cf0b60d9b92b3cf1597f6b7ff9c4fbf4326f66eccdbf05411d4a42e798491c54e3e6f", "3c54d63cef61aa187f941933694c882f4835e79819ddc15edb9ca42b19129e446327fbe58f617cc4617f5347a395cacecf34365db4d55dace1d4e9d56e6fa42e", "fd0000e7744b74eaa2317fdd9db2fea7e7d63f9a007866063c8c162b99d845fb", [0x61, 0x4]}}) ioctl$LOOP_SET_BLOCK_SIZE(r4, 0x4c09, 0x4) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) (async) syz_usb_connect(0x0, 0x36, &(0x7f0000000940)=ANY=[@ANYBLOB="12010000226aa140070ad0001310010203010902240001000000000904000002bd22f00009050303000000000009058aff"], 0x0) (async) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000005c0)={0x14, 0x0, &(0x7f0000000580)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) read$char_usb(r2, &(0x7f0000000000)=""/104, 0x68) (async) close_range(r0, 0xffffffffffffffff, 0x0) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) (async) syz_open_dev$loop(&(0x7f0000000080), 0x100d, 0xde8bef52389a5434) (async) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f0000000280)={r3, 0x0, {0x0, 0x0, 0x0, 0x2000000000, 0x4000000000000004, 0x0, 0x0, 0x12, 0x14, "996a78edc5cac93c3e473f65d9eb5297f0ca82d56dcddb164e29606b4f2cf0b60d9b92b3cf1597f6b7ff9c4fbf4326f66eccdbf05411d4a42e798491c54e3e6f", "3c54d63cef61aa187f941933694c882f4835e79819ddc15edb9ca42b19129e446327fbe58f617cc4617f5347a395cacecf34365db4d55dace1d4e9d56e6fa42e", "fd0000e7744b74eaa2317fdd9db2fea7e7d63f9a007866063c8c162b99d845fb", [0x61, 0x4]}}) (async) ioctl$LOOP_SET_BLOCK_SIZE(r4, 0x4c09, 0x4) (async) 433.734768ms ago: executing program 2 (id=2735): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000083c0)={{0x3}}) close_range(r0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) setuid(0xee01) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) fcntl$lock(r0, 0x24, &(0x7f0000000000)={0x2, 0x4, 0x4, 0x3}) fcntl$lock(r2, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x9, 0x9}) fcntl$lock(r2, 0x7, &(0x7f00000000c0)={0x1, 0x2, 0x8, 0x73e9}) write$char_usb(r2, &(0x7f0000000600)="3e61ccfac3b5abc0f8a2e556dd8b47fa91925bdaa62238b917b1f2b432e74f9b7eec348eb1ff0e8fc3280c3f59b9f72442eb62eb19a6d362c53cb0d2d10b2985f212816da7db1fb2fdcbc418ba0878bf583ffe34a79e83c8575e3d240f0a4496e2f4753ed31123bdc68531e73291f7d34fa8927a20e7cbd2a2005a7f8e13f87507c81a702e799f412a3e87ba5643620f4fc34b5cc7a6c3052c6116ab75b7f5dc1a677a48fa7cb050429c93850ccd7a56abab44e5173b15535c36dd2e784ca8fe9a9f235a8ded5fd9289f957e6d78c333ce01fd54b4cd8704c9029e0276dc576c7d", 0xe1) r3 = add_key(&(0x7f0000000080)='dns_resolver\x00', &(0x7f0000000500)={'syz', 0x3}, &(0x7f0000000040)="42d7386debb9c100", 0x8, 0xfffffffffffffffe) keyctl$read(0xb, r3, 0x0, 0x0) r4 = syz_ublk_setup_io_uring(0x3ac, &(0x7f0000000540)={0x0, 0xffffffff, 0x1000, 0x0, 0x11a}, &(0x7f00000005c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000180)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0x408, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x30}}}, &(0x7f0000000280)) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_GET_CLOCK(r9, 0x8030ae7c, &(0x7f0000000240)) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_PPC_ALLOCATE_HTAB(0xffffffffffffffff, 0xc004aea7, &(0x7f0000000000)=0x7ee7) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0) r12 = socket(0x15, 0x5, 0x0) r13 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r14 = ioctl$KVM_CREATE_VCPU(r13, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r13, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x28bd, 0x933, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x7, 0x10, 0x3, "", [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x3, 0x1, 0x2, 0x6, {0x9, 0x21, 0x5, 0x7f, 0x1, {0x22, 0x80f}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0xd, 0xa3, 0x9}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x6, 0x1, 0x5}}]}}}]}}]}}, &(0x7f0000000480)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x0, 0x6, 0x4, 0xff, 0xff}, 0x80, &(0x7f00000004c0)={0x5, 0xf, 0x80, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x5, 0x1, 0xb0, 0xd98}, @ssp_cap={0x24, 0x10, 0xa, 0x4, 0x6, 0x9, 0xf, 0x400, [0xff3fcf, 0xf0, 0xff0030, 0xc0, 0x0, 0xf]}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0xfd, 0x3, 0x9}, @wireless={0xb, 0x10, 0x1, 0x8, 0xd0, 0x9, 0x9, 0xa1b4, 0xff}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "89468def36582de7a21bae1fc2c8dd5d"}, @ssp_cap={0x24, 0x10, 0xa, 0x2, 0x6, 0x1, 0x88f, 0x4, [0xc0, 0x77933bbc071193c1, 0xc000, 0x3f00, 0xf, 0xf]}]}, 0x3, [{0x51, &(0x7f0000000700)=ANY=[@ANYBLOB="510320294125ca90580b2018811a846ed18ed1e6f8bbf0b3308491f6aa7353d391655fe754a435a028b319032ab38d487f2294d0f102e8b274d11f681994ac10d427c14cb9374dea4270784e949acc33a70c8a8da8afdfeb682766ddc370dc8eed2d6c7ed7f0ec8fb7d8b6dc741c09167583aeb418be701e92c9f61d16e116032a0495617f6f06e6d0a7b1db94b33b5589e155dc9acd3093a9b0966054db61faa81df93e6ec3e7369c9e556ab14a42318d48405f82363ac130e6549d8780ac36d6034b43b9c2fdec6583f1da840c09e907ed6191a04d063860a8f33fb1c57cb3883d3c1dfee5fd01fcd71d2160652fb278c1a59585ae25b384e0c6def63908cd2426308de792801c1b94024ffa57bc97320a2e175658"]}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x41a}}, {0xf5, &(0x7f00000002c0)=ANY=[@ANYBLOB="f503be9450cfc732b4b3c25d77121a77d946a44d3c2aa43bb12d115bd72983aa9a77f93574d788031c8edc93840433514ffa71b20c794d134eab8e94f247de41e9f8d5dfd8cc1b41beb98b0163660a33344cac3ff8b19d6432023ff85c6f33da90a6316a69be8927bb9008a8aea4f437c6039a73667c9906a4b28421756b028a4fbb611fa8a2301db47316487907d88d14303c041f9a191a1b3e019a32d56dba5638be7697fcc78dd5984ac858255b35164dc9d0198da9d8b208fdb04b46cf33b9512cf9f25d6eb6a43a591aad542d9aff0ad75a62488de14ef26aba173c52c6b2e07b580d29a3253aac231010915d86a66315f413"]}]}) ioctl$KVM_SET_REGS(r14, 0x4090ae82, &(0x7f00000003c0)={[0x60000000002, 0x8, 0x1, 0x41, 0xc3d, 0x0, 0x2004cb, 0xffffffffffffffff, 0xa1d, 0x8, 0x5, 0x79, 0x3, 0x2], 0x3332d000, 0x202}) ioctl$KVM_RUN(r14, 0xae80, 0x0) setsockopt$sock_attach_bpf(r12, 0x1, 0x32, &(0x7f0000000200)=r10, 0x4) ioctl$KVM_RUN(r14, 0xae80, 0x0) 356.766662ms ago: executing program 3 (id=2738): socket$netlink(0x10, 0x3, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) r1 = syz_open_pts(r0, 0x1) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00005cf000/0x4000)=nil, 0x400000, 0x2, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x46180, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x200000000000004) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r3, 0x40383d0c, &(0x7f0000000100)={{0x9, 0xfffffffa}, {0x9, 0x1003ff}, 0xffffffff, 0x7}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x11) 356.540217ms ago: executing program 2 (id=2739): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="ad56b65f060faea795cd3292ae2ac7beef915d564c90c200", 0x18) recvmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040), 0x6e, &(0x7f0000000240)=[{&(0x7f00000000c0)=""/71, 0x47}, {&(0x7f0000000140)=""/207, 0xcf}], 0x2, &(0x7f0000000280)=[@rights={{0x10}}, @cred={{0x1c}}], 0x30}, 0x102) r1 = accept4(r0, 0x0, 0x0, 0x80800) syz_genetlink_get_family_id$nl80211(&(0x7f0000001780), r1) 260.061575ms ago: executing program 3 (id=2740): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) syz_emit_ethernet(0x56, &(0x7f00000004c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0xc2, 0x700, 0x0, 0x0, {[@mptcp=@syn={0x1e, 0xc, 0x8, 0x1, 0x9, 0x100, 0x7}]}}}}}}}}, 0x0) 259.757618ms ago: executing program 3 (id=2741): r0 = socket(0x10, 0x3, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x3, 0x40) read$usbmon(r1, &(0x7f0000000000)=""/177, 0xb1) r2 = syz_open_dev$usbfs(&(0x7f0000002000), 0xd, 0x20041) read$usbmon(r1, &(0x7f0000000600)=""/4106, 0x100a) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x710, 0x1100, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x0, 0x0, 0x5, 0x2f, 0x0, @empty, @private}}}}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r3, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xfffffeffffffffff]}, 0x0, 0x8) r4 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x12, 0x4, @tid=r4}, &(0x7f0000000380)=0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000000100)={0x80000001, 0x0, "046264da5310be8c28f8c65c346c912aee6f5cf14e5188d884c94804d97acde7cdb8f19277aa2a4a38d029206b85469c6d2966b3f40d84fd6ca4ade6a40ef89bc8df8c8ebbb0db234eda456707f1f74cb0411610332db1bb61f04357dcb3ed1421f5d140b9274d5e45e8fb580205df3c5caf376859b254c9ea0380655da7aa3a867297041b9f8835dfe45a44de63f9552f2270e386da75d5c0cbfb18180a61cfddb1a3218f64adf9f2779497a3e9a4649a6572db21a8d481bfc94c32e1d99a811d6204eadf40798090bc9ff921413c0d8e860a7d7aabb7d4bc501960318db63aca89ad97d9ee24709cc6e270fb19704044d8280636136e1cd6b29ba709b658fc"}) timer_settime(r5, 0x1, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) timer_delete(r5) io_pgetevents(0x0, 0x200000c, 0x0, 0x0, 0x0, &(0x7f0000000500)={&(0x7f00000004c0)={[0x6]}, 0x8}) syz_emit_ethernet(0x46, &(0x7f00000002c0)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb0800450000380000000000019078ac1e0001ac1414aa030490781200183f250000000000000000010000000000017f00000100186371ae9b1c031210cfce4b3a1c5cf91ded318f0f"], 0x0) 259.48819ms ago: executing program 2 (id=2742): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)={0x18, 0x5a, 0x1, 0x0, 0x0, {}, [@nested={0x4, 0x5}]}, 0x18}}, 0x0) socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) quotactl_fd$Q_SETQUOTA(0xffffffffffffffff, 0xffffffff80000800, 0x0, &(0x7f0000000180)={0x0, 0x1, 0x9, 0x2000000009, 0x3, 0x80000002, 0x48cd, 0x5, 0xc}) r1 = add_key$user(&(0x7f0000000080), &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000200)='\x00', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, r2, r1}, &(0x7f00000000c0)=""/67, 0x43, 0x0) 107.472942ms ago: executing program 3 (id=2743): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x7}, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)='\"', 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x80800) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) bind$bt_hci(r3, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r0, 0x2) 107.052734ms ago: executing program 2 (id=2744): openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) (async) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x18, &(0x7f0000000580)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {0xffff, 0xffff}, {0xd, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x800, 0x1, 0x9, 0x400, 0x2, 0x6, 0x7, 0x0, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$packet(0x11, 0x3, 0x300) (async) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r5, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0x485, 0x0, 0x8001}]}) (async) ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0x485, 0x0, 0x8001}]}) socket(0x10, 0x3, 0x0) r7 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x80000, 0x0) ioctl$KVM_SET_IRQCHIP(r7, 0x8208ae63, &(0x7f0000000480)={0x0, 0x0, @pic={0xd, 0x7, 0x8, 0xa3, 0x43, 0x4, 0x7, 0xf, 0x6, 0x4, 0x4, 0x1, 0x8, 0x7f, 0x5, 0x3}}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r8, &(0x7f0000000340)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) ioctl$XFS_IOC_FSCOUNTS(r0, 0x80205871, &(0x7f0000000300)) setsockopt$inet6_tcp_TCP_ULP(r8, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async) setsockopt$inet6_tcp_TCP_ULP(r8, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r8, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r8, 0x11a, 0x2, &(0x7f0000000180)=@ccm_128={{0x303}, "87b8ffffffffffff", "880e8bd84efdaa8bc835c358bacb67b9", '\x00', "41c0f1c3cc72b9ca"}, 0x28) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.dequeue\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) setsockopt$inet6_tcp_TLS_TX(r8, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f5d937e5523", "4705a7b6113b967d7314f7201eb2babf", "1d1cbe23", "ecba06893bcdc493"}, 0x28) (async) setsockopt$inet6_tcp_TLS_TX(r8, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f5d937e5523", "4705a7b6113b967d7314f7201eb2babf", "1d1cbe23", "ecba06893bcdc493"}, 0x28) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r8) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r8) socket$packet(0x11, 0x3, 0x300) 633.42µs ago: executing program 3 (id=2745): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x6000, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) 0s ago: executing program 3 (id=2746): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x3, @mcast1, 0x2}, 0x1c) syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0) r1 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000080)={0x7, 0x10, 0x85, 0x9, "b75fc47f994d6d4056b9b835c407dd0fcd70131cb1a8f007512701d3987e5821"}) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff810000400e227f000001925aa80020007b00090080007f000006e809000000ff0000f03ac71002000000ffffffffffffffffffe7ee00050000000000000200000000", 0x58}], 0x1) r3 = creat(&(0x7f00000002c0)='./file0\x00', 0x104) write$bt_hci(r3, &(0x7f0000000100)={0x1, @switch_role={{0x80b, 0x7}, {@any, 0x9}}}, 0xb) write$P9_RVERSION(r3, &(0x7f0000000c40)=ANY=[], 0x13) write$cgroup_subtree(r3, &(0x7f0000000000)={[{0x2b, 'memory'}, {0x2b, 'net_cls'}, {0x2d, 'freezer'}, {0x2d, 'pids'}, {0x2d, 'net_cls'}, {0x2d, 'io'}, {0x2d, 'cpu'}, {0x2d, 'memory'}]}, 0x3a) kernel console output (not intermixed with test programs): 30909.945:887): avc: denied { write } for pid=11609 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.129063][T11433] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 192.177685][ T42] audit: type=1400 audit(1782830910.019:888): avc: denied { write } for pid=11614 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.220606][T11433] 8021q: adding VLAN 0 to HW filter on device bond0 [ 192.234209][T11433] 8021q: adding VLAN 0 to HW filter on device team0 [ 192.241576][ T6677] bridge0: port 1(bridge_slave_0) entered blocking state [ 192.243855][ T6677] bridge0: port 1(bridge_slave_0) entered forwarding state [ 192.256318][ T6677] bridge0: port 2(bridge_slave_1) entered blocking state [ 192.258545][ T6677] bridge0: port 2(bridge_slave_1) entered forwarding state [ 192.327858][ T42] audit: type=1400 audit(1782830910.166:889): avc: denied { write } for pid=11624 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.377203][ T42] audit: type=1400 audit(1782830910.203:890): avc: denied { write } for pid=11630 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.382801][ T5786] IPVS: stop unused estimator thread 0... [ 192.465070][ T35] block nbd0: Possible stuck request ffff8880297b2140: control (read@0,4096B). Runtime 96 seconds [ 192.486301][ T42] audit: type=1400 audit(1782830910.295:891): avc: denied { write } for pid=11633 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.542426][ T42] audit: type=1400 audit(1782830910.360:892): avc: denied { write } for pid=11643 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.614560][T11433] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 192.617038][ T42] audit: type=1400 audit(1782830910.425:893): avc: denied { write } for pid=11654 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.653436][ T42] audit: type=1400 audit(1782830910.462:894): avc: denied { write } for pid=11660 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.657114][T11433] veth0_vlan: entered promiscuous mode [ 192.668296][T11433] veth1_vlan: entered promiscuous mode [ 192.691714][T11433] veth0_macvtap: entered promiscuous mode [ 192.697068][T11433] veth1_macvtap: entered promiscuous mode [ 192.705520][T11433] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 192.712095][T11433] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 192.724056][ T5786] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.730940][ T5786] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.736327][ T5786] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.742877][ T5786] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.794547][ T6679] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 192.797305][ T6679] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 192.811090][ T29] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 192.819880][ T6680] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 192.822677][ T6680] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 192.828372][ T42] audit: type=1400 audit(1782830910.618:895): avc: denied { mounton } for pid=11433 comm="syz-executor" path="/syzkaller.I3SlL4/syz-tmp" dev="sda1" ino=2039 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 192.865404][ T5736] Bluetooth: hci5: command tx timeout [ 192.995447][ T29] usb 6-1: Using ep0 maxpacket: 16 [ 192.998445][ T29] usb 6-1: config 254 has an invalid interface number: 235 but max is 0 [ 193.003535][ T29] usb 6-1: config 254 has no interface number 0 [ 193.005482][ T29] usb 6-1: config 254 interface 235 altsetting 2 bulk endpoint 0x6 has invalid maxpacket 32 [ 193.008737][ T29] usb 6-1: config 254 interface 235 altsetting 2 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 193.012355][ T29] usb 6-1: config 254 interface 235 altsetting 2 endpoint 0x8F has invalid wMaxPacketSize 0 [ 193.015420][ T29] usb 6-1: config 254 interface 235 has no altsetting 0 [ 193.020542][ T29] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=2b.f1 [ 193.023393][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.025835][ T29] usb 6-1: Product: syz [ 193.027155][ T29] usb 6-1: Manufacturer: syz [ 193.028735][ T29] usb 6-1: SerialNumber: syz [ 193.032095][T11647] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 193.035984][ T29] usbtest 6-1:254.235: couldn't get endpoints, -22 [ 193.038079][ T29] usbtest 6-1:254.235: probe with driver usbtest failed with error -22 [ 193.254040][ T5821] usb 6-1: USB disconnect, device number 17 [ 194.394096][T11719] ubi0: attaching mtd0 [ 194.397312][T11719] ubi0: scanning is finished [ 194.398744][T11719] ubi0: empty MTD device detected [ 194.513576][ T34] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 194.911628][T11719] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 194.914381][T11719] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 194.918484][T11719] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 194.920778][T11719] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 194.923162][T11719] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 194.925566][T11719] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 194.928161][T11719] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2930858918 [ 194.931392][T11719] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 194.935574][T11735] ubi0: background thread "ubi_bgt0d" started, PID 11735 [ 195.122154][ T5736] Bluetooth: hci5: command tx timeout [ 195.314475][ T42] audit: type=1400 audit(1782830912.916:896): avc: denied { name_bind } for pid=11743 comm="syz.4.1967" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 195.566166][ T34] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 195.570237][ T34] usb 6-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 195.573370][ T34] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 195.576249][ T34] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.582874][ T34] hub 6-1:4.0: USB hub found [ 195.801985][ T34] hub 6-1:4.0: 2 ports detected [ 195.803936][ T34] usb 6-1: selecting invalid altsetting 1 [ 195.805810][ T34] hub 6-1:4.0: Using single TT (err -22) [ 196.022156][ T34] hub 6-1:4.0: hub_hub_status failed (err = -71) [ 196.029547][ T34] hub 6-1:4.0: config failed, can't get hub status (err -71) [ 196.051713][ T34] usb 6-1: USB disconnect, device number 18 [ 196.352004][T11767] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1976'. [ 196.375932][T11767] veth3: entered allmulticast mode [ 196.836590][T11785] netlink: 'syz.1.1984': attribute type 29 has an invalid length. [ 196.840373][T11785] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1984'. [ 197.395491][ T5736] Bluetooth: hci5: command tx timeout [ 197.921254][ T5736] Bluetooth: hci5: unexpected event for opcode 0x200c [ 197.969751][ T29] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 197.992948][ T42] kauditd_printk_skb: 1 callbacks suppressed [ 197.992974][ T42] audit: type=1400 audit(1782830915.389:898): avc: denied { lock } for pid=11819 comm="syz.2.1998" path="/dev/dlm-control" dev="devtmpfs" ino=100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 198.108935][T11830] sch_fq: defrate 65536 ignored. [ 198.143335][ T29] usb 6-1: Using ep0 maxpacket: 8 [ 198.153337][ T29] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 198.157578][ T29] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 198.160501][ T29] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.167195][ T29] usb 6-1: config 0 descriptor?? [ 198.398948][ T29] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 198.587870][ T848] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 198.839747][ T5885] usb 6-1: USB disconnect, device number 19 [ 198.945768][ T64] Bluetooth: hci5: Opcode 0x206a failed: -110 [ 199.520776][ T848] usb 9-1: config index 0 descriptor too short (expected 12147, got 18) [ 199.523550][ T848] usb 9-1: config 97 has too many interfaces: 99, using maximum allowed: 32 [ 199.526330][ T848] usb 9-1: config 97 has an invalid descriptor of length 95, skipping remainder of the config [ 199.529512][ T848] usb 9-1: config 97 has 0 interfaces, different from the descriptor's value: 99 [ 199.533197][ T848] usb 9-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice= 9.00 [ 199.536115][ T848] usb 9-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 199.538651][ T848] usb 9-1: Product: syz [ 199.570127][ T42] audit: type=1400 audit(1782830916.838:899): avc: denied { create } for pid=11892 comm="syz.3.2031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 199.571734][T11893] syz.3.2031: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3 [ 199.577324][ T42] audit: type=1400 audit(1782830916.838:900): avc: denied { setopt } for pid=11892 comm="syz.3.2031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 199.577328][T11893] ,mems_allowed=0-1 [ 199.590700][T11893] CPU: 2 UID: 0 PID: 11893 Comm: syz.3.2031 Tainted: G L syzkaller #0 PREEMPT(full) [ 199.590719][T11893] Tainted: [L]=SOFTLOCKUP [ 199.590723][T11893] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 199.590744][T11893] Call Trace: [ 199.590749][T11893] [ 199.590754][T11893] dump_stack_lvl+0x100/0x190 [ 199.590874][T11893] warn_alloc.cold+0x94/0xa8 [ 199.590888][T11893] ? __pfx_warn_alloc+0x10/0x10 [ 199.590914][T11893] ? register_lock_class+0x40/0x560 [ 199.590951][T11893] ? kasan_save_stack+0x3f/0x50 [ 199.590966][T11893] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 199.590984][T11893] ? xskq_create+0x52/0x1d0 [ 199.591087][T11893] ? xsk_setsockopt+0x743/0xab0 [ 199.591100][T11893] ? do_sock_setsockopt+0xf3/0x1d0 [ 199.591149][T11893] ? __sys_setsockopt+0x195/0x220 [ 199.591161][T11893] ? __x64_sys_setsockopt+0xbd/0x160 [ 199.591172][T11893] ? do_syscall_64+0x115/0x870 [ 199.591202][T11893] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.591218][T11893] ? xskq_create+0xfb/0x1d0 [ 199.591233][T11893] __vmalloc_node_range_noprof+0x136c/0x1630 [ 199.591255][T11893] ? xskq_create+0xfb/0x1d0 [ 199.591274][T11893] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 199.591293][T11893] ? kasan_save_track+0x14/0x30 [ 199.591306][T11893] ? __kasan_kmalloc+0xaa/0xb0 [ 199.591320][T11893] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 199.591337][T11893] ? xskq_create+0xfb/0x1d0 [ 199.591351][T11893] vmalloc_user_noprof+0x9e/0xe0 [ 199.591367][T11893] ? xskq_create+0xfb/0x1d0 [ 199.591396][T11893] xskq_create+0xfb/0x1d0 [ 199.591412][T11893] xsk_setsockopt+0x743/0xab0 [ 199.591428][T11893] ? __pfx_xsk_setsockopt+0x10/0x10 [ 199.591445][T11893] ? find_held_lock+0x2b/0x80 [ 199.591456][T11893] ? __fget_files+0x215/0x3d0 [ 199.591472][T11893] ? selinux_socket_setsockopt+0x6a/0x80 [ 199.591506][T11893] ? __pfx_xsk_setsockopt+0x10/0x10 [ 199.591522][T11893] do_sock_setsockopt+0xf3/0x1d0 [ 199.591539][T11893] __sys_setsockopt+0x195/0x220 [ 199.591555][T11893] __x64_sys_setsockopt+0xbd/0x160 [ 199.591567][T11893] ? do_syscall_64+0x90/0x870 [ 199.591585][T11893] ? lockdep_hardirqs_on+0x78/0x100 [ 199.591602][T11893] do_syscall_64+0x115/0x870 [ 199.591632][T11893] ? clear_bhb_loop+0x40/0x90 [ 199.591647][T11893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.591661][T11893] RIP: 0033:0x7fc1a4b9ce59 [ 199.591685][T11893] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 199.591697][T11893] RSP: 002b:00007fc1a5975028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 199.591711][T11893] RAX: ffffffffffffffda RBX: 00007fc1a4e15fa0 RCX: 00007fc1a4b9ce59 [ 199.591719][T11893] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 199.591727][T11893] RBP: 00007fc1a4c32e6f R08: 0000000000000004 R09: 0000000000000000 [ 199.591735][T11893] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 199.591742][T11893] R13: 00007fc1a4e16038 R14: 00007fc1a4e15fa0 R15: 00007ffeff86d508 [ 199.591758][T11893] [ 199.591817][T11893] Mem-Info: [ 199.660388][ T10] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 199.661209][T11893] active_anon:12990 inactive_anon:16515 isolated_anon:0 [ 199.661209][T11893] active_file:213 inactive_file:55944 isolated_file:1 [ 199.661209][T11893] unevictable:2792 dirty:165 writeback:0 [ 199.661209][T11893] slab_reclaimable:9627 slab_unreclaimable:75460 [ 199.661209][T11893] mapped:30308 shmem:21708 pagetables:3669 [ 199.661209][T11893] sec_pagetables:298 bounce:0 [ 199.661209][T11893] kernel_misc_reclaimable:0 [ 199.661209][T11893] free:396117 free_pcp:22906 free_cma:0 [ 199.703737][T11893] Node 0 active_anon:51412kB inactive_anon:66060kB active_file:852kB inactive_file:223500kB unevictable:5584kB isolated(anon):0kB isolated(file):4kB mapped:80272kB dirty:652kB writeback:0kB shmem:81236kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:2048kB kernel_stack:14944kB pagetables:6136kB sec_pagetables:1192kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 199.714320][T11893] Node 1 active_anon:548kB inactive_anon:0kB active_file:0kB inactive_file:276kB unevictable:5584kB isolated(anon):0kB isolated(file):0kB mapped:40960kB dirty:8kB writeback:0kB shmem:5596kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:128kB pagetables:8540kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 199.724355][T11893] Node 0 DMA free:12284kB boost:0kB min:340kB low:424kB high:508kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:188kB local_pcp:16kB free_cma:0kB [ 199.734248][T11893] lowmem_reserve[]: 0 1229 1229 1229 1229 [ 199.736132][T11893] Node 0 DMA32 free:72940kB boost:0kB min:27444kB low:34304kB high:41164kB reserved_highatomic:0KB free_highatomic:0KB active_anon:51388kB inactive_anon:66060kB active_file:852kB inactive_file:223500kB unevictable:5584kB writepending:652kB zspages:0kB present:2080628kB managed:1258700kB mlocked:0kB bounce:0kB free_pcp:62820kB local_pcp:24436kB free_cma:0kB [ 199.746294][T11893] lowmem_reserve[]: 0 0 0 0 0 [ 199.747916][T11893] Node 1 Normal free:1499244kB boost:0kB min:39796kB low:49744kB high:59692kB reserved_highatomic:0KB free_highatomic:0KB active_anon:548kB inactive_anon:0kB active_file:0kB inactive_file:276kB unevictable:5584kB writepending:8kB zspages:0kB present:2097152kB managed:1781884kB mlocked:0kB bounce:0kB free_pcp:28552kB local_pcp:6900kB free_cma:0kB [ 199.757676][T11893] lowmem_reserve[]: 0 0 0 0 0 [ 199.759316][T11893] Node 0 DMA: 16*4kB (UME) 29*8kB (UME) 26*16kB (UME) 30*32kB (UME) 8*64kB (UME) 9*128kB (ME) 7*256kB (ME) 6*512kB (UME) 4*1024kB (UM) 0*2048kB 0*4096kB = 12296kB [ 199.764537][T11893] Node 0 DMA32: 384*4kB (M) 525*8kB (UME) 224*16kB (UME) 240*32kB (UME) 110*64kB (ME) 48*128kB (ME) 23*256kB (ME) 4*512kB (ME) 4*1024kB (M) 3*2048kB (UM) 6*4096kB (U) = 72936kB [ 199.768818][ T34] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 199.770736][T11893] Node 1 Normal: 344*4kB (UM) 324*8kB (UM) 279*16kB (UME) 282*32kB (UM) 181*64kB (UME) 176*128kB (UME) 265*256kB (UM) 257*512kB (UME) 221*1024kB (UME) 11*2048kB (UM) 244*4096kB (UM) = 1499248kB [ 199.779106][T11893] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 199.782095][T11893] Node 0 hugepages_total=3 hugepages_free=2 hugepages_surp=1 hugepages_size=2048kB [ 199.784914][T11893] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 199.787815][T11893] Node 1 hugepages_total=4 hugepages_free=2 hugepages_surp=2 hugepages_size=2048kB [ 199.790720][T11893] 77862 total pagecache pages [ 199.792209][T11893] 0 pages in swap cache [ 199.793456][T11893] Free swap = 124996kB [ 199.794731][T11893] Total swap = 124996kB [ 199.796015][T11893] 1048443 pages RAM [ 199.797202][T11893] 0 pages HighMem/MovableOnly [ 199.798667][T11893] 284457 pages reserved [ 199.799974][T11893] 0 pages cma reserved [ 199.806497][ T35] block nbd0: Possible stuck request ffff8880297b2140: control (read@0,4096B). Runtime 102 seconds [ 199.823003][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 199.826103][ T10] usb 7-1: config 11 has an invalid interface number: 161 but max is 0 [ 199.828726][ T10] usb 7-1: config 11 has no interface number 0 [ 199.830681][ T10] usb 7-1: config 11 interface 161 has no altsetting 0 [ 199.835704][ T10] usb 7-1: New USB device found, idVendor=10d2, idProduct=81d2, bcdDevice=11.e5 [ 199.839795][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.843406][ T10] usb 7-1: Product: syz [ 199.845074][ T10] usb 7-1: Manufacturer: syz [ 199.846619][ T10] usb 7-1: SerialNumber: syz [ 199.955756][ T34] usb 6-1: config 0 has an invalid interface number: 196 but max is 0 [ 199.959383][ T34] usb 6-1: config 0 has no interface number 0 [ 199.963120][ T34] usb 6-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice=d7.23 [ 199.966232][ T34] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.968985][ T34] usb 6-1: Product: syz [ 199.970304][ T34] usb 6-1: Manufacturer: syz [ 199.971751][ T34] usb 6-1: SerialNumber: syz [ 199.977298][ T34] usb 6-1: config 0 descriptor?? [ 199.980441][ T34] ftdi_sio 6-1:0.196: FTDI USB Serial Device converter detected [ 199.983915][ T34] ftdi_sio ttyUSB0: unknown device type: 0xd723 [ 199.987598][ T5846] usb 9-1: USB disconnect, device number 22 [ 200.073430][ T10] usblcd 7-1:11.161: USBLCD model not supported. [ 200.076978][ T10] usb 7-1: USB disconnect, device number 27 [ 200.198917][ T34] usb 6-1: USB disconnect, device number 20 [ 200.209815][ T34] ftdi_sio 6-1:0.196: device disconnected [ 201.632847][ T41] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 201.755588][T11980] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2069'. [ 201.793614][T11983] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 201.797078][ T41] usb 6-1: too many endpoints for config 0 interface 0 altsetting 15: 130, using maximum allowed: 30 [ 201.800441][ T41] usb 6-1: config 0 interface 0 altsetting 15 endpoint 0x81 has an invalid bInterval 176, changing to 11 [ 201.803848][ T41] usb 6-1: config 0 interface 0 altsetting 15 has 1 endpoint descriptor, different from the interface descriptor's value: 130 [ 201.808932][ T41] usb 6-1: config 0 interface 0 has no altsetting 0 [ 201.811051][ T41] usb 6-1: New USB device found, idVendor=0c70, idProduct=f003, bcdDevice= 0.00 [ 201.813820][ T41] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.817630][ T41] usb 6-1: config 0 descriptor?? [ 201.885683][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 201.887861][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 202.017704][ T42] audit: type=1400 audit(1782830919.098:901): avc: denied { read write } for pid=11985 comm="syz.3.2072" name="vhost-vsock" dev="devtmpfs" ino=1300 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 202.025250][ T42] audit: type=1400 audit(1782830919.098:902): avc: denied { open } for pid=11985 comm="syz.3.2072" path="/dev/vhost-vsock" dev="devtmpfs" ino=1300 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 202.032686][ T42] audit: type=1400 audit(1782830919.098:903): avc: denied { ioctl } for pid=11985 comm="syz.3.2072" path="/dev/vhost-vsock" dev="devtmpfs" ino=1300 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 202.033944][ T1048] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 202.058896][T11989] af_packet: tpacket_rcv: packet too big, clamped from 32 to 4294967272. macoff=96 [ 202.094440][T11991] syzkaller0: entered promiscuous mode [ 202.096258][T11991] syzkaller0: entered allmulticast mode [ 202.101784][T11991] tipc: Started in network mode [ 202.103350][T11991] tipc: Node identity 729cbbb2cb06, cluster identity 4711 [ 202.105740][T11991] tipc: Enabled bearer , priority 0 [ 202.108585][T11990] tipc: Resetting bearer [ 202.122490][T11990] tipc: Disabling bearer [ 202.208813][ T1048] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 202.212438][ T1048] usb 9-1: New USB device found, idVendor=0b05, idProduct=1abe, bcdDevice= 0.00 [ 202.215443][ T1048] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.220691][ T1048] usb 9-1: config 0 descriptor?? [ 202.225237][T11982] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 202.439500][ T42] audit: type=1400 audit(1782830919.495:904): avc: denied { append } for pid=12008 comm="syz.3.2083" name="ptp0" dev="devtmpfs" ino=730 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 202.491443][ T64] Bluetooth: hci5: unexpected event for opcode 0x200c [ 202.654501][ T64] Bluetooth: hci5: unexpected event for opcode 0x200c [ 202.677861][ T1048] hid_parser_main: 899 callbacks suppressed [ 202.677890][ T1048] asus 0003:0B05:1ABE.000D: unknown main item tag 0x0 [ 202.683675][ T1048] asus 0003:0B05:1ABE.000D: unknown main item tag 0x0 [ 202.686618][ T1048] asus 0003:0B05:1ABE.000D: unknown main item tag 0x0 [ 202.690938][ T1048] asus 0003:0B05:1ABE.000D: unknown main item tag 0x0 [ 202.695529][ T1048] asus 0003:0B05:1ABE.000D: unknown main item tag 0x0 [ 202.700584][ T1048] asus 0003:0B05:1ABE.000D: unknown main item tag 0x0 [ 202.704191][ T1048] asus 0003:0B05:1ABE.000D: unknown main item tag 0x0 [ 202.707948][ T1048] asus 0003:0B05:1ABE.000D: unknown main item tag 0x0 [ 202.710138][ T1048] asus 0003:0B05:1ABE.000D: unknown main item tag 0x0 [ 202.712263][ T1048] asus 0003:0B05:1ABE.000D: unknown main item tag 0x0 [ 202.721372][ T1048] asus 0003:0B05:1ABE.000D: hidraw1: USB HID v7f.fd Device [HID 0b05:1abe] on usb-dummy_hcd.4-1/input0 [ 202.770959][ T42] audit: type=1400 audit(1782830919.790:905): avc: denied { append } for pid=12049 comm="syz.2.2103" name="usbmon5" dev="devtmpfs" ino=754 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 202.798425][T12053] netlink: 'syz.3.2105': attribute type 1 has an invalid length. [ 202.800969][T12053] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.2105'. [ 202.849539][ T64] Bluetooth: hci5: unexpected event for opcode 0x200c [ 202.885374][ T29] usb 9-1: USB disconnect, device number 23 [ 203.182638][ T5843] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 203.347303][ T5843] usb 8-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice= 9.00 [ 203.350258][ T5843] usb 8-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 203.352911][ T5843] usb 8-1: Product: syz [ 203.355762][ T5843] usb 8-1: config 0 descriptor?? [ 203.359433][ T5843] ftdi_sio 8-1:0.0: FTDI USB Serial Device converter detected [ 203.362440][ T5843] usb 8-1: Detected FT232H [ 203.795633][ T5843] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 203.799529][ T5843] ftdi_sio 8-1:0.0: GPIO initialisation failed: -71 [ 203.802887][ T5843] usb 8-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 203.807047][ T5843] usb 8-1: USB disconnect, device number 9 [ 203.816077][ T5843] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 203.819284][ T5843] ftdi_sio 8-1:0.0: device disconnected [ 203.976479][T12087] bond0: (slave batadv0): Releasing backup interface [ 203.980698][T12087] bridge_slave_0: left allmulticast mode [ 203.982528][T12087] bridge_slave_0: left promiscuous mode [ 203.986711][T12087] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.991047][T12087] bridge_slave_1: left allmulticast mode [ 203.992846][T12087] bridge_slave_1: left promiscuous mode [ 203.994672][T12087] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.999336][T12087] bond0: (slave bond_slave_0): Releasing backup interface [ 204.003410][T12087] bond0: (slave bond_slave_1): Releasing backup interface [ 204.011380][T12087] team0: Port device team_slave_0 removed [ 204.014593][T12087] team0: Port device team_slave_1 removed [ 204.016661][T12087] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 204.019835][T12087] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 204.022630][T12087] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 204.435183][ T41] usbhid 6-1:0.0: can't add hid device: -71 [ 204.440693][ T41] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 204.447063][ T41] usb 6-1: USB disconnect, device number 21 [ 204.589977][T12104] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 205.444070][T12130] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2137'. [ 205.549675][ T42] audit: type=1800 audit(1782830922.365:906): pid=12142 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.2143" name="file0" dev="overlay" ino=1460 res=0 errno=0 [ 205.564537][T12146] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2144'. [ 205.568776][T12146] netlink: 644 bytes leftover after parsing attributes in process `syz.3.2144'. [ 205.734745][ T42] audit: type=1400 audit(1782830922.531:907): avc: denied { create } for pid=12149 comm="syz.1.2147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 205.743055][ T42] audit: type=1400 audit(1782830922.531:908): avc: denied { write } for pid=12149 comm="syz.1.2147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 206.000456][ T41] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 206.198752][ T41] usb 8-1: Using ep0 maxpacket: 16 [ 206.201058][ T64] Bluetooth: hci2: SCO packet for unknown connection handle 3840 [ 206.243562][ T41] usb 8-1: config 254 has an invalid interface number: 235 but max is 0 [ 206.273561][ T41] usb 8-1: config 254 has no interface number 0 [ 206.277127][ T41] usb 8-1: config 254 interface 235 altsetting 2 bulk endpoint 0x6 has invalid maxpacket 32 [ 206.280378][ T41] usb 8-1: config 254 interface 235 altsetting 2 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 206.284241][ T41] usb 8-1: config 254 interface 235 altsetting 2 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 206.287850][ T41] usb 8-1: config 254 interface 235 altsetting 2 endpoint 0x8F has invalid wMaxPacketSize 0 [ 206.291000][ T41] usb 8-1: config 254 interface 235 has no altsetting 0 [ 206.297696][ T41] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=2b.f1 [ 206.300654][ T41] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.303307][ T41] usb 8-1: Product: syz [ 206.305322][ T41] usb 8-1: Manufacturer: syz [ 206.306927][ T41] usb 8-1: SerialNumber: syz [ 206.323360][T12156] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 206.551140][T12156] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 206.556323][ T41] usbtest 8-1:254.235: Linux gadget zero [ 206.558242][ T41] usbtest 8-1:254.235: high-speed {control in/out bulk-out iso-in} tests (+alt) [ 206.635899][ T42] audit: type=1400 audit(1782830923.352:909): avc: denied { read } for pid=12198 comm="syz.4.2167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 206.676206][ T42] audit: type=1400 audit(1782830923.398:910): avc: denied { setopt } for pid=12198 comm="syz.4.2167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 206.753765][ T35] block nbd0: Possible stuck request ffff8880297b2140: control (read@0,4096B). Runtime 108 seconds [ 206.775883][ T41] usb 8-1: USB disconnect, device number 10 [ 207.148594][ T42] audit: type=1400 audit(1782830923.822:911): avc: denied { name_bind } for pid=12218 comm="syz.2.2174" src=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 207.353368][ T42] audit: type=1400 audit(1782830924.025:912): avc: denied { watch_sb } for pid=12220 comm="syz.3.2175" path="/98/file0" dev="tmpfs" ino=514 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 207.908000][ T5821] usb 9-1: new full-speed USB device number 24 using dummy_hcd [ 208.084903][ T5821] usb 9-1: config 0 has an invalid interface number: 41 but max is 0 [ 208.087651][ T5821] usb 9-1: config 0 has no interface number 0 [ 208.089564][ T5821] usb 9-1: config 0 interface 41 has no altsetting 0 [ 208.095761][ T5821] usb 9-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 208.098732][ T5821] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.101425][ T5821] usb 9-1: Product: syz [ 208.102963][ T5821] usb 9-1: Manufacturer: syz [ 208.104446][ T5821] usb 9-1: SerialNumber: syz [ 208.109573][ T5821] usb 9-1: config 0 descriptor?? [ 208.940913][T12283] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 208.988118][ T5821] CoreChips 9-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 209.333084][T12297] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2209'. [ 209.335829][T12297] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2209'. [ 210.559140][ T5821] CoreChips 9-1:0.41 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0000:ffffffb9 [ 210.563648][ T5821] CoreChips 9-1:0.41: probe with driver CoreChips failed with error -71 [ 210.568727][ T5821] usb 9-1: USB disconnect, device number 24 [ 210.595630][T12305] comedi comedi1: reset error (fatal) [ 210.707073][T12327] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2220'. [ 210.791482][ T5524] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 210.965919][ T5524] usb 8-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 210.969800][ T5524] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.978639][ T5524] usb 8-1: config 0 descriptor?? [ 210.987674][ T5524] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 211.484338][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 211.654217][ T5524] cpia1 8-1:0.0: unexpected state after lo power cmd: 00 [ 211.950465][ T42] audit: type=1400 audit(1782830928.122:913): avc: denied { unmount } for pid=5744 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 212.177925][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 212.357692][ T5524] gspca_cpia1: usb_control_msg 02, error -71 [ 212.359835][ T5524] cpia1 8-1:0.0: only firmware version 1 is supported (got: 0) [ 212.368428][ T5524] usb 8-1: USB disconnect, device number 11 [ 212.483821][ T64] Bluetooth: hci4: unexpected event for opcode 0x640c [ 212.988164][T12404] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2251'. [ 213.692973][ T35] block nbd0: Possible stuck request ffff8880297b2140: control (read@0,4096B). Runtime 114 seconds [ 213.944033][ T42] audit: type=1400 audit(1782830930.106:914): avc: denied { mounton } for pid=12424 comm="syz.1.2261" path="/550/bus" dev="tmpfs" ino=2847 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 214.110899][T12381] comedi comedi1: reset error (fatal) [ 214.193674][T12431] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2264'. [ 214.200871][T12431] erspan0: entered promiscuous mode [ 214.206277][T12431] macvtap1: entered promiscuous mode [ 214.208091][T12431] macvtap1: entered allmulticast mode [ 214.209814][T12431] erspan0: entered allmulticast mode [ 214.214902][T12431] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2264'. [ 214.218658][T12431] erspan0: left allmulticast mode [ 214.220484][T12431] erspan0: left promiscuous mode [ 214.222906][T12431] macvtap1: left promiscuous mode [ 214.224577][T12431] macvtap1: left allmulticast mode [ 214.294313][T12438] bridge0: port 3(ip6gretap0) entered blocking state [ 214.296518][T12438] bridge0: port 3(ip6gretap0) entered disabled state [ 214.298819][T12438] ip6gretap0: entered allmulticast mode [ 214.302818][T12438] ip6gretap0: entered promiscuous mode [ 214.305274][T12438] bridge0: port 3(ip6gretap0) entered blocking state [ 214.307476][T12438] bridge0: port 3(ip6gretap0) entered forwarding state [ 214.669999][T12449] Bluetooth: hci0: invalid len left 7, exp >= 104 [ 214.751669][ T42] audit: type=1400 audit(1782830930.853:915): avc: denied { ioctl } for pid=12459 comm="syz.3.2277" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x587b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 214.824000][T12465] libceph: resolve '.Fº' (ret=-3): failed [ 214.850206][ T42] audit: type=1400 audit(1782830930.946:916): avc: denied { unmount } for pid=5744 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 215.179896][ T42] audit: type=1400 audit(1782830931.241:917): avc: denied { ioctl } for pid=12492 comm="syz.4.2291" path="socket:[47126]" dev="sockfs" ino=47126 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 215.494331][ T5821] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 215.507706][ T42] audit: type=1400 audit(1782830931.555:918): avc: denied { map } for pid=12492 comm="syz.4.2291" path="/dev/uinput" dev="devtmpfs" ino=944 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 215.509944][T12493] ubi7: attaching mtd1 [ 215.518584][T12493] ubi7 error: ubi_attach_mtd_dev: bad VID header (4) or data offsets (68) [ 215.526208][T12493] input: syz0 as /devices/virtual/input/input28 [ 215.983033][T12503] raw_sendmsg: syz.1.2293 forgot to set AF_INET. Fix it! [ 216.057452][T12511] FAULT_INJECTION: forcing a failure. [ 216.057452][T12511] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 216.062522][T12511] CPU: 0 UID: 0 PID: 12511 Comm: syz.2.2297 Tainted: G L syzkaller #0 PREEMPT(full) [ 216.062539][T12511] Tainted: [L]=SOFTLOCKUP [ 216.062543][T12511] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 216.062560][T12511] Call Trace: [ 216.062564][T12511] [ 216.062569][T12511] dump_stack_lvl+0x100/0x190 [ 216.062627][T12511] should_fail_ex.cold+0x5/0xa [ 216.062659][T12511] _copy_from_iter+0x1f4/0x1690 [ 216.062689][T12511] ? __lock_acquire+0x49f/0x1a40 [ 216.062715][T12511] ? __pfx__copy_from_iter+0x10/0x10 [ 216.062728][T12511] ? __lock_acquire+0x49f/0x1a40 [ 216.062747][T12511] copy_page_from_iter+0x238/0x300 [ 216.062763][T12511] tun_build_skb.constprop.0+0x2ea/0x18f0 [ 216.062796][T12511] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 216.062812][T12511] ? unwind_get_return_address+0x59/0xa0 [ 216.062824][T12511] ? arch_stack_walk+0xa6/0xf0 [ 216.062842][T12511] ? _kstrtoull+0x13c/0x1f0 [ 216.062859][T12511] ? __pfx__kstrtoull+0x10/0x10 [ 216.062877][T12511] tun_get_user+0x16d6/0x3c20 [ 216.062899][T12511] ? __pfx_tun_get_user+0x10/0x10 [ 216.062916][T12511] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 216.062935][T12511] ? find_held_lock+0x2b/0x80 [ 216.062945][T12511] ? tun_get+0x191/0x370 [ 216.062959][T12511] ? tun_get+0x191/0x370 [ 216.062977][T12511] tun_chr_write_iter+0xdc/0x200 [ 216.062994][T12511] vfs_write+0x6ac/0x1050 [ 216.063024][T12511] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 216.063041][T12511] ? __pfx_vfs_write+0x10/0x10 [ 216.063056][T12511] ? find_held_lock+0x2b/0x80 [ 216.063074][T12511] ksys_write+0x12a/0x250 [ 216.063084][T12511] ? __pfx_ksys_write+0x10/0x10 [ 216.063104][T12511] do_syscall_64+0x115/0x870 [ 216.063166][T12511] ? clear_bhb_loop+0x40/0x90 [ 216.063179][T12511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.063190][T12511] RIP: 0033:0x7fb4ea35d68e [ 216.063210][T12511] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 216.063221][T12511] RSP: 002b:00007fb4eb26afb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 216.063233][T12511] RAX: ffffffffffffffda RBX: 00007fb4eb26b6c0 RCX: 00007fb4ea35d68e [ 216.063240][T12511] RDX: 0000000000000042 RSI: 0000200000000080 RDI: 00000000000000c8 [ 216.063247][T12511] RBP: 00007fb4eb26b090 R08: 0000000000000000 R09: 0000000000000000 [ 216.063253][T12511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 216.063259][T12511] R13: 00007fb4ea616038 R14: 00007fb4ea615fa0 R15: 00007ffe2cf888f8 [ 216.063273][T12511] [ 216.223222][ T64] Bluetooth: hci5: Invalid handle: 0xffc9 > 0x0eff [ 216.345806][T12540] syzkaller1: entered promiscuous mode [ 216.347627][T12540] syzkaller1: entered allmulticast mode [ 216.532596][ T42] audit: type=1400 audit(1782830932.496:919): avc: denied { create } for pid=12552 comm="syz.4.2316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 216.577687][T12553] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12553 comm=syz.4.2316 [ 217.101808][T12566] FAULT_INJECTION: forcing a failure. [ 217.101808][T12566] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 217.106862][T12566] CPU: 2 UID: 0 PID: 12566 Comm: syz.3.2321 Tainted: G L syzkaller #0 PREEMPT(full) [ 217.106885][T12566] Tainted: [L]=SOFTLOCKUP [ 217.106890][T12566] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 217.106912][T12566] Call Trace: [ 217.106937][T12566] [ 217.106944][T12566] dump_stack_lvl+0x100/0x190 [ 217.106979][T12566] should_fail_ex.cold+0x5/0xa [ 217.107015][T12566] _copy_from_user+0x2e/0xd0 [ 217.107040][T12566] copy_msghdr_from_user+0x9f/0x4c0 [ 217.107091][T12566] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 217.107119][T12566] ___sys_sendmsg+0x106/0x1e0 [ 217.107139][T12566] ? __pfx____sys_sendmsg+0x10/0x10 [ 217.107156][T12566] ? __lock_acquire+0x49f/0x1a40 [ 217.107174][T12566] ? get_pid_task+0x106/0x250 [ 217.107210][T12566] __sys_sendmsg+0x160/0x210 [ 217.107230][T12566] ? __pfx___sys_sendmsg+0x10/0x10 [ 217.107258][T12566] do_syscall_64+0x115/0x870 [ 217.107296][T12566] ? clear_bhb_loop+0x40/0x90 [ 217.107316][T12566] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.107330][T12566] RIP: 0033:0x7fc1a4b9ce59 [ 217.107355][T12566] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.107368][T12566] RSP: 002b:00007fc1a5975028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 217.107388][T12566] RAX: ffffffffffffffda RBX: 00007fc1a4e15fa0 RCX: 00007fc1a4b9ce59 [ 217.107398][T12566] RDX: 0000000000040000 RSI: 0000200000000240 RDI: 0000000000000003 [ 217.107406][T12566] RBP: 00007fc1a5975090 R08: 0000000000000000 R09: 0000000000000000 [ 217.107415][T12566] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 217.107423][T12566] R13: 00007fc1a4e16038 R14: 00007fc1a4e15fa0 R15: 00007ffeff86d508 [ 217.107441][T12566] [ 217.176320][ T42] audit: type=1400 audit(1782830933.086:920): avc: denied { ioctl } for pid=12567 comm="syz.2.2322" path="socket:[44922]" dev="sockfs" ino=44922 ioctlcmd=0x7201 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 217.349638][ T64] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:201' [ 217.352541][ T64] CPU: 3 UID: 0 PID: 64 Comm: kworker/u34:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 217.352561][ T64] Tainted: [L]=SOFTLOCKUP [ 217.352566][ T64] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 217.352601][ T64] Workqueue: hci5 hci_rx_work [ 217.352657][ T64] Call Trace: [ 217.352663][ T64] [ 217.352668][ T64] dump_stack_lvl+0x100/0x190 [ 217.352707][ T64] sysfs_warn_dup.cold+0x1c/0x28 [ 217.352744][ T64] sysfs_create_dir_ns+0x24b/0x2b0 [ 217.352766][ T64] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 217.352799][ T64] ? find_held_lock+0x2b/0x80 [ 217.352812][ T64] ? kobject_add_internal+0x25f/0x930 [ 217.352853][ T64] ? kobject_add_internal+0x25f/0x930 [ 217.352868][ T64] ? do_raw_spin_unlock+0x145/0x1e0 [ 217.352902][ T64] kobject_add_internal+0x2c8/0x930 [ 217.352919][ T64] kobject_add+0x16a/0x1e0 [ 217.352946][ T64] ? __pfx_kobject_add+0x10/0x10 [ 217.352960][ T64] ? class_to_subsys+0x10f/0x150 [ 217.352992][ T64] ? kobject_put+0xb9/0x640 [ 217.353005][ T64] ? _raw_spin_unlock+0x28/0x50 [ 217.353037][ T64] device_add+0x294/0x1970 [ 217.353068][ T64] ? __pfx_dev_set_name+0x10/0x10 [ 217.353088][ T64] ? __pfx_device_add+0x10/0x10 [ 217.353119][ T64] ? mgmt_send_event_skb+0x2fb/0x460 [ 217.353155][ T64] hci_conn_add_sysfs+0x1a3/0x260 [ 217.353168][ T64] le_conn_complete_evt+0x11eb/0x1f60 [ 217.353203][ T64] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 217.353220][ T64] ? hci_event_packet+0x186/0xcd0 [ 217.353256][ T64] hci_le_conn_complete_evt+0x23c/0x3a0 [ 217.353288][ T64] ? skb_pull_data+0x15f/0x1e0 [ 217.353308][ T64] hci_le_meta_evt+0x34a/0x5f0 [ 217.353340][ T64] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 217.353374][ T64] hci_event_packet+0x51c/0xcd0 [ 217.353393][ T64] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 217.353422][ T64] ? __pfx_hci_event_packet+0x10/0x10 [ 217.353453][ T64] ? kcov_remote_start+0x384/0x670 [ 217.353469][ T64] ? lockdep_hardirqs_on+0x78/0x100 [ 217.353503][ T64] hci_rx_work+0x451/0xfc0 [ 217.353524][ T64] process_one_work+0xa23/0x1940 [ 217.353583][ T64] ? __pfx_process_one_work+0x10/0x10 [ 217.353604][ T64] ? __pfx_hci_rx_work+0x10/0x10 [ 217.353638][ T64] worker_thread+0x5ef/0xe50 [ 217.353669][ T64] ? kthread+0x13a/0x450 [ 217.353686][ T64] ? __pfx_worker_thread+0x10/0x10 [ 217.353703][ T64] kthread+0x370/0x450 [ 217.353727][ T64] ? __pfx_kthread+0x10/0x10 [ 217.353742][ T64] ret_from_fork+0x72b/0xd50 [ 217.353774][ T64] ? __pfx_ret_from_fork+0x10/0x10 [ 217.353793][ T64] ? __switch_to+0x800/0x10f0 [ 217.353816][ T64] ? __pfx_kthread+0x10/0x10 [ 217.353829][ T64] ret_from_fork_asm+0x1a/0x30 [ 217.353863][ T64] [ 217.353878][ T64] kobject: kobject_add_internal failed for hci5:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 217.441666][ T64] Bluetooth: hci5: failed to register connection device [ 217.490717][ T64] Bluetooth: hci2: unexpected event for opcode 0x200c [ 217.527178][T12616] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2341'. [ 217.554866][T12620] FAULT_INJECTION: forcing a failure. [ 217.554866][T12620] name failslab, interval 1, probability 0, space 0, times 1 [ 217.558723][T12620] CPU: 2 UID: 0 PID: 12620 Comm: syz.2.2343 Tainted: G L syzkaller #0 PREEMPT(full) [ 217.558740][T12620] Tainted: [L]=SOFTLOCKUP [ 217.558744][T12620] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 217.558751][T12620] Call Trace: [ 217.558756][T12620] [ 217.558760][T12620] dump_stack_lvl+0x100/0x190 [ 217.558780][T12620] should_fail_ex.cold+0x5/0xa [ 217.558796][T12620] should_failslab+0xc2/0x120 [ 217.558812][T12620] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 217.558845][T12620] ? __alloc_skb+0x5b7/0x710 [ 217.558856][T12620] ? __alloc_skb+0x140/0x710 [ 217.558867][T12620] __alloc_skb+0x140/0x710 [ 217.558877][T12620] ? __alloc_skb+0x5b7/0x710 [ 217.558886][T12620] ? __pfx___alloc_skb+0x10/0x10 [ 217.558900][T12620] netlink_alloc_large_skb+0x69/0x150 [ 217.558946][T12620] netlink_sendmsg+0x680/0xda0 [ 217.558963][T12620] ? __pfx_netlink_sendmsg+0x10/0x10 [ 217.558978][T12620] ? __might_fault+0x60/0x140 [ 217.558994][T12620] ____sys_sendmsg+0xa4d/0xbe0 [ 217.559008][T12620] ? __pfx_netlink_sendmsg+0x10/0x10 [ 217.559024][T12620] ? __pfx_____sys_sendmsg+0x10/0x10 [ 217.559044][T12620] ___sys_sendmsg+0x190/0x1e0 [ 217.559059][T12620] ? __pfx____sys_sendmsg+0x10/0x10 [ 217.559073][T12620] ? __lock_acquire+0x49f/0x1a40 [ 217.559087][T12620] ? get_pid_task+0x106/0x250 [ 217.559111][T12620] __sys_sendmsg+0x160/0x210 [ 217.559122][T12620] ? __pfx___sys_sendmsg+0x10/0x10 [ 217.559140][T12620] do_syscall_64+0x115/0x870 [ 217.559156][T12620] ? clear_bhb_loop+0x40/0x90 [ 217.559169][T12620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.559180][T12620] RIP: 0033:0x7fb4ea39ce59 [ 217.559190][T12620] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.559200][T12620] RSP: 002b:00007fb4eb26b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 217.559212][T12620] RAX: ffffffffffffffda RBX: 00007fb4ea615fa0 RCX: 00007fb4ea39ce59 [ 217.559219][T12620] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 217.559225][T12620] RBP: 00007fb4eb26b090 R08: 0000000000000000 R09: 0000000000000000 [ 217.559235][T12620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 217.559241][T12620] R13: 00007fb4ea616038 R14: 00007fb4ea615fa0 R15: 00007ffe2cf888f8 [ 217.559254][T12620] [ 217.568607][T12622] FAULT_INJECTION: forcing a failure. [ 217.568607][T12622] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 217.648587][T12622] CPU: 1 UID: 0 PID: 12622 Comm: syz.1.2344 Tainted: G L syzkaller #0 PREEMPT(full) [ 217.648606][T12622] Tainted: [L]=SOFTLOCKUP [ 217.648610][T12622] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 217.648617][T12622] Call Trace: [ 217.648621][T12622] [ 217.648626][T12622] dump_stack_lvl+0x100/0x190 [ 217.648651][T12622] should_fail_ex.cold+0x5/0xa [ 217.648668][T12622] _copy_from_iter+0x1f4/0x1690 [ 217.648685][T12622] ? __asan_memset+0x23/0x50 [ 217.648696][T12622] ? __pfx__copy_from_iter+0x10/0x10 [ 217.648710][T12622] ? __pfx___alloc_skb+0x10/0x10 [ 217.648727][T12622] netlink_sendmsg+0x808/0xda0 [ 217.648747][T12622] ? __pfx_netlink_sendmsg+0x10/0x10 [ 217.648761][T12622] ? __might_fault+0x60/0x140 [ 217.648777][T12622] ____sys_sendmsg+0xa4d/0xbe0 [ 217.648791][T12622] ? __pfx_netlink_sendmsg+0x10/0x10 [ 217.648807][T12622] ? __pfx_____sys_sendmsg+0x10/0x10 [ 217.648827][T12622] ___sys_sendmsg+0x190/0x1e0 [ 217.648843][T12622] ? __pfx____sys_sendmsg+0x10/0x10 [ 217.648856][T12622] ? __lock_acquire+0x49f/0x1a40 [ 217.648870][T12622] ? get_pid_task+0x106/0x250 [ 217.648894][T12622] __sys_sendmsg+0x160/0x210 [ 217.648906][T12622] ? __pfx___sys_sendmsg+0x10/0x10 [ 217.648924][T12622] do_syscall_64+0x115/0x870 [ 217.648940][T12622] ? clear_bhb_loop+0x40/0x90 [ 217.648953][T12622] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.648964][T12622] RIP: 0033:0x7f7f7bb9ce59 [ 217.648974][T12622] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.648985][T12622] RSP: 002b:00007f7f7c99c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 217.648996][T12622] RAX: ffffffffffffffda RBX: 00007f7f7be15fa0 RCX: 00007f7f7bb9ce59 [ 217.649003][T12622] RDX: 0000000000044014 RSI: 0000200000000100 RDI: 0000000000000003 [ 217.649009][T12622] RBP: 00007f7f7c99c090 R08: 0000000000000000 R09: 0000000000000000 [ 217.649015][T12622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 217.649021][T12622] R13: 00007f7f7be16038 R14: 00007f7f7be15fa0 R15: 00007ffda54da348 [ 217.649034][T12622] [ 217.845867][ T42] audit: type=1400 audit(1782830933.705:921): avc: denied { watch_with_perm } for pid=12646 comm="syz.1.2354" path="/577/bus" dev="tmpfs" ino=2983 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 217.863018][T12647] nvme_fabrics: unknown parameter or missing value '' in ctrl creation request [ 218.265977][T12699] FAULT_INJECTION: forcing a failure. [ 218.265977][T12699] name failslab, interval 1, probability 0, space 0, times 0 [ 218.272301][T12699] CPU: 0 UID: 0 PID: 12699 Comm: syz.1.2372 Tainted: G L syzkaller #0 PREEMPT(full) [ 218.272320][T12699] Tainted: [L]=SOFTLOCKUP [ 218.272324][T12699] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 218.272343][T12699] Call Trace: [ 218.272353][T12699] [ 218.272358][T12699] dump_stack_lvl+0x100/0x190 [ 218.272387][T12699] should_fail_ex.cold+0x5/0xa [ 218.272417][T12699] should_failslab+0xc2/0x120 [ 218.272432][T12699] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 218.272447][T12699] ? __alloc_skb+0x5b7/0x710 [ 218.272473][T12699] ? __alloc_skb+0x140/0x710 [ 218.272485][T12699] __alloc_skb+0x140/0x710 [ 218.272494][T12699] ? __alloc_skb+0x5b7/0x710 [ 218.272503][T12699] ? __pfx___alloc_skb+0x10/0x10 [ 218.272517][T12699] netlink_alloc_large_skb+0x69/0x150 [ 218.272547][T12699] netlink_sendmsg+0x680/0xda0 [ 218.272564][T12699] ? __pfx_netlink_sendmsg+0x10/0x10 [ 218.272579][T12699] ? __might_fault+0x60/0x140 [ 218.272595][T12699] ____sys_sendmsg+0xa4d/0xbe0 [ 218.272609][T12699] ? __pfx_netlink_sendmsg+0x10/0x10 [ 218.272625][T12699] ? __pfx_____sys_sendmsg+0x10/0x10 [ 218.272645][T12699] ___sys_sendmsg+0x190/0x1e0 [ 218.272661][T12699] ? __pfx____sys_sendmsg+0x10/0x10 [ 218.272675][T12699] ? __lock_acquire+0x49f/0x1a40 [ 218.272689][T12699] ? get_pid_task+0x106/0x250 [ 218.272713][T12699] __sys_sendmsg+0x160/0x210 [ 218.272725][T12699] ? __pfx___sys_sendmsg+0x10/0x10 [ 218.272743][T12699] do_syscall_64+0x115/0x870 [ 218.272778][T12699] ? clear_bhb_loop+0x40/0x90 [ 218.272791][T12699] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.272802][T12699] RIP: 0033:0x7f7f7bb9ce59 [ 218.272825][T12699] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 218.272835][T12699] RSP: 002b:00007f7f7c99c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 218.272850][T12699] RAX: ffffffffffffffda RBX: 00007f7f7be15fa0 RCX: 00007f7f7bb9ce59 [ 218.272857][T12699] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 218.272863][T12699] RBP: 00007f7f7c99c090 R08: 0000000000000000 R09: 0000000000000000 [ 218.272869][T12699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 218.272875][T12699] R13: 00007f7f7be16038 R14: 00007f7f7be15fa0 R15: 00007ffda54da348 [ 218.272888][T12699] [ 218.400712][T12714] FAULT_INJECTION: forcing a failure. [ 218.400712][T12714] name failslab, interval 1, probability 0, space 0, times 0 [ 218.406935][T12714] CPU: 1 UID: 0 PID: 12714 Comm: syz.3.2380 Tainted: G L syzkaller #0 PREEMPT(full) [ 218.406953][T12714] Tainted: [L]=SOFTLOCKUP [ 218.406957][T12714] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 218.406964][T12714] Call Trace: [ 218.406968][T12714] [ 218.406973][T12714] dump_stack_lvl+0x100/0x190 [ 218.406993][T12714] should_fail_ex.cold+0x5/0xa [ 218.407008][T12714] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 218.407036][T12714] should_failslab+0xc2/0x120 [ 218.407052][T12714] kmem_cache_alloc_noprof+0x91/0x6a0 [ 218.407066][T12714] ? skb_clone+0x190/0x400 [ 218.407081][T12714] skb_clone+0x190/0x400 [ 218.407092][T12714] netlink_deliver_tap+0xaed/0xcc0 [ 218.407111][T12714] netlink_unicast+0x62b/0x850 [ 218.407130][T12714] ? __pfx_netlink_unicast+0x10/0x10 [ 218.407150][T12714] netlink_sendmsg+0x8b0/0xda0 [ 218.407171][T12714] ? __pfx_netlink_sendmsg+0x10/0x10 [ 218.407203][T12714] ? __might_fault+0x60/0x140 [ 218.407221][T12714] ____sys_sendmsg+0xa4d/0xbe0 [ 218.407320][T12714] ? __pfx_netlink_sendmsg+0x10/0x10 [ 218.407338][T12714] ? __pfx_____sys_sendmsg+0x10/0x10 [ 218.407360][T12714] ___sys_sendmsg+0x190/0x1e0 [ 218.407376][T12714] ? __pfx____sys_sendmsg+0x10/0x10 [ 218.407391][T12714] ? __lock_acquire+0x49f/0x1a40 [ 218.407406][T12714] ? get_pid_task+0x106/0x250 [ 218.407432][T12714] __sys_sendmsg+0x160/0x210 [ 218.407445][T12714] ? __pfx___sys_sendmsg+0x10/0x10 [ 218.407464][T12714] do_syscall_64+0x115/0x870 [ 218.407481][T12714] ? clear_bhb_loop+0x40/0x90 [ 218.407495][T12714] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.407507][T12714] RIP: 0033:0x7fc1a4b9ce59 [ 218.407516][T12714] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 218.407526][T12714] RSP: 002b:00007fc1a5975028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 218.407538][T12714] RAX: ffffffffffffffda RBX: 00007fc1a4e15fa0 RCX: 00007fc1a4b9ce59 [ 218.407545][T12714] RDX: 0000000000044014 RSI: 0000200000000100 RDI: 0000000000000003 [ 218.407551][T12714] RBP: 00007fc1a5975090 R08: 0000000000000000 R09: 0000000000000000 [ 218.407557][T12714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 218.407563][T12714] R13: 00007fc1a4e16038 R14: 00007fc1a4e15fa0 R15: 00007ffeff86d508 [ 218.407576][T12714] [ 218.462874][T12719] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2383'. [ 218.492530][T12719] netlink: 5 bytes leftover after parsing attributes in process `syz.4.2383'. [ 218.496633][T12725] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 218.511461][ T42] audit: type=1400 audit(1782830934.323:922): avc: denied { read } for pid=12723 comm="syz.1.2385" name="file0" dev="9p" ino=80740371 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 218.541251][T12727] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2388'. [ 218.547604][T12719] syzkaller0: entered promiscuous mode [ 218.549370][T12719] syzkaller0: entered allmulticast mode [ 218.720081][T12735] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2391'. [ 218.723543][T12735] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2391'. [ 218.753100][T12737] FAULT_INJECTION: forcing a failure. [ 218.753100][T12737] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 218.758046][T12737] CPU: 2 UID: 0 PID: 12737 Comm: syz.4.2392 Tainted: G L syzkaller #0 PREEMPT(full) [ 218.758063][T12737] Tainted: [L]=SOFTLOCKUP [ 218.758066][T12737] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 218.758073][T12737] Call Trace: [ 218.758077][T12737] [ 218.758082][T12737] dump_stack_lvl+0x100/0x190 [ 218.758102][T12737] should_fail_ex.cold+0x5/0xa [ 218.758119][T12737] _copy_to_user+0x32/0xd0 [ 218.758134][T12737] simple_read_from_buffer+0xcb/0x170 [ 218.758165][T12737] proc_fail_nth_read+0x1af/0x230 [ 218.758182][T12737] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 218.758199][T12737] ? rw_verify_area+0xce/0x6d0 [ 218.758216][T12737] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 218.758232][T12737] vfs_read+0x1e4/0xb40 [ 218.758250][T12737] ? __pfx_vfs_read+0x10/0x10 [ 218.758266][T12737] ? __fget_files+0x215/0x3d0 [ 218.758280][T12737] ? __fget_files+0x21f/0x3d0 [ 218.758294][T12737] ksys_read+0x12a/0x250 [ 218.758310][T12737] ? __pfx_ksys_read+0x10/0x10 [ 218.758330][T12737] do_syscall_64+0x115/0x870 [ 218.758346][T12737] ? clear_bhb_loop+0x40/0x90 [ 218.758359][T12737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.758370][T12737] RIP: 0033:0x7f3b53d5d68e [ 218.758380][T12737] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 218.758391][T12737] RSP: 002b:00007f3b54d26fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 218.758403][T12737] RAX: ffffffffffffffda RBX: 00007f3b54d276c0 RCX: 00007f3b53d5d68e [ 218.758410][T12737] RDX: 000000000000000f RSI: 00007f3b54d270a0 RDI: 0000000000000003 [ 218.758416][T12737] RBP: 00007f3b54d27090 R08: 0000000000000000 R09: 0000000000000000 [ 218.758422][T12737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 218.758428][T12737] R13: 00007f3b54016038 R14: 00007f3b54015fa0 R15: 00007ffce0ab3b78 [ 218.758441][T12737] [ 218.986726][ T42] audit: type=1326 audit(1782830934.756:923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12755 comm="syz.2.2400" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4ea39ce59 code=0x50000 [ 218.993829][ T42] audit: type=1326 audit(1782830934.756:924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12755 comm="syz.2.2400" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4ea39ce59 code=0x50000 [ 219.002152][ T42] audit: type=1326 audit(1782830934.756:925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12755 comm="syz.2.2400" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4ea39ce59 code=0x50000 [ 219.017457][ T42] audit: type=1326 audit(1782830934.756:926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12755 comm="syz.2.2400" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4ea39ce59 code=0x50000 [ 219.031966][ T42] audit: type=1326 audit(1782830934.756:927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12755 comm="syz.2.2400" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4ea39ce59 code=0x50000 [ 219.040430][ T42] audit: type=1326 audit(1782830934.756:928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12755 comm="syz.2.2400" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4ea39ce59 code=0x50000 [ 219.048652][ T42] audit: type=1326 audit(1782830934.756:929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12755 comm="syz.2.2400" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4ea39ce59 code=0x50000 [ 219.057188][ T42] audit: type=1326 audit(1782830934.756:930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12755 comm="syz.2.2400" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb4ea39ce59 code=0x50000 [ 219.666935][ T5750] Bluetooth: hci5: command 0x206a tx timeout [ 219.822061][ T5524] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 219.992074][ T5524] usb 9-1: Using ep0 maxpacket: 32 [ 219.995041][ T5524] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 219.999186][ T5524] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 220.004330][ T5524] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 220.008695][ T5524] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 220.012479][ T5524] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 220.018106][ T5524] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 220.024468][ T5524] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 220.029802][ T5524] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.044585][ T5524] usb 9-1: config 0 descriptor?? [ 220.186455][ T5750] Bluetooth: hci5: unexpected event for opcode 0x200c [ 220.277261][ T5524] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 26 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 220.286819][ T5524] usb 9-1: USB disconnect, device number 26 [ 220.293080][ T5524] usblp0: removed [ 220.345097][ T5750] Bluetooth: hci5: unexpected event for opcode 0x000c [ 220.434441][T12825] 9p: Bad value for 'rfdno' [ 220.529639][T12828] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 220.538533][T12828] bond2 (unregistering): Released all slaves [ 220.559425][T12832] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2431'. [ 220.563190][T12832] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2431'. [ 220.618142][ T35] block nbd0: Possible stuck request ffff8880297b2140: control (read@0,4096B). Runtime 120 seconds [ 220.696691][ T5750] Bluetooth: hci2: command 0x0c1a tx timeout [ 220.765623][ T64] Bluetooth: hci5: unexpected event for opcode 0x000c [ 221.498513][ T5750] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 221.502670][ T5750] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 221.505674][ T5750] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 221.508610][ T5750] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 221.512818][ T5750] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 221.661016][ T5736] Bluetooth: hci4: command 0x0406 tx timeout [ 221.850361][T12874] fuse: Bad value for 'user_id' [ 221.851977][T12874] fuse: Bad value for 'user_id' [ 221.904285][T12874] fuse: Bad value for 'fd' [ 221.906703][T12859] bridge0: port 1(bridge_slave_0) entered blocking state [ 221.908482][ T5736] Bluetooth: hci5: unexpected cc 0x204b length: 9 > 3 [ 221.909107][T12859] bridge0: port 1(bridge_slave_0) entered disabled state [ 221.913821][T12859] bridge_slave_0: entered allmulticast mode [ 221.915241][ T5736] Bluetooth: hci5: unexpected event for opcode 0x204b [ 221.916564][T12859] bridge_slave_0: entered promiscuous mode [ 221.921467][T12859] bridge0: port 2(bridge_slave_1) entered blocking state [ 221.923900][T12859] bridge0: port 2(bridge_slave_1) entered disabled state [ 221.928053][T12859] bridge_slave_1: entered allmulticast mode [ 221.930797][T12859] bridge_slave_1: entered promiscuous mode [ 221.955485][T12859] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 221.962943][T12859] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 221.978313][T12859] team0: Port device team_slave_0 added [ 221.981402][T12859] team0: Port device team_slave_1 added [ 221.996870][T12859] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 222.001358][T12859] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 222.009243][T12859] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 222.013751][T12859] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 222.015936][T12859] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 222.024015][T12859] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 222.051044][T12859] hsr_slave_0: entered promiscuous mode [ 222.053562][T12859] hsr_slave_1: entered promiscuous mode [ 222.057179][T12859] debugfs: 'hsr0' already exists in 'hsr' [ 222.059030][T12859] Cannot create hsr debugfs directory [ 222.134427][ T5095] Bluetooth: hci4: unexpected event for opcode 0x000c [ 222.156609][T12889] input: syz0 as /devices/virtual/input/input29 [ 222.211142][ T5813] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 222.214897][ T5813] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.286054][T12897] qnx6: unable to read the first superblock [ 222.288782][T12897] qnx6: unable to read the first superblock [ 222.293421][T12897] qnx6: unable to read the first superblock [ 222.306588][T12889] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 222.338525][ T5813] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 222.342653][ T5813] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.520467][ T5813] netdevsim netdevsim1 netdevsim1 (unregistering): left promiscuous mode [ 222.527839][ T5813] team0: Port device netdevsim1 removed [ 222.532095][ T5813] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 222.536033][ T5813] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.591354][T12917] CIFS: enabling forceuid mount option implicitly because uid= option is specified [ 222.598460][T12917] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 222.607338][T12917] CIFS mount error: No usable UNC path provided in device string! [ 222.607338][T12917] [ 222.612818][T12917] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 222.630758][ T5813] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 222.634113][ T5813] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.712387][ T41] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 222.815512][ T5813] bridge_slave_1: left allmulticast mode [ 222.817452][ T5813] bridge_slave_1: left promiscuous mode [ 222.819201][ T5813] bridge0: port 2(bridge_slave_1) entered disabled state [ 222.824309][ T5813] bridge_slave_0: left allmulticast mode [ 222.826207][ T5813] bridge_slave_0: left promiscuous mode [ 222.828231][ T5813] bridge0: port 1(bridge_slave_0) entered disabled state [ 222.886181][ T41] usb 8-1: config 0 has an invalid interface number: 120 but max is 0 [ 222.894784][ T41] usb 8-1: config 0 has no interface number 0 [ 222.897416][ T41] usb 8-1: config 0 interface 120 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 222.903428][ T41] usb 8-1: config 0 interface 120 altsetting 0 endpoint 0x8F has an invalid bInterval 102, changing to 10 [ 222.907222][ T41] usb 8-1: config 0 interface 120 altsetting 0 endpoint 0x8F has invalid maxpacket 24624, setting to 1024 [ 222.911309][ T41] usb 8-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 222.914257][ T41] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.920240][ T41] usb 8-1: config 0 descriptor?? [ 222.930658][ T41] input: USB Touchscreen 16e3:f9e9 as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.120/input/input30 [ 222.949176][ C0] usbtouchscreen 8-1:0.120: usbtouch_irq - usb_submit_urb failed with result: -1 [ 222.989905][T12926] NILFS (nullb0): couldn't find nilfs on the device [ 222.993775][ T5095] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 223.025333][ T5813] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 223.030008][ T5813] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 223.034007][ T5813] bond0 (unregistering): Released all slaves [ 223.042615][ T5813] bond1 (unregistering): Released all slaves [ 223.231394][ T5447] 8021q: adding VLAN 0 to HW filter on device eth2 [ 223.234702][ T7023] usb 8-1: USB disconnect, device number 12 [ 223.340140][ T42] kauditd_printk_skb: 31629 callbacks suppressed [ 223.340171][ T42] audit: type=1400 audit(1782830938.770:32560): avc: denied { write } for pid=12946 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 223.379775][ T42] audit: type=1400 audit(1782830938.816:32561): avc: denied { write } for pid=12950 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 223.430265][ T42] audit: type=1400 audit(1782830938.862:32562): avc: denied { write } for pid=12939 comm="syz.4.2458" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 223.456803][ T42] audit: type=1400 audit(1782830938.881:32563): avc: denied { write } for pid=12952 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 223.504999][ T42] audit: type=1400 audit(1782830938.936:32564): avc: denied { write } for pid=12955 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 223.556835][T12859] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 223.563573][T12859] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 223.566512][T12859] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 223.575288][T12859] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 223.578315][T12859] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 223.584256][T12859] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 223.587235][T12859] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 223.592226][T12859] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 223.608862][ T42] audit: type=1400 audit(1782830939.019:32565): avc: denied { write } for pid=12958 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 223.636457][ T5813] hsr_slave_0: left promiscuous mode [ 223.638974][ T5813] hsr_slave_1: left promiscuous mode [ 223.643003][ T5813] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 223.647423][ T5813] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 223.650524][ T5813] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 223.653062][ T5813] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 223.660851][ T42] audit: type=1400 audit(1782830939.075:32566): avc: denied { write } for pid=12967 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 223.670012][ T5813] veth1_macvtap: left promiscuous mode [ 223.672050][ T5813] veth0_macvtap: left promiscuous mode [ 223.676671][ T5813] veth1_vlan: left promiscuous mode [ 223.679898][ T5813] veth0_vlan: left promiscuous mode [ 223.732303][ T5095] Bluetooth: hci1: command tx timeout [ 223.804677][ T5095] Bluetooth: hci5: unexpected event for opcode 0x200c [ 223.806865][T12922] comedi comedi1: reset error (fatal) [ 223.823094][ T5813] team_slave_1 (unregistering): left promiscuous mode [ 223.828223][ T5813] team0 (unregistering): Port device team_slave_1 removed [ 223.838996][ T5813] team_slave_0 (unregistering): left promiscuous mode [ 223.842318][ T5813] team0 (unregistering): Port device team_slave_0 removed [ 223.946061][T12859] 8021q: adding VLAN 0 to HW filter on device bond0 [ 223.964518][T12859] 8021q: adding VLAN 0 to HW filter on device team0 [ 223.969099][T12985] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2466'. [ 223.971142][ T6662] bridge0: port 1(bridge_slave_0) entered blocking state [ 223.974434][ T6662] bridge0: port 1(bridge_slave_0) entered forwarding state [ 223.982139][ T6662] bridge0: port 2(bridge_slave_1) entered blocking state [ 223.984418][ T6662] bridge0: port 2(bridge_slave_1) entered forwarding state [ 224.206511][T12859] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 224.236767][T12859] veth0_vlan: entered promiscuous mode [ 224.243073][T12859] veth1_vlan: entered promiscuous mode [ 224.250866][T13009] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2472'. [ 224.269051][T12859] veth0_macvtap: entered promiscuous mode [ 224.275941][T12859] veth1_macvtap: entered promiscuous mode [ 224.298705][T12859] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 224.304494][T12859] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 224.311922][ T5786] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 224.314795][ T5786] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 224.319319][ T5786] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 224.323230][ T5786] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 224.389282][ T6657] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 224.391874][ T6657] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 224.407338][ T5813] IPVS: stop unused estimator thread 0... [ 224.417631][ T6657] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 224.420168][ T6657] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 224.476757][T13021] cdrom: dropping to single frame dma [ 224.594111][ T5095] Bluetooth: hci1: unexpected cc 0x204b length: 9 > 3 [ 224.626910][ T5095] Bluetooth: hci5: SCO packet too small [ 224.627803][T13036] netdevsim netdevsim3: Firmware load for './file0/../file0/file0' refused, path contains '..' component [ 224.817564][ T42] audit: type=1326 audit(1782830940.145:32567): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13049 comm="syz.1.2487" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe88e59ce59 code=0x0 [ 225.211752][T13053] netlink: 'syz.2.2488': attribute type 9 has an invalid length. [ 225.261594][ T42] audit: type=1400 audit(1782830940.551:32568): avc: denied { connect } for pid=13057 comm="syz.2.2489" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 225.285775][T13058] netlink: 108 bytes leftover after parsing attributes in process `syz.2.2489'. [ 225.772720][ T5095] Bluetooth: hci2: Invalid handle: 0xffc9 > 0x0eff [ 225.821860][T13095] nftables ruleset with unbound chain [ 225.846667][T13097] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input31 [ 225.935501][T13106] FAULT_INJECTION: forcing a failure. [ 225.935501][T13106] name failslab, interval 1, probability 0, space 0, times 0 [ 225.939317][T13106] CPU: 0 UID: 0 PID: 13106 Comm: syz.2.2513 Tainted: G L syzkaller #0 PREEMPT(full) [ 225.939341][T13106] Tainted: [L]=SOFTLOCKUP [ 225.939346][T13106] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 225.939370][T13106] Call Trace: [ 225.939376][T13106] [ 225.939383][T13106] dump_stack_lvl+0x100/0x190 [ 225.939416][T13106] should_fail_ex.cold+0x5/0xa [ 225.939432][T13106] should_failslab+0xc2/0x120 [ 225.939447][T13106] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 225.939460][T13106] ? __alloc_skb+0x5b7/0x710 [ 225.939488][T13106] ? __alloc_skb+0x140/0x710 [ 225.939499][T13106] __alloc_skb+0x140/0x710 [ 225.939509][T13106] ? __alloc_skb+0x5b7/0x710 [ 225.939518][T13106] ? __pfx___alloc_skb+0x10/0x10 [ 225.939532][T13106] netlink_alloc_large_skb+0x69/0x150 [ 225.939562][T13106] netlink_sendmsg+0x680/0xda0 [ 225.939580][T13106] ? __pfx_netlink_sendmsg+0x10/0x10 [ 225.939600][T13106] sock_write_iter+0x53a/0x5b0 [ 225.939614][T13106] ? __pfx_netlink_sendmsg+0x10/0x10 [ 225.939630][T13106] ? __pfx_sock_write_iter+0x10/0x10 [ 225.939647][T13106] ? __pfx___file_has_perm+0x10/0x10 [ 225.939674][T13106] do_iter_readv_writev+0x6f7/0x930 [ 225.939691][T13106] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 225.939706][T13106] ? selinux_file_permission+0x8f/0x6d0 [ 225.939724][T13106] ? bpf_lsm_file_permission+0x9/0x10 [ 225.939741][T13106] ? security_file_permission+0x76/0x210 [ 225.939758][T13106] ? rw_verify_area+0xce/0x6d0 [ 225.939774][T13106] vfs_writev+0x360/0xdd0 [ 225.939793][T13106] ? __pfx_vfs_writev+0x10/0x10 [ 225.939809][T13106] ? rcu_read_lock_any_held+0x6a/0xa0 [ 225.939828][T13106] ? __fget_files+0x21f/0x3d0 [ 225.939843][T13106] ? do_writev+0x28a/0x340 [ 225.939858][T13106] do_writev+0x28a/0x340 [ 225.939873][T13106] ? __pfx_do_writev+0x10/0x10 [ 225.939892][T13106] do_syscall_64+0x115/0x870 [ 225.939918][T13106] ? clear_bhb_loop+0x40/0x90 [ 225.939931][T13106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.939942][T13106] RIP: 0033:0x7fb4ea39ce59 [ 225.939963][T13106] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 225.939974][T13106] RSP: 002b:00007fb4eb26b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 225.939986][T13106] RAX: ffffffffffffffda RBX: 00007fb4ea615fa0 RCX: 00007fb4ea39ce59 [ 225.939993][T13106] RDX: 0000000000000001 RSI: 0000200000001200 RDI: 0000000000000004 [ 225.939999][T13106] RBP: 00007fb4eb26b090 R08: 0000000000000000 R09: 0000000000000000 [ 225.940005][T13106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 225.940012][T13106] R13: 00007fb4ea616038 R14: 00007fb4ea615fa0 R15: 00007ffe2cf888f8 [ 225.940025][T13106] [ 226.145366][ T5095] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 226.149413][ T5095] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 226.152804][ T5095] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 226.155727][ T5095] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 226.160795][ T5095] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 226.463123][T13112] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.465439][T13112] bridge0: port 1(bridge_slave_0) entered disabled state [ 226.467710][T13112] bridge_slave_0: entered allmulticast mode [ 226.470372][T13112] bridge_slave_0: entered promiscuous mode [ 226.476776][T13112] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.479087][T13112] bridge0: port 2(bridge_slave_1) entered disabled state [ 226.481348][T13112] bridge_slave_1: entered allmulticast mode [ 226.484055][T13112] bridge_slave_1: entered promiscuous mode [ 226.498953][T13112] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 226.503337][T13112] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 226.519998][T13112] team0: Port device team_slave_0 added [ 226.523098][T13112] team0: Port device team_slave_1 added [ 226.536939][T13112] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 226.539233][T13112] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 226.547086][T13112] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 226.551328][T13112] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 226.553489][T13112] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 226.561345][T13112] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 226.584011][T13112] hsr_slave_0: entered promiscuous mode [ 226.586348][T13112] hsr_slave_1: entered promiscuous mode [ 226.588426][T13112] debugfs: 'hsr0' already exists in 'hsr' [ 226.590212][T13112] Cannot create hsr debugfs directory [ 226.664337][ T5095] Bluetooth: hci5: Invalid handle: 0xffc9 > 0x0eff [ 226.775097][T13141] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 226.802144][T13143] netlink: 11 bytes leftover after parsing attributes in process `syz.3.2521'. [ 226.805486][T13143] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2521'. [ 226.808371][T13143] netlink: 'syz.3.2521': attribute type 10 has an invalid length. [ 226.811528][T13143] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2521'. [ 226.817679][T13143] geneve2: entered promiscuous mode [ 226.819523][T13143] geneve2: entered allmulticast mode [ 226.834885][ T5736] Bluetooth: hci4: unexpected event for opcode 0x200c [ 226.857683][T13148] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2523'. [ 226.905051][T13150] sctp: [Deprecated]: syz.1.2524 (pid 13150) Use of struct sctp_assoc_value in delayed_ack socket option. [ 226.905051][T13150] Use struct sctp_sack_info instead [ 226.935171][ T6662] Bluetooth: hci2: Frame reassembly failed (-84) [ 226.956198][ T5095] Bluetooth: hci1: Invalid handle: 0xffc9 > 0x0eff [ 226.985949][ T42] audit: type=1400 audit(1782830942.138:32569): avc: denied { setopt } for pid=13155 comm="syz.1.2527" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 227.025883][ T5095] Bluetooth: hci1: command tx timeout [ 227.029368][T13161] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2529'. [ 227.032720][T13161] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2529'. [ 227.042162][T13161] futex_wake_op: syz.4.2529 tries to shift op by -1; fix this program [ 227.082042][T13164] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2530'. [ 227.117275][T13167] tipc: Enabling of bearer rejected, failed to enable media [ 227.120667][T13167] netlink: 'syz.4.2531': attribute type 13 has an invalid length. [ 227.141280][T13167] netlink: 'syz.4.2531': attribute type 13 has an invalid length. [ 227.144340][ T5786] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 227.148588][ T5786] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 227.155041][ T5786] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 227.157864][ T5786] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 227.186819][T13112] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 227.192452][T13112] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 227.195776][T13112] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 227.201856][T13112] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 227.205352][T13112] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 227.210716][T13112] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 227.213186][T13112] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 227.218047][T13112] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 227.241002][T13112] bridge0: port 2(bridge_slave_1) entered blocking state [ 227.243204][T13112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 227.245681][T13112] bridge0: port 1(bridge_slave_0) entered blocking state [ 227.247753][T13112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 227.335898][T13112] 8021q: adding VLAN 0 to HW filter on device bond0 [ 227.345782][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 227.348939][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 227.360706][T13112] 8021q: adding VLAN 0 to HW filter on device team0 [ 227.368383][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 227.370648][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 227.377131][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 227.379475][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 227.497339][ T5095] Bluetooth: hci4: Invalid handle: 0xffc9 > 0x0eff [ 227.551500][ T35] block nbd0: Possible stuck request ffff8880297b2140: control (read@0,4096B). Runtime 126 seconds [ 227.604601][ T7023] hid-generic 0362:07FF:7FFFFFFF.000E: item fetching failed at offset 0/1 [ 227.605595][T13112] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 227.608112][ T7023] hid-generic 0362:07FF:7FFFFFFF.000E: probe with driver hid-generic failed with error -22 [ 227.639817][T13208] No source specified [ 227.640321][T13112] veth0_vlan: entered promiscuous mode [ 227.649895][T13112] veth1_vlan: entered promiscuous mode [ 227.664236][T13112] veth0_macvtap: entered promiscuous mode [ 227.669068][T13112] veth1_macvtap: entered promiscuous mode [ 227.678268][T13112] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 227.681865][ T5095] Bluetooth: hci1: Invalid handle: 0xffc9 > 0x0eff [ 227.693471][T13112] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 227.699908][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.703589][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.706855][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.710719][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.739123][T13210] kvm: pic: non byte write [ 227.809952][ T6656] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 227.812651][ T6656] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 227.836150][ T6675] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 227.840692][ T6675] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 227.853557][ T5095] Bluetooth: hci1: unexpected cc 0x204b length: 9 > 3 [ 227.886762][T13225] tmpfs: Bad value for 'mpol' [ 227.897993][T13225] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input32 [ 227.978357][T13234] program syz.2.2551 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 228.134562][ T5447] veth0_vlan: left promiscuous mode [ 228.145841][ T5524] veth0_vlan: entered promiscuous mode [ 228.175276][T13268] futex_wake_op: syz.4.2559 tries to shift op by -1; fix this program [ 228.259475][T13275] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input33 [ 228.289282][T13279] x_tables: ip_tables: .0 target: invalid size 8 (kernel) != (user) 4 [ 228.302446][T13281] bridge0: port 1(bridge_slave_0) entered disabled state [ 228.415090][ T5095] Bluetooth: hci3: command tx timeout [ 228.535955][T13305] bond0: (slave syz_tun): Releasing backup interface [ 228.624473][T13315] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 228.769955][T13326] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=13326 comm=syz.1.2583 [ 228.960061][T13338] FAULT_INJECTION: forcing a failure. [ 228.960061][T13338] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 228.964101][T13338] CPU: 0 UID: 0 PID: 13338 Comm: syz.2.2589 Tainted: G L syzkaller #0 PREEMPT(full) [ 228.964118][T13338] Tainted: [L]=SOFTLOCKUP [ 228.964121][T13338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 228.964138][T13338] Call Trace: [ 228.964144][T13338] [ 228.964148][T13338] dump_stack_lvl+0x100/0x190 [ 228.964245][T13338] should_fail_ex.cold+0x5/0xa [ 228.964276][T13338] _copy_to_user+0x32/0xd0 [ 228.964308][T13338] simple_read_from_buffer+0xcb/0x170 [ 228.964333][T13338] proc_fail_nth_read+0x1af/0x230 [ 228.964350][T13338] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 228.964367][T13338] ? rw_verify_area+0xce/0x6d0 [ 228.964382][T13338] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 228.964397][T13338] vfs_read+0x1e4/0xb40 [ 228.964415][T13338] ? __pfx_vfs_read+0x10/0x10 [ 228.964431][T13338] ? __fget_files+0x215/0x3d0 [ 228.964445][T13338] ? __fget_files+0x21f/0x3d0 [ 228.964459][T13338] ksys_read+0x12a/0x250 [ 228.964475][T13338] ? __pfx_ksys_read+0x10/0x10 [ 228.964495][T13338] do_syscall_64+0x115/0x870 [ 228.964567][T13338] ? clear_bhb_loop+0x40/0x90 [ 228.964580][T13338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 228.964591][T13338] RIP: 0033:0x7fd20e15d68e [ 228.964601][T13338] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 228.964611][T13338] RSP: 002b:00007fd20f042fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 228.964623][T13338] RAX: ffffffffffffffda RBX: 00007fd20f0436c0 RCX: 00007fd20e15d68e [ 228.964629][T13338] RDX: 000000000000000f RSI: 00007fd20f0430a0 RDI: 0000000000000004 [ 228.964635][T13338] RBP: 00007fd20f043090 R08: 0000000000000000 R09: 0000000000000000 [ 228.964641][T13338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 228.964647][T13338] R13: 00007fd20e416038 R14: 00007fd20e415fa0 R15: 00007fffe93e4fd8 [ 228.964660][T13338] [ 229.045778][T13340] tmpfs: Bad value for 'mpol' [ 229.059275][T13340] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input34 [ 229.079532][T13343] BTRFS info: 'norecovery' is for compatibility only, recommended to use 'rescue=nologreplay' [ 229.113680][ T42] kauditd_printk_skb: 7 callbacks suppressed [ 229.113692][ T42] audit: type=1800 audit(1782830944.103:32577): pid=13348 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.2593" name="file0" dev="overlay" ino=205 res=0 errno=0 [ 229.123269][ T5095] Bluetooth: hci2: command 0x1003 tx timeout [ 229.130847][ T5736] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 229.442734][ T7023] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 229.565908][T13374] tmpfs: Unknown parameter 'qoîwЩØt‡Óaa²Z›¸ØIûw7-ä' [ 229.598467][T13381] xt_cgroup: path and classid specified [ 229.602786][T13381] __nla_validate_parse: 7 callbacks suppressed [ 229.602797][T13381] netlink: 277 bytes leftover after parsing attributes in process `syz.4.2606'. [ 229.611811][ T7023] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 229.615501][ T7023] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.618248][ T7023] usb 6-1: Product: syz [ 229.619575][ T7023] usb 6-1: Manufacturer: syz [ 229.621871][ T7023] usb 6-1: SerialNumber: syz [ 229.635181][T13383] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2607'. [ 229.641606][ T42] audit: type=1400 audit(1782830944.592:32578): avc: denied { accept } for pid=13384 comm="syz.4.2608" path="/406/file0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 229.643203][ T7023] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 229.681946][ T41] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 229.696352][T13390] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2610'. [ 229.702217][T13390] bond0: (slave bond_slave_0): Releasing backup interface [ 229.747657][ T5736] Bluetooth: hci4: Invalid handle: 0xffc9 > 0x0eff [ 229.750859][T13390] bond_slave_0: entered promiscuous mode [ 229.753238][T13390] bond_slave_0: entered allmulticast mode [ 229.790854][T13399] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2613'. [ 229.858234][T13405] No source specified [ 229.904006][ T42] audit: type=1400 audit(1782830944.832:32579): avc: denied { write } for pid=13406 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 229.947008][T13415] NILFS (loop4): device size too small [ 229.950663][ T42] audit: type=1400 audit(1782830944.869:32580): avc: denied { write } for pid=13411 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 230.009174][T13419] IPVS: set_ctl: invalid protocol: 2 224.0.0.2:20002 [ 230.016410][T13422] macsec1: entered promiscuous mode [ 230.019417][T13422] macsec1: entered allmulticast mode [ 230.080255][ T5736] Bluetooth: hci4: Invalid handle: 0xffc9 > 0x0eff [ 230.113941][ T5736] Bluetooth: hci4: unexpected event for opcode 0x1408 [ 230.149564][T13434] tmpfs: Bad value for 'mpol' [ 230.326224][ T42] audit: type=1400 audit(1782830945.220:32581): avc: denied { accept } for pid=13441 comm="syz.4.2627" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 230.374639][ T5828] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 230.548119][ T5828] usb 8-1: Using ep0 maxpacket: 16 [ 230.557453][ T5828] usb 8-1: config 11 has an invalid interface number: 151 but max is 1 [ 230.563177][ T5828] usb 8-1: config 11 contains an unexpected descriptor of type 0x1, skipping [ 230.568683][ T5828] usb 8-1: config 11 has an invalid interface number: 233 but max is 1 [ 230.573739][ T5828] usb 8-1: config 11 contains an unexpected descriptor of type 0x1, skipping [ 230.576667][ T5828] usb 8-1: config 11 contains an unexpected descriptor of type 0x2, skipping [ 230.579685][ T5828] usb 8-1: config 11 contains an unexpected descriptor of type 0x2, skipping [ 230.584596][ T5828] usb 8-1: config 11 has an invalid interface number: 138 but max is 1 [ 230.587322][ T5828] usb 8-1: config 11 contains an unexpected descriptor of type 0x1, skipping [ 230.590451][ T5828] usb 8-1: config 11 has 3 interfaces, different from the descriptor's value: 2 [ 230.593496][ T5828] usb 8-1: config 11 has no interface number 0 [ 230.595484][ T5828] usb 8-1: config 11 has no interface number 1 [ 230.597531][ T5828] usb 8-1: config 11 has no interface number 2 [ 230.599763][ T5828] usb 8-1: config 11 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 230.603402][ T5828] usb 8-1: config 11 interface 151 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 230.606531][ T5828] usb 8-1: config 11 interface 151 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 230.610195][ T5828] usb 8-1: config 11 interface 151 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 230.614009][ T5828] usb 8-1: config 11 interface 151 altsetting 0 has a duplicate endpoint with address 0x3, skipping [ 230.617421][ T5828] usb 8-1: config 11 interface 151 altsetting 0 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 230.621004][ T5828] usb 8-1: config 11 interface 151 altsetting 0 has a duplicate endpoint with address 0x5, skipping [ 230.624519][ T5828] usb 8-1: config 11 interface 151 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 16 [ 230.629220][ T5828] usb 8-1: too many endpoints for config 11 interface 233 altsetting 91: 182, using maximum allowed: 30 [ 230.632767][ T5828] usb 8-1: config 11 interface 233 altsetting 91 has a duplicate endpoint with address 0xB, skipping [ 230.636951][ T5828] usb 8-1: config 11 interface 233 altsetting 91 has a duplicate endpoint with address 0x6, skipping [ 230.640591][ T5828] usb 8-1: config 11 interface 233 altsetting 91 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 230.644129][ T5828] usb 8-1: config 11 interface 233 altsetting 91 has 4 endpoint descriptors, different from the interface descriptor's value: 182 [ 230.648530][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has a duplicate endpoint with address 0xE, skipping [ 230.652248][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 230.655755][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has a duplicate endpoint with address 0x5, skipping [ 230.659411][ T5828] usb 8-1: config 11 interface 138 altsetting 9 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 230.663071][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 230.666525][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has a duplicate endpoint with address 0x4, skipping [ 230.670614][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has a duplicate endpoint with address 0xF, skipping [ 230.674122][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has a duplicate endpoint with address 0xD, skipping [ 230.677488][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has a duplicate endpoint with address 0x4, skipping [ 230.682231][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has a duplicate endpoint with address 0xB, skipping [ 230.685659][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has a duplicate endpoint with address 0xF, skipping [ 230.689231][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has a duplicate endpoint with address 0xC, skipping [ 230.692752][ T5828] usb 8-1: config 11 interface 138 altsetting 9 has a duplicate endpoint with address 0x6, skipping [ 230.696205][ T5828] usb 8-1: config 11 interface 233 has no altsetting 0 [ 230.698384][ T5828] usb 8-1: config 11 interface 138 has no altsetting 0 [ 230.702683][ T5828] usb 8-1: New USB device found, idVendor=3537, idProduct=afaf, bcdDevice=d3.ef [ 230.705886][ T5828] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.708455][ T5828] usb 8-1: Product: syz [ 230.709819][ T5828] usb 8-1: Manufacturer: syz [ 230.711430][ T5828] usb 8-1: SerialNumber: syz [ 230.715752][T13430] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 230.840552][ T41] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 230.843057][ T41] ath9k_htc: Failed to initialize the device [ 230.868842][ T41] usb 6-1: ath9k_htc: USB layer deinitialized [ 230.875906][ T5524] usb 6-1: USB disconnect, device number 22 [ 230.954864][ T5828] usb 8-1: USB disconnect, device number 13 [ 231.046529][ T8548] usb 9-1: new full-speed USB device number 27 using dummy_hcd [ 231.211094][ T42] audit: type=1326 audit(1782830946.041:32582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13449 comm="syz.4.2630" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b53d9ce59 code=0x7ffc0000 [ 231.221009][ T42] audit: type=1326 audit(1782830946.041:32583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13449 comm="syz.4.2630" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b53d9ce59 code=0x7ffc0000 [ 231.224673][ T8548] usb 9-1: unable to get BOS descriptor or descriptor too short [ 231.231143][ T42] audit: type=1326 audit(1782830946.041:32584): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13449 comm="syz.4.2630" exe="/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f3b53d9ce59 code=0x7ffc0000 [ 231.234464][ T8548] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 231.241422][ T42] audit: type=1326 audit(1782830946.041:32585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13449 comm="syz.4.2630" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b53d9ce59 code=0x7ffc0000 [ 231.244037][ T8548] usb 9-1: can't read configurations, error -71 [ 231.252519][ T42] audit: type=1326 audit(1782830946.041:32586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13449 comm="syz.4.2630" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b53d9ce59 code=0x7ffc0000 [ 231.267190][ T5736] Bluetooth: hci4: Invalid handle: 0xffc9 > 0x0eff [ 231.274292][ T5095] Bluetooth: hci3: command tx timeout [ 231.298893][T13460] tmpfs: Bad value for 'mpol' [ 231.346247][T13462] overlay: ./file0 is not a directory [ 231.348698][T13462] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 231.384174][T13465] FAULT_INJECTION: forcing a failure. [ 231.384174][T13465] name failslab, interval 1, probability 0, space 0, times 0 [ 231.388868][T13465] CPU: 3 UID: 0 PID: 13465 Comm: syz.4.2635 Tainted: G L syzkaller #0 PREEMPT(full) [ 231.388886][T13465] Tainted: [L]=SOFTLOCKUP [ 231.388890][T13465] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 231.388896][T13465] Call Trace: [ 231.388901][T13465] [ 231.388905][T13465] dump_stack_lvl+0x100/0x190 [ 231.388925][T13465] should_fail_ex.cold+0x5/0xa [ 231.388941][T13465] should_failslab+0xc2/0x120 [ 231.388956][T13465] __kmalloc_cache_noprof+0x91/0x6c0 [ 231.388974][T13465] ? ip6_setup_cork+0x9dd/0x14c0 [ 231.389029][T13465] ip6_setup_cork+0x9dd/0x14c0 [ 231.389049][T13465] ip6_append_data+0x1aa/0x410 [ 231.389066][T13465] ? __pfx_raw6_getfrag+0x10/0x10 [ 231.389097][T13465] rawv6_sendmsg+0x169c/0x4420 [ 231.389115][T13465] ? __print_lock_name+0x60/0x80 [ 231.389141][T13465] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 231.389156][T13465] ? avc_has_perm_noaudit+0x145/0x3b0 [ 231.389171][T13465] ? avc_has_perm+0x135/0x1e0 [ 231.389183][T13465] ? __pfx_avc_has_perm+0x10/0x10 [ 231.389195][T13465] ? avc_has_perm_noaudit+0x145/0x3b0 [ 231.389218][T13465] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 231.389234][T13465] ? inet_sendmsg+0x11c/0x140 [ 231.389254][T13465] inet_sendmsg+0x11c/0x140 [ 231.389265][T13465] sock_write_iter+0x4ea/0x5b0 [ 231.389298][T13465] ? __pfx_inet_sendmsg+0x10/0x10 [ 231.389309][T13465] ? __pfx_sock_write_iter+0x10/0x10 [ 231.389327][T13465] ? bpf_lsm_file_permission+0x9/0x10 [ 231.389367][T13465] ? security_file_permission+0x76/0x210 [ 231.389386][T13465] ? rw_verify_area+0xce/0x6d0 [ 231.389403][T13465] vfs_write+0x6ac/0x1050 [ 231.389419][T13465] ? __pfx_sock_write_iter+0x10/0x10 [ 231.389435][T13465] ? __pfx_vfs_write+0x10/0x10 [ 231.389450][T13465] ? find_held_lock+0x2b/0x80 [ 231.389468][T13465] ksys_write+0x1f8/0x250 [ 231.389478][T13465] ? __pfx_ksys_write+0x10/0x10 [ 231.389498][T13465] do_syscall_64+0x115/0x870 [ 231.389514][T13465] ? clear_bhb_loop+0x40/0x90 [ 231.389528][T13465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.389539][T13465] RIP: 0033:0x7f3b53d9ce59 [ 231.389548][T13465] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 231.389559][T13465] RSP: 002b:00007f3b54d27028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 231.389570][T13465] RAX: ffffffffffffffda RBX: 00007f3b54015fa0 RCX: 00007f3b53d9ce59 [ 231.389577][T13465] RDX: 00000000000005ac RSI: 00002000000000c0 RDI: 0000000000000003 [ 231.389583][T13465] RBP: 00007f3b54d27090 R08: 0000000000000000 R09: 0000000000000000 [ 231.389590][T13465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 231.389596][T13465] R13: 00007f3b54016038 R14: 00007f3b54015fa0 R15: 00007ffce0ab3b78 [ 231.389609][T13465] [ 231.699895][T13484] FAULT_INJECTION: forcing a failure. [ 231.699895][T13484] name failslab, interval 1, probability 0, space 0, times 0 [ 231.704161][T13484] CPU: 0 UID: 0 PID: 13484 Comm: syz.1.2640 Tainted: G L syzkaller #0 PREEMPT(full) [ 231.704178][T13484] Tainted: [L]=SOFTLOCKUP [ 231.704182][T13484] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 231.704189][T13484] Call Trace: [ 231.704194][T13484] [ 231.704198][T13484] dump_stack_lvl+0x100/0x190 [ 231.704218][T13484] should_fail_ex.cold+0x5/0xa [ 231.704234][T13484] should_failslab+0xc2/0x120 [ 231.704249][T13484] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 231.704263][T13484] ? __alloc_skb+0x140/0x710 [ 231.704277][T13484] __alloc_skb+0x140/0x710 [ 231.704287][T13484] ? __alloc_skb+0x5b7/0x710 [ 231.704296][T13484] ? __pfx___alloc_skb+0x10/0x10 [ 231.704305][T13484] ? genl_rcv_msg+0x4be/0x800 [ 231.704338][T13484] netlink_ack+0x117/0xb80 [ 231.704358][T13484] netlink_rcv_skb+0x333/0x420 [ 231.704373][T13484] ? __pfx_genl_rcv_msg+0x10/0x10 [ 231.704384][T13484] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 231.704405][T13484] ? netlink_deliver_tap+0x1ae/0xcc0 [ 231.704436][T13484] genl_rcv+0x28/0x40 [ 231.704451][T13484] netlink_unicast+0x585/0x850 [ 231.704469][T13484] ? __pfx_netlink_unicast+0x10/0x10 [ 231.704488][T13484] netlink_sendmsg+0x8b0/0xda0 [ 231.704506][T13484] ? __pfx_netlink_sendmsg+0x10/0x10 [ 231.704525][T13484] ? __might_fault+0x60/0x140 [ 231.704541][T13484] ____sys_sendmsg+0xa4d/0xbe0 [ 231.704554][T13484] ? __pfx_netlink_sendmsg+0x10/0x10 [ 231.704571][T13484] ? __pfx_____sys_sendmsg+0x10/0x10 [ 231.704591][T13484] ___sys_sendmsg+0x190/0x1e0 [ 231.704607][T13484] ? __pfx____sys_sendmsg+0x10/0x10 [ 231.704621][T13484] ? __lock_acquire+0x49f/0x1a40 [ 231.704635][T13484] ? get_pid_task+0x106/0x250 [ 231.704660][T13484] __sys_sendmsg+0x160/0x210 [ 231.704672][T13484] ? __pfx___sys_sendmsg+0x10/0x10 [ 231.704690][T13484] do_syscall_64+0x115/0x870 [ 231.704706][T13484] ? clear_bhb_loop+0x40/0x90 [ 231.704719][T13484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.704730][T13484] RIP: 0033:0x7fe88e59ce59 [ 231.704739][T13484] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 231.704750][T13484] RSP: 002b:00007fe88f505028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 231.704761][T13484] RAX: ffffffffffffffda RBX: 00007fe88e815fa0 RCX: 00007fe88e59ce59 [ 231.704768][T13484] RDX: 0000000004004050 RSI: 00002000000000c0 RDI: 0000000000000003 [ 231.704774][T13484] RBP: 00007fe88f505090 R08: 0000000000000000 R09: 0000000000000000 [ 231.704780][T13484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 231.704786][T13484] R13: 00007fe88e816038 R14: 00007fe88e815fa0 R15: 00007ffda3fc4e58 [ 231.704799][T13484] [ 231.834768][ T5095] Bluetooth: hci5: unexpected cc 0x204b length: 9 > 3 [ 231.837064][ T5095] Bluetooth: hci5: unexpected event for opcode 0x204b [ 231.926757][ T8548] usb 9-1: new low-speed USB device number 28 using dummy_hcd [ 232.065659][T13454] comedi comedi1: reset error (fatal) [ 232.089405][ T8548] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 232.092627][ T8548] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 232.097070][ T8548] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 232.102431][ T8548] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 232.107412][ T8548] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 232.110590][T13501] loop6: detected capacity change from 0 to 8 [ 232.113457][ T8548] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 232.117046][ T8548] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 232.122004][ T8548] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 232.126779][ T8548] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 232.132385][ T8548] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 232.140500][ T8548] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 232.144251][ T8548] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 232.148752][ T8548] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 232.152412][ T10] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 232.155135][ T8548] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 232.160719][ T8548] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 232.175847][ T8548] usb 9-1: string descriptor 0 read error: -22 [ 232.185063][ T8548] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 232.190641][ T8548] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.202681][ T8548] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 232.325416][ T10] usb 8-1: Using ep0 maxpacket: 8 [ 232.328315][ T10] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 232.330916][ T10] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 232.333865][ T10] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 232.337829][ T10] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 232.340845][ T10] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 232.344736][ T10] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 232.347600][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.434364][T13530] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 232.557820][ T5095] Bluetooth: hci3: ISO packet too small [ 232.569757][ T10] usb 8-1: usb_control_msg returned -32 [ 232.571696][ T10] usbtmc 8-1:16.0: can't read capabilities [ 233.045082][ T8548] usb 8-1: USB disconnect, device number 14 [ 233.068153][ T5095] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:201' [ 233.071259][ T5095] CPU: 0 UID: 0 PID: 5095 Comm: kworker/u34:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 233.071279][ T5095] Tainted: [L]=SOFTLOCKUP [ 233.071284][ T5095] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 233.071321][ T5095] Workqueue: hci5 hci_rx_work [ 233.071378][ T5095] Call Trace: [ 233.071383][ T5095] [ 233.071389][ T5095] dump_stack_lvl+0x100/0x190 [ 233.071425][ T5095] sysfs_warn_dup.cold+0x1c/0x28 [ 233.071460][ T5095] sysfs_create_dir_ns+0x24b/0x2b0 [ 233.071486][ T5095] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 233.071519][ T5095] ? find_held_lock+0x2b/0x80 [ 233.071531][ T5095] ? kobject_add_internal+0x25f/0x930 [ 233.071577][ T5095] ? kobject_add_internal+0x25f/0x930 [ 233.071594][ T5095] ? do_raw_spin_unlock+0x145/0x1e0 [ 233.071627][ T5095] kobject_add_internal+0x2c8/0x930 [ 233.071645][ T5095] kobject_add+0x16a/0x1e0 [ 233.071670][ T5095] ? __pfx_kobject_add+0x10/0x10 [ 233.071684][ T5095] ? class_to_subsys+0x10f/0x150 [ 233.071730][ T5095] ? kobject_put+0xb9/0x640 [ 233.071742][ T5095] ? _raw_spin_unlock+0x28/0x50 [ 233.071776][ T5095] device_add+0x294/0x1970 [ 233.071805][ T5095] ? __pfx_dev_set_name+0x10/0x10 [ 233.071825][ T5095] ? __pfx_device_add+0x10/0x10 [ 233.071854][ T5095] ? mgmt_send_event_skb+0x2fb/0x460 [ 233.071879][ T5095] hci_conn_add_sysfs+0x1a3/0x260 [ 233.071903][ T5095] le_conn_complete_evt+0x11eb/0x1f60 [ 233.071949][ T5095] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 233.071979][ T5095] ? hci_event_packet+0x186/0xcd0 [ 233.072033][ T5095] hci_le_conn_complete_evt+0x23c/0x3a0 [ 233.072074][ T5095] ? skb_pull_data+0x15f/0x1e0 [ 233.072094][ T5095] hci_le_meta_evt+0x34a/0x5f0 [ 233.072129][ T5095] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 233.072154][ T5095] hci_event_packet+0x51c/0xcd0 [ 233.072194][ T5095] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 233.072224][ T5095] ? __pfx_hci_event_packet+0x10/0x10 [ 233.072256][ T5095] ? kcov_remote_start+0x384/0x670 [ 233.072273][ T5095] ? lockdep_hardirqs_on+0x78/0x100 [ 233.072307][ T5095] hci_rx_work+0x451/0xfc0 [ 233.072329][ T5095] process_one_work+0xa23/0x1940 [ 233.072364][ T5095] ? __pfx_process_one_work+0x10/0x10 [ 233.072384][ T5095] ? __pfx_hci_rx_work+0x10/0x10 [ 233.072417][ T5095] worker_thread+0x5ef/0xe50 [ 233.072451][ T5095] ? kthread+0x13a/0x450 [ 233.072464][ T5095] ? __pfx_worker_thread+0x10/0x10 [ 233.072477][ T5095] kthread+0x370/0x450 [ 233.072505][ T5095] ? __pfx_kthread+0x10/0x10 [ 233.072520][ T5095] ret_from_fork+0x72b/0xd50 [ 233.072552][ T5095] ? __pfx_ret_from_fork+0x10/0x10 [ 233.072572][ T5095] ? __switch_to+0x800/0x10f0 [ 233.072597][ T5095] ? __pfx_kthread+0x10/0x10 [ 233.072611][ T5095] ret_from_fork_asm+0x1a/0x30 [ 233.072644][ T5095] [ 233.072659][ T5095] kobject: kobject_add_internal failed for hci5:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 233.166772][ T5095] Bluetooth: hci5: failed to register connection device [ 233.220680][T13572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2672'. [ 233.373016][T13577] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2674'. [ 233.394183][T13583] netlink: 'syz.1.2677': attribute type 9 has an invalid length. [ 233.465017][T13593] sctp: [Deprecated]: syz.3.2683 (pid 13593) Use of struct sctp_assoc_value in delayed_ack socket option. [ 233.465017][T13593] Use struct sctp_sack_info instead [ 233.910010][ T8950] usb 6-1: new low-speed USB device number 23 using dummy_hcd [ 233.974364][T13631] usb usb9: usbfs: process 13631 (syz.3.2697) did not claim interface 0 before use [ 233.978937][T13631] usb usb9: usbfs: process 13631 (syz.3.2697) did not claim interface 4 before use [ 234.058548][T13636] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2699'. [ 234.083154][ T8950] usb 6-1: config index 0 descriptor too short (expected 1307, got 27) [ 234.086339][ T8950] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 234.088983][ T8950] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 234.091815][ T8950] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 234.095689][ T8950] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10 [ 234.099117][ T8950] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 234.102087][ T8950] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 234.108615][ T8950] usb 6-1: string descriptor 0 read error: -22 [ 234.110703][ T8950] usb 6-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 234.113550][ T8950] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.120148][ T8950] usb 6-1: config 0 descriptor?? [ 234.126047][ T8950] hub 6-1:0.0: bad descriptor, ignoring hub [ 234.127978][ T8950] hub 6-1:0.0: probe with driver hub failed with error -5 [ 234.133922][ T8950] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.0/input/input35 [ 234.402287][ T8548] usb 6-1: USB disconnect, device number 23 [ 234.483899][ T35] block nbd0: Possible stuck request ffff8880297b2140: control (read@0,4096B). Runtime 132 seconds [ 235.006428][T13654] syz.2.2705: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 235.011148][T13654] CPU: 3 UID: 0 PID: 13654 Comm: syz.2.2705 Tainted: G L syzkaller #0 PREEMPT(full) [ 235.011165][T13654] Tainted: [L]=SOFTLOCKUP [ 235.011169][T13654] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 235.011188][T13654] Call Trace: [ 235.011193][T13654] [ 235.011197][T13654] dump_stack_lvl+0x100/0x190 [ 235.011227][T13654] warn_alloc.cold+0x94/0xa8 [ 235.011239][T13654] ? __pfx_warn_alloc+0x10/0x10 [ 235.011252][T13654] ? kasan_save_stack+0x3f/0x50 [ 235.011266][T13654] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 235.011282][T13654] ? xskq_create+0x52/0x1d0 [ 235.011347][T13654] ? xsk_setsockopt+0x743/0xab0 [ 235.011359][T13654] ? do_sock_setsockopt+0xf3/0x1d0 [ 235.011385][T13654] ? __sys_setsockopt+0x195/0x220 [ 235.011395][T13654] ? __x64_sys_setsockopt+0xbd/0x160 [ 235.011405][T13654] ? do_syscall_64+0x115/0x870 [ 235.011434][T13654] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.011452][T13654] ? xskq_create+0xfb/0x1d0 [ 235.011466][T13654] __vmalloc_node_range_noprof+0x136c/0x1630 [ 235.011486][T13654] ? xskq_create+0xfb/0x1d0 [ 235.011503][T13654] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 235.011522][T13654] ? kasan_save_track+0x14/0x30 [ 235.011534][T13654] ? __kasan_kmalloc+0xaa/0xb0 [ 235.011547][T13654] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 235.011564][T13654] ? xskq_create+0xfb/0x1d0 [ 235.011577][T13654] vmalloc_user_noprof+0x9e/0xe0 [ 235.011593][T13654] ? xskq_create+0xfb/0x1d0 [ 235.011607][T13654] xskq_create+0xfb/0x1d0 [ 235.011622][T13654] xsk_setsockopt+0x743/0xab0 [ 235.011636][T13654] ? __pfx_xsk_setsockopt+0x10/0x10 [ 235.011649][T13654] ? find_held_lock+0x2b/0x80 [ 235.011660][T13654] ? __fget_files+0x215/0x3d0 [ 235.011673][T13654] ? selinux_socket_setsockopt+0x6a/0x80 [ 235.011693][T13654] ? __pfx_xsk_setsockopt+0x10/0x10 [ 235.011707][T13654] do_sock_setsockopt+0xf3/0x1d0 [ 235.011722][T13654] __sys_setsockopt+0x195/0x220 [ 235.011735][T13654] __x64_sys_setsockopt+0xbd/0x160 [ 235.011745][T13654] ? do_syscall_64+0x90/0x870 [ 235.011760][T13654] ? lockdep_hardirqs_on+0x78/0x100 [ 235.011776][T13654] do_syscall_64+0x115/0x870 [ 235.011791][T13654] ? clear_bhb_loop+0x40/0x90 [ 235.011804][T13654] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.011815][T13654] RIP: 0033:0x7fd20e19ce59 [ 235.011826][T13654] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 235.011836][T13654] RSP: 002b:00007fd20f043028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 235.011847][T13654] RAX: ffffffffffffffda RBX: 00007fd20e415fa0 RCX: 00007fd20e19ce59 [ 235.011854][T13654] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 235.011860][T13654] RBP: 00007fd20e232e6f R08: 0000000000000004 R09: 0000000000000000 [ 235.011867][T13654] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 235.011873][T13654] R13: 00007fd20e416038 R14: 00007fd20e415fa0 R15: 00007fffe93e4fd8 [ 235.011886][T13654] [ 235.011902][T13654] Mem-Info: [ 235.105962][T13654] active_anon:15181 inactive_anon:16457 isolated_anon:0 [ 235.105962][T13654] active_file:213 inactive_file:50336 isolated_file:1 [ 235.105962][T13654] unevictable:1768 dirty:284 writeback:0 [ 235.105962][T13654] slab_reclaimable:9632 slab_unreclaimable:77293 [ 235.105962][T13654] mapped:30492 shmem:20690 pagetables:3842 [ 235.105962][T13654] sec_pagetables:298 bounce:0 [ 235.105962][T13654] kernel_misc_reclaimable:0 [ 235.105962][T13654] free:408051 free_pcp:11800 free_cma:0 [ 235.122356][T13654] Node 0 active_anon:60208kB inactive_anon:65828kB active_file:852kB inactive_file:200832kB unevictable:3536kB isolated(anon):0kB isolated(file):4kB mapped:60528kB dirty:1124kB writeback:0kB shmem:79212kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15680kB pagetables:6800kB sec_pagetables:1192kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 235.134130][T13654] Node 1 active_anon:516kB inactive_anon:0kB active_file:0kB inactive_file:512kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:61440kB dirty:12kB writeback:0kB shmem:3548kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:128kB pagetables:8444kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 235.144902][T13654] Node 0 DMA free:14364kB boost:0kB min:340kB low:424kB high:508kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:140kB local_pcp:4kB free_cma:0kB [ 235.156276][T13654] lowmem_reserve[]: 0 1229 1229 1229 1229 [ 235.158167][T13654] Node 0 DMA32 free:132136kB boost:0kB min:27444kB low:34304kB high:41164kB reserved_highatomic:0KB free_highatomic:0KB active_anon:60184kB inactive_anon:65828kB active_file:852kB inactive_file:200832kB unevictable:3536kB writepending:1124kB zspages:0kB present:2080628kB managed:1258700kB mlocked:0kB bounce:0kB free_pcp:39700kB local_pcp:16344kB free_cma:0kB [ 235.169022][T13654] lowmem_reserve[]: 0 0 0 0 0 [ 235.170930][T13654] Node 1 Normal free:1485704kB boost:0kB min:39796kB low:49744kB high:59692kB reserved_highatomic:0KB free_highatomic:0KB active_anon:516kB inactive_anon:0kB active_file:0kB inactive_file:512kB unevictable:3536kB writepending:12kB zspages:0kB present:2097152kB managed:1781884kB mlocked:0kB bounce:0kB free_pcp:7380kB local_pcp:20kB free_cma:0kB [ 235.193001][T13654] lowmem_reserve[]: 0 0 0 0 0 [ 235.194634][T13654] Node 0 DMA: 13*4kB (UME) 21*8kB (UME) 18*16kB (UME) 17*32kB (UME) 8*64kB (UME) 8*128kB (UME) 6*256kB (UME) 8*512kB (UME) 4*1024kB (UM) 1*2048kB (M) 0*4096kB = 14364kB [ 235.200142][T13654] Node 0 DMA32: 2*4kB (ME) 68*8kB (ME) 341*16kB (ME) 531*32kB (UME) 360*64kB (UME) 129*128kB (UME) 35*256kB (UM) 11*512kB (M) 8*1024kB (M) 9*2048kB (UM) 6*4096kB (U) = 128344kB [ 235.206144][T13654] Node 1 Normal: 294*4kB (UM) 284*8kB (UM) 273*16kB (UME) 360*32kB (UME) 186*64kB (UME) 171*128kB (UME) 238*256kB (UME) 231*512kB (UME) 210*1024kB (UME) 7*2048kB (UM) 250*4096kB (UM) = 1485704kB [ 235.212828][T13654] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 235.216113][T13654] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 235.219351][T13654] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 235.222654][T13654] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 235.225677][T13654] 72693 total pagecache pages [ 235.227284][T13654] 0 pages in swap cache [ 235.228597][T13654] Free swap = 124996kB [ 235.232592][T13654] Total swap = 124996kB [ 235.233972][T13654] 1048443 pages RAM [ 235.235209][T13654] 0 pages HighMem/MovableOnly [ 235.236684][T13654] 284457 pages reserved [ 235.238000][T13654] 0 pages cma reserved [ 235.285265][T13670] 9pnet_fd: Insufficient options for proto=fd [ 235.286206][ T5736] Bluetooth: hci5: Malformed HCI Event [ 235.288502][T13670] netlink: 'syz.1.2712': attribute type 1 has an invalid length. [ 235.297139][T13670] netlink: 756 bytes leftover after parsing attributes in process `syz.1.2712'. [ 235.301835][ T5736] Bluetooth: hci1: unexpected cc 0x204b length: 9 > 3 [ 235.360407][ T5736] Bluetooth: hci5: command 0x206a tx timeout [ 235.401713][T13681] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input36 [ 235.440113][ T5736] Bluetooth: hci5: SCO packet too small [ 235.917006][T13703] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2725'. [ 235.920019][T13703] netlink: 'syz.3.2725': attribute type 30 has an invalid length. [ 235.922576][T13703] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2725'. [ 235.934627][T13703] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2725'. [ 235.934642][ T5813] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 235.937707][T13703] netlink: 'syz.3.2725': attribute type 30 has an invalid length. [ 235.941115][ T5813] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 235.943810][T13703] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2725'. [ 235.947883][ T5813] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 235.955112][ T5813] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 236.024568][T13708] program syz.3.2727 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 236.027892][T13709] program syz.3.2727 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 236.067659][T13711] tmpfs: Cannot change global quota limit on remount [ 236.116950][T13716] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 236.117307][T13717] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 236.432875][T13676] comedi comedi1: reset error (fatal) [ 236.595498][ T848] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 236.612505][ T42] kauditd_printk_skb: 5 callbacks suppressed [ 236.612517][ T42] audit: type=1400 audit(1782830951.024:32592): avc: denied { read } for pid=13757 comm="syz.3.2738" name="loop-control" dev="devtmpfs" ino=657 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 236.623066][ T42] audit: type=1400 audit(1782830951.024:32593): avc: denied { open } for pid=13757 comm="syz.3.2738" path="/dev/loop-control" dev="devtmpfs" ino=657 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 236.759349][ T848] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 236.762783][ T848] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 236.765935][ T848] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 236.769578][ T848] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 236.776643][ T848] usb 6-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 236.779880][ T848] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.782759][ T848] usb 6-1: Product: syz [ 236.784092][ T848] usb 6-1: Manufacturer: syz [ 236.785529][ T848] usb 6-1: SerialNumber: syz [ 236.791276][ T848] usb 6-1: config 0 descriptor?? [ 236.838577][T13779] syzkaller0: entered promiscuous mode [ 236.840364][T13779] syzkaller0: entered allmulticast mode [ 237.012977][ T848] adutux 6-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux1 [ 237.181013][ T5524] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 237.257631][ T43] INFO: task syz.0.587:7930 blocked in I/O wait for more than 143 seconds. [ 237.260433][ T43] Tainted: G L syzkaller #0 [ 237.263161][ T43] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 237.265989][ T43] task:syz.0.587 state:D stack:25624 pid:7930 tgid:7928 ppid:5734 task_flags:0x400140 flags:0x00080002 [ 237.270070][ T43] Call Trace: [ 237.271169][ T43] [ 237.272127][ T43] __schedule+0x125c/0x6730 [ 237.273607][ T43] ? __pfx___schedule+0x10/0x10 [ 237.275151][ T43] ? find_held_lock+0x2b/0x80 [ 237.276771][ T43] ? schedule+0x225/0x2c0 [ 237.278378][ T43] schedule+0xdd/0x2c0 [ 237.280220][ T43] io_schedule+0x8a/0xf0 [ 237.282103][ T43] folio_wait_bit_common+0x414/0xa70 [ 237.284232][ T43] ? folio_wait_bit_common+0x2a0/0xa70 [ 237.286521][ T43] ? __pfx_folio_wait_bit_common+0x10/0x10 [ 237.287178][ T5821] usb 6-1: USB disconnect, device number 24 [ 237.288854][ T43] ? __pfx_wake_page_function+0x10/0x10 [ 237.292326][T13786] loop9: detected capacity change from 0 to 255852544 [ 237.293816][ T43] ? __pfx___might_resched+0x10/0x10 [ 237.298239][ T43] ? compaction_free+0x182/0x430 [ 237.300428][ T43] migrate_pages_batch+0x7a1/0x45c0 [ 237.302662][ T43] ? __pfx_compaction_alloc+0x10/0x10 [ 237.304948][ T43] ? __pfx_compaction_free+0x10/0x10 [ 237.307181][ T43] ? __pfx_migrate_pages_batch+0x10/0x10 [ 237.309573][ T43] ? trace_sched_exit_tp+0x120/0x160 [ 237.312080][ T43] ? __schedule+0x126e/0x6730 [ 237.314072][ T43] ? __pfx_clockevents_program_event+0x10/0x10 [ 237.316694][ T43] migrate_pages_sync+0x4db/0x880 [ 237.318777][ T43] ? __pfx_compaction_alloc+0x10/0x10 [ 237.321078][ T43] ? __pfx_compaction_free+0x10/0x10 [ 237.323068][ T43] ? __pfx_migrate_pages_sync+0x10/0x10 [ 237.325225][ T43] migrate_pages+0x1a83/0x2850 [ 237.326913][ T43] ? isolate_migratepages_block+0xd74/0x61d0 [ 237.329009][ T43] ? __pfx_compaction_alloc+0x10/0x10 [ 237.330979][ T43] ? __pfx_compaction_free+0x10/0x10 [ 237.333095][ T43] ? __pfx_migrate_pages+0x10/0x10 [ 237.334685][ T43] ? __pfx_isolate_migratepages_block+0x10/0x10 [ 237.336617][ T43] ? __pfx___might_resched+0x10/0x10 [ 237.338288][ T43] ? putback_movable_pages+0x7e0/0xbd0 [ 237.339977][ T43] compact_zone+0x243c/0x4420 [ 237.341500][ T43] ? debug_object_free+0x295/0x550 [ 237.343227][ T5524] usb 8-1: Using ep0 maxpacket: 16 [ 237.343654][ T43] ? __pfx_debug_object_free+0x10/0x10 [ 237.346377][ T5524] usb 8-1: config 0 has an invalid interface number: 8 but max is 0 [ 237.346803][ T43] ? __pfx_compact_zone+0x10/0x10 [ 237.349320][ T5524] usb 8-1: config 0 has no interface number 0 [ 237.350839][ T43] ? __flush_work+0x928/0xcb0 [ 237.352723][ T5524] usb 8-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 237.354407][ T43] ? __flush_work+0x928/0xcb0 [ 237.357637][ T5524] usb 8-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 237.359077][ T43] compact_node+0x17f/0x2c0 [ 237.363328][ T5524] usb 8-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 237.363489][ T43] ? __pfx_compact_node+0x10/0x10 [ 237.366387][ T5524] usb 8-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 237.367908][ T43] ? __lru_add_drain_all+0x441/0x650 [ 237.370376][ T5524] usb 8-1: Product: syz [ 237.370386][ T5524] usb 8-1: SerialNumber: syz [ 237.371765][ T5524] usb 8-1: config 0 descriptor?? [ 237.372026][ T43] sysctl_compaction_handler+0x141/0x210 [ 237.376580][ T5524] cm109 8-1:0.8: invalid payload size 0, expected 4 [ 237.378081][ T43] proc_sys_call_handler+0x47f/0x5a0 [ 237.378100][ T43] ? __pfx_proc_sys_call_handler+0x10/0x10 [ 237.378113][ T43] ? splice_from_pipe_next+0x1ec/0x5a0 [ 237.381403][ T5524] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.8/input/input37 [ 237.382011][ T43] iter_file_splice_write+0x830/0x10b0 [ 237.390244][ T43] ? copy_splice_read+0x739/0xbb0 [ 237.391807][ T43] ? __pfx_iter_file_splice_write+0x10/0x10 [ 237.393639][ T43] ? __pfx_copy_splice_read+0x10/0x10 [ 237.395317][ T43] ? __pfx_iter_file_splice_write+0x10/0x10 [ 237.397127][ T43] direct_splice_actor+0x192/0x690 [ 237.398821][ T43] splice_direct_to_actor+0x345/0xa30 [ 237.400495][ T43] ? __pfx_direct_splice_actor+0x10/0x10 [ 237.402218][ T43] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 237.404038][ T43] do_splice_direct+0x174/0x240 [ 237.405577][ T43] ? __pfx_do_splice_direct+0x10/0x10 [ 237.407260][ T43] ? avc_policy_seqno+0x9/0x20 [ 237.408814][ T43] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 237.410661][ T43] ? rw_verify_area+0xce/0x6d0 [ 237.412153][ T43] do_sendfile+0xadc/0xe20 [ 237.413568][ T43] ? __pfx_do_sendfile+0x10/0x10 [ 237.415112][ T43] __x64_sys_sendfile64+0x154/0x220 [ 237.416746][ T43] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 237.418528][ T43] do_syscall_64+0x115/0x870 [ 237.420111][ T43] ? clear_bhb_loop+0x40/0x90 [ 237.421638][ T43] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 237.423495][ T43] RIP: 0033:0x7f958d39ce59 [ 237.424828][ T43] RSP: 002b:00007f958e264028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 237.427393][ T43] RAX: ffffffffffffffda RBX: 00007f958d615fa0 RCX: 00007f958d39ce59 [ 237.429842][ T43] RDX: 00002000000000c0 RSI: 0000000000000004 RDI: 0000000000000005 [ 237.432509][ T43] RBP: 00007f958d432e6f R08: 0000000000000000 R09: 0000000000000000 [ 237.434888][ T43] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000 [ 237.437274][ T43] R13: 00007f958d616038 R14: 00007f958d615fa0 R15: 00007ffe1b021d98 [ 237.439771][ T43] [ 237.440959][ T43] [ 237.440959][ T43] Showing all locks held in the system: [ 237.443379][ T43] 1 lock held by khungtaskd/43: [ 237.444915][ T43] #0: ffffffff8e9e60c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 237.448001][ T43] 2 locks held by getty/5538: [ 237.449480][ T43] #0: ffff88801e2f10a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 237.452563][ T43] #1: ffffc900000dd2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 [ 237.455619][ T43] 1 lock held by udevd/5738: [ 237.457037][ T43] 1 lock held by udevd/5746: [ 237.458456][ T43] #0: ffff888029704350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 237.461321][ T43] 6 locks held by kworker/3:3/5821: [ 237.462986][ T43] #0: ffff88801cff2d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 [ 237.466288][ T43] #1: ffffc9000331fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 [ 237.469696][ T43] #2: ffff88802ccbc1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 [ 237.472462][ T43] #3: ffff8880422d21d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0 [ 237.475306][ T43] #4: ffff88803a1d01a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620 [ 237.478526][ T43] #5: ffffffff8ff295a0 (adutux_mutex){+.+.}-{4:4}, at: adu_disconnect+0xb2/0x1c0 [ 237.481416][ T43] 1 lock held by syz.0.587/7930: [ 237.482967][ T43] #0: ffff888058cc0450 (sb_writers#3){.+.+}-{0:0}, at: splice_direct_to_actor+0x345/0xa30 [ 237.486071][ T43] 4 locks held by kworker/3:6/8950: [ 237.487689][ T43] #0: ffff88801cff2d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 [ 237.490991][ T43] #1: ffffc9000d6b7d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 [ 237.494417][ T43] #2: ffff88802b5c81d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 [ 237.497162][ T43] #3: ffff88802bfdc568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x5ab/0x4af0 [ 237.500168][ T43] 1 lock held by syz.4.2639/13539: [ 237.501754][ T43] #0: ffffffff8ff295a0 (adutux_mutex){+.+.}-{4:4}, at: adu_release+0xc8/0x7a0 [ 237.504474][ T43] 2 locks held by udevd/13555: [ 237.506010][ T43] #0: ffff888029248350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 237.508822][ T43] #1: ffff888029249430 (&lo->lo_mutex){+.+.}-{4:4}, at: lo_open+0x4c/0xe0 [ 237.511493][ T43] 4 locks held by syz.1.2733/13786: [ 237.513103][ T43] #0: ffff888029249430 (&lo->lo_mutex){+.+.}-{4:4}, at: loop_set_block_size+0x102/0x9e0 [ 237.516130][ T43] #1: ffff888029245118 (&q->limits_lock){+.+.}-{4:4}, at: loop_set_block_size+0x3c3/0x9e0 [ 237.519337][ T43] #2: ffff888029244ae0 (&q->q_usage_counter(io)#26){++++}-{0:0}, at: blk_mq_freeze_queue_nomemsave+0x15/0x20 [ 237.522908][ T43] #3: ffff888029244b18 (&q->q_usage_counter(queue)#10){+.+.}-{0:0}, at: blk_mq_freeze_queue_nomemsave+0x15/0x20 [ 237.526557][ T43] [ 237.527310][ T43] ============================================= [ 237.527310][ T43] [ 237.529903][ T43] NMI backtrace for cpu 0 [ 237.529914][ T43] CPU: 0 UID: 0 PID: 43 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 237.529928][ T43] Tainted: [L]=SOFTLOCKUP [ 237.529932][ T43] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 237.529939][ T43] Call Trace: [ 237.529943][ T43] [ 237.529948][ T43] dump_stack_lvl+0x100/0x190 [ 237.529964][ T43] nmi_cpu_backtrace.cold+0x12d/0x151 [ 237.529981][ T43] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 237.529997][ T43] nmi_trigger_cpumask_backtrace+0x21c/0x2a0 [ 237.530014][ T43] sys_info+0x141/0x190 [ 237.530025][ T43] watchdog+0xcb1/0x1030 [ 237.530040][ T43] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 237.530055][ T43] ? __pfx_watchdog+0x10/0x10 [ 237.530068][ T43] ? __kthread_parkme+0x18c/0x230 [ 237.530086][ T43] ? kthread+0x13a/0x450 [ 237.530095][ T43] ? __pfx_watchdog+0x10/0x10 [ 237.530107][ T43] kthread+0x370/0x450 [ 237.530116][ T43] ? __pfx_kthread+0x10/0x10 [ 237.530127][ T43] ret_from_fork+0x72b/0xd50 [ 237.530143][ T43] ? __pfx_ret_from_fork+0x10/0x10 [ 237.530159][ T43] ? __switch_to+0x800/0x10f0 [ 237.530170][ T43] ? __pfx_kthread+0x10/0x10 [ 237.530181][ T43] ret_from_fork_asm+0x1a/0x30 [ 237.530197][ T43] [ 237.530201][ T43] Sending NMI from CPU 0 to CPUs 1-3: [ 237.570894][ C1] NMI backtrace for cpu 1 [ 237.570908][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 237.570922][ C1] Tainted: [L]=SOFTLOCKUP [ 237.570926][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 237.570943][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 237.570963][ C1] Code: b6 a4 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 63 b9 2e 00 fb f4 bc 48 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 237.570973][ C1] RSP: 0018:ffffc90000177e00 EFLAGS: 00000206 [ 237.570982][ C1] RAX: 00000000009bc6af RBX: ffff88801ead2540 RCX: ffffffff8b9ce2d5 [ 237.570989][ C1] RDX: 0000000000000000 RSI: ffffffff8e15d8c3 RDI: ffffffff8c3e9b80 [ 237.570995][ C1] RBP: ffffed1003d5a4a8 R08: 0000000000000001 R09: ffffed100d4a678d [ 237.571001][ C1] R10: ffff88806a533c6b R11: 0000000000000000 R12: 0000000000000000 [ 237.571007][ C1] R13: 0000000000000000 R14: 1ffff9200002efc4 R15: dffffc0000000000 [ 237.571013][ C1] FS: 0000000000000000(0000) GS:ffff8880d61e0000(0000) knlGS:0000000000000000 [ 237.571034][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 237.571043][ C1] CR2: 000056247c22e208 CR3: 000000002deef000 CR4: 0000000000352ef0 [ 237.571049][ C1] Call Trace: [ 237.571052][ C1] [ 237.571056][ C1] default_idle+0x9/0x10 [ 237.571065][ C1] default_idle_call+0x6c/0xb0 [ 237.571075][ C1] do_idle+0x3a7/0x5b0 [ 237.571090][ C1] ? __pfx_do_idle+0x10/0x10 [ 237.571104][ C1] ? do_idle+0x388/0x5b0 [ 237.571118][ C1] cpu_startup_entry+0x4f/0x60 [ 237.571132][ C1] start_secondary+0x21d/0x2d0 [ 237.571145][ C1] ? __pfx_start_secondary+0x10/0x10 [ 237.571159][ C1] common_startup_64+0x13e/0x158 [ 237.571171][ C1] [ 237.571176][ C3] NMI backtrace for cpu 3 [ 237.571202][ C3] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Tainted: G L syzkaller #0 PREEMPT(full) [ 237.571220][ C3] Tainted: [L]=SOFTLOCKUP [ 237.571225][ C3] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 237.571232][ C3] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 237.571254][ C3] Code: b6 a4 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 63 b9 2e 00 fb f4 bc 48 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 237.571266][ C3] RSP: 0018:ffffc90000197e00 EFLAGS: 00000206 [ 237.571277][ C3] RAX: 00000000004fc0dd RBX: ffff88801eeba540 RCX: ffffffff8b9ce2d5 [ 237.571286][ C3] RDX: 0000000000000000 RSI: ffffffff8e15d8c3 RDI: ffffffff8c3e9b80 [ 237.571294][ C3] RBP: ffffed1003dd74a8 R08: 0000000000000001 R09: ffffed100d4e678d [ 237.571302][ C3] R10: ffff88806a733c6b R11: 0000000000000000 R12: 0000000000000000 [ 237.571310][ C3] R13: 0000000000000000 R14: 1ffff92000032fc4 R15: dffffc0000000000 [ 237.571319][ C3] FS: 0000000000000000(0000) GS:ffff8880d63e0000(0000) knlGS:0000000000000000 [ 237.571345][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 237.571354][ C3] CR2: 00007fe88f4c2ff8 CR3: 00000000344e8000 CR4: 0000000000352ef0 [ 237.571363][ C3] Call Trace: [ 237.571367][ C3] [ 237.571371][ C3] default_idle+0x9/0x10 [ 237.571383][ C3] default_idle_call+0x6c/0xb0 [ 237.571394][ C3] do_idle+0x3a7/0x5b0 [ 237.571413][ C3] ? __pfx_do_idle+0x10/0x10 [ 237.571429][ C3] ? finish_task_switch.isra.0+0x14c/0x10c0 [ 237.571450][ C3] cpu_startup_entry+0x4f/0x60 [ 237.571468][ C3] start_secondary+0x21d/0x2d0 [ 237.571490][ C3] ? __pfx_start_secondary+0x10/0x10 [ 237.571508][ C3] common_startup_64+0x13e/0x158 [ 237.571525][ C3] [ 237.571530][ C2] NMI backtrace for cpu 2 [ 237.571542][ C2] CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Tainted: G L syzkaller #0 PREEMPT(full) [ 237.571562][ C2] Tainted: [L]=SOFTLOCKUP [ 237.571567][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 237.571576][ C2] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 237.571599][ C2] Code: b6 a4 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 63 b9 2e 00 fb f4 bc 48 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 237.571614][ C2] RSP: 0018:ffffc90000187e00 EFLAGS: 00000206 [ 237.571628][ C2] RAX: 000000000046a8c3 RBX: ffff88801eebca80 RCX: ffffffff8b9ce2d5 [ 237.571638][ C2] RDX: 0000000000000000 RSI: ffffffff8e15d8c3 RDI: ffffffff8c3e9b80 [ 237.571647][ C2] RBP: ffffed1003dd7950 R08: 0000000000000001 R09: ffffed100d4c678d [ 237.571656][ C2] R10: ffff88806a633c6b R11: 0000000000000000 R12: 0000000000000000 [ 237.571665][ C2] R13: 0000000000000000 R14: 1ffff92000030fc4 R15: dffffc0000000000 [ 237.571671][ C2] FS: 0000000000000000(0000) GS:ffff8880d62e0000(0000) knlGS:0000000000000000 [ 237.571693][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 237.571701][ C2] CR2: 000056247c1c3a18 CR3: 0000000026ab4000 CR4: 0000000000352ef0 [ 237.571707][ C2] Call Trace: [ 237.571710][ C2] [ 237.571713][ C2] default_idle+0x9/0x10 [ 237.571722][ C2] default_idle_call+0x6c/0xb0 [ 237.571731][ C2] do_idle+0x3a7/0x5b0 [ 237.571744][ C2] ? __pfx_do_idle+0x10/0x10 [ 237.571758][ C2] ? finish_task_switch.isra.0+0x14c/0x10c0 [ 237.571773][ C2] cpu_startup_entry+0x4f/0x60 [ 237.571787][ C2] start_secondary+0x21d/0x2d0 [ 237.571799][ C2] ? __pfx_start_secondary+0x10/0x10 [ 237.571813][ C2] common_startup_64+0x13e/0x158 [ 237.571825][ C2] [ 237.603643][ T5736] Bluetooth: hci5: command 0x206a tx timeout [ 237.605355][ T43] Kernel panic - not syncing: hung_task: blocked tasks [ 237.605369][ T43] CPU: 0 UID: 0 PID: 43 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 237.605384][ T43] Tainted: [L]=SOFTLOCKUP [ 237.605389][ T43] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 237.605396][ T43] Call Trace: [ 237.605401][ T43] [ 237.605406][ T43] dump_stack_lvl+0x100/0x190 [ 237.605425][ T43] vpanic+0x552/0x970 [ 237.605436][ T43] ? __pfx_vpanic+0x10/0x10 [ 237.605452][ T43] ? nmi_trigger_cpumask_backtrace+0x1c7/0x2a0 [ 237.605468][ T43] panic+0xd1/0xe0 [ 237.605478][ T43] ? __pfx_panic+0x10/0x10 [ 237.605490][ T43] ? nmi_trigger_cpumask_backtrace+0x1fa/0x2a0 [ 237.605504][ T43] ? nmi_trigger_cpumask_backtrace+0x260/0x2a0 [ 237.605518][ T43] ? nmi_trigger_cpumask_backtrace+0x26a/0x2a0 [ 237.605531][ T43] ? watchdog.cold+0x1ec/0x234 [ 237.605543][ T43] ? watchdog+0xcc1/0x1030 [ 237.605557][ T43] watchdog.cold+0x1fd/0x234 [ 237.605572][ T43] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 237.605587][ T43] ? __pfx_watchdog+0x10/0x10 [ 237.605601][ T43] ? __kthread_parkme+0x18c/0x230 [ 237.605619][ T43] ? kthread+0x13a/0x450 [ 237.605629][ T43] ? __pfx_watchdog+0x10/0x10 [ 237.605641][ T43] kthread+0x370/0x450 [ 237.605651][ T43] ? __pfx_kthread+0x10/0x10 [ 237.605663][ T43] ret_from_fork+0x72b/0xd50 [ 237.605679][ T43] ? __pfx_ret_from_fork+0x10/0x10 [ 237.605695][ T43] ? __switch_to+0x800/0x10f0 [ 237.605707][ T43] ? __pfx_kthread+0x10/0x10 [ 237.605718][ T43] ret_from_fork_asm+0x1a/0x30 [ 237.605734][ T43] [ 237.608817][ T43] Kernel Offset: disabled