last executing test programs: 5.436786075s ago: executing program 2 (id=2146): syz_io_uring_setup(0x2f67, 0x0, 0x0, 0x0, &(0x7f0000000000)) syz_emit_ethernet(0x155, &(0x7f00000005c0)={@local, @link_local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "15fe0c", 0x11f, 0x2f, 0x0, @private2, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x88a8, 0x0, 0x0, [0xb3fe]}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [], "2c9015ae7a59854a8e82f3ba85d167bb50a021807097ee69f46f2e8885c44e9e407d99e26b93007bf0c47b1d532d214fe1d56016176e01bcb019fa503834312470eab4c537dc6c4c10946322ec2dfa4d61661474d77e9c36e43b2bd62e873fc5b91f85364e6adfe13d70bf4b938a270018d2b61a4dfdc9214848a17839a86c4db8593b928e9780dd2f88042a0c687e1afa8aadf50958a3c3d56b9aee5435095a934932438095e40a4feeb7e835c0cd650790fbd61625949ac889317a5b023effbb1303a0a6dc635a70fa0d95feb0d21e63e9aac5d6ab000000"}, {0xa888, 0x88be, 0x8000003}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0x0, 0xfffc}}}}}}}}}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="04"], 0x16) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r0, &(0x7f0000000000)={0x24, @short={0x2, 0xffff, 0xaaa1}}, 0x14) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$BTRFS_IOC_WAIT_SYNC(r1, 0x800452d2, 0x0) r2 = io_uring_setup(0xf06, &(0x7f00000003c0)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) io_uring_register$IORING_REGISTER_FILES(r2, 0x20, &(0x7f0000000000)=[r2], 0x1) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) getrandom(&(0x7f0000000080)=""/236, 0xec, 0x1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 5.004571418s ago: executing program 2 (id=2152): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'wg0\x00'}) bind$packet(r0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) ioctl$int_in(r1, 0x5421, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, &(0x7f0000000280)) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00'/19], 0x50) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0200000004000000040000000c"], 0x50) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0d000000040000000400000007"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000700), &(0x7f0000000880), 0xde9, r6}, 0x38) (fail_nth: 8) 4.004180447s ago: executing program 2 (id=2164): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000007d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r5 = socket$nl_generic(0x10, 0x3, 0x10) socket$phonet_pipe(0x23, 0x5, 0x2) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000480)={0x38, r6, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x38}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r8 = socket$qrtr(0x2a, 0x2, 0x0) r9 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r9, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) r10 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') sendmsg$TIPC_NL_MON_SET(r10, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x24, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r11 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r11, 0x0, 0x27, &(0x7f0000000000)={@multicast2, @local, @local}, 0xc) preadv(r10, &(0x7f0000001b80)=[{&(0x7f0000000140)=""/105, 0x69}], 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) syz_clone3(&(0x7f0000001880)={0x120000200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) writev(r8, &(0x7f0000000340)=[{&(0x7f0000000080)="fb", 0x1}], 0x1) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r12, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) 3.877298558s ago: executing program 2 (id=2166): openat$vicodec0(0xffffff9c, &(0x7f0000000440), 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec778000) r0 = syz_open_dev$amidi(&(0x7f00000002c0), 0x9, 0x2962c0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0205710, &(0x7f0000000300)={0x1, 0x4, 0x9, 0x1, 0x3}) r1 = syz_ublk_setup_io_uring(0x4992, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) r5 = openat$uhid(0xffffff9c, &(0x7f00000002c0), 0x802, 0x0) pselect6(0x40, &(0x7f0000000680)={0x8, 0x7, 0x0, 0xfffffffffffffff9, 0x916, 0xae3, 0x7, 0x8}, 0x0, 0x0, &(0x7f0000000740), 0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_emit_ethernet(0x6e, &(0x7f0000000a80)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000104000380600fe880000000000000000000000000001fe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="e4000000907806c31312345f8cf949a01b555682f44cecac91ba1d12d2b653e0c9d32072c19dd6ca814b7da07e314fd4867b75fe7593e57ddfb803d8158c4747d2ae6cc5b4b83726a1c77ef0414198f674714ad16bcd3be85c99e37ee4d2aac9bf1b49b6de9a0cccf8727f31e4b2fc328a07e4347d6bf88c685ef539c0bbd12f7d7db098e9dd375e4b1b4faf31069f613ff336e5c6787b6e913620aa97303067729199f037e397e4d7f3159f8f000001c6b927e8fdf3def78c5dcbb7615d2448ba4b62ce7b1a858c7e4628ff9453280f4141fa840489f36b24ca8513d1c01b364680b31ed21f3be22c4b2bc4161248dd4285ce198f32e7b0c2ea28ba0a33fa7a67d5a2baf51a8d2a03f566ee357c15050529bebd3353785fac1672e995e964e9faeadadc1ced42e25d7fbe7d3f6ecb3d88eec9826d133292068c6b41c008a32ace24b89ef6180bc30c5e5c51658e27f99c38fd9487d1f7edd2faaddf5f63b4945a53"], 0x0) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0xfb87, 0x800, 0x1, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x6, 0x15e, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x8, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x1, 0x3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x82, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) ioctl$DVB_DVR_DMX_EXPBUF(r8, 0xc00c6f3e, &(0x7f0000000000)={0x800, 0x80000, r5}) r10 = socket$inet(0x2, 0x1, 0x0) getsockopt$IP_SET_OP_VERSION(r10, 0x1, 0x2f, &(0x7f0000000000), &(0x7f0000000180)=0x8) bind$inet(r9, &(0x7f00000000c0)={0x2, 0x4e21, @rand_addr=0x64010100}, 0x10) ioctl$KVM_CAP_X2APIC_API(r8, 0x4068aea3, &(0x7f0000000500)={0x81, 0x0, 0x1}) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x1035, {0x0, 0x0, 0x0, 0x0, 0x5}}) 3.589191583s ago: executing program 2 (id=2169): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$ndctl0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x8002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)="180c4552", 0x4) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f0000000400)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff00", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90be8b1c55080000000c547d03d8a0f4bd00", [0x0, 0x6]}}) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f00000000c0)={0x1, 0x5, 0x4, 0xffff, 0x2, "a54b4f138d9801e8bb8aa8dad7815e78784ed9"}) mbind(&(0x7f00002c8000/0x4000)=nil, 0x4000, 0x1, &(0x7f0000000280)=0x5, 0x1, 0x0) getpid() socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r5, &(0x7f0000007fc0)={0x2020}, 0x2020) 2.399796046s ago: executing program 3 (id=2172): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_io_uring_setup(0x414d, &(0x7f0000000400)={0x0, 0x287d, 0x400, 0x3, 0x4e}, &(0x7f0000002200)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000002280)=0x0) prlimit64(0x0, 0x7, &(0x7f0000004080), 0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_ACCEPT={0xd, 0x0, 0x5, r0, 0x0, 0x0, 0x0, 0x800}) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r5, &(0x7f0000000580)={0x20e, 0x2, 0x0, {{0x500, 0xcd, 0x500, 0xc3, {}, 0x0, 0x0, 0x4, 0x0, 0x1b, '\x04nodev{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x28, 'pg>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18x\x9b\xa9\x16c\x88\x14\xe5p\x81\x03\xb4\x94\xe1\x00\x00\x00\x00\x00\x00\x00\x00', 0x2, '\b\x00', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xe2\x89\xdad\x9a7\x00'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300, 0x0, 0x0, 0xee01}}, 0x20e) io_uring_enter(r1, 0x2003, 0xfffffffd, 0x9, 0x0, 0x0) sendmmsg(r0, &(0x7f00000005c0)=[{{&(0x7f0000000040)=@rxrpc=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e24, 0x4, @mcast1, 0xfffe0}}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000100)="f576d85eae4aa3d5a13310", 0xb}, {&(0x7f0000000140)="073b2727c3d2f4823f1f08a57e020739c24b0206302a9c0376383ff295a062e75a6faae59d55ad053f0b6e55376f8d8c992e6e4d3479a2afa228c0635b94c3c68f68a4c7e370a2ac78e1955c0326a0d2cde112bc4055569bc641a694f9750aeaab20d05d69095ce3faf4d7d219fc9e412f06ac1276859b08b60d58d85b19424b5c139113572875d8631fcbdb0ad072bf40ebce", 0x93}, {&(0x7f0000000200)="a7439f7bbc8662e0fca157badc75e49c6a6179b228ff257472f18ff2c666e4a7ed0979edc6893d2c444bbd8d56cbfbc8c55bc7c35dc70b", 0x37}, {&(0x7f0000000300)="d27bfda1a98b1d68be393116966c5b7ef26d5c7db15f65643b0a5048c25df3aff616f4312a6812b846ce7591309e3e4b47ff7f31cc2f5a0203449e9b32c661d38ba97874471911eee4a6ac98102880c1adca697f0fb77357f807f9d62baaf2cc7d20d67afe8c8f00be7b353e40fcba33fe00e9fc1373dc44ec907753bc5f606fab786ed3cff9539795361a2d232d9e54f323a4", 0x93}, {&(0x7f0000000480)="002f2f2bd500330b54e40826b25b98d222db80cfe90c81b41c6523e2c3cfeb1691350ce0a21e1b2167fc2cce1d00d0762f9438a4bd47ec57077bac9950a63945d42c99e1607c575d1d8d69555bb268b34d6cd42de0772124410319e852ae44", 0x5f}], 0x5, &(0x7f0000000540)=[{0x80, 0x112, 0xf2a, "e60108528fa38904e55400a677c596b31048543fc0f928ae3fd0e3ed8fe273812467fc8f93afd51f55bf83c2afed5a607d70dc39cd29e3ca012096ce2c289688e904d68889ba49945f8e156e9ce3c36aa48dabeb93bd15542bb3b9cf8774594af083db01b6b057e694ec4b10dc50bf034999"}], 0x80}}], 0x1, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) 2.311562641s ago: executing program 3 (id=2173): syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000740)={0x53, 0x0, 0xa, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000000)="2ff8a81b133d", 0x0, 0x0, 0x0, 0x0, 0x0}) 2.310396007s ago: executing program 1 (id=2174): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000007d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r5 = socket$nl_generic(0x10, 0x3, 0x10) socket$phonet_pipe(0x23, 0x5, 0x2) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000480)={0x38, r6, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x38}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r8 = socket$qrtr(0x2a, 0x2, 0x0) r9 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r9, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) r10 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') sendmsg$TIPC_NL_MON_SET(r10, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x24, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r11 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r11, 0x0, 0x27, &(0x7f0000000000)={@multicast2, @local, @local}, 0xc) preadv(r10, &(0x7f0000001b80)=[{&(0x7f0000000140)=""/105, 0x69}], 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) syz_clone3(&(0x7f0000001880)={0x120000200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) writev(r8, &(0x7f0000000340)=[{&(0x7f0000000080)="fb", 0x1}], 0x1) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r12, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) 2.189169983s ago: executing program 3 (id=2175): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x3b, 0x301, 0x2270bd24, 0x25dfdbff, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x40800}, 0x40000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="50000000100001042cbd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="58010500000000001400350073797a5f74756e000000000000000000050021000500000014001680100001800c000500"], 0x50}, 0x1, 0x0, 0x0, 0x5}, 0x40080) 2.098715068s ago: executing program 1 (id=2176): socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$alg(0x26, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x28, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) socket$kcm(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x3e8, 0xf, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68888a887", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x8000000}, 0x50) 2.098237153s ago: executing program 3 (id=2177): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) fsopen(&(0x7f0000000480)='jffs2\x00', 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000040), 0x0) getsockopt$inet_sctp_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f00000003c0), &(0x7f0000000440)=0x4) r0 = openat2$dir(0xffffff9c, 0x0, &(0x7f00000006c0)={0x2000, 0x0, 0xa}, 0x18) renameat2(r0, &(0x7f00000002c0)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffffff, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100008b}, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x0, 0x4, 0x110, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x2b, 0x80801, 0x1) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x8080, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7a, 0x0, 0x8000, 0x6, 0x3}, 0x0, &(0x7f0000000080)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000003}, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x49, 0x0, 0x80000000000008}]}) r2 = openat$vicodec0(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0185648, &(0x7f0000000500)={0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) recvmmsg(r3, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000140)=""/186, 0xba}, {&(0x7f0000002a00)=""/4096, 0x1000}], 0x2}, 0x1000}], 0x1, 0x0, 0x0) 2.097966035s ago: executing program 1 (id=2178): syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000740)={0x53, 0x0, 0xa, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000000)="2ff8a81b133d", 0x0, 0x0, 0x0, 0x0, 0x0}) (fail_nth: 2) 2.001765467s ago: executing program 1 (id=2179): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f0000003480)=[{{&(0x7f00000000c0)=@pppoe={0x18, 0x0, {0x0, @remote}}, 0x80, &(0x7f0000002e80)=[{&(0x7f0000000a40)=""/4096, 0x1000}, {&(0x7f0000001a40)=""/35, 0x23}, {&(0x7f0000001a80)=""/4096, 0x1000}, {&(0x7f0000002a80)=""/176, 0xb0}, {&(0x7f0000002b40)=""/196, 0xc4}, {&(0x7f0000002c40)=""/183, 0xb7}, {&(0x7f0000002d00)=""/162, 0xa2}, {&(0x7f0000002dc0)=""/151, 0x97}], 0x8, &(0x7f0000002ec0)=""/159, 0x9f}}, {{0x0, 0x0, &(0x7f0000003380)=[{&(0x7f0000002f80)=""/251, 0xfb}, {&(0x7f0000003080)=""/132, 0x84}, {&(0x7f0000003140)=""/242, 0xf2}, {&(0x7f0000003240)=""/51, 0x33}, {&(0x7f0000003280)=""/213, 0xd5}], 0x5, &(0x7f00000033c0)=""/163, 0xa3}, 0x6}], 0x2, 0x41, &(0x7f00000034c0)={0x0, 0x3938700}) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x80000001, 0x4) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) bind$tipc(r2, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) (async) bind$tipc(r2, 0x0, 0x0) (async) recvmmsg(r1, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/16, 0x10}], 0x1}, 0x3}], 0x1, 0x22, 0x0) (async) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="1403000030000100000100000400000001"], 0x314}], 0x1}, 0x800) 1.942158005s ago: executing program 2 (id=2180): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write(0xffffffffffffffff, &(0x7f0000000340), 0x11000) pipe(0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x480, 0x0) r2 = getpid() socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(r2, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x7ffe, 0x0, 0x9, 0xffffffff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(0xffffffffffffffff, 0x0, 0x0) gettid() r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r5) sendmsg$NFC_CMD_LLC_SET_PARAMS(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="abdbcc5315c846f0595d05dac94a40344d89cdbf0a07cc9e", @ANYRES16=r6, @ANYBLOB="01002dbd7400fedbdf250700e1000800810058ef51a699ea8ef14189b121e5edcd7c4d74f67a7cbabd2fcf2c0eba150ef417a6033692d8c057f9368ceb84ef1e838b7d8706c9cf1e3896f65951b91527aa5abb56c1b889ef71bb01bfb623db33540b3f70dfc121c3077d6840441602f2205e2e519968dadcc038c45d0d50651bb5"], 0x2c}, 0x1, 0x0, 0x0, 0x40810}, 0x4) ioctl$KVM_CAP_MEMORY_FAULT_INFO(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000200)) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000002500)=@raw={'raw\x00', 0x3c1, 0x3, 0x5f0, 0x3b8, 0xffffff80, 0x178, 0x0, 0x178, 0x520, 0x22b, 0x258, 0x520, 0x258, 0x2034, 0x0, {[{{@uncond, 0x1d, 0x398, 0x3b8, 0x340, {0x1e0002a8, 0x7203000000000000}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x1a, 0x64, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x6}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x8000}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0xa}, {}, {}, {0xfffc}]}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "e22e50439abb066265e088a63e13552b8b2fec412753ac647d17d2ebca69d17a9722bd2f5be411676d5993fb4cc74168209fb9f43b63bab2a88206d7dd8158d916b865d0f713f772c59ad6e6b572e9a6c498fb6459888a281e8c071a9a7229f9fe02cb8e9ba7637a2591a5367c770c87034734be6eda195ce135517efa85da52", 0x1}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x100, 0x168, 0x0, {}, [@common=@ah={{0x30}, {[], 0x0, 0x1}}, @common=@ipv6header={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x12, 0x0, 0x0, 0x0, '\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x650) r7 = socket(0x10, 0x2, 0x0) write(r7, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r7, &(0x7f0000002ec0), 0x0, 0x2, &(0x7f00000001c0)) r8 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') read$FUSE(r8, &(0x7f00000007c0)={0x2020}, 0x2020) sendmsg$nl_route_sched(r8, &(0x7f0000000640)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000002b40)=@deltaction={0x17c, 0x31, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@TCA_ACT_TAB={0x4}, @TCA_ACT_TAB={0x6c, 0x1, [{0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffffc}}, {0x14, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x10, 0x1e, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}, @TCA_ACT_TAB={0x54, 0x1, [{0x10, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe19}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xde}}, {0xc, 0x15, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @TCA_ACT_TAB={0x94, 0x1, [{0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xc}}, {0x14, 0x14, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xbb88}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3ff}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x185}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2d}}, {0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9ff9}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8bdc6132b197f0b6}, 0x40040) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000003c0)={'pcl818\x00', [0x4f23, 0x2, 0xfffffffd, 0x4000, 0x7, 0x5, 0x8, 0xd287, 0xa, 0xfd, 0xffeffffa, 0x23, 0x4, 0x1, 0x6, 0x101, 0xf7fffffe, 0x1ff, 0x2, 0x0, 0x10000008, 0x927, 0xeb96, 0x8401, 0x40f, 0xe69, 0x4, 0x10008, 0x3, 0x1cdc, 0xfbfffff8]}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000780)={0xfc78, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x20, 0x1, 0x1, 0x1}, 0x0}) 1.319477905s ago: executing program 0 (id=2184): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000007d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r5 = socket$nl_generic(0x10, 0x3, 0x10) socket$phonet_pipe(0x23, 0x5, 0x2) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000480)={0x38, r6, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x38}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r8 = socket$qrtr(0x2a, 0x2, 0x0) r9 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r9, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) r10 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') sendmsg$TIPC_NL_MON_SET(r10, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x24, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r11 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r11, 0x0, 0x27, &(0x7f0000000000)={@multicast2, @local, @local}, 0xc) preadv(r10, &(0x7f0000001b80)=[{&(0x7f0000000140)=""/105, 0x69}], 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) syz_clone3(&(0x7f0000001880)={0x120000200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) writev(r8, &(0x7f0000000340)=[{&(0x7f0000000080)="fb", 0x1}], 0x1) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r12, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) 1.228032124s ago: executing program 0 (id=2185): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x14, r1, 0x1, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x24040090}, 0xc0) r2 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000040), r0) sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r2, 0x402, 0x70bd28, 0x25dfdbfd, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004805}, 0x0) 1.179242784s ago: executing program 0 (id=2186): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x48}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000780)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xe, 0x0, &(0x7f0000000380)="fc5cc45c490704289349a8af1d21", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 1.178357311s ago: executing program 3 (id=2187): socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000000280)={0x0, 0xffff, 0x0, 0x0, 0x0}) prlimit64(r0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(r0, 0x6, &(0x7f0000000240)=0xffffff30) r1 = getpid() sched_setscheduler(r1, 0x3, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, 0xffffffffffffffff, 0x0) mprotect(&(0x7f000010a000/0x3000)=nil, 0x3000, 0x1000009) unlink(&(0x7f0000000180)='./bus\x00') recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_queued_recursive\x00', 0x26e1, 0x0) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000340)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800, 0x0, 0x0, 0x1, 0xffff}, 0x20) add_key$fscrypt_v1(0x0, &(0x7f0000000300)={'fscrypt:', @desc4}, 0x0, 0x0, 0xffffffffffffffff) openat$mixer(0xffffffffffffff9c, &(0x7f0000000700), 0x101180, 0x0) ioctl$TCFLSH(r4, 0x540b, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmsg(r6, 0x0, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000100)={@private1, 0x3eff, 0x1, 0x3, 0xd, 0x2}, 0x20) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040), 0xc, 0x0}, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r7, 0x0, 0x0) getsockopt$inet_mptcp_buf(r7, 0x11c, 0x1, &(0x7f0000000480)=""/196, &(0x7f0000000080)=0xc4) r8 = socket(0x10, 0x803, 0x0) setsockopt$sock_int(r8, 0x1, 0x22, &(0x7f0000000380)=0xc, 0x4) 998.83579ms ago: executing program 1 (id=2188): r0 = socket$inet_sctp(0x2, 0x1, 0x84) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x3c, &(0x7f0000000000)=[@in={0x2, 0x4e20, @multicast1}, @in6={0xa, 0x4e22, 0x800, @loopback, 0xeb6}, @in={0x2, 0x4e22, @rand_addr=0x64010101}]}, &(0x7f0000000080)=0xc) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f00000000c0)={r1, 0x8}, &(0x7f0000000100)=0x8) (async) r2 = openat$zero(0xffffff9c, &(0x7f0000000140), 0x418001, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x4}}, [@NFT_MSG_DELRULE={0x134, 0x8, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x6}, [@NFTA_RULE_EXPRESSIONS={0xe4, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5}, @NFTA_CT_DIRECTION={0x5, 0x3, 0x1}]}}}, {0x10, 0x1, 0x0, 0x1, @last={{0x9}, @void}}, {0x20, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_TTL={0x5, 0x2, 0xf1}]}}}, {0x10, 0x1, 0x0, 0x1, @tproxy={{0xb}, @void}}, {0xc, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}, {0x2c, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x8d1}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x81}]}}}, {0x24, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}]}}}, {0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x3e}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_COMPAT={0x1c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x6c}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x5c}]}, @NFTA_RULE_ID={0x8}]}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELOBJ={0x6c, 0x14, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_USERDATA={0x10, 0x8, "212c5c8db0c3bc8513a2c492"}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x1e8}, 0x1, 0x0, 0x0, 0x40}, 0x1) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = fsopen(&(0x7f0000000440)='qnx4\x00', 0x1) (async) read(0xffffffffffffffff, &(0x7f0000000480)=""/71, 0x47) (async) connect$netlink(r2, &(0x7f0000000500)=@unspec, 0xc) sendmsg$NFT_MSG_GETRULE(r2, &(0x7f0000000b40)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000580)={0x548, 0x7, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}, @NFTA_RULE_EXPRESSIONS={0x2e0, 0x4, 0x0, 0x1, [{0x2b4, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x2a8, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_DATA={0x27c, 0x3, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xd3, 0x1, "888305a6f5a16f445b83c131d9a54dcf21eb37670f36c039d398b6360ae82a7730b325c17ace4e79f6fa45c2db4ddf4f875535aa20190731de2c9215678322792d7f36f7023768bd9f7c59ea4429b63786b09abcae5b8d191cfbba8af4bb1fe23d862645e18afdb2898ba541b416ca2c48985f3c14ab06ae304f2fa5b6190b66d027a9fb780ca39dcdf9c4168fc0711e5ecf85fe0bc03b4a90e623a3aa95d9e6fc4d58a31a88bbac707b419b0ef4b6862fec5151411c7270c6e4ec34bdf3afc95564540803090f5d6ed34ce0b280ab"}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x78, 0x1, "91670e2132a5553e44582e916216da38bc549006ceb2aea470fe7d08e37399427f0d18113e41d44b1784a4fbf50e08974a72ab6825fd120edf88ac97c446c46eef11f20df4a490f3aa825cdc8c3ef362ef229302b09f051ae6d9ad140ba9f917ccbebd1adb2e4fa32f5632d788e729f3405a51f2"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VALUE={0xef, 0x1, "6dd8bd11108973e70a1a8304b99ef2e8ed2ac8e067b07d6b73b2cb7962307ab55303f5bb93df1793dad028ed65163871520fd816d1462e167efed6f3bb7ee0efaea08a2b217e25747d740d589833990e6b647cb3dae2206b6a7b116075b211fcab2ae36551e22153b3ea3099061ff6e4d7842d8f65762421a4ca366e960cf9ae8fdda313711ed156c9b18440ad1c15892069ab3cc0cb535738b27bbde54073aa62ce8832d6e58301f52d351894feb2cf242dbc4dbf83686117f1a6014ae1f0edf85e530eb87694b55ba0f7481a8abfced6973d9a790a8983025fdb0f91939b4d65801304b225db317c1d72"}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}, {0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_FIB_RESULT={0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_RULE_COMPAT={0xc, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8}]}, @NFTA_RULE_COMPAT={0x4c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x88be}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x892f}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x67}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x2b}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x809b}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x88ca}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x5c}]}, @NFTA_RULE_EXPRESSIONS={0x1c4, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_DUP_SREG_DEV={0x8}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x15}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x1b}]}}}, {0x38, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x10}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x10}, @NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0xa}]}}}, {0xa8, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x98, 0x2, 0x0, 0x1, [@NFTA_INNER_NUM={0x8}, @NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0x18}, @NFTA_INNER_EXPR={0x10, 0x5, 0x0, 0x1, @payload={{0xc}, @void}}, @NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x8b}, @NFTA_INNER_EXPR={0x64, 0x5, 0x0, 0x1, @payload={{0xc}, @val={0x54, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_CSUM_FLAGS={0x8}, @NFTA_PAYLOAD_CSUM_TYPE={0x8}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x72}, @NFTA_PAYLOAD_SREG={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x9c}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x1d}]}}}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0xc}]}}}, {0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}, {0x38, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_ID={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x15}]}}}, {0x10, 0x1, 0x0, 0x1, @queue={{0xa}, @void}}, {0x2c, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_DYNSET_SET_ID={0x8}, @NFTA_DYNSET_OP={0x8}, @NFTA_DYNSET_SREG_DATA={0x8, 0x5, 0x1, 0x0, 0xc}]}}}, {0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}]}]}, 0x548}, 0x1, 0x0, 0x0, 0x2}, 0x20000000) (async) r5 = openat$vhost_vsock(0xffffff9c, &(0x7f0000000b80), 0x2, 0x0) ioctl$XFS_IOC_FREE_EOFBLOCKS(r5, 0x8080583a, &(0x7f0000000bc0)={0x5, 0x8, 0x0, 0x2, 0xffffffff, 0x0, 0x6}) (async) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_XSAVE(r6, 0x5000aea5, &(0x7f0000000c40)={[0x7fffffff, 0x1bd5, 0x137, 0x400, 0x1, 0xffffff80, 0xe, 0xc, 0x3, 0x8, 0x4, 0x7, 0x9, 0xa8e7, 0xc2e1, 0x9, 0x2, 0xfff, 0x5, 0x80000000, 0x0, 0x2, 0x8, 0x7, 0x0, 0x7ff, 0x0, 0x6, 0x2, 0x6, 0x7, 0x6, 0xffff2a7f, 0x33c0932e, 0x58, 0x9, 0x3, 0x6, 0x83, 0x9, 0xc2, 0x67, 0x6, 0x102b, 0x5, 0x8, 0xfffff677, 0x5, 0x74b4, 0x8000, 0x3, 0xe2f, 0x1ff, 0x2, 0x0, 0x1, 0x5, 0xa, 0x7, 0x10001, 0x7, 0x1, 0xffffffff, 0x2, 0x2, 0x4, 0x1, 0x2, 0x9, 0x7, 0x2, 0x4, 0x4, 0x904, 0x10001, 0x7, 0x8, 0x8001, 0x2, 0x6, 0x6a8e, 0x2, 0x0, 0x6, 0x9, 0x8001, 0x9, 0x8, 0x5, 0xe42, 0x0, 0x2e2, 0x6, 0x5, 0x4, 0x6, 0x9, 0x90e2, 0x6, 0x5, 0x8, 0x660e, 0x3, 0x1000, 0x5, 0x4, 0x5, 0xffff, 0x6, 0x0, 0x1, 0x83, 0x4, 0xd3, 0xe6, 0x7, 0xb1ed, 0x1ff, 0x99, 0x1, 0x100, 0xcb, 0x7343b504, 0x537, 0x400, 0x0, 0x7, 0xffff, 0x0, 0x8000, 0xffffffff, 0xa62, 0x8, 0xffffff82, 0x2, 0x5, 0x9, 0x8, 0x2, 0xff, 0x40, 0xfff, 0x57d, 0x1000, 0x5, 0x2, 0x7, 0xf, 0x5, 0x0, 0x1, 0x3, 0x5, 0x7f, 0xc9, 0x7, 0x0, 0x3, 0x7, 0x4, 0x4, 0x8, 0x80000000, 0x6, 0x8, 0x1, 0x3, 0x9, 0x9, 0x9, 0x2, 0x6, 0xd31c, 0xffff, 0x8, 0x0, 0xfffffffc, 0x1, 0x10000, 0x9, 0x2, 0x88, 0xfffffffd, 0x6, 0x1, 0x0, 0x7, 0x9, 0x8, 0xa, 0x3ff, 0x9, 0xc, 0x100, 0x4, 0x1, 0xffff, 0x81, 0x3, 0x5, 0x5f, 0x9, 0x3ff, 0x2d, 0xffffff01, 0x6, 0x4, 0x1, 0x8, 0x6, 0x346e6cbe, 0x5, 0x2, 0x5, 0x7, 0xdc23, 0x8, 0x1, 0x2, 0x3, 0x3, 0x9, 0x1, 0x4, 0x6, 0x80000, 0x2, 0xe, 0x6cd8, 0x1, 0x401, 0x7, 0x80000000, 0x2, 0xff, 0x6, 0x3, 0x5, 0xfffffffb, 0x1, 0x8001, 0x80000000, 0x8, 0x8, 0x3, 0x4, 0x9, 0x0, 0x4, 0x0, 0x101, 0x6, 0x7a, 0xfd57, 0xfffffffa, 0x9275, 0x1, 0x6, 0x9, 0xffff, 0xd, 0x3, 0x8d, 0x4, 0x101, 0x400, 0x10000, 0x0, 0x200, 0x2, 0x5, 0xfffffff7, 0x9, 0x8, 0x9, 0x80, 0x0, 0x7, 0x5b4c5728, 0x401, 0x1, 0x80000001, 0x5, 0x2, 0xd7, 0x5, 0x4, 0x7, 0xffffa71f, 0x3, 0x3ff, 0x3ff, 0x7, 0x200, 0x6, 0x87ea, 0x879, 0xd, 0x1ff, 0x7, 0x0, 0x0, 0x4, 0xfffffff2, 0x6, 0xffffffff, 0x6, 0x0, 0xc, 0xff, 0x8, 0x9, 0x6, 0xffffcaa5, 0x3, 0x683, 0x5, 0x0, 0xfd8, 0x4, 0x8, 0x5, 0x7, 0x9, 0xa4c, 0x3, 0x6, 0x5, 0x8, 0x8, 0x2, 0x2, 0x8, 0x8, 0xffff8001, 0x8, 0x4e6d16bd, 0xffff8000, 0x0, 0xc98, 0xfffffff7, 0x9a42, 0x9, 0xd1, 0xc089, 0x40, 0x0, 0x3, 0xcf, 0x7, 0x1d97, 0x22, 0x5, 0x9, 0x6, 0x2, 0x8, 0x400, 0x6, 0x2, 0x0, 0x5, 0x20, 0x7, 0x1, 0x5, 0x0, 0x9, 0x1, 0x1, 0x4, 0x2, 0x2, 0x9, 0x8, 0xc, 0xffffffbe, 0x8, 0x0, 0x6, 0x4, 0x7fff, 0xfffff294, 0x3, 0x822a, 0x7, 0x2, 0xc2e, 0x7fffffff, 0x80, 0xec53, 0x9, 0x5, 0x2f, 0x2, 0x7466, 0x80000001, 0x400, 0x9, 0x8, 0xf, 0xcf, 0xf4, 0x9, 0x4, 0x1, 0x1, 0x80000000, 0x4, 0x4, 0x81, 0x200, 0x5, 0xa52c, 0x1, 0xfffffffc, 0x81, 0x11f, 0x5, 0x6, 0x1000, 0x6a5, 0x0, 0x1000, 0x2, 0x4, 0x2, 0xc, 0x1, 0x3, 0x7, 0x3, 0x1, 0x1, 0x1, 0x6, 0xb, 0x7, 0x999d, 0x6, 0xde74, 0x5, 0x4, 0x9a34, 0x6, 0x2, 0x9, 0x8, 0x3, 0x7, 0x5, 0xce, 0xf0000000, 0x0, 0x6, 0x1, 0x6, 0xfffffffb, 0x5, 0x4, 0x6, 0x4, 0x1, 0x8, 0x8, 0x0, 0x6, 0x2, 0x2, 0x5, 0xb55, 0x8f8, 0x3, 0x3ff, 0x6, 0x5, 0x5, 0x8, 0x5, 0x9, 0xfffffff8, 0x200, 0x0, 0x7, 0x4, 0x8, 0x7, 0x6ac, 0xa570, 0xc, 0x2, 0x100, 0x9, 0xf1fb, 0x0, 0x3, 0x4, 0x0, 0x200, 0x2, 0x7f, 0x9, 0x1, 0xac9b, 0x0, 0x0, 0xd, 0x1, 0x8, 0x2c90, 0x401, 0x401, 0x9, 0x6, 0x5, 0x0, 0xb, 0x6, 0x35, 0x4c, 0x8, 0x4, 0x85, 0x7, 0x8, 0x20, 0x6, 0x10000, 0x243e, 0xaf, 0x8001, 0x7, 0xe0, 0x18000000, 0x58e4, 0x7ff, 0xfffffffb, 0x2, 0x4f, 0xeb, 0xc, 0x5, 0xff, 0x9, 0x9, 0x3f, 0x7fff, 0x7, 0x6, 0x10, 0x4, 0x0, 0xf, 0x9, 0x0, 0x7, 0x1, 0xc2c, 0x1ff, 0x3, 0x70a4, 0x59de, 0x9, 0x5, 0xe81e, 0xf42, 0x1, 0x8, 0x8, 0x9, 0xffff, 0xe, 0x8, 0xef, 0x6, 0x9cd, 0x4, 0xcc, 0x3, 0x8, 0xa53f, 0x1, 0x4, 0x3, 0x3ff, 0x62a, 0x2, 0xf33, 0x8, 0x1, 0xd, 0x3, 0x9, 0x6, 0x400, 0x5, 0xe48, 0x9, 0x2, 0x401, 0x7, 0x6ef6, 0x18000, 0x4, 0xfff, 0x7, 0x2, 0x4, 0x0, 0xc, 0x41, 0xc3, 0x0, 0x8, 0x4, 0x9, 0x8, 0xb, 0x0, 0x0, 0x5, 0x8001, 0x4, 0x4, 0x2, 0x80000000, 0x3, 0x5, 0x1000, 0xa1, 0x7ff, 0x8, 0x1000, 0x9, 0x8, 0x80, 0x8, 0x5, 0xffffffff, 0x5, 0x37, 0x2, 0x10, 0x51c0000, 0x1, 0x5, 0x2, 0x0, 0x80, 0xb33, 0x3, 0x5, 0xd, 0x1, 0x65, 0x4, 0x1161, 0x31, 0x8, 0x6, 0x4, 0x5, 0x8, 0x687, 0x11cb, 0x2, 0x6, 0x1ff, 0x1, 0xffff4494, 0x3, 0x12000000, 0x7, 0xffffff80, 0x8, 0xf7, 0x7fffffff, 0x7, 0x9, 0x5, 0x6, 0x8, 0xc, 0xde2, 0xe, 0x7, 0xf8000000, 0x1, 0x4, 0x9, 0x7, 0x6, 0x2, 0x0, 0x3, 0x3a, 0x4, 0x4, 0x96b2, 0xcaa6, 0x7, 0x92, 0xc, 0x9, 0x4, 0x7515e9b4, 0x9, 0x0, 0x8, 0x3e95, 0x7ff, 0x0, 0x3ff, 0x2, 0x5, 0x8, 0x2, 0xd, 0x8000, 0x7f, 0x0, 0x6, 0x3b, 0xd, 0x7, 0x6, 0x5, 0x1, 0x2417, 0x2, 0x3f85, 0x2b9, 0x1, 0x4, 0x9, 0x10001, 0x7ff, 0x6, 0x8, 0x6, 0x2, 0x2, 0x0, 0x8, 0x4, 0x5, 0x1, 0xffffffff, 0x6, 0x4, 0x87, 0x8, 0x92c1, 0x1ff, 0x64000000, 0x5, 0x7, 0x9, 0x2, 0x84, 0x5, 0x1, 0xffffff7f, 0xc351, 0x2, 0xbff, 0x0, 0x8, 0x80, 0x3, 0x4, 0x0, 0x7fff, 0xb0be, 0xfffffff7, 0x3, 0x1, 0xf, 0x8, 0x1, 0x546, 0x1, 0x2, 0x7, 0x8, 0x5, 0x800, 0x9, 0x5, 0x7, 0x3, 0xfff, 0x8, 0x7f, 0x5, 0x1, 0x6, 0x69f, 0x40000000, 0x6c, 0x0, 0x80000001, 0x0, 0x19, 0x7, 0x5, 0x7fffffff, 0x9f6, 0x3, 0x6, 0x8, 0x80, 0x7fff, 0x1000, 0x67e, 0x218f, 0xf7, 0x9, 0x8, 0x2, 0x6, 0x1, 0x5, 0x3, 0xffffffff, 0x80, 0xfffffffa, 0xac9, 0x4, 0x7, 0xc, 0x6, 0xd26, 0x0, 0x401, 0x8, 0x81, 0x10001, 0xe4a, 0x8, 0x8, 0x5, 0x40, 0x7, 0x8, 0x8, 0x5, 0x7f, 0x4c, 0xc0000, 0x5, 0x1, 0xa1, 0x1ff, 0x2, 0x8, 0xe4, 0x2, 0x8, 0x0, 0xc51, 0x101, 0x4, 0x4, 0x2, 0x1, 0x0, 0x1, 0x3, 0x3, 0xb, 0xf, 0x3, 0x0, 0x101, 0xa0c, 0x0, 0x9, 0x101, 0x3, 0x1, 0x3, 0xcd4, 0x6a96, 0x7, 0x312c, 0x4, 0x6, 0x3, 0x3, 0x6f32, 0x200, 0x2, 0x3, 0xfffffff9, 0x54, 0x0, 0x6f79, 0x1, 0x0, 0xff, 0x5, 0x4, 0x2000000, 0x4dc4, 0x8d, 0x7, 0x6f2d, 0xe413, 0x8, 0x8, 0x8, 0x1d8, 0xc9f, 0x5, 0x9f, 0x3, 0x1, 0xfffffeff, 0x4, 0x1, 0x5, 0xa780, 0x1, 0x3, 0x7, 0xfe, 0x1, 0x9, 0x9, 0x8, 0x10001, 0x1, 0xc, 0xda7c59ee, 0x3c5, 0xf1d, 0x2, 0x71, 0x7, 0x12c, 0xeb4, 0x10, 0x3, 0x7, 0x4, 0x4, 0x5, 0x4b17, 0x8, 0x800, 0x8, 0x4, 0x0, 0x400, 0xa, 0x7fff, 0x8000, 0x5, 0x244d, 0x6, 0x3, 0x4, 0x4, 0xb, 0x5, 0x9, 0x0, 0x3, 0x0, 0x9, 0x8, 0x6, 0x7, 0x0, 0x0, 0x3, 0x101, 0x8, 0x7, 0x2f9f, 0xfffffffd, 0x3, 0x800, 0xfffffffd, 0x0, 0x4, 0x8, 0xb, 0x9, 0x102, 0x7fffffff, 0x81, 0x0, 0x0, 0x0, 0x5, 0x6, 0x6, 0xffffd285, 0x6, 0x55a, 0x5, 0x80000000, 0x1, 0x5, 0x3, 0x9, 0xfff, 0x3, 0x1, 0xfffffff8, 0x3fdc, 0x4, 0x3, 0x8, 0x7, 0xce5, 0x8, 0x6, 0x7fff, 0x2, 0xd]}) (async) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f0000001cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000001c80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000001d00)={&(0x7f0000001c40)=[0x0], 0x1, r7}) (async) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000001d80)={0xd0002001}) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001e00), r2) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r2, &(0x7f0000002040)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000002000)={&(0x7f0000001e40)={0x1ac, r8, 0x400, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x10, 0x21}}}}, [@NL80211_ATTR_NAN_FUNC={0x44, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_TTL={0x8, 0xa, 0x6}, @NL80211_NAN_FUNC_FOLLOW_UP_ID={0x5, 0x6, 0x8}, @NL80211_NAN_FUNC_SRF={0xc, 0xc, 0x0, 0x1, [@NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x5b}]}, @NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE={0x4}, @NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID={0x5, 0x7, 0x7}, @NL80211_NAN_FUNC_INSTANCE_ID={0x5}, @NL80211_NAN_FUNC_FOLLOW_UP_DEST={0xa}, @NL80211_NAN_FUNC_CLOSE_RANGE={0x4}]}, @NL80211_ATTR_NAN_FUNC={0x3c, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID={0x5, 0x7, 0x2}, @NL80211_NAN_FUNC_FOLLOW_UP_DEST={0xa}, @NL80211_NAN_FUNC_INSTANCE_ID={0x5}, @NL80211_NAN_FUNC_SRF={0x8, 0xc, 0x0, 0x1, [@NL80211_NAN_SRF_INCLUDE={0x4}]}, @NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID={0x5, 0x7, 0x14}, @NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE={0x4}, @NL80211_NAN_FUNC_CLOSE_RANGE={0x4}, @NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE={0x4}]}, @NL80211_ATTR_NAN_FUNC={0x8c, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_SERVICE_INFO={0x55, 0xb, "58efcff55295c17a58820dcc6c63bbfe93a5f0314da4cc8dda2461a7b6beeb0cbf8a3852fcb0050d8397a10f991a2c0ea364555eeaf99f939142818293323ca31bc8fa6e2a87173baffded872efa42e546"}, @NL80211_NAN_FUNC_INSTANCE_ID={0x5, 0xf, 0xa}, @NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE={0x4}, @NL80211_NAN_FUNC_TTL={0x8, 0xa, 0x3}, @NL80211_NAN_FUNC_FOLLOW_UP_ID={0x5, 0x6, 0xa7}, @NL80211_NAN_FUNC_TERM_REASON={0x5, 0x10, 0xa}, @NL80211_NAN_FUNC_FOLLOW_UP_DEST={0xa}]}, @NL80211_ATTR_NAN_FUNC={0x80, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_TYPE={0x5}, @NL80211_NAN_FUNC_FOLLOW_UP_DEST={0xa}, @NL80211_NAN_FUNC_SRF={0x14, 0xc, 0x0, 0x1, [@NL80211_NAN_SRF_INCLUDE={0x4}, @NL80211_NAN_SRF_INCLUDE={0x4}, @NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x7c}]}, @NL80211_NAN_FUNC_TYPE={0x5}, @NL80211_NAN_FUNC_RX_MATCH_FILTER={0x4c, 0xd, 0x0, 0x1, [{0x47, 0x0, "c57a88a753471faaae22c2cb15e1342a4aaad59ecd92d650a2cf8e3ad87ff59df22183cc536b9e5c5ba94aa8c249f8108178b6e78cade57a523db4d46e2428a79ebb67"}]}]}]}, 0x1ac}, 0x1, 0x0, 0x0, 0x10}, 0x2400c084) (async) syz_clone3(&(0x7f0000002300)={0x20000, &(0x7f0000002080)=0xffffffffffffffff, &(0x7f00000020c0), &(0x7f0000002100)=0x0, {0x23}, &(0x7f0000002140)=""/209, 0xd1, &(0x7f0000002240)=""/97, &(0x7f00000022c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3, {r2}}, 0x58) tkill(r10, 0xa) (async) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000002380)={'vlan1\x00', 0x6}) (async) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f00000023c0)=@x={0x94, 0x6, "24a062292735"}) r11 = openat$binder_debug(0xffffff9c, &(0x7f0000002700)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) io_submit(0x0, 0x7, &(0x7f0000003a40)=[&(0x7f00000024c0)={0x0, 0x0, 0x0, 0x0, 0x101, r4, &(0x7f0000002400)="e61cc6e7e7a0de0a169349198e0666f050732a291e309b44e03aadfb00f10aee970884ef1848789df5a18d80a4f4b40725cf085bd21bef222543966997ab8aee589f5a25959ae8f059bac229271a1030feb49f5a68819cb8fb0060a10e8a110262a71c1e9995680839728c1db116857819511e9bf0833689d343ba3fd4a8a5323467ceb1e859a0f7d8311826a43f89", 0x8f, 0x9, 0x0, 0x0, r2}, &(0x7f0000002540)={0x0, 0x0, 0x0, 0x2, 0x6c, 0xffffffffffffffff, &(0x7f0000002500)="6c99164b524c8845ad99", 0xa, 0x0, 0x0, 0x0, r2}, &(0x7f00000025c0)={0x0, 0x0, 0x0, 0x5, 0x0, r9, &(0x7f0000002580)='&R9\nk', 0x5, 0x2, 0x0, 0x2, r2}, &(0x7f0000002740)={0x0, 0x0, 0x0, 0x7, 0x4, r5, &(0x7f0000002600)="ccec939c6bacd145f46334932dc026ca5bf7b48e57163ec4d3e2e3bac3696e3caf78172706803eb2ed3a25cb93e156608d263231753869772b313ab7c71a3b93fd521f3eb6c32be760be4958b28f03c7eaef540198ebd31ddda797b5c54fd2ededb52aad6a9839107011ec20bc0dadaee2a8d1eb5d587a3304fb06a34fcce53d6d13a19719a4dd2202efa0a129608741ea6ece8adce9e50e5f6ddef1b928481c270a457ac8183d8c779b57ffdae22086011ebe1d9bebbc26722f33c2f88c032ee9446efd37daef89d79615c5b66daf11e21c17b3eee71e463f7c98bfa9dd1c871133b9cf3a3c03f8439590153626ec47bc7cf19a035e", 0xf6, 0x9, 0x0, 0x0, r11}, &(0x7f0000002880)={0x0, 0x0, 0x0, 0x5, 0x2, r4, &(0x7f0000002780)="581e7f5a84d1467073c525c28cba67a739ad9ddeecb8f446eef3fd3c5d676bb112596ed3703c7d540d19d15443800b744bc8bd2e0a8c07287b3e6e52080b210eba494abd7d9ad06fde6d4a1189c8bf6b273ba97a57f8bdf511fcc959bb5f54077b83cc47fc064e3dce67854649d4edc6252ebd60fde4f20d6d0919b55cd9226391af2b3b63eae9068c672044f21f81ec8b8f083ea0626d45a535fdfea110d032da2ba8801554eecfd0a6773ce295588a56d7028135f9a18c92849d69642763da31062f79fba26116eeff9cb7516376ce", 0xd0, 0x6, 0x0, 0x3}, &(0x7f00000038c0)={0x0, 0x0, 0x0, 0x8, 0x6, r3, &(0x7f00000028c0)="34cee7a73ba83925e80d1184505a9c9318b4022ba4cbb96ed563ff3f6e5bc03ebafe3f75845a4b37d2372f4f16dbcd888d6fe3beb2500926ef11cfac6650d75d24d7789bc5e7ea3f97fd6f55a1e70a7087d99185fd358388d65caba225eba418b60670d41c177d070ba99979d20f6422a8892c806e449fefbd7406277dec48f8f4fa37124c24cd449cbd976cbc433e2e034dd93e082552f361cfc719a150dfda2b8e1797f30fce370e1222bc529738552ff7fdc0bb2dfff26fe7905e2da5a4e8bfa30c4223ac297a8c6717047b5a67b7bae5112fa1cae882c6b1d054bfdca3bad9d964d47041dc7861cae9a190f8b9e356b3fbe96a8035f71dbda3867be904dee8c7343106ac9477094d1b44a86523561117eaff5a2a90576c2789a944f938b91b29e8bcfbdf07bd6619f98f54a481ac85777b310f88b90f0bd76b1d518797a19091288da1763107f725d0f5919753c374f35488cfc47dbf46b0cec77421428f41cd4a044b22f810433d03e550c3c991d1aa4c5fc71a54da6e775aabd241e2d55f25de3a994099e26fc9e951f03b1a5384fb23b350ba76d650becc52b60601bcc8d3bcb8ab5236dcbc213aee544bca36d2e8832994bc698996621a9d3f1edf355c7d34cb27407348c65cadb58cea06a1ccb1b1794c3d628654aecaa8b3a795caa1a4ec9e96c10fdba1489d5ce3c71a441c461f0a096e3f7e8932fcc4cd3878ce384582cb8fe2bc188c7648f95d7e6b3ad88953c6b6a316f99e6c284d4bd8df1ff9732ed8fef7e2e2bbe2f6ad24b5b6e913aa20618036b45a0bb1a9176618743389b1c4607b4a7f05835f905b952d417491539a9e4629f6a78d260880aa389788915c9b903109ea65cc57351e2210b45a4444f9eed00591ce74437c72401001848f1020d1ba135227129dc671879fc96f4442e3908aa26688f43f7550a2c7993f2afd97e89a3bfa0ed3bf136d39c07688955a59baed2edb0c3867c35fd9f963813c43bc9f4111c3753230dcecaca44187bf88fea310c72f31bdcc842ba1d5e3fb9c04c4fd9e1a81ff43ec1b86ecf2d598187ae2f4c3e9b471aa68613facc3a246d234dd1219d7a64e90acee4e5c058ea7c635053df98fd42cff1cd4759f02662adee4cc7773df1ea260b570a4a7b28f9a050ba2cfa2e67aa8938c36b589c8708fc3777e91a25caf1624f5533a101ffbcbe6859a2ee0b0419dc226e50b44990c293cc585a04bdba0fff5a96bb1e6ce8fa99f7c5bf6bbc160568d560179185ac9cf842c00f4ced7c2f8e76ed3d116c2bd87fc0b412f5973225efe7dbb18f81e415a016dcf8507bbaa5dadc43406e7f58b0d337f8566ad18fa40bfa187878e7c50b856df5fa4dde63f1e493c4c1422a38a342c88a384ba95ec32ed8ddcae2d8f7aa0ac9dc397e3a9aa9ffaa71e7567bc2868f7bfb714b814f0d1bd0f3ed18cedae9e6cd4328d46f9c57192e557b68b77f9742f565d72cf83613db1aa492e6d3b3bea25fb012d7e6dd79b89add26160a6a333dc8f5e19b4d56573512b5e234b3d7d303ef1a93890b2c11cf131e81a7da30d8cd5e2818700e2da394820ba207289ed3410695029119dc8cd130b20438aafd4e5b38f8c3c4461d43e6c1ef6b689c5ed881ccd5459ed9da41c398303252fcf44dd79a48d802b8331ceaa918539e98bf54738c06bbd7ad978a6bd8ed950463a93d2ad9b0b16aefe633884b644df3e7e7e1d6ace10b670977dc798f4c0aa9843d795fd50ce2fa96eb4b361c6ae8d2424281a454c5a5d970cbcfed0b3fe644ef7febfe2902e4d3a4a319edf70f7c03c00fc53658ea8524fb223c491d17d7892037644f9c58f20bc2205fed8564531b0eef836b8ecf69e8393f9946d8e97f6d3aec2fa73239e12f4ae9e95680dd8743744a14037a08dfc3336d4a95f6cb24b1520d595ab20e66c2245236c85537095de20eae0c1b3f59b5fa6316be5376f16260031b36a15a64ab9e5c9c7eae881bf46f0dab2ca7f07ff1c630335f4dcc29e68185ff393be9df740684638a870398dee9f5e0855f83530ddda9956c3fecb9658e556dcccd2ef4b6dbb763bcda39a1dea5263cf97333c56f14ffe59e1ef682aaecd271d99c6c4cb78d1ee0b1e996ed80562135bc1fd449d076b679b213498c54fe2ab2525877cb3d1ba6aba7c8bccf7829051002cb2163609e5a8df631376deb5c80e2fd3ebf5556a4af3e26519590cf4e3bccd2458696c07fb404f3a246a68d53b2324bf5b70b0346fc6e6214a3dc5854d4e6f9736bb82bb9f4d993c86823f305fac98ffeeb54511230892b99d3d3f39c4bf426adead2d66e7b6b552dd09fb0cd89519361f25c51fc0e3e3152e65dc5261eb56ae6b4325b790815274bc4ae266e924b6422898bbd481d6546153000ddbe5499de43df72da902843769908bb731fc2c34ead7803513b814e2767e1f3e20461a66451cfc00e935888a47ede724ccbe38165f236f80b7c68d6a77d7a5f1f09b5643ebee1fb2681ced288e22bf9da84a3f8d004f7e70203939112da76e82514529e3e59044f68c4a60284955dc12311663ff9b38c8c4346c1e2c96a7f3b45d33e578fde3a165ede8118bd726c3f14fcb78b91df38812dbbbafa216e9b28f8cfe56697119b907bcf16e969920ae8bbc840d3000c583f6cced3e2c093446bf402db31226a84105f834e799643615d043b009b807f9fe694f6be58f0b970ebaea050e4d052cbea95818545171ad25388a155c5e7a4d7d37d35526ea604d30812607295b57cf25ccf2a92b35c0139f162eb17bf5becaa91973cd6f098bda2569d71bdceee8df72dfdc4523f919e694453e51fa847cec66b5e6b2fd7372c8ad2d15a771029666238be4bbfb824739750e0a4f8fea0288e6601aaf549598c7afae3d06529585357f5b4bba8ffd0ff83ec668a722f5b5d4dcb1b103862dcbe472c66595e6fa32d88fba1333c6ff1bfed2a18284517e3ec2ae1936dbf32f2445ffc954622639b761908f7e4257d1d7aeae017137237bf0edcc8bc227acea216517311c0d8439e216fb8cdc74cca1407f13fc884e5c86fd1cfdab4feb174db3bd420ab3007d2d10716605658fbb20b375ffe4f50e2acda976dcf2191efe769cae72aa86d884f39435d039d721ef6370e38d61e1d39f294a0d1537effa3ce4d3fe53d9daedf3e5d36bf70f012a82c1e695d531416c35120d0ea492a0c02839287ec2e7a729a8a9efbf111e466705722fbcaa1317395db32b2e22f80dba0f5dd6484750f454ed7327f9b68f629fe7bd25247ee0aa6a3b3d6c056b93145f9c067b2e365e0d820e6812b1d4c5e73a8dcd1bb3083f859dab451ea2594780a19e3dd6c0f0c23dd9c83c6d5e75173623048151e4e3a71394ef278935d2b1c9b75384794531ff479a1a080c35e459d62250f540fd7849487f0c2072abda30f9faa06349333470306dc65a6a9e81ea946076ee7477af92d52cb99a20988441c11532d20965048be34b779be7627e99e387b498964a3a2e2e930984b9182c9c26154ef997b7a3cd8e94e5c6d28b120d6bd794a01ae8cf9689e3a5fbdfd2d5467be6b98d59f54fc03750ba3a3fccb7fdaaf5119ae64db74cfc048823f66df7e5746c5266c0603dd01a4195b58350fa15a238f0d070755e75026f49ab3ed113295cd2a972974a8d56fb8658231cdee548d83758b5ec107475b007068b557967ba78e5ad0096c8e01ee6f79f42ac422e3d027c24e5774ccefb12ccc4cac553be90c78ab89c49009220ae6629745d09911d6b59b5637cb70c99a76990cfdde9e7965d5c501cd9b2c4ddde2e7a3ff80165ee63c0f9bc621bd4b7f582ec051d19b8b8c687909b34734003f4fc6671fcb028028418e60a81b76775c306c76889b4ed40c18f72d6fead7c573cb3cdec9ab5a50811f3b68e79aab42b1ceb1be2e2cf3661f88325475d5df382960611b66c45d73bd637066d0358da45ce611d63b01cbed01ca96bad4858f83d2580f71c59c6a7ce0663d0c34a4dc21ea3ba6bdfc29888ea0fde1dc3cfc34f3862f5541c1736e11454df938f076d7ccfc230996631c171850800718134aff71c9f59b0f64a6697ad227e58ddbc40dbf75844aaca70cf3a3cf812d9fa2dbe9dc34f003febc47be3212fae48ddc0c7e03c8be9a3957ac89ca67c07603092b3161a1cb6d2a281b2aecfd0eb2a6bcfe2f24a7a8a7499e15148e69001fed07d52de1191bdbe59639230eedbca09e17f171b5498e423efa7ce62f2bad89d5f50b2b7af10dd0fd49e6e0ec4631185b2d476f6c4d648d33f9875e59f02b257ffc2ae1be599e245858164bacbc26f719abe0df0c8af50a1314ff1879950090a0fd207e4bd9146fd05c52eb6a258d14201f8838726d12f05b1358563cde4555c687aed1b51b389803d6ad4a5f3c2a47f37ac9e5ad81c07f134eeed7d5dfa0d6cec85572eb31f7c6bd932e9bf1b7a199a57ceebfcf320277ca764424c0b1a74e4183efa11f638edfa2d1b6be4dc74e8e34a708b339f3299ac7ebdd7a540f3d820df284e1ddcc3e30dc0745f1074ddd5bd4c400628c7212241271ce96d27b47eebc133af01d9411acc20db108f4a62b4e7751c4b4ef1dd558884ad2222f879946752e21238c9bac15980f839ebcd4b6f3b1a175c4c5f18a1adedbd85046b21b32e5f659954d5f35188cc41fd63495ffc6eb91b9765106786e8629e3a1c8153520ba50eff10e5c515c19de277f40bb236138bc73a7da7c459af87b9b36f7732caa740af75dac3da9e1ca066da8e75c19ae3d6122f19373cce6b630ca1369e77e8ecdc959f21f1df2dbe5e79c6295495017a6f45609cfd153de01cf5f1badbc5e6c7e3b0c62822741844d56e0b11536fea372f650019b5b0a3ccbcc5a356f4bb91acb20dbfc4969587b5c4b49febf91f8768284da41de00d5c493f82e5e519744e56f1fb3823c820d2188c8eb3978fa50c5ca8020fa7591eece43df0164c875d3baf1534b90f9ef21d414cff904351a6c172281ac34ec3b35d56d34994df68d5aba0cdcd2e766816ea442f9f6c54d5564b1ffd4157e3ce5f67ea691d89e3f44b5dcceb0cfaa9f6cd26e04bf5cf28f84c5c348bbd2953a9c9e804696c4469afe34f96633e7fe98e84d42d4df6c778d289b87c7cb7a63ab10caddeb4154c799027189aa6842d14b31a8254edc8c76cf80ee883aaea8568d141805f0d4f0060795d9f114d77291d2e431342a64aab9312ad07e7c06738edfa517ac9795bd2d8f5a8cb52b21c8051cc3f31e037916b9719983ac958516898e19d86bba4b231fce6068b74ee7f7b583c5d78357c28410160330fa624dcf72c43ef9d7a7ccedabfb1048a249aa31306e047181900a9d4f2c170408520a0675841379e9bfe23a4d0372ac7a19a77379f11a6c01ecb335a08bd3d92f8e1d4f6f5988a571160180c930954420d53ad433125e82b88c67aacd445a832d3e8375aec864c55aa8d6d17c7a28db3af179df5f30e6a2369fca25812b51e1f69aec08adf023032c1ead2fa329986b717e1150b7b2d0294791fb27996d88d95d1b63de93d7b3902e5f227e448bf4b1a8e91aafb6a2de6031e4184440b12b0712bd987f4d1e287f39afb5aba23c6dc5448973542fbc7996e1a3053e94799908ca165e136b88e9baa95edd8c8090e0284175ff87359770f5be4346bdb8592e881fbba4e1b786e7a3d942b6de21dc646faf357eb051aa05c3373e887df2d2e9c3bb98a9bbcc9b68314d5dfa300c8ad531cf393df65fdeec8ed634f9e0f9eefbf92f0ee3f9418ac6ef0ffa0b018737d0b9384f419f7be166ba3e3a0", 0x1000, 0x5, 0x0, 0x0, r2}, &(0x7f0000003a00)={0x0, 0x0, 0x0, 0x2, 0x3, r5, &(0x7f0000003900)="c9daecb8a66cc1f7b39181c0e761bfed36dc37f3f5ed7461615727d089e5a5b55939f9dada95edfe97a9956de1365981ddb0e6e00ba2194ddac250dd941c80a54bbbfea43416ea6c8a86eef3ef6147d56959718356b6b44090c2d28cac7e59d1ff3d6ff308757722307dcc7a6eb12b322693f6ead210ef975db545c018f7852f01e560449af86e683435cb54e332f9ce72e36c49bc81bce3dfd600f4cace2ebb5b8fd9ff6b1a26adcebb60d4d5faefeed60bed8908e8644b674a3b1960e81c7544fc77469b74849115819af5a57b33816f6a98d17525a46c28e2b278", 0xdc, 0x2, 0x0, 0x0, r2}]) ioctl$KDENABIO(r11, 0x4b36) (async) r12 = syz_open_dev$MSR(&(0x7f0000003a80), 0xd9e, 0x0) read$msr(r12, &(0x7f0000003ac0)=""/122, 0x7a) (async) ioctl$SG_IO(r2, 0x2285, &(0x7f0000003c80)={0x53, 0xffffffffffffffff, 0x1d, 0x9, @buffer={0x0, 0x1f, &(0x7f0000003b40)=""/31}, &(0x7f0000003b80)="b478447ddb16130942b8389d6d2d604ca7bbf28af26a48cb974341ae0c", &(0x7f0000003bc0)=""/128, 0xfffffffc, 0x0, 0x2, &(0x7f0000003c40)}) (async) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000003cc0)={r1, @in6={{0xa, 0x4e22, 0x45fd, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1}}, 0x101, 0x2, 0xdb7c, 0x7ff, 0xfffff800}, &(0x7f0000003d80)=0x98) 918.316464ms ago: executing program 0 (id=2189): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x1000000}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_CT_DIRECTION={0x5, 0x3, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x2008c040}, 0x0) 917.235521ms ago: executing program 1 (id=2190): io_setup(0x7, &(0x7f0000000280)=0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000000c0)=ANY=[@ANYBLOB="795740703c57039bd69327606969b70dab3d405ff50a3b4edac642ec34a900010a0102000000000000000001000004000000"], 0x14}, 0x1, 0x0, 0x0, 0x20040050}, 0x8000) r2 = openat$sysfs(0xffffff9c, &(0x7f0000000140)='/sys/power/resume', 0x400042, 0x17a) io_submit(r0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0xfffffc98}]) mknod(&(0x7f0000001b40)='./file0\x00', 0x400, 0xffffffff) mount$nfs(0x0, &(0x7f0000001c40)='./file0\x00', &(0x7f0000001c80), 0x0, &(0x7f0000001cc0)={[{'lock'}]}) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x40000000, 0x80000000000d, 0x0, 0x0, 0x0, 0x0) r3 = getpgrp(0xffffffffffffffff) sched_getaffinity(r3, 0x8, &(0x7f0000000080)) 868.682987ms ago: executing program 0 (id=2191): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) fsopen(&(0x7f0000000480)='jffs2\x00', 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000040), 0x0) getsockopt$inet_sctp_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f00000003c0), &(0x7f0000000440)=0x4) r0 = openat2$dir(0xffffff9c, 0x0, &(0x7f00000006c0)={0x2000, 0x0, 0xa}, 0x18) renameat2(r0, &(0x7f00000002c0)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffffff, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100008b}, 0x0) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x0, 0x4, 0x110, r1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x2b, 0x80801, 0x1) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x8080, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7a, 0x0, 0x8000, 0x6, 0x3}, 0x0, &(0x7f0000000080)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000003}, 0x0, 0x0) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f00000007c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140300003000f5ffff000000040000000103", @ANYRES64=r3, @ANYRESDEC=r4], 0x314}], 0x1}, 0x800) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x49, 0x0, 0x80000000000008}]}) r6 = openat$vicodec0(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc0185648, &(0x7f0000000500)={0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x0, 0x6, '\x00', @value64}}) mount(&(0x7f0000000140)=@sr0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x200001, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)=ANY=[@ANYBLOB="20000000100001070000000000000000"], 0x20}}, 0x0) recvmmsg(r7, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000140)=""/186, 0xba}, {&(0x7f0000002a00)=""/4096, 0x1000}], 0x2}, 0x1000}], 0x1, 0x0, 0x0) 370.379µs ago: executing program 0 (id=2192): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000ff0100000000000000000000850000007a752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70300000000000000030000cd000000850000007b0000009500000000000000"], &(0x7f0000000680)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffff8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000500)="0000000000000000000051229dc9", 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f00000000c0)=ANY=[], 0x1c) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) writev(r3, &(0x7f0000000600)=[{&(0x7f0000000100)="339931a8e57f9726597cb103c8611cef98c8869bc249aa823e92dd5c4bdd15e15339b6a03d8cc177f480d2e85bdff1334fd2dab10a3382102d2433b096bdd4c48950f490f041002f93a162be7ea5d398df5a8decd22af100f0dbcd", 0x5b}, {&(0x7f0000000180)="63960c77c65e2f6b4f3a7f058be0ca84bc1abb869a", 0x15}, {&(0x7f00000001c0)="c3d417f6", 0x4}, {&(0x7f0000000200)="5223424f66c0f32ba3fd", 0xa}, {&(0x7f0000000280)="332c7174438292916ef13b51716c1d4afaa3adea1d06b134146556747468acf3984227f9e5b28d1fd3456061ddf9052b0a24f30f3922baa872c9926140aae7f58258adcb12b2d24359c8a412d7cbfe6a79faa831d8b6739b9c59ef540c", 0x5d}], 0x5) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x5, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f00000001c0)=@mmap={0x0, 0x1, 0x4, 0x20, 0x0, {0x77359400}, {0x4, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x291d}) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$SNDCTL_DSP_GETODELAY(r2, 0x80045017, &(0x7f0000000240)) connect$can_bcm(r6, &(0x7f00000000c0), 0x10) dup3(r6, r5, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000005c0)={'gre0\x00'}) sendmsg$can_bcm(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="050000002308"], 0x80}}, 0x0) sendmsg$can_bcm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="050000002308"], 0x80}}, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000100)=0x1) fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000480)=[{0x6, 0xfc, 0x1, 0x7fff8000}]}) close_range(r8, 0xffffffffffffffff, 0x0) ioctl$FBIOGET_VSCREENINFO(r3, 0x4600, &(0x7f0000000100)) syz_emit_ethernet(0x36, &(0x7f0000000000)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x2, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x2, 0x200000}}}}}, 0x0) r9 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r9, 0x40946400, 0x0) ioctl$SIOCX25CALLACCPTAPPRV(r9, 0x89e8) ioctl$COMEDI_DEVCONFIG(r9, 0x40946400, &(0x7f00000000c0)={'pcl818\x00', [0x100, 0x4, 0x2, 0xc, 0xfffffffe, 0x5, 0x79, 0x1, 0x1, 0x0, 0x40, 0x145, 0x7, 0x1, 0x2, 0xfd, 0xfffffffb, 0xd, 0x5, 0x80000000, 0x8, 0x5, 0x1, 0x20201e58, 0xffdfffff, 0xf3a2, 0x3, 0x80000008, 0xa6b5, 0x24a05ffd, 0x10001]}) socket$kcm(0x29, 0x2, 0x0) 0s ago: executing program 3 (id=2193): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000007d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r5 = socket$nl_generic(0x10, 0x3, 0x10) socket$phonet_pipe(0x23, 0x5, 0x2) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000480)={0x3c, r6, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r8 = socket$qrtr(0x2a, 0x2, 0x0) r9 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r9, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) r10 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') sendmsg$TIPC_NL_MON_SET(r10, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x38, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x24, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r11 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r11, 0x0, 0x27, &(0x7f0000000000)={@multicast2, @local, @local}, 0xc) preadv(r10, &(0x7f0000001b80)=[{&(0x7f0000000140)=""/105, 0x69}], 0x1, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) syz_clone3(&(0x7f0000001880)={0x120000200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) writev(r8, &(0x7f0000000340)=[{&(0x7f0000000080)="fb", 0x1}], 0x1) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r12, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) kernel console output (not intermixed with test programs): 2 [ 346.748200][T11966] hsr0 speed is unknown, defaulting to 1000 [ 346.891509][T11983] hfs: can't find a HFS filesystem on dev sr0 [ 347.081556][T11966] bridge0: port 1(bridge_slave_0) entered blocking state [ 347.084139][T11966] bridge0: port 1(bridge_slave_0) entered disabled state [ 347.086954][T11966] bridge_slave_0: entered allmulticast mode [ 347.090395][T11966] bridge_slave_0: entered promiscuous mode [ 347.126949][T11966] bridge0: port 2(bridge_slave_1) entered blocking state [ 347.129039][T11966] bridge0: port 2(bridge_slave_1) entered disabled state [ 347.134886][T11966] bridge_slave_1: entered allmulticast mode [ 347.138197][T11966] bridge_slave_1: entered promiscuous mode [ 347.155288][T11966] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 347.160950][T11966] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 347.202605][T11966] team0: Port device team_slave_0 added [ 347.206725][T11966] team0: Port device team_slave_1 added [ 347.221927][T11966] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 347.224378][T11966] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 347.234318][T11966] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 347.263397][T11966] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 347.265683][T11966] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 347.274056][T11966] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 347.313008][T11966] hsr_slave_0: entered promiscuous mode [ 347.319421][T11966] hsr_slave_1: entered promiscuous mode [ 347.325679][T11966] debugfs: 'hsr0' already exists in 'hsr' [ 347.330588][T11966] Cannot create hsr debugfs directory [ 347.566558][T11993] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 347.569120][T11993] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 347.572643][T11993] vhci_hcd vhci_hcd.0: Device attached [ 347.801350][ T13] team0: Port device geneve1 removed [ 347.836393][ T5887] usb 37-1: new low-speed USB device number 7 using vhci_hcd [ 347.839953][ T5827] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 347.882608][ T13] bond0 (unregistering): Released all slaves [ 347.911314][T12001] FAULT_INJECTION: forcing a failure. [ 347.911314][T12001] name failslab, interval 1, probability 0, space 0, times 0 [ 347.916347][T12001] CPU: 0 UID: 0 PID: 12001 Comm: syz.1.1774 Tainted: G L syzkaller #0 PREEMPT(full) [ 347.916377][T12001] Tainted: [L]=SOFTLOCKUP [ 347.916383][T12001] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 347.916391][T12001] Call Trace: [ 347.916420][T12001] [ 347.916427][T12001] dump_stack_lvl+0x100/0x190 [ 347.916523][T12001] should_fail_ex.cold+0x5/0xa [ 347.916541][T12001] should_failslab+0xc2/0x120 [ 347.916559][T12001] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 347.916576][T12001] ? __alloc_skb+0x5b7/0x710 [ 347.916614][T12001] ? __alloc_skb+0x140/0x710 [ 347.916656][T12001] __alloc_skb+0x140/0x710 [ 347.916669][T12001] ? __alloc_skb+0x5b7/0x710 [ 347.916683][T12001] ? __pfx___alloc_skb+0x10/0x10 [ 347.916703][T12001] netlink_alloc_large_skb+0x69/0x150 [ 347.916726][T12001] netlink_sendmsg+0x680/0xda0 [ 347.916752][T12001] ? __pfx_netlink_sendmsg+0x10/0x10 [ 347.916775][T12001] ? apparmor_socket_sendmsg+0x15b/0x270 [ 347.916858][T12001] ____sys_sendmsg+0xa4d/0xbe0 [ 347.916879][T12001] ? __pfx_netlink_sendmsg+0x10/0x10 [ 347.916904][T12001] ? __pfx_____sys_sendmsg+0x10/0x10 [ 347.916935][T12001] ___sys_sendmsg+0x190/0x1e0 [ 347.916956][T12001] ? __pfx____sys_sendmsg+0x10/0x10 [ 347.916978][T12001] ? find_held_lock+0x2b/0x80 [ 347.916998][T12001] __sys_sendmsg+0x160/0x210 [ 347.917010][T12001] ? __pfx___sys_sendmsg+0x10/0x10 [ 347.917026][T12001] ? __pfx_ksys_write+0x10/0x10 [ 347.917044][T12001] __do_fast_syscall_32+0xe7/0x970 [ 347.917055][T12001] ? lockdep_hardirqs_on+0x78/0x100 [ 347.917072][T12001] do_fast_syscall_32+0x32/0x70 [ 347.917083][T12001] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 347.917097][T12001] RIP: 0023:0xf6fdefec [ 347.917114][T12001] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 347.917171][T12001] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 347.917192][T12001] RAX: ffffffffffffffda RBX: 0000000000000020 RCX: 0000000080000540 [ 347.917203][T12001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 347.917212][T12001] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 347.917219][T12001] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 347.917225][T12001] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 347.917239][T12001] [ 347.921343][ T7036] smbdirect: ib_dev[syz1] removed [ 348.003530][ T13] bond1 (unregistering): (slave veth3): Releasing backup interface [ 348.011649][ T13] bond1 (unregistering): Released all slaves [ 348.040162][ T5827] usb 5-1: not running at top speed; connect to a high speed hub [ 348.043977][ T5827] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 254, changing to 4 [ 348.049095][ T5827] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 1023 [ 348.049458][ T13] bond2 (unregistering): Released all slaves [ 348.053117][ T5827] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 184, changing to 4 [ 348.062820][ T5827] usb 5-1: language id specifier not provided by device, defaulting to English [ 348.068476][ T5827] usb 5-1: New USB device found, idVendor=0499, idProduct=1002, bcdDevice= 0.40 [ 348.068713][ T13] bond3 (unregistering): Released all slaves [ 348.072095][ T5827] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.077610][ T5827] usb 5-1: Product: syz [ 348.079448][ T5827] usb 5-1: Manufacturer: Ъ [ 348.081414][ T5827] usb 5-1: SerialNumber: syz [ 348.084790][ T13] bond4 (unregistering): Released all slaves [ 348.086228][ T5883] usb 8-1: new high-speed USB device number 39 using dummy_hcd [ 348.102429][ T13] bond5 (unregistering): Released all slaves [ 348.120080][ T13] bond6 (unregistering): Released all slaves [ 348.141007][ T13] bond7 (unregistering): Released all slaves [ 348.155107][ T13] bond8 (unregistering): Released all slaves [ 348.187114][ T64] Bluetooth: hci4: command tx timeout [ 348.241223][ T5883] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 348.245084][ T5883] usb 8-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 348.249534][ T5883] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 348.252877][ T5883] usb 8-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 348.257901][ T5883] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 348.264033][ T5883] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 348.285801][ T5883] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 348.289025][ T5883] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 348.291602][ T5883] usb 8-1: Product: syz [ 348.293929][ T5883] usb 8-1: Manufacturer: syz [ 348.304816][T11999] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 348.326600][ T5883] cdc_wdm 8-1:1.0: skipping garbage [ 348.329104][ T5883] cdc_wdm 8-1:1.0: skipping garbage [ 348.353008][T11994] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 4 [ 348.360351][ T5883] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 348.362351][ T5883] cdc_wdm 8-1:1.0: Unknown control protocol [ 348.375545][ T5789] vhci_hcd vhci_hcd.0: stop threads [ 348.378510][ T5789] vhci_hcd vhci_hcd.0: release socket [ 348.384811][ T5789] vhci_hcd vhci_hcd.0: disconnect device [ 348.451328][ T5827] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 348.459453][ T5827] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 348.465683][ T5827] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 348.479717][ T5827] snd-usb-audio 5-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 348.509787][ C0] wdm_int_callback: 10588 callbacks suppressed [ 348.509805][ C0] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 348.509815][ C0] wdm_int_callback: 10588 callbacks suppressed [ 348.509822][ C0] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 348.510155][ C0] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 348.510167][ C0] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 348.511604][ C0] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 348.511617][ C0] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 348.512183][ C0] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 348.512193][ C0] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 348.516936][ C0] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 348.516953][ C0] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 348.517205][ C0] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 348.517215][ C0] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 348.517404][ C0] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 348.517414][ C0] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 348.517598][ C0] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 348.517608][ C0] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 348.517892][ T5827] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 348.519140][ C0] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 348.519154][ C0] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 348.519347][ C0] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 348.519356][ C0] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 348.564397][ T5827] snd-usb-audio 5-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 348.598343][ T5827] usb 5-1: USB disconnect, device number 33 [ 348.646878][ T6058] udevd[6058]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 348.658790][ T13] tipc: Left network mode [ 348.898938][ T5883] usb 8-1: USB disconnect, device number 39 [ 348.900902][ C0] cdc_wdm 8-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 348.948964][T11999] cdc_wdm 8-1:1.0: Tx URB error: -19 [ 348.958359][T12009] cdc_wdm 8-1:1.0: Tx URB error: -19 [ 349.017289][ T29] IPVS: starting estimator thread 0... [ 349.166286][T12026] IPVS: set_ctl: invalid protocol: 8 100.1.1.0:20004 [ 349.183478][T12026] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 349.389028][T12020] IPVS: using max 43 ests per chain, 103200 per kthread [ 350.184989][T11966] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 350.195153][T11966] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 350.199712][T11966] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 350.230578][T11966] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 350.244839][T11966] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 350.266546][ T64] Bluetooth: hci4: command tx timeout [ 350.278848][T11966] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 350.293166][T11966] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 350.331631][T11966] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 350.375604][T12047] FAULT_INJECTION: forcing a failure. [ 350.375604][T12047] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 350.375633][T12047] CPU: 3 UID: 0 PID: 12047 Comm: syz.1.1781 Tainted: G L syzkaller #0 PREEMPT(full) [ 350.375649][T12047] Tainted: [L]=SOFTLOCKUP [ 350.375653][T12047] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 350.375660][T12047] Call Trace: [ 350.375665][T12047] [ 350.375669][T12047] dump_stack_lvl+0x100/0x190 [ 350.375685][T12047] should_fail_ex.cold+0x5/0xa [ 350.375697][T12047] _copy_to_user+0x32/0xd0 [ 350.375757][T12047] io_uring_setup.cold+0x1487/0x1c2e [ 350.375775][T12047] ? __pfx_io_uring_setup+0x10/0x10 [ 350.375827][T12047] ? ksys_write+0x190/0x250 [ 350.375844][T12047] ? __mutex_unlock_slowpath+0x35d/0x930 [ 350.375868][T12047] ? fput+0x79/0x100 [ 350.375879][T12047] ? ksys_write+0x1ac/0x250 [ 350.375894][T12047] ? __pfx_ksys_write+0x10/0x10 [ 350.375911][T12047] __ia32_sys_io_uring_setup+0xc2/0x170 [ 350.375928][T12047] __do_fast_syscall_32+0xe7/0x970 [ 350.375939][T12047] ? lockdep_hardirqs_on+0x78/0x100 [ 350.375959][T12047] do_fast_syscall_32+0x32/0x70 [ 350.375969][T12047] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 350.375983][T12047] RIP: 0023:0xf6fdefec [ 350.375998][T12047] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 350.376003][T12047] RSP: 002b:00000000f53cd43c EFLAGS: 00000286 ORIG_RAX: 00000000000001a9 [ 350.376013][T12047] RAX: ffffffffffffffda RBX: 0000000000000e26 RCX: 0000000080000808 [ 350.376020][T12047] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 350.376026][T12047] RBP: 00000000f53cd4fc R08: 0000000000000000 R09: 0000000000000000 [ 350.376032][T12047] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 350.376038][T12047] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 350.376051][T12047] [ 350.384032][ T42] audit: type=1326 audit(1783591794.388:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12035 comm="syz.0.1779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 350.384069][ T42] audit: type=1326 audit(1783591794.388:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12035 comm="syz.0.1779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 350.394805][ T42] audit: type=1326 audit(1783591794.398:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12035 comm="syz.0.1779" exe="/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf709efec code=0x7ffc0000 [ 350.394840][ T42] audit: type=1326 audit(1783591794.398:288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12035 comm="syz.0.1779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 350.394861][ T42] audit: type=1326 audit(1783591794.398:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12035 comm="syz.0.1779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 350.397240][ T42] audit: type=1326 audit(1783591794.408:290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12035 comm="syz.0.1779" exe="/syz-executor" sig=0 arch=40000003 syscall=358 compat=1 ip=0xf709efec code=0x7ffc0000 [ 350.403067][ T42] audit: type=1326 audit(1783591794.408:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12035 comm="syz.0.1779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 350.419588][ T42] audit: type=1326 audit(1783591794.428:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12035 comm="syz.0.1779" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf709efec code=0x7ffc0000 [ 350.429536][ T42] audit: type=1326 audit(1783591794.438:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12035 comm="syz.0.1779" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 350.438941][ T42] audit: type=1326 audit(1783591794.438:294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12035 comm="syz.0.1779" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf709efec code=0x7ffc0000 [ 350.510553][T11966] 8021q: adding VLAN 0 to HW filter on device bond0 [ 350.524604][T11966] 8021q: adding VLAN 0 to HW filter on device team0 [ 350.530260][ T7032] bridge0: port 1(bridge_slave_0) entered blocking state [ 350.546943][T12054] netlink: 'syz.1.1783': attribute type 1 has an invalid length. [ 350.548016][ T7032] bridge0: port 1(bridge_slave_0) entered forwarding state [ 350.626491][T12049] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 350.735663][T12054] bond11: entered promiscuous mode [ 350.739097][T12054] 8021q: adding VLAN 0 to HW filter on device bond11 [ 350.748760][ T7032] bridge0: port 2(bridge_slave_1) entered blocking state [ 350.751291][ T7032] bridge0: port 2(bridge_slave_1) entered forwarding state [ 350.839236][ T5756] cgroup: fork rejected by pids controller in /syz3 [ 350.915019][ T13] IPVS: stop unused estimator thread 0... [ 351.344389][T11966] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 351.418210][T12081] veth0: entered promiscuous mode [ 351.530025][ T6226] syz_tun (unregistering): left allmulticast mode [ 351.555437][T11966] veth0_vlan: entered promiscuous mode [ 351.567104][T11966] veth1_vlan: entered promiscuous mode [ 351.595014][T11966] veth0_macvtap: entered promiscuous mode [ 351.600165][T11966] veth1_macvtap: entered promiscuous mode [ 351.611861][T11966] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 351.618672][T11966] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 351.625263][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.629169][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.634164][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.639579][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.762293][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 351.770796][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 351.794018][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 351.798395][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 351.851515][T12086] FAULT_INJECTION: forcing a failure. [ 351.851515][T12086] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 351.856241][T12086] CPU: 3 UID: 0 PID: 12086 Comm: syz.2.1768 Tainted: G L syzkaller #0 PREEMPT(full) [ 351.856261][T12086] Tainted: [L]=SOFTLOCKUP [ 351.856265][T12086] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 351.856285][T12086] Call Trace: [ 351.856291][T12086] [ 351.856297][T12086] dump_stack_lvl+0x100/0x190 [ 351.856314][T12086] should_fail_ex.cold+0x5/0xa [ 351.856328][T12086] _copy_from_user+0x2e/0xd0 [ 351.856345][T12086] bpf_prog_load+0x1386/0x2fa0 [ 351.856367][T12086] ? __pfx_bpf_prog_load+0x10/0x10 [ 351.856385][T12086] ? __lock_acquire+0x49f/0x1a40 [ 351.856415][T12086] __sys_bpf+0x18dc/0x4e80 [ 351.856430][T12086] ? __pfx___sys_bpf+0x10/0x10 [ 351.856441][T12086] ? find_held_lock+0x2b/0x80 [ 351.856453][T12086] ? get_pid_task+0xfc/0x250 [ 351.856466][T12086] ? get_pid_task+0xfc/0x250 [ 351.856482][T12086] ? proc_fail_nth_write+0x9f/0x220 [ 351.856520][T12086] ? find_held_lock+0x2b/0x80 [ 351.856536][T12086] ? rcu_read_lock_any_held+0x6a/0xa0 [ 351.856549][T12086] ? find_held_lock+0x2b/0x80 [ 351.856565][T12086] ? ksys_write+0x190/0x250 [ 351.856581][T12086] ? ksys_write+0x190/0x250 [ 351.856608][T12086] ? fput+0x79/0x100 [ 351.856620][T12086] ? __ia32_sys_bpf+0xcc/0x170 [ 351.856630][T12086] __ia32_sys_bpf+0xcc/0x170 [ 351.856642][T12086] ? __do_fast_syscall_32+0x98/0x970 [ 351.856654][T12086] __do_fast_syscall_32+0xe7/0x970 [ 351.856664][T12086] ? lockdep_hardirqs_on+0x78/0x100 [ 351.856681][T12086] do_fast_syscall_32+0x32/0x70 [ 351.856692][T12086] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 351.856709][T12086] RIP: 0023:0xf7f64fec [ 351.856724][T12086] Code: Unable to access opcode bytes at 0xf7f64fc2. [ 351.856729][T12086] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 351.856741][T12086] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800000c0 [ 351.856748][T12086] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 351.856754][T12086] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 351.856761][T12086] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 351.856767][T12086] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 351.856780][T12086] [ 351.974445][ T5758] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 351.981734][ T5758] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 351.986067][ T5758] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 351.993002][ T5758] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 351.995864][ T5758] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 352.261604][T12080] veth0: left promiscuous mode [ 352.346180][ T64] Bluetooth: hci4: command tx timeout [ 352.375735][T12087] hsr0 speed is unknown, defaulting to 1000 [ 352.596642][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 352.634408][T12087] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.638108][T12087] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.640651][T12087] bridge_slave_0: entered allmulticast mode [ 352.643511][T12087] bridge_slave_0: entered promiscuous mode [ 352.647131][T12087] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.649798][T12087] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.652421][T12087] bridge_slave_1: entered allmulticast mode [ 352.655300][T12087] bridge_slave_1: entered promiscuous mode [ 352.705917][ T64] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 352.714788][T12087] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 352.721614][T12087] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 352.746711][T12087] team0: Port device team_slave_0 added [ 352.752663][T12087] team0: Port device team_slave_1 added [ 352.778335][T12087] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 352.780604][T12087] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 352.788820][T12087] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 352.793316][T12087] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 352.795540][T12087] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 352.807019][T12087] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 352.834075][T12087] hsr_slave_0: entered promiscuous mode [ 352.836672][T12087] hsr_slave_1: entered promiscuous mode [ 352.839132][T12087] debugfs: 'hsr0' already exists in 'hsr' [ 352.840969][T12087] Cannot create hsr debugfs directory [ 352.965552][T12087] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.986844][ T5887] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 353.216923][T12087] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.303236][T12087] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.366206][T12134] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1799'. [ 353.435613][T12087] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 353.485554][T12136] netlink: 'syz.0.1800': attribute type 1 has an invalid length. [ 353.672726][T12087] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 353.683135][T12087] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 353.685945][T12087] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 353.691685][T12087] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 353.695049][T12087] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 353.700627][T12087] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 353.703511][T12087] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 353.711524][T12087] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 353.788537][T12087] 8021q: adding VLAN 0 to HW filter on device bond0 [ 353.798665][T12087] 8021q: adding VLAN 0 to HW filter on device team0 [ 353.807448][ T1201] bridge0: port 1(bridge_slave_0) entered blocking state [ 353.810589][ T1201] bridge0: port 1(bridge_slave_0) entered forwarding state [ 353.829659][ T1201] bridge0: port 2(bridge_slave_1) entered blocking state [ 353.832445][ T1201] bridge0: port 2(bridge_slave_1) entered forwarding state [ 354.037231][ T64] Bluetooth: hci1: command tx timeout [ 354.205910][T12087] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 354.267236][T12087] veth0_vlan: entered promiscuous mode [ 354.286438][T12087] veth1_vlan: entered promiscuous mode [ 354.321611][T12087] veth0_macvtap: entered promiscuous mode [ 354.328538][T12087] veth1_macvtap: entered promiscuous mode [ 354.352736][T12087] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 354.365569][T12087] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 354.373386][ T5807] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.376425][ T5807] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.380213][ T5807] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.383736][ T5807] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.427465][ T64] Bluetooth: hci4: command tx timeout [ 354.443862][T12162] netlink: 'syz.1.1802': attribute type 10 has an invalid length. [ 354.454280][T12162] bridge0: entered allmulticast mode [ 354.457580][T12162] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 354.540198][T12162] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 354.587362][ T7041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 354.595249][ T7041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 354.630560][ T7041] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 354.638843][ T7041] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 355.186630][T12179] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 355.372559][T12182] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1808'. [ 355.806812][ T29] usb 8-1: new high-speed USB device number 40 using dummy_hcd [ 355.910590][T12191] FAULT_INJECTION: forcing a failure. [ 355.910590][T12191] name failslab, interval 1, probability 0, space 0, times 0 [ 355.914881][T12191] CPU: 3 UID: 0 PID: 12191 Comm: syz.0.1812 Tainted: G L syzkaller #0 PREEMPT(full) [ 355.914908][T12191] Tainted: [L]=SOFTLOCKUP [ 355.914914][T12191] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 355.914926][T12191] Call Trace: [ 355.914933][T12191] [ 355.914942][T12191] dump_stack_lvl+0x100/0x190 [ 355.914968][T12191] should_fail_ex.cold+0x5/0xa [ 355.914988][T12191] should_failslab+0xc2/0x120 [ 355.915010][T12191] __kmalloc_noprof+0xfc/0x820 [ 355.915028][T12191] ? __pfx_dynamic_dname+0x10/0x10 [ 355.915079][T12191] ? tomoyo_encode2+0xfb/0x3c0 [ 355.915105][T12191] tomoyo_encode2+0xfb/0x3c0 [ 355.915130][T12191] tomoyo_encode+0x29/0x50 [ 355.915150][T12191] tomoyo_realpath_from_path+0x18c/0x690 [ 355.915179][T12191] tomoyo_path_number_perm+0x23c/0x580 [ 355.915197][T12191] ? tomoyo_path_number_perm+0x22e/0x580 [ 355.915217][T12191] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 355.915237][T12191] ? get_pid_task+0x106/0x250 [ 355.915278][T12191] ? find_held_lock+0x2b/0x80 [ 355.915297][T12191] ? __fget_files+0x215/0x3d0 [ 355.915319][T12191] ? hook_file_ioctl_common+0x140/0x440 [ 355.915338][T12191] ? __fget_files+0x215/0x3d0 [ 355.915365][T12191] ? __fget_files+0x21f/0x3d0 [ 355.915393][T12191] security_file_ioctl_compat+0xd3/0x230 [ 355.915439][T12191] __ia32_compat_sys_ioctl+0xc2/0x360 [ 355.915470][T12191] __do_fast_syscall_32+0xe7/0x970 [ 355.915488][T12191] ? lockdep_hardirqs_on+0x78/0x100 [ 355.915515][T12191] do_fast_syscall_32+0x32/0x70 [ 355.915533][T12191] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 355.915555][T12191] RIP: 0023:0xf709efec [ 355.915577][T12191] Code: Unable to access opcode bytes at 0xf709efc2. [ 355.915585][T12191] RSP: 002b:00000000f544b50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 355.915603][T12191] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0502100 [ 355.915614][T12191] RDX: 0000000080000980 RSI: 0000000000000000 RDI: 0000000000000000 [ 355.915626][T12191] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 355.915636][T12191] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 355.915648][T12191] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 355.915672][T12191] [ 355.915692][T12191] ERROR: Out of memory at tomoyo_realpath_from_path. [ 355.966258][ T29] usb 8-1: Using ep0 maxpacket: 8 [ 355.992844][ T29] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 355.996038][ T29] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 355.999325][ T29] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 356.002540][ T29] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 356.006656][ T29] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 356.009920][ T29] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.116169][ T64] Bluetooth: hci1: command tx timeout [ 356.220432][ T29] usb 8-1: GET_CAPABILITIES returned 0 [ 356.222243][ T29] usbtmc 8-1:16.0: can't read capabilities [ 356.364776][T12198] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1813'. [ 356.377363][ T29] IPVS: starting estimator thread 0... [ 356.428911][ T41] usb 8-1: USB disconnect, device number 40 [ 356.466504][T12199] IPVS: using max 43 ests per chain, 103200 per kthread [ 356.503413][T12198] pim6reg: entered allmulticast mode [ 356.531324][T12198] pim6reg: left allmulticast mode [ 356.589275][ T42] kauditd_printk_skb: 46 callbacks suppressed [ 356.589293][ T42] audit: type=1326 audit(1783591800.598:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12188 comm="syz.0.1812" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7fc00000 [ 356.742385][ T42] audit: type=1800 audit(1783591800.748:342): pid=12208 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=set_data cause=unavailable-hash-algorithm comm="syz.0.1816" name="/sr0" dev="devtmpfs" ino=726 res=0 errno=0 [ 356.798650][T12202] IPVS: set_ctl: invalid protocol: 8 100.1.1.0:20004 [ 357.006473][T12214] syzkaller1: entered promiscuous mode [ 357.009124][T12214] syzkaller1: entered allmulticast mode [ 357.377250][ T42] audit: type=1326 audit(1783591801.388:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12200 comm="syz.1.1814" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7fc00000 [ 357.494522][T12222] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 357.497224][T12222] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 357.502840][T12222] vhci_hcd vhci_hcd.0: Device attached [ 357.739421][ T6255] usb 39-1: new low-speed USB device number 10 using vhci_hcd [ 357.750794][ T41] usb 6-1: new full-speed USB device number 42 using dummy_hcd [ 357.910573][ T41] usb 6-1: not running at top speed; connect to a high speed hub [ 357.915107][ T41] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 254, changing to 4 [ 357.925171][ T41] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 1023 [ 357.929066][ T41] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 184, changing to 4 [ 357.938293][ T41] usb 6-1: language id specifier not provided by device, defaulting to English [ 357.945882][ T41] usb 6-1: New USB device found, idVendor=0499, idProduct=1002, bcdDevice= 0.40 [ 357.951746][ T41] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.954841][ T41] usb 6-1: Product: syz [ 357.962546][ T41] usb 6-1: Manufacturer: Ъ [ 357.966288][ T41] usb 6-1: SerialNumber: syz [ 358.132207][T12239] ieee802154 phy0 wpan0: encryption failed: -22 [ 358.187109][ T64] Bluetooth: hci1: command tx timeout [ 358.192933][ T42] audit: type=1326 audit(1783591802.198:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.2.1827" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f64fec code=0x7ffc0000 [ 358.203230][T12243] FAULT_INJECTION: forcing a failure. [ 358.203230][T12243] name failslab, interval 1, probability 0, space 0, times 0 [ 358.208831][ T42] audit: type=1326 audit(1783591802.208:345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.2.1827" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f64fec code=0x7ffc0000 [ 358.221144][T12243] CPU: 0 UID: 0 PID: 12243 Comm: syz.2.1827 Tainted: G L syzkaller #0 PREEMPT(full) [ 358.221172][T12243] Tainted: [L]=SOFTLOCKUP [ 358.221178][T12243] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 358.221188][T12243] Call Trace: [ 358.221194][T12243] [ 358.221202][T12243] dump_stack_lvl+0x100/0x190 [ 358.221225][T12243] should_fail_ex.cold+0x5/0xa [ 358.221244][T12243] should_failslab+0xc2/0x120 [ 358.221265][T12243] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 358.221285][T12243] ? __alloc_skb+0x5b7/0x710 [ 358.221302][T12243] ? __alloc_skb+0x140/0x710 [ 358.221321][T12243] __alloc_skb+0x140/0x710 [ 358.221335][T12243] ? __alloc_skb+0x5b7/0x710 [ 358.221351][T12243] ? __pfx___alloc_skb+0x10/0x10 [ 358.221368][T12243] ? lockdep_init_map_type+0x5c/0x250 [ 358.221395][T12243] audit_log_start+0x350/0x930 [ 358.221416][T12243] ? __pfx_audit_log_start+0x10/0x10 [ 358.221439][T12243] ? rcu_read_lock_any_held+0x6a/0xa0 [ 358.221457][T12243] ? find_held_lock+0x2b/0x80 [ 358.221478][T12243] audit_seccomp+0x60/0x190 [ 358.221496][T12243] __seccomp_filter+0x896/0x1140 [ 358.221516][T12243] ? __pfx___seccomp_filter+0x10/0x10 [ 358.221536][T12243] ? fput+0x79/0x100 [ 358.221554][T12243] ? ksys_write+0x1ac/0x250 [ 358.221579][T12243] __secure_computing+0x204/0x2c0 [ 358.221597][T12243] __do_fast_syscall_32+0x460/0x970 [ 358.221613][T12243] ? lockdep_hardirqs_on+0x78/0x100 [ 358.221637][T12243] do_fast_syscall_32+0x32/0x70 [ 358.221653][T12243] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 358.221673][T12243] RIP: 0023:0xf7f64fec [ 358.221695][T12243] Code: Unable to access opcode bytes at 0xf7f64fc2. [ 358.221702][T12243] RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 00000000000000e8 [ 358.221719][T12243] RAX: ffffffffffffffda RBX: 0000000080000180 RCX: 0000000000000000 [ 358.221729][T12243] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 358.221739][T12243] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 358.221748][T12243] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 358.221756][T12243] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 358.221778][T12243] [ 358.221824][T12243] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 358.223851][T12225] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 9 [ 358.226214][ T42] audit: type=1326 audit(1783591802.208:346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.2.1827" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71671eb code=0x7ffc0000 [ 358.226241][ T42] audit: type=1326 audit(1783591802.208:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.2.1827" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf71671eb code=0x7ffc0000 [ 358.229167][T12243] audit: out of memory in audit_log_start [ 358.231905][ T5789] vhci_hcd vhci_hcd.1: stop threads [ 358.233664][ T42] audit: type=1326 audit(1783591802.238:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12242 comm="syz.2.1827" exe="/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf71671eb code=0x7ffc0000 [ 358.234023][ T5789] vhci_hcd vhci_hcd.1: release socket [ 358.332508][ T5789] vhci_hcd vhci_hcd.1: disconnect device [ 358.446814][ T41] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 358.450390][ T41] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 358.459936][ T41] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 358.463153][ T41] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 358.479176][ T41] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 358.588577][ T41] snd-usb-audio 6-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 358.598075][ T41] usb 6-1: USB disconnect, device number 42 [ 358.638701][ T6058] udevd[6058]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb6/6-1/6-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 358.965229][T12258] nfs4: Bad value for 'source' [ 359.861902][T12272] macsec1: entered promiscuous mode [ 359.864609][T12272] virt_wifi0: entered promiscuous mode [ 360.027547][T12278] FAULT_INJECTION: forcing a failure. [ 360.027547][T12278] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 360.033266][T12278] CPU: 3 UID: 0 PID: 12278 Comm: syz.0.1836 Tainted: G L syzkaller #0 PREEMPT(full) [ 360.033295][T12278] Tainted: [L]=SOFTLOCKUP [ 360.033302][T12278] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 360.033313][T12278] Call Trace: [ 360.033320][T12278] [ 360.033327][T12278] dump_stack_lvl+0x100/0x190 [ 360.033353][T12278] should_fail_ex.cold+0x5/0xa [ 360.033381][T12278] _copy_to_user+0x32/0xd0 [ 360.033406][T12278] bpf_prog_test_run_raw_tp+0x583/0x7d0 [ 360.033433][T12278] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 360.033460][T12278] ? fput+0x79/0x100 [ 360.033480][T12278] ? __bpf_prog_get+0x97/0x2a0 [ 360.033501][T12278] ? __pfx_bpf_prog_test_run_raw_tp+0x10/0x10 [ 360.033525][T12278] __sys_bpf+0x2a12/0x4e80 [ 360.033550][T12278] ? __pfx___sys_bpf+0x10/0x10 [ 360.033569][T12278] ? find_held_lock+0x2b/0x80 [ 360.033589][T12278] ? get_pid_task+0xfc/0x250 [ 360.033608][T12278] ? get_pid_task+0xfc/0x250 [ 360.033635][T12278] ? proc_fail_nth_write+0x9f/0x220 [ 360.033655][T12278] ? find_held_lock+0x2b/0x80 [ 360.033679][T12278] ? rcu_read_lock_any_held+0x6a/0xa0 [ 360.033702][T12278] ? find_held_lock+0x2b/0x80 [ 360.033724][T12278] ? ksys_write+0x190/0x250 [ 360.033747][T12278] ? ksys_write+0x190/0x250 [ 360.033815][T12278] ? fput+0x79/0x100 [ 360.033837][T12278] ? __ia32_sys_bpf+0xcc/0x170 [ 360.033853][T12278] __ia32_sys_bpf+0xcc/0x170 [ 360.033870][T12278] ? __do_fast_syscall_32+0x98/0x970 [ 360.033891][T12278] __do_fast_syscall_32+0xe7/0x970 [ 360.033905][T12278] ? lockdep_hardirqs_on+0x78/0x100 [ 360.033933][T12278] do_fast_syscall_32+0x32/0x70 [ 360.033955][T12278] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 360.033976][T12278] RIP: 0023:0xf709efec [ 360.033998][T12278] Code: Unable to access opcode bytes at 0xf709efc2. [ 360.034007][T12278] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 360.034025][T12278] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000800003c0 [ 360.034034][T12278] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 360.034046][T12278] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 360.034056][T12278] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 360.034065][T12278] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 360.034086][T12278] [ 360.266318][ T64] Bluetooth: hci1: command tx timeout [ 360.566963][T12291] 9p: Bad value for 'wfdno' [ 360.616901][T12294] [U] v3f"S/4:XTzWtlW= [ 360.619873][T12294] [U] J"e:" [ 360.796308][ T73] usb 6-1: new low-speed USB device number 43 using dummy_hcd [ 360.966730][ T73] usb 6-1: Invalid ep0 maxpacket: 64 [ 361.096192][ T73] usb 6-1: new low-speed USB device number 44 using dummy_hcd [ 361.266766][ T73] usb 6-1: Invalid ep0 maxpacket: 64 [ 361.268633][ T73] usb usb6-port1: attempt power cycle [ 361.632476][T12306] FAULT_INJECTION: forcing a failure. [ 361.632476][T12306] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 361.638221][T12306] CPU: 0 UID: 0 PID: 12306 Comm: syz.3.1844 Tainted: G L syzkaller #0 PREEMPT(full) [ 361.638242][T12306] Tainted: [L]=SOFTLOCKUP [ 361.638247][T12306] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 361.638254][T12306] Call Trace: [ 361.638258][T12306] [ 361.638264][T12306] dump_stack_lvl+0x100/0x190 [ 361.638283][T12306] should_fail_ex.cold+0x5/0xa [ 361.638302][T12306] _copy_to_user+0x32/0xd0 [ 361.638326][T12306] simple_read_from_buffer+0xcb/0x170 [ 361.638353][T12306] proc_fail_nth_read+0x1af/0x230 [ 361.638375][T12306] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 361.638399][T12306] ? rw_verify_area+0xce/0x6d0 [ 361.638429][T12306] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 361.638452][T12306] vfs_read+0x1e4/0xb40 [ 361.638475][T12306] ? __pfx_vfs_read+0x10/0x10 [ 361.638490][T12306] ? find_held_lock+0x2b/0x80 [ 361.638503][T12306] ? __fget_files+0x215/0x3d0 [ 361.638521][T12306] ? __fget_files+0x21f/0x3d0 [ 361.638541][T12306] ksys_read+0x12a/0x250 [ 361.638557][T12306] ? __pfx_ksys_read+0x10/0x10 [ 361.638576][T12306] do_int80_emulation+0x14b/0x720 [ 361.638609][T12306] asm_int80_emulation+0x1a/0x20 [ 361.638620][T12306] RIP: 0023:0xf71a71eb [ 361.638631][T12306] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 361.638643][T12306] RSP: 002b:00000000f54664bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 361.638655][T12306] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54665d0 [ 361.638663][T12306] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 361.638669][T12306] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 361.638675][T12306] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 361.638682][T12306] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 361.638696][T12306] [ 361.728196][T12310] FAULT_INJECTION: forcing a failure. [ 361.728196][T12310] name failslab, interval 1, probability 0, space 0, times 0 [ 361.732223][T12310] CPU: 0 UID: 0 PID: 12310 Comm: syz.3.1846 Tainted: G L syzkaller #0 PREEMPT(full) [ 361.732251][T12310] Tainted: [L]=SOFTLOCKUP [ 361.732258][T12310] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 361.732268][T12310] Call Trace: [ 361.732276][T12310] [ 361.732286][T12310] dump_stack_lvl+0x100/0x190 [ 361.732310][T12310] should_fail_ex.cold+0x5/0xa [ 361.732331][T12310] should_failslab+0xc2/0x120 [ 361.732354][T12310] __kmalloc_noprof+0xfc/0x820 [ 361.732367][T12310] ? rcu_is_watching+0x12/0xc0 [ 361.732379][T12310] ? tomoyo_realpath_from_path+0xb6/0x690 [ 361.732397][T12310] tomoyo_realpath_from_path+0xb6/0x690 [ 361.732419][T12310] tomoyo_path_number_perm+0x23c/0x580 [ 361.732431][T12310] ? tomoyo_path_number_perm+0x22e/0x580 [ 361.732443][T12310] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 361.732456][T12310] ? get_pid_task+0x106/0x250 [ 361.732479][T12310] ? find_held_lock+0x2b/0x80 [ 361.732492][T12310] ? __fget_files+0x215/0x3d0 [ 361.732507][T12310] ? hook_file_ioctl_common+0x140/0x440 [ 361.732519][T12310] ? __fget_files+0x215/0x3d0 [ 361.732536][T12310] ? __fget_files+0x21f/0x3d0 [ 361.732553][T12310] security_file_ioctl_compat+0xd3/0x230 [ 361.732567][T12310] __ia32_compat_sys_ioctl+0xc2/0x360 [ 361.732583][T12310] __do_fast_syscall_32+0xe7/0x970 [ 361.732594][T12310] ? lockdep_hardirqs_on+0x78/0x100 [ 361.732612][T12310] do_fast_syscall_32+0x32/0x70 [ 361.732622][T12310] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 361.732636][T12310] RIP: 0023:0xf7fa3fec [ 361.732652][T12310] Code: Unable to access opcode bytes at 0xf7fa3fc2. [ 361.732657][T12310] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 361.732668][T12310] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0245628 [ 361.732675][T12310] RDX: 0000000080000600 RSI: 0000000000000000 RDI: 0000000000000000 [ 361.732681][T12310] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 361.732687][T12310] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 361.732693][T12310] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 361.732706][T12310] [ 361.732712][T12310] ERROR: Out of memory at tomoyo_realpath_from_path. [ 361.909887][T12316] bond1: ARP target 9.0.0.0 is already present [ 361.911888][T12316] bond1: option arp_ip_target: invalid value (9) [ 361.915149][T12316] bond1 (unregistering): Released all slaves [ 361.956187][ T73] usb 6-1: new low-speed USB device number 45 using dummy_hcd [ 361.977228][ T73] usb 6-1: Invalid ep0 maxpacket: 64 [ 362.108697][ T73] usb 6-1: new low-speed USB device number 46 using dummy_hcd [ 362.116237][ T5883] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 362.126885][ T73] usb 6-1: Invalid ep0 maxpacket: 64 [ 362.129268][ T73] usb usb6-port1: unable to enumerate USB device [ 362.455018][ T5883] usb 7-1: device descriptor read/64, error -71 [ 362.716512][ T5883] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 362.846235][ T5883] usb 7-1: device descriptor read/64, error -71 [ 362.896349][ T6255] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 363.114564][ T5883] usb usb7-port1: attempt power cycle [ 363.256221][ T5746] usb 8-1: new full-speed USB device number 41 using dummy_hcd [ 363.386256][ T5746] usb 8-1: device descriptor read/64, error -71 [ 363.506244][ T5883] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 363.736798][T12337] syzkaller1: entered promiscuous mode [ 363.739199][T12337] syzkaller1: entered allmulticast mode [ 363.992130][ T5883] usb 7-1: device descriptor read/8, error -71 [ 364.249649][T12343] FAULT_INJECTION: forcing a failure. [ 364.249649][T12343] name failslab, interval 1, probability 0, space 0, times 0 [ 364.269501][T12343] CPU: 3 UID: 0 PID: 12343 Comm: syz.1.1858 Tainted: G L syzkaller #0 PREEMPT(full) [ 364.269535][T12343] Tainted: [L]=SOFTLOCKUP [ 364.269541][T12343] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 364.269552][T12343] Call Trace: [ 364.269559][T12343] [ 364.269567][T12343] dump_stack_lvl+0x100/0x190 [ 364.269594][T12343] should_fail_ex.cold+0x5/0xa [ 364.269615][T12343] should_failslab+0xc2/0x120 [ 364.269638][T12343] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 364.269655][T12343] ? register_lock_class+0x40/0x560 [ 364.269679][T12343] ? __d_alloc+0x35/0xa50 [ 364.269701][T12343] __d_alloc+0x35/0xa50 [ 364.269743][T12343] ? __lock_acquire+0x49f/0x1a40 [ 364.269771][T12343] d_alloc_parallel+0x105/0x14b0 [ 364.269804][T12343] ? __pfx_d_alloc_parallel+0x10/0x10 [ 364.269826][T12343] ? __d_lookup+0x25c/0x4a0 [ 364.269852][T12343] ? __d_lookup+0x266/0x4a0 [ 364.269887][T12343] path_openat+0x271c/0x4280 [ 364.269926][T12343] ? __pfx_path_openat+0x10/0x10 [ 364.269961][T12343] do_file_open+0x20e/0x430 [ 364.269987][T12343] ? __lock_acquire+0x49f/0x1a40 [ 364.270013][T12343] ? __pfx_do_file_open+0x10/0x10 [ 364.270056][T12343] ? _raw_spin_unlock+0x28/0x50 [ 364.270080][T12343] ? alloc_fd+0x471/0x7a0 [ 364.270113][T12343] do_sys_openat2+0x10f/0x1e0 [ 364.270136][T12343] ? __pfx_do_sys_openat2+0x10/0x10 [ 364.270160][T12343] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 364.270193][T12343] __ia32_compat_sys_openat+0x12d/0x210 [ 364.270217][T12343] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 364.270239][T12343] ? fput+0x79/0x100 [ 364.270256][T12343] ? ksys_write+0x1ac/0x250 [ 364.270281][T12343] ? __pfx_ksys_write+0x10/0x10 [ 364.270311][T12343] __do_fast_syscall_32+0xe7/0x970 [ 364.270326][T12343] ? lockdep_hardirqs_on+0x78/0x100 [ 364.270353][T12343] do_fast_syscall_32+0x32/0x70 [ 364.270371][T12343] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 364.270393][T12343] RIP: 0023:0xf6fdefec [ 364.270416][T12343] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 364.270424][T12343] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 364.270442][T12343] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 364.270453][T12343] RDX: 000000000000275a RSI: 0000000000000000 RDI: 0000000000000000 [ 364.270463][T12343] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 364.270472][T12343] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 364.270482][T12343] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 364.270506][T12343] [ 364.440541][T12345] [U] [ 364.441880][T12345] [U] [ 364.443075][T12345] [U] [ 364.444242][T12345] [U] [ 364.446697][T12345] [U] [ 364.447916][T12345] [U] [ 364.449116][T12345] [U] [ 364.450385][T12345] [U] [ 364.451749][T12345] [U] [ 364.452940][T12345] [U] [ 364.454118][T12345] [U] [ 364.455307][T12345] [U] [ 364.456176][ T5746] usb 8-1: new full-speed USB device number 42 using dummy_hcd [ 364.456709][T12345] [U] [ 364.460200][T12345] [U] [ 364.461125][T12345] [U] [ 364.462025][T12345] [U] [ 364.464236][T12345] [U] [ 364.465313][T12345] [U] [ 364.466278][T12345] [U] [ 364.467297][T12345] [U] [ 364.468791][T12345] [U] [ 364.469998][T12345] [U] [ 364.471198][T12345] [U] [ 364.472354][T12345] [U] [ 364.473672][T12345] [U] [ 364.474885][T12345] [U] [ 364.476087][T12345] [U] [ 364.477280][T12345] [U] [ 364.478907][T12345] [U] [ 364.480096][T12345] [U] [ 364.481302][T12345] [U] [ 364.482525][T12345] [U] [ 364.483813][T12345] [U] [ 364.485001][T12345] [U] [ 364.486205][T12345] [U] [ 364.487381][T12345] [U] [ 364.488885][T12345] [U] [ 364.490082][T12345] [U] [ 364.491302][T12345] [U] [ 364.492498][T12345] [U] [ 364.494985][T12345] [U] [ 364.496223][T12345] [U] [ 364.497417][T12345] [U] [ 364.498621][T12345] [U] [ 364.500619][T12345] [U] [ 364.501802][T12345] [U] [ 364.502957][T12345] [U] [ 364.504128][T12345] [U] [ 364.505466][T12345] [U] [ 364.506694][T12345] [U] [ 364.507876][T12345] [U] [ 364.509070][T12345] [U] [ 364.511975][T12345] [U] [ 364.513188][T12345] [U] [ 364.514351][T12345] [U] [ 364.515534][T12345] [U] [ 364.517441][T12345] [U] [ 364.518673][T12345] [U] [ 364.519651][T12345] [U] [ 364.520771][T12345] [U] [ 364.525977][T12345] [U] [ 364.527215][T12345] [U] [ 364.528386][T12345] [U] [ 364.529564][T12345] [U] [ 364.532441][T12345] [U] [ 364.533652][T12345] [U] [ 364.534841][T12345] [U] [ 364.536025][T12345] [U] [ 364.537912][T12345] [U] [ 364.539123][T12345] [U] [ 364.540349][T12345] [U] [ 364.541549][T12345] [U] [ 364.542896][T12345] [U] [ 364.544101][T12345] [U] [ 364.545285][T12345] [U] [ 364.546486][T12345] [U] [ 364.548688][T12345] [U] [ 364.549621][T12345] [U] [ 364.550811][T12345] [U] [ 364.551969][T12345] [U] [ 364.553337][T12345] [U] [ 364.554522][T12345] [U] [ 364.555695][T12345] [U] [ 364.556877][T12345] [U] [ 364.558946][T12345] [U] [ 364.560121][T12345] [U] [ 364.561286][T12345] [U] [ 364.562479][T12345] [U] [ 364.563752][T12345] [U] [ 364.564861][T12345] [U] [ 364.566038][T12345] [U] [ 364.567219][T12345] [U] [ 364.568869][T12345] [U] [ 364.570063][T12345] [U] [ 364.571260][T12345] [U] [ 364.572417][T12345] [U] [ 364.574514][T12345] [U] [ 364.575681][T12345] [U] [ 364.577184][T12345] [U] [ 364.578716][T12345] [U] [ 364.602524][T12345] [U] [ 364.603752][T12345] [U] [ 364.604912][T12345] [U] [ 364.606083][T12345] [U] [ 364.608412][T12345] [U] [ 364.609617][T12345] [U] [ 364.610804][T12345] [U] [ 364.611975][T12345] [U] [ 364.613313][T12345] [U] [ 364.614505][T12345] [U] [ 364.615688][T12345] [U] [ 364.616878][T12345] [U] [ 364.623182][T12344] [U] [ 364.646280][ T5746] usb 8-1: device descriptor read/64, error -71 [ 364.656279][ T5883] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 364.687040][ T5883] usb 7-1: device descriptor read/8, error -71 [ 364.691761][T12351] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 364.694505][T12351] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 364.699293][T12351] vhci_hcd vhci_hcd.0: Device attached [ 364.879633][ T5746] usb usb8-port1: attempt power cycle [ 364.909128][ T5883] usb usb7-port1: unable to enumerate USB device [ 364.936279][ T6255] usb 39-1: new low-speed USB device number 11 using vhci_hcd [ 364.946285][ T73] usb 6-1: new full-speed USB device number 47 using dummy_hcd [ 365.225812][ T73] usb 6-1: not running at top speed; connect to a high speed hub [ 365.417643][ T73] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 254, changing to 4 [ 365.496499][ T5746] usb 8-1: new full-speed USB device number 43 using dummy_hcd [ 365.516705][ T5746] usb 8-1: device descriptor read/8, error -71 [ 365.757115][ T5746] usb 8-1: new full-speed USB device number 44 using dummy_hcd [ 365.777280][ T5746] usb 8-1: device descriptor read/8, error -71 [ 365.887501][ T5746] usb usb8-port1: unable to enumerate USB device [ 365.973717][ T73] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 1023 [ 365.979881][ T73] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 184, changing to 4 [ 365.992741][ T73] usb 6-1: language id specifier not provided by device, defaulting to English [ 366.005747][ T73] usb 6-1: New USB device found, idVendor=0499, idProduct=1002, bcdDevice= 0.40 [ 366.009630][ T73] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.012909][ T73] usb 6-1: Product: syz [ 366.014643][ T73] usb 6-1: Manufacturer: Ъ [ 366.018648][ T73] usb 6-1: SerialNumber: syz [ 366.265437][T12353] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 10 [ 366.280142][ T12] vhci_hcd vhci_hcd.1: stop threads [ 366.285736][ T12] vhci_hcd vhci_hcd.1: release socket [ 366.288850][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 366.432648][ T73] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 366.440692][ T73] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 366.452534][ T73] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 366.458731][ T73] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 366.469155][ T73] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 366.526055][ T73] snd-usb-audio 6-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 366.538972][ T73] usb 6-1: USB disconnect, device number 47 [ 366.552083][ T6058] udevd[6058]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb6/6-1/6-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 367.176557][ T5827] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 367.309123][ T5827] usb 8-1: device descriptor read/64, error -71 [ 367.546353][ T5827] usb 8-1: new high-speed USB device number 46 using dummy_hcd [ 367.686197][ T5827] usb 8-1: device descriptor read/64, error -71 [ 367.731079][T12411] program syz.1.1881 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 367.734708][T12411] ata1.00: non-matching transfer count (67438080/0) [ 367.767979][T12413] FAULT_INJECTION: forcing a failure. [ 367.767979][T12413] name failslab, interval 1, probability 0, space 0, times 0 [ 367.773207][T12413] CPU: 3 UID: 0 PID: 12413 Comm: syz.1.1882 Tainted: G L syzkaller #0 PREEMPT(full) [ 367.773236][T12413] Tainted: [L]=SOFTLOCKUP [ 367.773242][T12413] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 367.773252][T12413] Call Trace: [ 367.773260][T12413] [ 367.773270][T12413] dump_stack_lvl+0x100/0x190 [ 367.773295][T12413] should_fail_ex.cold+0x5/0xa [ 367.773314][T12413] should_failslab+0xc2/0x120 [ 367.773337][T12413] __kmalloc_noprof+0xfc/0x820 [ 367.773356][T12413] ? tomoyo_encode2+0xfb/0x3c0 [ 367.773387][T12413] tomoyo_encode2+0xfb/0x3c0 [ 367.773412][T12413] tomoyo_encode+0x29/0x50 [ 367.773430][T12413] tomoyo_realpath_from_path+0x18c/0x690 [ 367.773458][T12413] tomoyo_path_number_perm+0x23c/0x580 [ 367.773478][T12413] ? tomoyo_path_number_perm+0x22e/0x580 [ 367.773496][T12413] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 367.773517][T12413] ? get_pid_task+0x106/0x250 [ 367.773557][T12413] ? find_held_lock+0x2b/0x80 [ 367.773577][T12413] ? __fget_files+0x215/0x3d0 [ 367.773600][T12413] ? hook_file_ioctl_common+0x140/0x440 [ 367.773617][T12413] ? __fget_files+0x215/0x3d0 [ 367.773644][T12413] ? __fget_files+0x21f/0x3d0 [ 367.773693][T12413] security_file_ioctl_compat+0xd3/0x230 [ 367.773716][T12413] __ia32_compat_sys_ioctl+0xc2/0x360 [ 367.773742][T12413] __do_fast_syscall_32+0xe7/0x970 [ 367.773758][T12413] ? lockdep_hardirqs_on+0x78/0x100 [ 367.773784][T12413] do_fast_syscall_32+0x32/0x70 [ 367.773802][T12413] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 367.773825][T12413] RIP: 0023:0xf6fdefec [ 367.773848][T12413] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 367.773860][T12413] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 367.773880][T12413] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000001 [ 367.773891][T12413] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 367.773900][T12413] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 367.773912][T12413] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 367.773924][T12413] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 367.773945][T12413] [ 367.773964][T12413] ERROR: Out of memory at tomoyo_realpath_from_path. [ 367.854243][ T5827] usb usb8-port1: attempt power cycle [ 367.858912][T12413] program syz.1.1882 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 367.862736][T12413] ata1.00: non-matching transfer count (67438080/0) [ 367.927790][T12415] veth0_virt_wifi: entered promiscuous mode [ 367.929980][T12415] veth0_virt_wifi: entered allmulticast mode [ 368.200369][ T5827] usb 8-1: new high-speed USB device number 47 using dummy_hcd [ 368.226608][ T5827] usb 8-1: device descriptor read/8, error -71 [ 368.466215][ T5827] usb 8-1: new high-speed USB device number 48 using dummy_hcd [ 368.487021][ T5827] usb 8-1: device descriptor read/8, error -71 [ 368.596967][ T5827] usb usb8-port1: unable to enumerate USB device [ 368.621819][T12434] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 368.654073][T12434] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 368.691577][T12432] bond0: (slave wlan0): Enslaving as an active interface with an up link [ 368.936208][ T42] kauditd_printk_skb: 9 callbacks suppressed [ 368.936360][ T42] audit: type=1800 audit(1783591812.878:358): pid=12441 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1890" name="file0" dev="overlay" ino=163 res=0 errno=0 [ 369.550453][T12448] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 369.971323][T12459] Invalid logical block size (55998) [ 370.910874][T12464] FAULT_INJECTION: forcing a failure. [ 370.910874][T12464] name failslab, interval 1, probability 0, space 0, times 0 [ 370.922509][T12464] CPU: 3 UID: 0 PID: 12464 Comm: syz.0.1896 Tainted: G L syzkaller #0 PREEMPT(full) [ 370.922543][T12464] Tainted: [L]=SOFTLOCKUP [ 370.922549][T12464] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 370.922560][T12464] Call Trace: [ 370.922567][T12464] [ 370.922576][T12464] dump_stack_lvl+0x100/0x190 [ 370.922602][T12464] should_fail_ex.cold+0x5/0xa [ 370.922624][T12464] should_failslab+0xc2/0x120 [ 370.922648][T12464] kmem_cache_alloc_noprof+0x91/0x6a0 [ 370.922669][T12464] ? dst_alloc+0x99/0x1a0 [ 370.922687][T12464] ? __pfx_ip6_dst_gc+0x10/0x10 [ 370.922710][T12464] dst_alloc+0x99/0x1a0 [ 370.922731][T12464] ip6_rt_cache_alloc+0x1ea/0x8e0 [ 370.922761][T12464] ? __pfx_ip6_rt_cache_alloc+0x10/0x10 [ 370.922795][T12464] ip6_pol_route+0xf28/0x1310 [ 370.922815][T12464] ? __lock_acquire+0x49f/0x1a40 [ 370.922841][T12464] ? __pfx_ip6_pol_route+0x10/0x10 [ 370.922873][T12464] ? __pfx_ip6_pol_route_output+0x10/0x10 [ 370.922892][T12464] fib6_rule_action+0x2e9/0x910 [ 370.922919][T12464] ? __pfx_fib6_rule_action+0x10/0x10 [ 370.922976][T12464] fib_rules_lookup+0x418/0x1060 [ 370.923004][T12464] ? __pfx_fib_rules_lookup+0x10/0x10 [ 370.923031][T12464] ? __pfx_ip6_pol_route_output+0x10/0x10 [ 370.923055][T12464] ? __pfx_ip6_pol_route_output+0x10/0x10 [ 370.923070][T12464] fib6_rule_lookup+0x18b/0x720 [ 370.923095][T12464] ? is_bpf_text_address+0x94/0x1a0 [ 370.923118][T12464] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 370.923143][T12464] ? __kernel_text_address+0xd/0x30 [ 370.923167][T12464] ? unwind_get_return_address+0x59/0xa0 [ 370.923195][T12464] ? __pfx_ip6_pol_route_output+0x10/0x10 [ 370.923219][T12464] ? tomoyo_check_open_permission+0x1a2/0x3c0 [ 370.923246][T12464] ip6_route_output_flags+0x1d0/0x650 [ 370.923280][T12464] ip6_dst_lookup_tail.constprop.0+0x116/0x2110 [ 370.923307][T12464] ? __lock_acquire+0x49f/0x1a40 [ 370.923333][T12464] ? __pfx_ip6_dst_lookup_tail.constprop.0+0x10/0x10 [ 370.923358][T12464] ? __lock_acquire+0x49f/0x1a40 [ 370.923392][T12464] ip6_dst_lookup_flow+0x122/0x240 [ 370.923413][T12464] ? __pfx_ip6_dst_lookup_flow+0x10/0x10 [ 370.923432][T12464] ? find_held_lock+0x2b/0x80 [ 370.923451][T12464] ? rawv6_sendmsg+0xb3c/0x4420 [ 370.923475][T12464] ? rawv6_sendmsg+0xb3c/0x4420 [ 370.923504][T12464] rawv6_sendmsg+0xe61/0x4420 [ 370.923536][T12464] ? tomoyo_update_policy+0x3ef/0x420 [ 370.923565][T12464] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 370.923602][T12464] ? __pfx___might_resched+0x10/0x10 [ 370.923633][T12464] ? aa_sk_perm+0x309/0xaa0 [ 370.923668][T12464] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 370.923694][T12464] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 370.923720][T12464] ? inet_sendmsg+0x11c/0x140 [ 370.923737][T12464] inet_sendmsg+0x11c/0x140 [ 370.923757][T12464] ____sys_sendmsg+0x9c9/0xbe0 [ 370.923779][T12464] ? __pfx_inet_sendmsg+0x10/0x10 [ 370.923801][T12464] ? __pfx_____sys_sendmsg+0x10/0x10 [ 370.923831][T12464] ? _kstrtoull+0x13c/0x1f0 [ 370.923859][T12464] ? __pfx__kstrtoull+0x10/0x10 [ 370.923889][T12464] ___sys_sendmsg+0x190/0x1e0 [ 370.923917][T12464] ? __pfx____sys_sendmsg+0x10/0x10 [ 370.923941][T12464] ? __lock_acquire+0x49f/0x1a40 [ 370.923997][T12464] __sys_sendmmsg+0x309/0x440 [ 370.924021][T12464] ? __pfx___sys_sendmmsg+0x10/0x10 [ 370.924041][T12464] ? find_held_lock+0x2b/0x80 [ 370.924067][T12464] ? __mutex_unlock_slowpath+0x35d/0x930 [ 370.924109][T12464] ? fput+0x79/0x100 [ 370.924128][T12464] ? ksys_write+0x1ac/0x250 [ 370.924158][T12464] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 370.924181][T12464] ? lockdep_hardirqs_on+0x78/0x100 [ 370.924207][T12464] __do_fast_syscall_32+0xe7/0x970 [ 370.924224][T12464] ? lockdep_hardirqs_on+0x78/0x100 [ 370.924252][T12464] do_fast_syscall_32+0x32/0x70 [ 370.924274][T12464] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 370.924297][T12464] RIP: 0023:0xf709efec [ 370.924317][T12464] Code: Unable to access opcode bytes at 0xf709efc2. [ 370.924324][T12464] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 370.924343][T12464] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001a40 [ 370.924355][T12464] RDX: 0000000000000002 RSI: 0000000004046040 RDI: 0000000000000000 [ 370.924365][T12464] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 370.924375][T12464] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 370.924384][T12464] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 370.924408][T12464] [ 370.926301][ T6255] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 371.142343][T12471] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 371.145092][T12471] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 371.148880][T12471] vhci_hcd vhci_hcd.0: Device attached [ 371.242742][ T64] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 371.396257][ T29] usb 6-1: new full-speed USB device number 48 using dummy_hcd [ 371.796774][T12481] binder: 12479:12481 ioctl 4018620d 0 returned -22 [ 372.026257][ T6255] usb 39-1: device descriptor read/64, error -110 [ 372.146055][T12472] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 10 [ 372.150204][T12485] netlink: 'syz.2.1902': attribute type 5 has an invalid length. [ 372.153905][ T5789] vhci_hcd vhci_hcd.1: stop threads [ 372.156596][ T5789] vhci_hcd vhci_hcd.1: release socket [ 372.161285][ T5789] vhci_hcd vhci_hcd.1: disconnect device [ 372.161746][T12485] ip6erspan0: entered promiscuous mode [ 372.206239][ T6255] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 372.269022][ T29] usb 6-1: unable to get BOS descriptor or descriptor too short [ 372.705045][ T29] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 372.708505][ T29] usb 6-1: can't read configurations, error -71 [ 372.821320][T12488] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 372.888162][T12488] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 372.965027][T12491] FAULT_INJECTION: forcing a failure. [ 372.965027][T12491] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 372.970747][T12491] CPU: 2 UID: 0 PID: 12491 Comm: syz.1.1905 Tainted: G L syzkaller #0 PREEMPT(full) [ 372.970779][T12491] Tainted: [L]=SOFTLOCKUP [ 372.970786][T12491] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 372.970798][T12491] Call Trace: [ 372.970805][T12491] [ 372.970814][T12491] dump_stack_lvl+0x100/0x190 [ 372.970841][T12491] should_fail_ex.cold+0x5/0xa [ 372.970864][T12491] _copy_from_user+0x2e/0xd0 [ 372.970890][T12491] move_addr_to_kernel+0x65/0x170 [ 372.970920][T12491] get_compat_msghdr+0x3c7/0x480 [ 372.970944][T12491] ? __pfx_get_compat_msghdr+0x10/0x10 [ 372.970972][T12491] ? _kstrtoull+0x13c/0x1f0 [ 372.970997][T12491] ? __pfx__kstrtoull+0x10/0x10 [ 372.971027][T12491] ___sys_sendmsg+0x1b6/0x1e0 [ 372.971057][T12491] ? __pfx____sys_sendmsg+0x10/0x10 [ 372.971081][T12491] ? __lock_acquire+0x49f/0x1a40 [ 372.971136][T12491] __sys_sendmmsg+0x309/0x440 [ 372.971161][T12491] ? __pfx___sys_sendmmsg+0x10/0x10 [ 372.971180][T12491] ? find_held_lock+0x2b/0x80 [ 372.971207][T12491] ? __mutex_unlock_slowpath+0x35d/0x930 [ 372.971249][T12491] ? fput+0x79/0x100 [ 372.971268][T12491] ? ksys_write+0x1ac/0x250 [ 372.971299][T12491] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 372.971324][T12491] ? lockdep_hardirqs_on+0x78/0x100 [ 372.971351][T12491] __do_fast_syscall_32+0xe7/0x970 [ 372.971369][T12491] ? lockdep_hardirqs_on+0x78/0x100 [ 372.971398][T12491] do_fast_syscall_32+0x32/0x70 [ 372.971417][T12491] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 372.971440][T12491] RIP: 0023:0xf6fdefec [ 372.971464][T12491] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 372.971472][T12491] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 372.971491][T12491] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080006b80 [ 372.971501][T12491] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 372.971509][T12491] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 372.971516][T12491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 372.971527][T12491] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 372.971550][T12491] [ 374.594405][T12519] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 374.597274][T12519] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 374.617153][T12519] vhci_hcd vhci_hcd.0: Device attached [ 374.623644][T12523] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 374.674082][T12523] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 374.857548][ T6064] usb 39-1: new low-speed USB device number 13 using vhci_hcd [ 374.876269][ T5887] usb 6-1: new full-speed USB device number 50 using dummy_hcd [ 375.053135][T12520] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 11 [ 375.055748][ T5807] vhci_hcd vhci_hcd.1: stop threads [ 375.058012][ T5807] vhci_hcd vhci_hcd.1: release socket [ 375.071894][ T5807] vhci_hcd vhci_hcd.1: disconnect device [ 375.285463][ T5887] usb 6-1: unable to get BOS descriptor or descriptor too short [ 375.298329][ T5887] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 375.313746][ T5887] usb 6-1: can't read configurations, error -71 [ 375.524009][T12538] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1918'. [ 376.191765][T12564] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 376.207013][T12564] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 376.289636][T12565] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 376.327714][T12565] @0: renamed from bond_slave_1 (while UP) [ 376.866214][ T29] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 376.922686][ T42] audit: type=1326 audit(1783591820.928:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12579 comm="syz.3.1932" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fec code=0x7ffc0000 [ 376.933607][ T42] audit: type=1326 audit(1783591820.938:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12579 comm="syz.3.1932" exe="/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf7fa3fec code=0x7ffc0000 [ 376.945982][ T42] audit: type=1326 audit(1783591820.938:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12579 comm="syz.3.1932" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fec code=0x7ffc0000 [ 376.972605][ T42] audit: type=1326 audit(1783591820.938:362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12579 comm="syz.3.1932" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fec code=0x7ffc0000 [ 376.989426][ T42] audit: type=1326 audit(1783591820.938:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12579 comm="syz.3.1932" exe="/syz-executor" sig=0 arch=40000003 syscall=358 compat=1 ip=0xf7fa3fec code=0x7ffc0000 [ 376.996514][ T42] audit: type=1326 audit(1783591820.948:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12579 comm="syz.3.1932" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fec code=0x7ffc0000 [ 377.007061][ T42] audit: type=1326 audit(1783591820.968:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12579 comm="syz.3.1932" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fa3fec code=0x7ffc0000 [ 377.014824][ T42] audit: type=1326 audit(1783591820.988:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12579 comm="syz.3.1932" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fec code=0x7ffc0000 [ 377.022591][ T42] audit: type=1326 audit(1783591820.988:367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12579 comm="syz.3.1932" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fa3fec code=0x7ffc0000 [ 377.030868][ T42] audit: type=1326 audit(1783591821.008:368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12579 comm="syz.3.1932" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fa3fec code=0x7ffc0000 [ 377.037535][ T29] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 377.040269][ T29] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 377.043368][ T29] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 377.046319][ T29] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 377.051489][ T29] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 377.059600][ T29] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 377.063540][ T29] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 377.066748][ T29] usb 5-1: Product: syz [ 377.068281][ T29] usb 5-1: Manufacturer: syz [ 377.079099][ T29] cdc_wdm 5-1:1.0: skipping garbage [ 377.080781][ T29] cdc_wdm 5-1:1.0: skipping garbage [ 377.085374][ T29] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 377.088854][ T29] cdc_wdm 5-1:1.0: Unknown control protocol [ 377.450045][T12589] syz_tun: entered allmulticast mode [ 377.454289][T12588] lo: entered allmulticast mode [ 377.465866][T12587] syz_tun: left allmulticast mode [ 377.532368][ T1485] usb 5-1: USB disconnect, device number 34 [ 377.926392][ T5746] usb 7-1: new full-speed USB device number 10 using dummy_hcd [ 378.056242][ T5746] usb 7-1: device descriptor read/64, error -71 [ 378.306612][ T5746] usb 7-1: new full-speed USB device number 11 using dummy_hcd [ 378.440023][T12618] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 378.448241][ T5746] usb 7-1: device descriptor read/64, error -71 [ 378.556627][ T5746] usb usb7-port1: attempt power cycle [ 378.916404][ T5746] usb 7-1: new full-speed USB device number 12 using dummy_hcd [ 378.936930][ T5746] usb 7-1: device descriptor read/8, error -71 [ 379.057227][T12624] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1946'. [ 379.102183][T12625] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 379.186238][ T5746] usb 7-1: new full-speed USB device number 13 using dummy_hcd [ 380.049834][T12641] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1949'. [ 380.343936][ T5746] usb 7-1: device descriptor read/8, error -71 [ 380.346461][ T6064] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 380.459941][ T5746] usb usb7-port1: unable to enumerate USB device [ 380.530641][T12644] binder: 12643:12644 ioctl c0306201 80000480 returned -14 [ 380.910876][T12652] netlink: 'syz.1.1954': attribute type 4 has an invalid length. [ 381.096920][T12658] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1955'. [ 381.309979][T12663] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 381.311977][T12663] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 381.315367][T12663] vhci_hcd vhci_hcd.0: Device attached [ 381.367412][T12655] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 381.586228][ T6255] usb 8-1: new full-speed USB device number 49 using dummy_hcd [ 381.591413][ T73] usb 43-1: new low-speed USB device number 11 using vhci_hcd [ 381.748477][ T6255] usb 8-1: not running at top speed; connect to a high speed hub [ 381.755093][T12668] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 381.755643][ T6255] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 254, changing to 4 [ 381.765120][ T6255] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 1023 [ 381.769793][ T6255] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 184, changing to 4 [ 381.782581][ T6255] usb 8-1: language id specifier not provided by device, defaulting to English [ 381.796561][ T6255] usb 8-1: New USB device found, idVendor=0499, idProduct=1002, bcdDevice= 0.40 [ 381.802621][ T6255] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.806324][ T6255] usb 8-1: Product: syz [ 381.811042][ T6255] usb 8-1: Manufacturer: Ъ [ 381.813310][ T6255] usb 8-1: SerialNumber: syz [ 381.822673][T12669] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1956'. [ 381.858093][T12669] x_tables: duplicate underflow at hook 1 [ 381.914043][T12668] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 382.136714][T12664] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 9 [ 382.144276][ T5807] vhci_hcd vhci_hcd.3: stop threads [ 382.154433][ T5807] vhci_hcd vhci_hcd.3: release socket [ 382.164553][ T5807] vhci_hcd vhci_hcd.3: disconnect device [ 382.214435][ T6255] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 382.226992][ T6255] snd-usb-audio 8-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 382.244491][ T6255] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 382.248614][ T6255] snd-usb-audio 8-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 382.261722][ T6255] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 382.482205][ T6255] snd-usb-audio 8-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 382.500055][ T6255] usb 8-1: USB disconnect, device number 49 [ 382.514968][ T6058] udevd[6058]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb8/8-1/8-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 382.953386][ T64] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 382.974424][T12691] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1964'. [ 383.311773][ T1438] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 383.316020][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 383.318833][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 384.398834][T12723] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1974'. [ 384.633580][T12737] FAULT_INJECTION: forcing a failure. [ 384.633580][T12737] name failslab, interval 1, probability 0, space 0, times 0 [ 384.640621][T12737] CPU: 3 UID: 0 PID: 12737 Comm: syz.0.1981 Tainted: G L syzkaller #0 PREEMPT(full) [ 384.640641][T12737] Tainted: [L]=SOFTLOCKUP [ 384.640645][T12737] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 384.640651][T12737] Call Trace: [ 384.640656][T12737] [ 384.640661][T12737] dump_stack_lvl+0x100/0x190 [ 384.640680][T12737] should_fail_ex.cold+0x5/0xa [ 384.640692][T12737] should_failslab+0xc2/0x120 [ 384.640706][T12737] __kmalloc_noprof+0xfc/0x820 [ 384.640717][T12737] ? get_pid_task+0x106/0x250 [ 384.640730][T12737] ? video_usercopy+0x145/0x14c0 [ 384.640745][T12737] video_usercopy+0x145/0x14c0 [ 384.640758][T12737] ? __pfx___video_do_ioctl+0x10/0x10 [ 384.640770][T12737] ? do_vfs_ioctl+0x226/0x13e0 [ 384.640785][T12737] ? __pfx_video_usercopy+0x10/0x10 [ 384.640801][T12737] ? __fget_files+0x215/0x3d0 [ 384.640816][T12737] ? hook_file_ioctl_common+0x140/0x440 [ 384.640832][T12737] v4l2_ioctl+0x1bd/0x250 [ 384.640846][T12737] v4l2_compat_ioctl32+0x20f/0x2d0 [ 384.640858][T12737] ? __pfx_v4l2_compat_ioctl32+0x10/0x10 [ 384.640869][T12737] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 384.640885][T12737] __do_fast_syscall_32+0xe7/0x970 [ 384.640895][T12737] ? lockdep_hardirqs_on+0x78/0x100 [ 384.640912][T12737] do_fast_syscall_32+0x32/0x70 [ 384.640922][T12737] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 384.640936][T12737] RIP: 0023:0xf709efec [ 384.640980][T12737] Code: Unable to access opcode bytes at 0xf709efc2. [ 384.640985][T12737] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 384.640997][T12737] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0845657 [ 384.641004][T12737] RDX: 0000000080000380 RSI: 0000000000000000 RDI: 0000000000000000 [ 384.641010][T12737] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 384.641016][T12737] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 384.641035][T12737] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 384.641048][T12737] [ 384.744746][T12740] random: crng reseeded on system resumption [ 385.363237][ T64] Bluetooth: hci2: unexpected event for opcode 0x3a29 [ 385.394594][ T42] kauditd_printk_skb: 73 callbacks suppressed [ 385.394607][ T42] audit: type=1326 audit(1783591829.398:442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12761 comm="syz.1.1989" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x0 [ 385.822266][T12771] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 385.880767][T12771] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 386.176386][ T5883] usb 8-1: new high-speed USB device number 50 using dummy_hcd [ 386.338765][ T5883] usb 8-1: no configurations [ 386.345622][ T5883] usb 8-1: can't read configurations, error -22 [ 386.507642][ T5883] usb 8-1: new high-speed USB device number 51 using dummy_hcd [ 386.689772][ T5883] usb 8-1: no configurations [ 386.707744][ T5883] usb 8-1: can't read configurations, error -22 [ 386.749360][ T5883] usb usb8-port1: attempt power cycle [ 386.829588][ T73] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 387.021087][T12787] netlink: 'syz.1.1997': attribute type 4 has an invalid length. [ 387.215393][T12796] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2001'. [ 387.227186][ T5883] usb 8-1: new high-speed USB device number 52 using dummy_hcd [ 387.248886][ T5883] usb 8-1: no configurations [ 387.250965][ T5883] usb 8-1: can't read configurations, error -22 [ 387.265309][T12798] NILFS (nbd1): device size too small [ 387.277443][T12798] netlink: 'syz.1.2002': attribute type 9 has an invalid length. [ 387.306218][ T1485] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 387.376281][ T5883] usb 8-1: new high-speed USB device number 53 using dummy_hcd [ 387.397716][ T5883] usb 8-1: no configurations [ 387.399991][ T5883] usb 8-1: can't read configurations, error -22 [ 387.408061][ T5883] usb usb8-port1: unable to enumerate USB device [ 387.478979][ T1485] usb 7-1: Using ep0 maxpacket: 8 [ 387.492544][ T1485] usb 7-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 387.497726][ T1485] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 387.502225][ T1485] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 387.628659][T12805] pim6reg: entered allmulticast mode [ 387.677418][T12801] pim6reg: left allmulticast mode [ 388.337272][T12812] syzkaller0: entered promiscuous mode [ 388.340308][T12812] syzkaller0: entered allmulticast mode [ 388.349223][T12812] nbd: must specify a size in bytes for the device [ 388.649085][ T42] audit: type=1804 audit(1783591832.648:443): pid=12814 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.2008" name="/newroot/470/file0" dev="fuse" ino=1 res=1 errno=0 [ 389.220321][T12837] FAULT_INJECTION: forcing a failure. [ 389.220321][T12837] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 389.225872][T12837] CPU: 0 UID: 0 PID: 12837 Comm: syz.3.2014 Tainted: G L syzkaller #0 PREEMPT(full) [ 389.225903][T12837] Tainted: [L]=SOFTLOCKUP [ 389.225909][T12837] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 389.225918][T12837] Call Trace: [ 389.225928][T12837] [ 389.225939][T12837] dump_stack_lvl+0x100/0x190 [ 389.225966][T12837] should_fail_ex.cold+0x5/0xa [ 389.225985][T12837] _copy_from_user+0x2e/0xd0 [ 389.226012][T12837] get_compat_msghdr+0xb3/0x480 [ 389.226039][T12837] ? __pfx_get_compat_msghdr+0x10/0x10 [ 389.226064][T12837] ? _kstrtoull+0x13c/0x1f0 [ 389.226107][T12837] ___sys_sendmsg+0x1b6/0x1e0 [ 389.226138][T12837] ? __pfx____sys_sendmsg+0x10/0x10 [ 389.226157][T12837] ? __lock_acquire+0x49f/0x1a40 [ 389.226209][T12837] __sys_sendmmsg+0x309/0x440 [ 389.226232][T12837] ? __pfx___sys_sendmmsg+0x10/0x10 [ 389.226253][T12837] ? trace_sched_exit_tp+0x120/0x160 [ 389.226288][T12837] ? fput+0x79/0x100 [ 389.226307][T12837] ? exit_to_user_mode_loop+0x166/0x6f0 [ 389.226337][T12837] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 389.226360][T12837] ? lockdep_hardirqs_on+0x78/0x100 [ 389.226388][T12837] __do_fast_syscall_32+0xe7/0x970 [ 389.226402][T12837] ? lockdep_hardirqs_on+0x78/0x100 [ 389.226428][T12837] do_fast_syscall_32+0x32/0x70 [ 389.226446][T12837] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 389.226471][T12837] RIP: 0023:0xf7fa3fec [ 389.226494][T12837] Code: Unable to access opcode bytes at 0xf7fa3fc2. [ 389.226503][T12837] RSP: 002b:00000000f542450c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 389.226522][T12837] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080003cc0 [ 389.226532][T12837] RDX: 0000000000000172 RSI: 0000000004000000 RDI: 0000000000000000 [ 389.226540][T12837] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 389.226549][T12837] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 389.226558][T12837] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 389.226581][T12837] [ 390.082334][ T1485] usb 7-1: USB disconnect, device number 14 [ 390.133597][T12857] ntfs3(nullb0): Primary boot signature is not NTFS. [ 390.137230][T12857] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 390.225801][T12861] kvm: emulating exchange as write [ 390.234133][T12861] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2021'. [ 390.406685][T12870] netlink: 'syz.0.2022': attribute type 1 has an invalid length. [ 390.411647][T12870] netlink: 756 bytes leftover after parsing attributes in process `syz.0.2022'. [ 391.295125][T12886] [U] [ 391.296499][T12886] [U] [ 391.297413][T12886] [U] [ 391.298318][T12886] [U] [ 391.299396][T12886] [U] [ 391.300485][T12886] [U] [ 391.301580][T12886] [U] [ 391.302654][T12886] [U] [ 391.333490][T12886] [U] [ 391.334789][T12886] [U] [ 391.336071][T12886] [U] [ 391.337421][T12886] [U] [ 391.338745][T12886] [U] [ 391.339928][T12886] [U] [ 391.341263][T12886] [U] [ 391.342546][T12886] [U] [ 391.386371][T12886] [U] [ 391.387740][T12886] [U] [ 391.389029][T12886] [U] [ 391.390313][T12886] [U] [ 391.391634][T12886] [U] [ 391.392916][T12886] [U] [ 391.394109][T12886] [U] [ 391.395385][T12886] [U] [ 391.418734][T12886] [U] [ 391.419726][T12886] [U] [ 391.420650][T12886] [U] [ 391.421584][T12886] [U] [ 391.422486][T12886] [U] [ 391.423362][T12886] [U] [ 391.424270][T12886] [U] [ 391.425221][T12886] [U] [ 391.441079][T12879] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 391.443587][T12886] [U] [ 391.444880][T12886] [U] [ 391.445846][T12886] [U] [ 391.446904][T12886] [U] [ 391.447839][T12886] [U] [ 391.448752][T12886] [U] [ 391.449730][T12886] [U] [ 391.450675][T12886] [U] [ 391.468400][T12888] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 391.469908][T12886] [U] [ 391.474469][T12886] [U] [ 391.475417][T12886] [U] [ 391.476332][T12886] [U] [ 391.477256][T12886] [U] [ 391.478206][T12886] [U] [ 391.479081][T12886] [U] [ 391.479951][T12886] [U] [ 391.487682][T12886] [U] [ 391.488980][T12886] [U] [ 391.490252][T12886] [U] [ 391.491525][T12886] [U] [ 391.492662][T12886] [U] [ 391.493925][T12886] [U] [ 391.495191][T12886] [U] [ 391.496441][T12886] [U] [ 391.499364][T12886] [U] [ 391.500662][T12886] [U] [ 391.501897][T12886] [U] [ 391.503117][T12886] [U] [ 391.504357][T12886] [U] [ 391.505593][T12886] [U] [ 391.506835][T12886] [U] [ 391.507981][T12886] [U] [ 391.509840][T12886] [U] [ 391.511125][T12886] [U] [ 391.512370][T12886] [U] [ 391.513529][T12886] [U] [ 391.514741][T12886] [U] [ 391.515989][T12886] [U] [ 391.517226][T12886] [U] [ 391.518495][T12886] [U] [ 391.521127][T12886] [U] [ 391.522414][T12886] [U] [ 391.523671][T12886] [U] [ 391.524904][T12886] [U] [ 391.526060][T12886] [U] [ 391.527294][T12886] [U] [ 391.528530][T12886] [U] [ 391.529773][T12886] [U] [ 391.532564][T12886] [U] [ 391.533863][T12886] [U] [ 391.535093][T12886] [U] [ 391.536317][T12886] [U] [ 391.537541][T12886] [U] [ 391.538808][T12886] [U] [ 391.539986][T12886] [U] [ 391.541245][T12886] [U] [ 391.543843][T12886] [U] [ 391.545158][T12886] [U] [ 391.546420][T12886] [U] [ 391.547679][T12886] [U] [ 391.548922][T12886] [U] [ 391.550222][T12886] [U] [ 391.551466][T12886] [U] [ 391.552708][T12886] [U] [ 391.552802][T12891] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 391.555175][T12886] [U] [ 391.558529][T12886] [U] [ 391.559791][T12886] [U] [ 391.561075][T12886] [U] [ 391.562346][T12886] [U] [ 391.563497][T12886] [U] [ 391.564735][T12886] [U] [ 391.565991][T12886] [U] [ 391.586315][T12886] [U] [ 391.587631][T12886] [U] [ 391.588868][T12886] [U] [ 391.590124][T12886] [U] [ 391.591290][T12886] [U] [ 391.592528][T12886] [U] [ 391.593785][T12886] [U] [ 391.595020][T12886] [U] [ 391.598591][T12886] [U] [ 391.599886][T12886] [U] [ 391.601054][T12886] [U] [ 391.602308][T12886] [U] [ 391.603568][T12886] [U] [ 391.604807][T12886] [U] [ 391.606062][T12886] [U] [ 391.607324][T12886] [U] [ 391.609982][T12886] [U] [ 391.611289][T12886] [U] [ 391.613287][T12886] [U] [ 391.614546][T12886] [U] [ 391.615782][T12886] [U] [ 391.617043][T12886] [U] [ 391.618295][T12886] [U] [ 391.697950][T12896] [U] [ 391.699327][T12896] [U] [ 391.700660][T12896] [U] ֱ˩EH&`  d$YnGZg4 XyGM'!d&-0~5dQLGma":;74ȵ/ܨӻK`قG_))U8o_Ih\?ؐ(a˘G}ǜ,CZ~Te2*5ig [ 391.709101][T12896] [U] bl=$|J(?~'^QϪɉ P [ 391.712066][T12896] [U] 2krz ׬J-o;JL)p3T>C=\Aaz+m\gvyZ&QВE [ 391.734122][T12896] [U] aUFTm FLh.I.YD~ [ 391.736426][T12896] [U] 2>ha U\: [ 391.738332][T12896] [U] 4q*y% 4M)*g8a*pi.i [ 391.741523][T12896] [U] 㠿L ?#.q㾳f |F Ⴄos l݋h,j.S [ 391.775418][T12896] [U] A_|=A]X3깙,FMLJU&NzNHd48v_fR0MBzI4*&P7;Oe[ǓÈ _8M@RaFv&ݜo\\eClq0«-vbVfC=p[xw{GQJ [ 391.793777][T12896] [U] &^9ԁlZՉ [ 391.795911][T12896] [U] 2&VDc [ 391.797491][T12896] [U] ² [ 391.798984][T12896] [U] glC7t} [ 391.800703][T12896] [U] J퀾bC9`nFQvO{hQ]WxfwcwiIy!FJ 85-ƴq >8nz8 Ι"sԃD0t(Q~@ [ 391.806170][T12896] [U] JFBFY/;,o@_:BZi͈ڊ~ql7gˌVcA!< $ˀv-E7Wl84 b__ч:F2;aK;<*JK[Q UB7@BB^.hC?*&^J;F̷tKIE,R>$u%ıZk [ 391.815309][T12896] [U] WC˶ղ5'_XUlijF"`#-#8e2b&:6j'3.)C|676Pc|3]?%^ץbIԭF-'([=%EP^XL [ 391.830968][T12896] [U] N]zẠ̏^k{C.2r֑(y) JjmI4z_ H9AFB:_ [ 391.835210][T12896] [U] g2ATj5 ;01+ [ 391.837377][T12896] [U] Sx’+o>r|'8`]Ag~9fTnG5`_@Zei$y!a [ 391.841870][T12896] [U] [ 391.843189][T12896] [U] [ 391.844477][T12896] [U] [ 391.845766][T12896] [U] [ 391.847064][T12896] [U] [ 391.848245][T12896] [U] [ 391.853472][T12896] [U] [ 391.854847][T12896] [U] [ 391.856163][T12896] [U] [ 391.857481][T12896] [U] [ 391.858771][T12896] [U] [ 391.860055][T12896] [U] [ 391.861361][T12896] [U] [ 391.862627][T12896] [U] [ 391.864226][T12896] [U] [ 391.865541][T12896] [U] [ 391.866847][T12896] [U] [ 391.868117][T12896] [U] [ 391.869407][T12896] [U] [ 391.870683][T12896] [U] [ 391.871881][T12896] [U] [ 391.873171][T12896] [U] [ 391.874978][T12896] [U] [ 391.876296][T12896] [U] [ 391.877608][T12896] [U] [ 391.878822][T12896] [U] [ 391.880107][T12896] [U] [ 391.881424][T12896] [U] [ 391.882704][T12896] [U] [ 391.884002][T12896] [U] [ 391.892008][T12896] [U] [ 391.893297][T12896] [U] [ 391.894562][T12896] [U] [ 391.895797][T12896] [U] [ 391.896915][T12896] [U] [ 391.898190][T12896] [U] [ 391.899447][T12896] [U] [ 391.900748][T12896] [U] [ 391.932215][T12896] [U] [ 391.933534][T12896] [U] [ 391.934790][T12896] [U] [ 391.936021][T12896] [U] [ 391.937153][T12896] [U] [ 391.938404][T12896] [U] [ 391.939644][T12896] [U] [ 391.940899][T12896] [U] [ 391.942171][T12896] [U] [ 391.944370][T12896] [U] [ 391.945679][T12896] [U] [ 391.946845][T12896] [U] [ 391.948100][T12896] [U] [ 391.949362][T12896] [U] [ 391.950635][T12896] [U] [ 391.951865][T12896] [U] [ 391.953099][T12896] [U] [ 391.954615][T12896] [U] [ 391.955879][T12896] [U] [ 391.956218][ T1485] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 391.957161][T12896] [U] [ 391.957194][T12896] [U] [ 391.962665][T12896] [U] [ 391.963911][T12896] [U] [ 391.965189][T12896] [U] [ 391.966348][T12896] [U] [ 391.977416][T12896] [U] [ 391.978620][T12896] [U] [ 391.979790][T12896] [U] [ 391.980969][T12896] [U] [ 391.982179][T12896] [U] [ 391.983314][T12896] [U] [ 391.984445][T12896] [U] [ 391.985606][T12896] [U] [ 392.014249][T12896] [U] [ 392.015464][T12896] [U] [ 392.016675][T12896] [U] [ 392.017852][T12896] [U] [ 392.019052][T12896] [U] [ 392.020235][T12896] [U] [ 392.021455][T12896] [U] [ 392.022624][T12896] [U] [ 392.039484][T12896] [U] [ 392.040796][T12896] [U] [ 392.041986][T12896] [U] [ 392.043157][T12896] [U] [ 392.044337][T12896] [U] [ 392.045519][T12896] [U] [ 392.046689][T12896] [U] [ 392.047864][T12896] [U] [ 392.066295][T12896] [U] [ 392.067527][T12896] [U] [ 392.068719][T12896] [U] [ 392.069924][T12896] [U] [ 392.071129][T12896] [U] [ 392.072317][T12896] [U] [ 392.073517][T12896] [U] [ 392.074684][T12896] [U] [ 392.094889][T12896] [U] [ 392.096122][T12896] [U] [ 392.097329][T12896] [U] [ 392.098518][T12896] [U] [ 392.099705][T12896] [U] [ 392.100887][T12896] [U] [ 392.102071][T12896] [U] [ 392.103244][T12896] [U] [ 392.114439][T12928] 9p: Bad value for 'msize' [ 392.118812][T12896] [U] [ 392.120035][T12896] [U] [ 392.121257][T12896] [U] [ 392.122447][T12896] [U] [ 392.123615][T12896] [U] [ 392.124786][T12896] [U] [ 392.125976][T12896] [U] [ 392.127151][T12896] [U] [ 392.133780][ T1485] usb 7-1: Using ep0 maxpacket: 8 [ 392.143627][ T1485] usb 7-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 392.150995][ T1485] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 392.157297][T12896] [U] [ 392.158549][T12896] [U] [ 392.159734][T12896] [U] [ 392.160916][T12896] [U] [ 392.162098][T12896] [U] [ 392.163314][T12896] [U] [ 392.164486][T12896] [U] [ 392.168083][ T1485] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 392.225366][T12893] [U] [ 392.322263][T12927] hsr0 speed is unknown, defaulting to 1000 [ 394.720258][ T1485] usb 7-1: USB disconnect, device number 15 [ 394.778372][ T64] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 395.083074][T12980] xt_nfacct: accounting object `\$9ZM#mU|^c\F9YⳈ' does not exist [ 396.260651][T13002] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 396.318806][T13002] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 396.466179][ T29] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 396.646156][ T29] usb 7-1: Using ep0 maxpacket: 8 [ 396.652050][ T29] usb 7-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 396.660328][ T29] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 396.664922][ T29] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.639152][T13028] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 397.669881][T13028] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 397.782443][T13033] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2065'. [ 398.139989][T13038] overlayfs: failed to resolve './file1': -2 [ 398.545774][T13042] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2068'. [ 399.128709][T13056] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 399.160627][T13056] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 399.200112][ T5883] usb 7-1: USB disconnect, device number 16 [ 399.330851][T13062] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2075'. [ 399.349591][T13062] input: syz0 as /devices/virtual/input/input12 [ 399.454571][T13067] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2077'. [ 400.335297][T13076] XFS (nullb0): Invalid superblock magic number [ 400.730739][T13095] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 400.767388][T13095] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 401.280034][T13106] tmpfs: Unknown parameter 'usrquota/#/msr' [ 401.615320][T13074] hsr0 speed is unknown, defaulting to 1000 [ 401.996834][ T5883] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 402.259717][ T64] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 402.845088][T13127] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2088'. [ 402.873089][ T5883] usb 5-1: Using ep0 maxpacket: 8 [ 402.888840][ T5883] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 402.895100][ T5883] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 402.902399][ T5883] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 402.909303][ T5883] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 403.031363][ T5883] usbtmc 5-1:16.0: bulk endpoints not found [ 403.659384][T13131] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2089'. [ 404.739378][T13138] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 404.747618][ T29] usb 5-1: USB disconnect, device number 35 [ 404.786690][T13138] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 405.127101][T13155] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 405.129902][T13155] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 405.959061][T13155] vhci_hcd vhci_hcd.0: Device attached [ 406.341215][ T6064] usb 42-1: SetAddress Request (2) to port 0 [ 406.341664][ T6064] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 406.795357][T13156] vhci_hcd: connection reset by peer [ 406.798281][ T12] vhci_hcd vhci_hcd.2: stop threads [ 406.798550][T13178] overlayfs: only single ':' or double '::' sequences of unescaped colons in lowerdir mount option allowed. [ 406.800648][ T12] vhci_hcd vhci_hcd.2: release socket [ 406.817474][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 406.886448][T13184] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 406.929484][T13184] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 407.106194][ T3852] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 407.256268][ T3852] usb 5-1: Using ep0 maxpacket: 8 [ 407.259862][ T3852] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 407.263600][ T3852] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 407.268973][ T3852] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 407.272267][ T3852] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 407.279143][ T3852] usbtmc 5-1:16.0: bulk endpoints not found [ 407.459769][T13198] FAULT_INJECTION: forcing a failure. [ 407.459769][T13198] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 407.464247][T13198] CPU: 3 UID: 0 PID: 13198 Comm: syz.1.2108 Tainted: G L syzkaller #0 PREEMPT(full) [ 407.464274][T13198] Tainted: [L]=SOFTLOCKUP [ 407.464280][T13198] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 407.464289][T13198] Call Trace: [ 407.464296][T13198] [ 407.464303][T13198] dump_stack_lvl+0x100/0x190 [ 407.464327][T13198] should_fail_ex.cold+0x5/0xa [ 407.464347][T13198] _copy_from_user+0x2e/0xd0 [ 407.464371][T13198] get_compat_msghdr+0xb3/0x480 [ 407.464395][T13198] ? __pfx_get_compat_msghdr+0x10/0x10 [ 407.464425][T13198] ___sys_sendmsg+0x1b6/0x1e0 [ 407.464452][T13198] ? __pfx____sys_sendmsg+0x10/0x10 [ 407.464489][T13198] ? find_held_lock+0x2b/0x80 [ 407.464523][T13198] __sys_sendmsg+0x160/0x210 [ 407.464543][T13198] ? __pfx___sys_sendmsg+0x10/0x10 [ 407.464568][T13198] ? __pfx_ksys_write+0x10/0x10 [ 407.464597][T13198] __do_fast_syscall_32+0xe7/0x970 [ 407.464613][T13198] ? lockdep_hardirqs_on+0x78/0x100 [ 407.464640][T13198] do_fast_syscall_32+0x32/0x70 [ 407.464657][T13198] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 407.464684][T13198] RIP: 0023:0xf6fdefec [ 407.464706][T13198] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 407.464714][T13198] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 407.464732][T13198] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800001c0 [ 407.464742][T13198] RDX: 000000000400c0c1 RSI: 0000000000000000 RDI: 0000000000000000 [ 407.464752][T13198] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 407.464761][T13198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 407.464771][T13198] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 407.464793][T13198] [ 407.582958][T13202] hsr0 speed is unknown, defaulting to 1000 [ 407.646424][T13209] could not allocate digest TFM handle sha384-arm [ 408.258811][T13225] hsr0 speed is unknown, defaulting to 1000 [ 408.822377][T13231] 9pnet_fd: Insufficient options for proto=fd [ 409.076306][ T5827] usb 6-1: new full-speed USB device number 52 using dummy_hcd [ 409.228455][ T5827] usb 6-1: not running at top speed; connect to a high speed hub [ 409.233520][ T5827] usb 6-1: config 1 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 409.240039][ T5827] usb 6-1: config 1 interface 0 has no altsetting 0 [ 409.259088][ T5827] usb 6-1: New USB device found, idVendor=056a, idProduct=0318, bcdDevice= 0.40 [ 409.262014][ T5827] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.264572][ T5827] usb 6-1: Product: ࠄ [ 409.265970][ T5827] usb 6-1: Manufacturer: 頋眫ﻙ虝怄曜 [ 409.270441][ T5827] usb 6-1: SerialNumber: syz [ 409.516493][T13242] FAULT_INJECTION: forcing a failure. [ 409.516493][T13242] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 409.521667][T13242] CPU: 1 UID: 0 PID: 13242 Comm: syz.2.2118 Tainted: G L syzkaller #0 PREEMPT(full) [ 409.521696][T13242] Tainted: [L]=SOFTLOCKUP [ 409.521700][T13242] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 409.521707][T13242] Call Trace: [ 409.521712][T13242] [ 409.521718][T13242] dump_stack_lvl+0x100/0x190 [ 409.521734][T13242] should_fail_ex.cold+0x5/0xa [ 409.521747][T13242] _copy_from_user+0x2e/0xd0 [ 409.521764][T13242] bpf_test_init.isra.0+0xaf/0x100 [ 409.521780][T13242] bpf_prog_test_run_flow_dissector+0x236/0x980 [ 409.521800][T13242] ? __pfx_bpf_prog_test_run_flow_dissector+0x10/0x10 [ 409.521818][T13242] ? find_held_lock+0x2b/0x80 [ 409.521830][T13242] ? __fget_files+0x215/0x3d0 [ 409.521849][T13242] ? __fget_files+0x21f/0x3d0 [ 409.521866][T13242] ? fput+0x79/0x100 [ 409.521877][T13242] ? __bpf_prog_get+0x97/0x2a0 [ 409.521891][T13242] ? __pfx_bpf_prog_test_run_flow_dissector+0x10/0x10 [ 409.521907][T13242] __sys_bpf+0x2a12/0x4e80 [ 409.521921][T13242] ? __pfx___sys_bpf+0x10/0x10 [ 409.521932][T13242] ? find_held_lock+0x2b/0x80 [ 409.521943][T13242] ? get_pid_task+0xfc/0x250 [ 409.521955][T13242] ? get_pid_task+0xfc/0x250 [ 409.521970][T13242] ? proc_fail_nth_write+0x9f/0x220 [ 409.521984][T13242] ? find_held_lock+0x2b/0x80 [ 409.521999][T13242] ? rcu_read_lock_any_held+0x6a/0xa0 [ 409.522012][T13242] ? find_held_lock+0x2b/0x80 [ 409.522023][T13242] ? ksys_write+0x190/0x250 [ 409.522050][T13242] ? ksys_write+0x190/0x250 [ 409.522075][T13242] ? fput+0x79/0x100 [ 409.522087][T13242] ? __ia32_sys_bpf+0xcc/0x170 [ 409.522097][T13242] __ia32_sys_bpf+0xcc/0x170 [ 409.522107][T13242] ? __do_fast_syscall_32+0x98/0x970 [ 409.522119][T13242] __do_fast_syscall_32+0xe7/0x970 [ 409.522128][T13242] ? lockdep_hardirqs_on+0x78/0x100 [ 409.522146][T13242] do_fast_syscall_32+0x32/0x70 [ 409.522156][T13242] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 409.522170][T13242] RIP: 0023:0xf7f64fec [ 409.522185][T13242] Code: Unable to access opcode bytes at 0xf7f64fc2. [ 409.522189][T13242] RSP: 002b:00000000f540550c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 409.522201][T13242] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000240 [ 409.522208][T13242] RDX: 000000000000004c RSI: 0000000000000000 RDI: 0000000000000000 [ 409.522214][T13242] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 409.522219][T13242] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 409.522225][T13242] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 409.522238][T13242] [ 409.676340][ T6255] usb 8-1: new full-speed USB device number 54 using dummy_hcd [ 409.837331][ T6255] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 409.842151][ T6255] usb 8-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 409.849188][ T6255] usb 8-1: config 6 has 0 interfaces, different from the descriptor's value: 1 [ 409.859404][ T6255] usb 8-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 409.863562][ T6255] usb 8-1: config 6 has 0 interfaces, different from the descriptor's value: 1 [ 409.871570][ T6255] usb 8-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 409.875809][ T6255] usb 8-1: config 6 has 0 interfaces, different from the descriptor's value: 1 [ 409.883595][ T6255] usb 8-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 409.889184][ T6255] usb 8-1: config 6 has 0 interfaces, different from the descriptor's value: 1 [ 409.895087][ T6255] usb 8-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 409.904011][ T6255] usb 8-1: config 6 has 0 interfaces, different from the descriptor's value: 1 [ 409.911459][ T6255] usb 8-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 409.916453][ T6255] usb 8-1: config 6 has 0 interfaces, different from the descriptor's value: 1 [ 409.921918][ T6255] usb 8-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 409.926035][ T6255] usb 8-1: config 6 has 0 interfaces, different from the descriptor's value: 1 [ 409.934170][ T6255] usb 8-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 409.939849][ T6255] usb 8-1: config 6 has 0 interfaces, different from the descriptor's value: 1 [ 409.951768][ T6255] usb 8-1: New USB device found, idVendor=05c6, idProduct=9055, bcdDevice=62.d8 [ 409.955890][ T6255] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.961534][ T6255] usb 8-1: Product: syz [ 409.968172][ T6255] usb 8-1: Manufacturer: syz [ 409.970341][ T6255] usb 8-1: SerialNumber: syz [ 410.114465][ T5827] usbhid 6-1:1.0: can't add hid device: -71 [ 410.119192][ T847] usb 5-1: USB disconnect, device number 36 [ 410.359043][T13239] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 410.369322][T13239] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.550888][ T5827] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 411.006761][T13251] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2119'. [ 411.233120][ T5827] usb 6-1: USB disconnect, device number 52 [ 411.400404][ T6064] usb 42-1: device descriptor read/8, error -110 [ 411.924592][ T6255] usb 8-1: USB disconnect, device number 54 [ 412.003131][T13266] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2125'. [ 412.171222][T13271] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 412.465677][T13275] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2127'. [ 412.609073][ T6064] usb usb42-port1: attempt power cycle [ 413.178605][ T6064] usb usb42-port1: unable to enumerate USB device [ 413.180630][T13280] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2129'. [ 413.221500][T13280] 8021q: adding VLAN 0 to HW filter on device bond12 [ 413.291244][T13282] FAULT_INJECTION: forcing a failure. [ 413.291244][T13282] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 413.296950][T13282] CPU: 2 UID: 0 PID: 13282 Comm: syz.3.2128 Tainted: G L syzkaller #0 PREEMPT(full) [ 413.297031][T13282] Tainted: [L]=SOFTLOCKUP [ 413.297039][T13282] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 413.297050][T13282] Call Trace: [ 413.297056][T13282] [ 413.297064][T13282] dump_stack_lvl+0x100/0x190 [ 413.297089][T13282] should_fail_ex.cold+0x5/0xa [ 413.297110][T13282] _copy_from_user+0x2e/0xd0 [ 413.297135][T13282] get_compat_msghdr+0xb3/0x480 [ 413.297157][T13282] ? __pfx_get_compat_msghdr+0x10/0x10 [ 413.297179][T13282] ? rcu_is_watching+0x12/0xc0 [ 413.297205][T13282] ? ___sys_sendmsg+0x19d/0x1e0 [ 413.297228][T13282] ? kfree+0x1e5/0x6c0 [ 413.297254][T13282] ___sys_sendmsg+0x1b6/0x1e0 [ 413.297279][T13282] ? __pfx____sys_sendmsg+0x10/0x10 [ 413.297302][T13282] ? __lock_acquire+0x49f/0x1a40 [ 413.297346][T13282] ? __pfx___might_resched+0x10/0x10 [ 413.297374][T13282] __sys_sendmmsg+0x309/0x440 [ 413.297395][T13282] ? __pfx___sys_sendmmsg+0x10/0x10 [ 413.297415][T13282] ? trace_sched_exit_tp+0x120/0x160 [ 413.297451][T13282] ? fput+0x79/0x100 [ 413.297471][T13282] ? exit_to_user_mode_loop+0x166/0x6f0 [ 413.297501][T13282] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 413.297523][T13282] ? lockdep_hardirqs_on+0x78/0x100 [ 413.297549][T13282] __do_fast_syscall_32+0xe7/0x970 [ 413.297563][T13282] ? lockdep_hardirqs_on+0x78/0x100 [ 413.297585][T13282] do_fast_syscall_32+0x32/0x70 [ 413.297595][T13282] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 413.297610][T13282] RIP: 0023:0xf7fa3fec [ 413.297626][T13282] Code: Unable to access opcode bytes at 0xf7fa3fc2. [ 413.297631][T13282] RSP: 002b:00000000f544550c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 413.297642][T13282] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080003dc0 [ 413.297648][T13282] RDX: 0000000000000299 RSI: 0000000000000000 RDI: 0000000000000000 [ 413.297655][T13282] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 413.297661][T13282] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 413.297667][T13282] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 413.297680][T13282] [ 413.526243][ T1485] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 413.681291][ T1485] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 413.689718][ T1485] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 413.694710][ T1485] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 413.699455][ T1485] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 413.702924][ T1485] usb 6-1: SerialNumber: syz [ 413.928154][T13280] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2129'. [ 413.932439][T13280] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2129'. [ 413.945163][T13280] netlink: 'syz.1.2129': attribute type 10 has an invalid length. [ 413.986740][ T1485] usb 6-1: 0:2 : does not exist [ 414.023072][ T1485] usb 6-1: USB disconnect, device number 53 [ 414.074934][ T6058] udevd[6058]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 414.359047][T13297] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2133'. [ 414.476414][ T5827] usb 8-1: new high-speed USB device number 55 using dummy_hcd [ 414.607473][ T5827] usb 8-1: device descriptor read/64, error -71 [ 414.846431][ T5827] usb 8-1: new high-speed USB device number 56 using dummy_hcd [ 414.993726][ T5827] usb 8-1: device descriptor read/64, error -71 [ 415.108045][ T5827] usb usb8-port1: attempt power cycle [ 415.538174][ T5827] usb 8-1: new high-speed USB device number 57 using dummy_hcd [ 415.557274][ T5827] usb 8-1: device descriptor read/8, error -71 [ 415.796400][ T5827] usb 8-1: new high-speed USB device number 58 using dummy_hcd [ 415.829523][ T5827] usb 8-1: device descriptor read/8, error -71 [ 415.952218][ T5827] usb usb8-port1: unable to enumerate USB device [ 416.330977][T13309] binder: 13308:13309 unknown command 0 [ 416.333440][T13309] binder: 13308:13309 ioctl c0306201 800001c0 returned -22 [ 416.595773][T13318] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 416.602972][T13318] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 416.607263][T13318] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 417.185586][T13324] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2141'. [ 417.496433][ T5827] usb 8-1: new high-speed USB device number 59 using dummy_hcd [ 417.646269][ T5827] usb 8-1: Using ep0 maxpacket: 8 [ 417.666680][T13329] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 417.705794][T13324] hsr0 speed is unknown, defaulting to 1000 [ 417.806537][ T64] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 417.937524][ T5827] usb 8-1: unable to get BOS descriptor or descriptor too short [ 417.946830][ T5827] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 417.954143][ T5827] usb 8-1: can't read configurations, error -71 [ 418.048215][T13356] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2149'. [ 418.444129][T13368] FAULT_INJECTION: forcing a failure. [ 418.444129][T13368] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 418.448847][T13368] CPU: 1 UID: 0 PID: 13368 Comm: syz.2.2152 Tainted: G L syzkaller #0 PREEMPT(full) [ 418.448866][T13368] Tainted: [L]=SOFTLOCKUP [ 418.448870][T13368] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 418.448877][T13368] Call Trace: [ 418.448882][T13368] [ 418.448887][T13368] dump_stack_lvl+0x100/0x190 [ 418.448903][T13368] should_fail_ex.cold+0x5/0xa [ 418.448916][T13368] _copy_from_user+0x2e/0xd0 [ 418.448964][T13368] generic_map_update_batch+0x452/0x800 [ 418.448988][T13368] ? __pfx_generic_map_update_batch+0x10/0x10 [ 418.449004][T13368] ? find_held_lock+0x2b/0x80 [ 418.449017][T13368] ? __might_fault+0xc5/0x140 [ 418.449033][T13368] ? __might_fault+0xc5/0x140 [ 418.449050][T13368] ? __pfx_generic_map_update_batch+0x10/0x10 [ 418.449067][T13368] bpf_map_do_batch+0x66f/0x6d0 [ 418.449083][T13368] __sys_bpf+0x4ce/0x4e80 [ 418.449096][T13368] ? __pfx___sys_bpf+0x10/0x10 [ 418.449107][T13368] ? find_held_lock+0x2b/0x80 [ 418.449118][T13368] ? get_pid_task+0xfc/0x250 [ 418.449130][T13368] ? get_pid_task+0xfc/0x250 [ 418.449149][T13368] ? proc_fail_nth_write+0x9f/0x220 [ 418.449164][T13368] ? find_held_lock+0x2b/0x80 [ 418.449178][T13368] ? rcu_read_lock_any_held+0x6a/0xa0 [ 418.449191][T13368] ? vfs_write+0x15d/0x1050 [ 418.449207][T13368] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 418.449220][T13368] ? populate_seccomp_data+0x225/0x4d0 [ 418.449241][T13368] ? __ia32_sys_bpf+0xcc/0x170 [ 418.449251][T13368] __ia32_sys_bpf+0xcc/0x170 [ 418.449261][T13368] ? __secure_computing+0x1e4/0x2c0 [ 418.449272][T13368] __do_fast_syscall_32+0xe7/0x970 [ 418.449282][T13368] ? lockdep_hardirqs_on+0x78/0x100 [ 418.449299][T13368] do_fast_syscall_32+0x32/0x70 [ 418.449309][T13368] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 418.449323][T13368] RIP: 0023:0xf7f64fec [ 418.449338][T13368] Code: Unable to access opcode bytes at 0xf7f64fc2. [ 418.449343][T13368] RSP: 002b:00000000f540550c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 418.449355][T13368] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000080000140 [ 418.449362][T13368] RDX: 0000000000000038 RSI: 0000000000000000 RDI: 0000000000000000 [ 418.449368][T13368] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 418.449374][T13368] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 418.449380][T13368] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 418.449393][T13368] [ 418.450377][T13375] FAULT_INJECTION: forcing a failure. [ 418.450377][T13375] name failslab, interval 1, probability 0, space 0, times 0 [ 418.535729][T13375] CPU: 0 UID: 0 PID: 13375 Comm: syz.0.2157 Tainted: G L syzkaller #0 PREEMPT(full) [ 418.535755][T13375] Tainted: [L]=SOFTLOCKUP [ 418.535759][T13375] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 418.535766][T13375] Call Trace: [ 418.535770][T13375] [ 418.535775][T13375] dump_stack_lvl+0x100/0x190 [ 418.535791][T13375] should_fail_ex.cold+0x5/0xa [ 418.535804][T13375] should_failslab+0xc2/0x120 [ 418.535818][T13375] kmem_cache_alloc_noprof+0x91/0x6a0 [ 418.535830][T13375] ? d_instantiate+0x8a/0xb0 [ 418.535841][T13375] ? d_instantiate+0x8a/0xb0 [ 418.535851][T13375] ? alloc_empty_file+0x5b/0x1c0 [ 418.535865][T13375] alloc_empty_file+0x5b/0x1c0 [ 418.535878][T13375] alloc_file_pseudo+0x183/0x290 [ 418.535890][T13375] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 418.535902][T13375] ? inode_init_always_gfp+0xc98/0xfb0 [ 418.535922][T13375] sock_alloc_file+0x50/0x210 [ 418.535936][T13375] do_accept+0x242/0x530 [ 418.535952][T13375] ? do_raw_spin_lock+0x128/0x260 [ 418.535964][T13375] ? __pfx_do_accept+0x10/0x10 [ 418.535990][T13375] __sys_accept4+0x108/0x200 [ 418.536008][T13375] ? __pfx___sys_accept4+0x10/0x10 [ 418.536025][T13375] ? ksys_write+0x1ac/0x250 [ 418.536042][T13375] __ia32_sys_accept4+0x94/0x100 [ 418.536059][T13375] ? lockdep_hardirqs_on+0x78/0x100 [ 418.536087][T13375] __do_fast_syscall_32+0xe7/0x970 [ 418.536099][T13375] ? lockdep_hardirqs_on+0x78/0x100 [ 418.536116][T13375] do_fast_syscall_32+0x32/0x70 [ 418.536126][T13375] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 418.536140][T13375] RIP: 0023:0xf709efec [ 418.536155][T13375] Code: Unable to access opcode bytes at 0xf709efc2. [ 418.536172][T13375] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 000000000000016c [ 418.536184][T13375] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000 [ 418.536191][T13375] RDX: 0000000000000000 RSI: 0000000000080800 RDI: 0000000000000000 [ 418.536197][T13375] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 418.536203][T13375] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 418.536209][T13375] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 418.536222][T13375] [ 418.731073][T13386] netlink: 'syz.3.2159': attribute type 10 has an invalid length. [ 418.749783][T13386] 8021q: adding VLAN 0 to HW filter on device bond0 [ 418.757829][T13386] team0: Port device bond0 added [ 418.897365][T13386] macsec1: left promiscuous mode [ 419.564731][ T42] audit: type=1326 audit(1783591863.568:444): auid=4294967295 uid=0 gid=60928 ses=4294967295 subj=unconfined pid=13413 comm="syz.1.2168" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 421.065155][T13438] syz_tun: entered promiscuous mode [ 421.082356][T13438] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 421.586411][ T6255] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 421.736569][ T6255] usb 7-1: Using ep0 maxpacket: 8 [ 421.746773][ T6255] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 421.749805][ T6255] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 421.753099][ T6255] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 421.756351][ T6255] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 421.760152][ T6255] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 421.764650][ T6255] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 421.767722][ T6255] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.993741][ T6255] usb 7-1: usb_control_msg returned -32 [ 421.997041][ T6255] usbtmc 7-1:16.0: can't read capabilities [ 422.003648][T13468] nbd: must specify an index to disconnect [ 422.102862][T13471] comedi comedi3: pcl818: I/O base address or length out of range [ 423.278202][T13493] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 423.304346][T13495] ------------[ cut here ]------------ [ 423.307228][T13495] !chanctx_conf [ 423.307241][T13495] WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5b6/0x710, CPU#0: syz.3.2193/13495 [ 423.313263][T13495] Modules linked in: [ 423.315532][T13495] CPU: 0 UID: 0 PID: 13495 Comm: syz.3.2193 Tainted: G L syzkaller #0 PREEMPT(full) [ 423.322657][T13495] Tainted: [L]=SOFTLOCKUP [ 423.324471][T13495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 423.328807][T13495] RIP: 0010:rate_control_rate_init+0x5b6/0x710 [ 423.331334][T13495] Code: 48 8d 35 00 00 00 00 e8 28 34 b9 f6 e8 23 95 c2 f6 e9 15 fe ff ff e8 89 81 dd f6 90 0f 0b 90 e9 07 fe ff ff e8 7b 81 dd f6 90 <0f> 0b 90 eb b1 e8 70 81 dd f6 e8 0b a0 c1 f6 31 ff 89 c3 89 c6 e8 [ 423.338741][T13495] RSP: 0018:ffffc90006587210 EFLAGS: 00010287 [ 423.341089][T13495] RAX: 00000000000006db RBX: ffff88802a280000 RCX: ffffc9002b732000 [ 423.343880][T13495] RDX: 0000000000080000 RSI: ffffffff8b2baae5 RDI: ffff888046790000 [ 423.346461][T13495] RBP: ffff88801d2e3440 R08: 0000000000000005 R09: 0000000000000000 [ 423.348921][T13495] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 423.351190][T13498] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2194'. [ 423.351331][T13495] R13: 0000000000000000 R14: ffff888065d40f40 R15: ffff888073684000 [ 423.356763][T13495] FS: 0000000000000000(0000) GS:ffff888096bf5000(0063) knlGS:00000000f5466b40 [ 423.359556][T13495] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 423.361634][T13495] CR2: 0000000080001080 CR3: 0000000071bfa000 CR4: 0000000000352ef0 [ 423.364152][T13495] Call Trace: [ 423.365218][T13495] [ 423.366250][T13495] rate_control_rate_init_all_links+0x76/0x1f0 [ 423.368174][T13495] sta_apply_auth_flags.isra.0+0x4aa/0x500 [ 423.370032][T13495] sta_apply_parameters+0x11a8/0x2030 [ 423.371706][T13495] ? __sta_info_alloc+0x1143/0x1cc0 [ 423.373389][T13495] ieee80211_add_station+0x3ff/0x760 [ 423.375041][T13495] nl80211_new_station+0x14a9/0x20e0 [ 423.376783][T13495] ? __pfx_nl80211_new_station+0x10/0x10 [ 423.378571][T13495] ? nl80211_pre_doit+0x19a/0xae0 [ 423.380169][T13495] genl_family_rcv_msg_doit+0x214/0x300 [ 423.381900][T13495] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 423.383863][T13495] ? genl_get_cmd+0x3e7/0x760 [ 423.385349][T13495] ? bpf_lsm_capable+0x9/0x10 [ 423.386898][T13495] ? security_capable+0x80/0x260 [ 423.388460][T13495] ? ns_capable+0xd2/0xf0 [ 423.389832][T13495] genl_rcv_msg+0x560/0x800 [ 423.391289][T13495] ? __pfx_genl_rcv_msg+0x10/0x10 [ 423.392878][T13495] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 423.394653][T13495] ? __pfx_nl80211_new_station+0x10/0x10 [ 423.396541][T13495] ? __pfx_nl80211_post_doit+0x10/0x10 [ 423.398799][T13495] netlink_rcv_skb+0x159/0x420 [ 423.400606][T13495] ? __pfx_genl_rcv_msg+0x10/0x10 [ 423.402347][T13495] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 423.404416][T13495] ? netlink_deliver_tap+0x1ae/0xcc0 [ 423.406069][T13495] genl_rcv+0x28/0x40 [ 423.407467][T13495] netlink_unicast+0x585/0x850 [ 423.409034][T13495] ? __pfx_netlink_unicast+0x10/0x10 [ 423.410728][T13495] netlink_sendmsg+0x8b0/0xda0 [ 423.412257][T13495] ? __pfx_netlink_sendmsg+0x10/0x10 [ 423.414053][T13495] ? apparmor_socket_sendmsg+0x15b/0x270 [ 423.415815][T13495] ____sys_sendmsg+0xa4d/0xbe0 [ 423.417477][T13495] ? __pfx_netlink_sendmsg+0x10/0x10 [ 423.419180][T13495] ? __pfx_____sys_sendmsg+0x10/0x10 [ 423.420906][T13495] ___sys_sendmsg+0x190/0x1e0 [ 423.422422][T13495] ? __pfx____sys_sendmsg+0x10/0x10 [ 423.424097][T13495] ? futex_wait+0x11e/0x370 [ 423.425692][T13495] ? find_held_lock+0x2b/0x80 [ 423.427299][T13495] __sys_sendmsg+0x160/0x210 [ 423.428766][T13495] ? __pfx___sys_sendmsg+0x10/0x10 [ 423.430410][T13495] __do_fast_syscall_32+0xe7/0x970 [ 423.432028][T13495] ? lockdep_hardirqs_on+0x78/0x100 [ 423.433726][T13495] do_fast_syscall_32+0x32/0x70 [ 423.435254][T13495] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 423.437354][T13495] RIP: 0023:0xf7fa3fec [ 423.438659][T13495] Code: Unable to access opcode bytes at 0xf7fa3fc2. [ 423.440729][T13495] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 423.443362][T13495] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080001080 [ 423.446449][T13495] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 423.449514][T13495] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 423.452564][T13495] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 423.455225][T13495] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 423.457819][T13495] [ 423.458775][T13495] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 423.461109][T13495] CPU: 0 UID: 0 PID: 13495 Comm: syz.3.2193 Tainted: G L syzkaller #0 PREEMPT(full) [ 423.464466][T13495] Tainted: [L]=SOFTLOCKUP [ 423.465840][T13495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 423.468950][T13495] Call Trace: [ 423.470045][T13495] [ 423.470976][T13495] dump_stack_lvl+0x100/0x190 [ 423.472448][T13495] vpanic+0x552/0x970 [ 423.473741][T13495] ? __pfx_vpanic+0x10/0x10 [ 423.475173][T13495] panic+0xd1/0xe0 [ 423.476372][T13495] ? __pfx_panic+0x10/0x10 [ 423.477795][T13495] check_panic_on_warn.cold+0x19/0x34 [ 423.479471][T13495] ? rate_control_rate_init+0x5b6/0x710 [ 423.481246][T13495] __warn.cold+0x191/0x318 [ 423.482661][T13495] __report_bug+0x30f/0x440 [ 423.484131][T13495] ? rate_control_rate_init+0x5b6/0x710 [ 423.485864][T13495] ? __pfx___report_bug+0x10/0x10 [ 423.487453][T13495] ? ieee80211_add_station+0x5f1/0x760 [ 423.489158][T13495] ? nl80211_new_station+0x14a9/0x20e0 [ 423.490895][T13495] ? genl_family_rcv_msg_doit+0x214/0x300 [ 423.492663][T13495] ? genl_rcv_msg+0x560/0x800