last executing test programs: 1m43.984780959s ago: executing program 1 (id=1354): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x7, r1, 0x0, &(0x7f0000000240)='LLL', 0x3, 0x1c}) ioctl$IOMMU_IOAS_UNMAP(r0, 0x3b86, &(0x7f0000000340)={0x18, r1, 0x2, 0x1c}) 1m32.098083431s ago: executing program 1 (id=1356): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xd0}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8000}, [@call={0x85, 0x0, 0x0, 0x75}]}, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r0, 0x0, 0x0}, 0x10) 1m25.393491005s ago: executing program 1 (id=1357): mmap(&(0x7f000027a000/0x1000)=nil, 0x1000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542a000) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) 1m15.141485861s ago: executing program 1 (id=1359): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, &(0x7f0000001dc0)={0x9, 0x0, 0x80000}, 0x20) 1m6.263411969s ago: executing program 1 (id=1361): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f0000000040)={0x2, 0x3, @remote}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @random="5a01f3c2f136", @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @remote, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @remote}}}}, 0x0) 56.442437759s ago: executing program 1 (id=1363): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x275a, 0x0) mmap(&(0x7f000048a000/0x1000)=nil, 0x1000, 0x6, 0x12, r0, 0x1b83c000) ftruncate(r0, 0xc17a) ftruncate(r0, 0x85) 41.13782775s ago: executing program 0 (id=1364): openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x4380, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f00000000c0)="5bffd08307d80c79b1cb7b5f0c5b4d719c69c8513f748fbe425a7bc388c9019bef114779f7a10dc03a883d6e16a0a704f74297f381ff1db75098a9b38bb67206a7ff22e6ca46dc760bdad8a79d5951988c55a368dd1132ba7f129c2e65441eaa27492c069488df0881f123ca01ae873f5b36eb0fddb8f07420f5484d81cabde167c87ffbab6a94b24b5537bb1a08d56469f516fd4b7c66e2ac50d5ff4e52c628d0a89e53d0e78582a5ab2a2c714f66", 0xfe7c}], 0x1) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000240)={0x2000, 0x1000000}) 33.095129389s ago: executing program 0 (id=1365): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x730, 0x1d0, 0x5c8, 0x0, 0x5c8, 0x0, 0x6b0, 0x6b0, 0x6b0, 0x6b0, 0x6b0, 0x6, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [0xffffff00, 0x0, 0x0, 0x1f9814788dbf7ab2], 'veth1\x00', 'syz_tun\x00'}, 0x11e, 0xa8, 0x1d0, 0x1f000000, {0x0, 0x7}}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@ipv6={@loopback, @dev, [], [], 'batadv_slave_0\x00', 'ip6gretap0\x00', {}, {}, 0x2b}, 0x0, 0x1e0, 0x208, 0x7400, {}, [@common=@rt={{0x138}, {0x0, [0x0, 0x5], 0x0, 0x0, 0x0, [@dev, @private2={0xfc, 0x2, '\x00', 0x1}, @remote, @private2, @private1, @dev, @dev={0xfe, 0x80, '\x00', 0x34}, @mcast2, @local, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0, @loopback, @mcast1, @private1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x68}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@mcast2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x790) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xb, 0x1f, 0x402, 0x3ff, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000400), 0x401, r0}, 0x38) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000001c0)={r0, &(0x7f0000000340)="a9", &(0x7f0000000200)=""/31}, 0x20) 25.452443473s ago: executing program 0 (id=1366): r0 = socket$inet(0x2, 0x801, 0x100) listen(r0, 0x0) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r0, 0x0, r1, 0x0, 0x7ffff000, 0x0) 19.577235437s ago: executing program 0 (id=1367): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0xa, 0xb, 0x42, 0x3e, 0x42}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0xc, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffe}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) 12.009657364s ago: executing program 0 (id=1368): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x10, 0x7, 0x0, 0x3}}}}}}}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000240)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, "9e00", 0x18, 0x6, 0xfde3996dcd16970f, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x6, 0xc2, 0xfffd, 0x0, 0xfff, {[@sack_perm={0x4, 0x2}]}}}}}}}}, 0x0) 0s ago: executing program 0 (id=1369): r0 = socket(0x2, 0x1, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:61463' (ED25519) to the list of known hosts. syzkaller login: [ 615.103839][ T3228] cgroup: Unknown subsys name 'net' [ 616.013167][ T3228] cgroup: Unknown subsys name 'cpuset' [ 616.164486][ T3228] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 709.650905][ T3228] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 901.150963][ T3240] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 901.421433][ T3240] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 907.906602][ T3244] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 908.150294][ T3244] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 917.975414][ T3240] hsr_slave_0: entered promiscuous mode [ 918.021662][ T3240] hsr_slave_1: entered promiscuous mode [ 932.764803][ T3244] hsr_slave_0: entered promiscuous mode [ 932.793688][ T3244] hsr_slave_1: entered promiscuous mode [ 932.824508][ T3244] debugfs: 'hsr0' already exists in 'hsr' [ 932.835676][ T3244] Cannot create hsr debugfs directory [ 935.995061][ T3240] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 936.224967][ T3240] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 936.742063][ T3240] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 936.901866][ T3240] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 937.222857][ T3240] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 937.471217][ T3240] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 937.600056][ T3240] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 937.812746][ T3240] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 949.224323][ T3244] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 949.533459][ T3244] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 949.697909][ T3244] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 950.286015][ T3244] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 950.391715][ T3244] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 950.485956][ T3244] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 950.708713][ T3244] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 950.854782][ T3244] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 971.166380][ T3240] 8021q: adding VLAN 0 to HW filter on device bond0 [ 977.119436][ T3244] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1059.516231][ T3240] veth0_vlan: entered promiscuous mode [ 1060.441920][ T3240] veth1_vlan: entered promiscuous mode [ 1064.841117][ T3240] veth0_macvtap: entered promiscuous mode [ 1065.146717][ T3240] veth1_macvtap: entered promiscuous mode [ 1069.834208][ T3244] veth0_vlan: entered promiscuous mode [ 1072.029327][ T3244] veth1_vlan: entered promiscuous mode [ 1073.012451][ T112] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1073.196306][ T112] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1073.229231][ T112] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1073.233792][ T112] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1080.050587][ T3244] veth0_macvtap: entered promiscuous mode [ 1081.645441][ T3244] veth1_macvtap: entered promiscuous mode [ 1082.790722][ T3240] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 1087.262474][ T22] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1087.322110][ T22] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1087.340126][ T22] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1087.388440][ T22] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1154.293657][ T3875] netlink: 'syz.1.7': attribute type 1 has an invalid length. [ 1168.023014][ T3879] faux_driver vgem: [drm] Unknown color mode 11173; guessing buffer size. [ 1290.973097][ T3923] nbd0: detected capacity change from 0 to 63 [ 1291.242836][ T877] block nbd0: Receive control failed (result -32) [ 1398.812150][ T3964] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 1398.833301][ C1] Illegal XDP return value 16128 on prog (id 3) dev lo, expect packet loss! [ 1452.471421][ T47] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1453.531629][ T47] usb 2-1: Using ep0 maxpacket: 32 [ 1453.906385][ T47] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 1453.933285][ T47] usb 2-1: config 0 has no interface number 0 [ 1454.703718][ T47] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1454.723587][ T47] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1454.733146][ T47] usb 2-1: Product: syz [ 1454.742498][ T47] usb 2-1: Manufacturer: syz [ 1454.766174][ T47] usb 2-1: SerialNumber: syz [ 1456.049325][ T47] usb 2-1: config 0 descriptor?? [ 1457.064138][ T47] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1462.191257][ T47] usb 2-1: qt2_attach - failed to power on unit: -110 [ 1462.206451][ T47] quatech2 2-1:0.51: probe with driver quatech2 failed with error -110 [ 1466.422203][ T3666] usb 2-1: USB disconnect, device number 2 [ 1473.556445][ T31] audit: type=1326 audit(1472.160:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4017 comm="syz.1.46" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff945339ce code=0x7fc00000 [ 1474.471755][ T31] audit: type=1326 audit(1473.160:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4017 comm="syz.1.46" exe="/syz-executor" sig=0 arch=c00000f3 syscall=211 compat=0 ip=0x7fff945339ce code=0x7fc00000 [ 1474.629088][ T31] audit: type=1326 audit(1473.190:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4017 comm="syz.1.46" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff945339ce code=0x7fc00000 [ 1514.253390][ T4036] mmap: syz.0.51 (4036) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 1558.409731][ T4052] ======================================================= [ 1558.409731][ T4052] WARNING: The mand mount option has been deprecated and [ 1558.409731][ T4052] and is ignored by this kernel. Remove the mand [ 1558.409731][ T4052] option from the mount to silence this warning. [ 1558.409731][ T4052] ======================================================= [ 1711.038510][ T4094] netlink: 8 bytes leftover after parsing attributes in process `syz.0.72'. [ 1711.062141][ T4094] netlink: 4 bytes leftover after parsing attributes in process `syz.0.72'. [ 1711.110442][ T4094] netlink: 'syz.0.72': attribute type 19 has an invalid length. [ 1711.186570][ T4094] netlink: 'syz.0.72': attribute type 20 has an invalid length. [ 1711.753031][ T4095] netlink: 8 bytes leftover after parsing attributes in process `syz.0.72'. [ 1711.782864][ T4095] netlink: 4 bytes leftover after parsing attributes in process `syz.0.72'. [ 1711.843070][ T4095] netlink: 'syz.0.72': attribute type 19 has an invalid length. [ 1711.865420][ T4095] netlink: 'syz.0.72': attribute type 20 has an invalid length. [ 1720.053429][ T3592] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1720.272234][ T4095] Zero length message leads to an empty skb [ 1720.616575][ T3801] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1720.642502][ T3801] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1720.673334][ T3801] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 2059.395777][ T3231] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 2064.306731][ T3231] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 2064.324867][ T3231] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 2064.362548][ T3231] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 2064.410801][ T3231] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 2064.991990][ T3231] usb 1-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 2064.995486][ T3231] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2065.009432][ T3231] usb 1-1: Product: syz [ 2065.018276][ T3231] usb 1-1: Manufacturer: syz [ 2065.025004][ T3231] usb 1-1: SerialNumber: syz [ 2065.995482][ T3231] usb 1-1: config 0 descriptor?? [ 2066.723288][ T3231] ums-isd200 1-1:0.0: USB Mass Storage device detected [ 2078.690737][ T3231] scsi host0: usb-storage 1-1:0.0 [ 2082.035589][ T3231] usb 1-1: USB disconnect, device number 2 [ 2098.603593][ T4222] input: syz1 as /devices/virtual/input/input0 [ 2190.583120][ T4252] capability: warning: `syz.1.116' uses deprecated v2 capabilities in a way that may be insecure [ 2354.673973][ T4202] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 2355.249709][ T4202] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2355.269439][ T4202] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2355.290299][ T4202] usb 1-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 2355.316466][ T4202] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2355.671197][ T4202] usb 1-1: config 0 descriptor?? [ 2361.698256][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 2361.720850][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 2361.736713][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 2361.753167][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 2361.763734][ T4202] usbhid 1-1:0.0: can't add hid device: -32 [ 2361.788543][ T4202] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 2362.982056][ T4202] usb 1-1: USB disconnect, device number 3 [ 2387.160803][ T4337] netlink: 'syz.0.145': attribute type 4 has an invalid length. [ 2394.992339][ T4342] veth1_macvtap: left promiscuous mode [ 2394.993971][ T4342] macsec0: entered promiscuous mode [ 2396.456327][ T4343] veth1_macvtap: entered promiscuous mode [ 2396.509603][ T4343] macsec0: left promiscuous mode [ 2453.350629][ T4372] netlink: 4 bytes leftover after parsing attributes in process `syz.1.160'. [ 2453.570960][ T4372] netlink: 4 bytes leftover after parsing attributes in process `syz.1.160'. [ 2484.804490][ T4388] macvlan2: entered promiscuous mode [ 2484.808951][ T4388] bond0: entered promiscuous mode [ 2484.810103][ T4388] bond_slave_0: entered promiscuous mode [ 2484.814354][ T4388] bond_slave_1: entered promiscuous mode [ 2484.893381][ T4388] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 2518.393071][ T4415] netlink: 8 bytes leftover after parsing attributes in process `syz.1.173'. [ 2518.824244][ T4415] netlink: 8 bytes leftover after parsing attributes in process `syz.1.173'. [ 2567.163603][ T4436] netlink: 24 bytes leftover after parsing attributes in process `syz.0.179'. [ 2621.008270][ T4477] netlink: 4 bytes leftover after parsing attributes in process `syz.0.196'. [ 2621.154021][ T4477] netlink: 12 bytes leftover after parsing attributes in process `syz.0.196'. [ 2621.660259][ T4476] netlink: 12 bytes leftover after parsing attributes in process `syz.1.195'. [ 2621.664587][ T4476] netlink: 12 bytes leftover after parsing attributes in process `syz.1.195'. [ 2627.858551][ T4479] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 2658.522982][ T31] audit: type=1326 audit(2657.180:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.0.203" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fffa93339ce code=0x7ffc0000 [ 2658.701155][ T31] audit: type=1326 audit(2657.350:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.0.203" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fffa93339ce code=0x7ffc0000 [ 2659.312096][ T31] audit: type=1326 audit(2658.000:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.0.203" exe="/syz-executor" sig=0 arch=c00000f3 syscall=280 compat=0 ip=0x7fffa93339ce code=0x7ffc0000 [ 2659.410207][ T31] audit: type=1326 audit(2658.100:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.0.203" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fffa93339ce code=0x7ffc0000 [ 2659.474264][ T31] audit: type=1326 audit(2658.110:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.0.203" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fffa93339ce code=0x7ffc0000 [ 2659.555292][ T31] audit: type=1326 audit(2658.250:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.0.203" exe="/syz-executor" sig=0 arch=c00000f3 syscall=277 compat=0 ip=0x7fffa93339ce code=0x7ffc0000 [ 2659.608373][ T31] audit: type=1326 audit(2658.300:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.0.203" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fffa93339ce code=0x50000 [ 2659.643959][ T31] audit: type=1326 audit(2658.330:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.0.203" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fffa93339ce code=0x50000 [ 2659.678246][ T31] audit: type=1326 audit(2658.350:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.0.203" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fffa93339ce code=0x50000 [ 2659.732083][ T31] audit: type=1326 audit(2658.400:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4505 comm="syz.0.203" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fffa93339ce code=0x50000 [ 2664.642417][ T4510] tmpfs: Cannot retroactively limit size [ 2665.665276][ T4512] input: syz1 as /devices/virtual/input/input1 [ 2685.754270][ T4526] block nbd1: server does not support multiple connections per device. [ 2686.431458][ T4526] block nbd1: shutting down sockets [ 2725.604593][ T4545] netlink: 4 bytes leftover after parsing attributes in process `syz.0.217'. [ 2729.293463][ T4547] netlink: 4 bytes leftover after parsing attributes in process `syz.1.218'. [ 2738.272733][ T4552] netlink: 32 bytes leftover after parsing attributes in process `syz.1.220'. [ 2739.414613][ T4551] netlink: 32 bytes leftover after parsing attributes in process `syz.1.220'. [ 2801.702918][ T4588] input: syz1 as /devices/virtual/input/input2 [ 2921.802535][ T4643] block nbd1: not configured, cannot reconfigure [ 2996.731448][ T4673] netlink: 52 bytes leftover after parsing attributes in process `syz.1.268'. [ 3009.302674][ T4678] netlink: 220 bytes leftover after parsing attributes in process `syz.1.270'. [ 3172.308624][ T4745] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 3172.317955][ T4745] IPv6: NLM_F_CREATE should be set when creating new route [ 3172.320971][ T4745] IPv6: NLM_F_CREATE should be set when creating new route [ 3172.444933][ T4745] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 3218.872499][ T4758] netlink: 8 bytes leftover after parsing attributes in process `syz.1.298'. [ 3218.903569][ T4758] netlink: 'syz.1.298': attribute type 29 has an invalid length. [ 3218.921549][ T4758] netlink: 4 bytes leftover after parsing attributes in process `syz.1.298'. [ 3462.601324][ T4846] netlink: 'syz.1.334': attribute type 8 has an invalid length. [ 3553.176192][ T4878] vxcan1: tx address claim with dlc 0 [ 3614.802356][ T4895] syz.0.351 uses obsolete (PF_INET,SOCK_PACKET) [ 3740.372707][ T3231] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 3741.000937][ T3231] usb 2-1: Using ep0 maxpacket: 8 [ 3741.633492][ T3231] usb 2-1: config index 0 descriptor too short (expected 6427, got 27) [ 3741.636018][ T3231] usb 2-1: config 0 has an invalid interface number: 21 but max is 0 [ 3741.649656][ T3231] usb 2-1: config 0 has no interface number 0 [ 3741.663570][ T3231] usb 2-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 3741.679038][ T3231] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 3741.692356][ T3231] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 3742.186381][ T3231] usb 2-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 3742.198892][ T3231] usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 3742.230438][ T3231] usb 2-1: Product: syz [ 3743.309058][ T3231] usb 2-1: config 0 descriptor?? [ 3753.112277][ T4617] usb 2-1: USB disconnect, device number 3 [ 3847.016431][ T4969] input: syz0 as /devices/virtual/input/input4 [ 4059.935933][ T5042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.399'. [ 4061.226762][ T5043] netlink: 8 bytes leftover after parsing attributes in process `syz.1.399'. [ 4217.436630][ T5090] syz.1.414 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 4261.149244][ T5104] netlink: 4 bytes leftover after parsing attributes in process `syz.0.420'. [ 4277.921116][ T4276] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 4282.073238][ T4276] usb 1-1: unable to get BOS descriptor or descriptor too short [ 4282.493622][ T4276] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 4282.516578][ T4276] usb 1-1: can't read configurations, error -71 [ 4321.114873][ T5129] netlink: 12 bytes leftover after parsing attributes in process `syz.1.427'. [ 4321.206575][ T5129] netlink: 12 bytes leftover after parsing attributes in process `syz.1.427'. [ 4353.902465][ T5142] binder: 5141:5142 ioctl 4018620d 0 returned -22 [ 4365.494996][ T5145] dummy0: mtu less than device minimum [ 4595.410569][ T5213] batadv_slave_1: entered promiscuous mode [ 4595.866347][ T5213] batadv_slave_1: left promiscuous mode [ 4696.633421][ T5254] input: syz1 as /devices/virtual/input/input6 [ 4760.559730][ T5285] netlink: 68 bytes leftover after parsing attributes in process `syz.0.482'. [ 4921.140135][ T5353] netlink: 16 bytes leftover after parsing attributes in process `syz.0.505'. [ 4921.732572][ T5353] netlink: 12 bytes leftover after parsing attributes in process `syz.0.505'. [ 4921.755782][ T5353] netlink: 12 bytes leftover after parsing attributes in process `syz.0.505'. [ 4932.421007][ T5356] netem: change failed [ 4990.425007][ T5379] netlink: 87 bytes leftover after parsing attributes in process `syz.0.515'. [ 5041.288859][ T4617] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 5041.294283][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 5041.559829][ T4617] usb 1-1: device descriptor read/64, error -32 [ 5041.953638][ T4617] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 5045.372831][ T4617] usb 1-1: Using ep0 maxpacket: 16 [ 5045.822920][ T4617] usb 1-1: config index 0 descriptor too short (expected 52, got 36) [ 5045.849461][ T4617] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 5045.875432][ T4617] usb 1-1: config 0 has no interface number 0 [ 5045.910712][ T4617] usb 1-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 5045.918928][ T4617] usb 1-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 5046.624238][ T4617] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 5046.646638][ T4617] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 5046.674782][ T4617] usb 1-1: Product: syz [ 5046.681675][ T4617] usb 1-1: Manufacturer: syz [ 5046.700857][ T4617] usb 1-1: SerialNumber: syz [ 5047.054957][ T4617] usb 1-1: config 0 descriptor?? [ 5047.383934][ T5400] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 5047.489031][ T5400] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 5053.091044][ T4617] asix 1-1:0.251: probe with driver asix failed with error -110 [ 5055.376449][ T4629] usb 1-1: USB disconnect, device number 7 [ 5106.161295][ T5432] capability: warning: `syz.1.532' uses 32-bit capabilities (legacy support in use) [ 5183.674620][ T5458] netlink: 28 bytes leftover after parsing attributes in process `syz.0.541'. [ 5183.709859][ T5458] netlink: 28 bytes leftover after parsing attributes in process `syz.0.541'. [ 5184.383057][ T5458] netlink: 28 bytes leftover after parsing attributes in process `syz.0.541'. [ 5184.414169][ T5458] netlink: 28 bytes leftover after parsing attributes in process `syz.0.541'. [ 5184.571723][ T5458] netlink: 28 bytes leftover after parsing attributes in process `syz.0.541'. [ 5184.575431][ T5458] netlink: 28 bytes leftover after parsing attributes in process `syz.0.541'. [ 5372.373083][ T5515] netlink: 8 bytes leftover after parsing attributes in process `syz.0.565'. [ 5372.398650][ T5515] netlink: 4 bytes leftover after parsing attributes in process `syz.0.565'. [ 5372.430496][ T5515] netlink: 'syz.0.565': attribute type 18 has an invalid length. [ 5429.248042][ T5532] input: syz0 as /devices/virtual/input/input8 [ 5486.920963][ T5560] netlink: 'syz.1.583': attribute type 12 has an invalid length. [ 5521.189937][ T5574] netlink: 422 bytes leftover after parsing attributes in process `syz.0.590'. [ 5546.083828][ T5054] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 5546.531341][ T5054] usb 1-1: Using ep0 maxpacket: 8 [ 5548.100767][ T5054] usb 1-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice= d.68 [ 5548.114785][ T5054] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 5548.129003][ T5054] usb 1-1: Product: syz [ 5548.134907][ T5054] usb 1-1: Manufacturer: syz [ 5548.136606][ T5054] usb 1-1: SerialNumber: syz [ 5553.929524][ T5054] kalmia 1-1:1.0 (unnamed net_device) (uninitialized): Error sending init packet. Status -71 [ 5554.038449][ T5054] kalmia 1-1:1.0: probe with driver kalmia failed with error -71 [ 5555.344761][ T5054] usb 1-1: USB disconnect, device number 8 [ 5588.464173][ T5614] netlink: 20 bytes leftover after parsing attributes in process `syz.1.600'. [ 5614.832449][ T5626] process 'syz.0.605' launched '/dev/fd/3' with NULL argv: empty string added [ 5716.289842][ T5666] netlink: 8 bytes leftover after parsing attributes in process `syz.1.617'. [ 5758.784234][ T5679] ªªªªªª: renamed from vlan0 (while UP) [ 5798.525983][ T5694] trusted_key: encrypted_key: keyword 'updat' not recognized [ 5890.059701][ T3231] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 5890.400422][ T3231] usb 2-1: Using ep0 maxpacket: 16 [ 5891.594958][ T3231] usb 2-1: unable to get BOS descriptor or descriptor too short [ 5891.610308][ T3231] usb 2-1: no configurations [ 5891.614030][ T3231] usb 2-1: can't read configurations, error -22 [ 6319.678982][ T5848] netlink: 20 bytes leftover after parsing attributes in process `syz.0.684'. [ 6412.996564][ T5883] netlink: 16255 bytes leftover after parsing attributes in process `syz.1.701'. [ 6464.932737][ T5906] ubi31: attaching mtd0 [ 6486.702530][ T31] kauditd_printk_skb: 33 callbacks suppressed [ 6486.712396][ T31] audit: type=1326 audit(6485.230:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5917 comm="syz.1.717" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff945339ce code=0x7fc00000 [ 6516.111318][ T5940] netlink: 8 bytes leftover after parsing attributes in process `syz.1.725'. [ 6653.015265][ T6001] ptrace attach of "/syz-executor exec"[3244] was attempted by " Ðÿ ð¥ Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ    ÿÿÿÿ   ÿÿÿÿ  [ 6731.110996][ T6041] blkio.reset_stats is deprecated [ 6754.460700][ T5054] af_packet: tpacket_rcv: packet too big, clamped from 74 to 4294967286. macoff=82 [ 6769.386159][ T31] audit: type=1326 audit(6768.080:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6060 comm="syz.1.775" exe="/syz-executor" sig=31 arch=c00000f3 syscall=98 compat=0 ip=0x7fff945339ce code=0x0 [ 6791.322798][ T4629] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 6791.600483][ T4629] usb 2-1: Using ep0 maxpacket: 16 [ 6792.934525][ T4629] usb 2-1: config 0 has no interfaces? [ 6793.020330][ T4629] usb 2-1: New USB device found, idVendor=045e, idProduct=fc40, bcdDevice=72.a8 [ 6793.023953][ T4629] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 6794.520829][ T4629] usb 2-1: config 0 descriptor?? [ 6800.171306][ T4629] usb 2-1: can't set config #0, error -110 [ 6801.832974][ T6087] usb 2-1: USB disconnect, device number 6 [ 6806.815560][ T6096] lo: entered promiscuous mode [ 6806.823182][ T6096] lo: entered allmulticast mode [ 6839.144704][ T6114] netem: change failed [ 6873.507545][ T6124] binder: 6123:6124 ioctl c0306201 200000000640 returned -22 [ 6931.075821][ T6146] netlink: 64 bytes leftover after parsing attributes in process `syz.1.800'. [ 6931.231179][ T6146] netlink: 64 bytes leftover after parsing attributes in process `syz.1.800'. [ 7101.519287][ T6201] netlink: 'syz.0.824': attribute type 12 has an invalid length. [ 7120.914822][ T6208] netlink: 'syz.1.827': attribute type 9 has an invalid length. [ 7148.569425][ T6224] netlink: 'syz.0.831': attribute type 29 has an invalid length. [ 7149.122435][ T6224] netlink: 'syz.0.831': attribute type 29 has an invalid length. [ 7149.791460][ T6224] netlink: 'syz.0.831': attribute type 29 has an invalid length. [ 7191.166422][ T6242] Invalid ELF header magic: != ELF [ 7253.204589][ T6268] block nbd1: NBD_DISCONNECT [ 7253.219712][ T6268] block nbd1: Send disconnect failed -32 [ 7253.358438][ T6266] block nbd1: Disconnected due to user request. [ 7253.385675][ T6266] block nbd1: shutting down sockets [ 7286.954790][ T6206] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 7287.603832][ T6206] usb 1-1: Using ep0 maxpacket: 16 [ 7288.323026][ T6206] usb 1-1: config index 0 descriptor too short (expected 16456, got 72) [ 7288.325521][ T6206] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 7288.352501][ T6206] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 7288.365514][ T6206] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 7288.384025][ T6206] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 7288.395944][ T6206] usb 1-1: config 0 has no interface number 0 [ 7288.415042][ T6206] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 7288.429552][ T6206] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 7288.445443][ T6206] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 7288.479285][ T6206] usb 1-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 7288.515733][ T6206] usb 1-1: config 0 interface 125 has no altsetting 0 [ 7288.535764][ T6206] usb 1-1: config 0 interface 125 has no altsetting 2 [ 7290.498169][ T6206] usb 1-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 7290.511148][ T6206] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 7290.544729][ T6206] usb 1-1: Product: syz [ 7290.560794][ T6206] usb 1-1: Manufacturer: syz [ 7290.563591][ T6206] usb 1-1: SerialNumber: syz [ 7291.003247][ T6206] usb 1-1: config 0 descriptor?? [ 7291.523397][ T6206] usb 1-1: selecting invalid altsetting 2 [ 7292.981671][ T6206] get_1284_register timeout [ 7292.988959][ C0] usb 1-1: async_complete: urb error -104 [ 7292.992136][ C0] usb 1-1: async_complete: urb error -104 [ 7292.994156][ C0] usb 1-1: async_complete: urb error -104 [ 7292.996052][ C0] usb 1-1: async_complete: urb error -104 [ 7297.593477][ T6087] usb 1-1: USB disconnect, device number 9 [ 7341.534376][ T6311] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 7383.723320][ T6328] CUSE: info not properly terminated [ 7466.962724][ T6362] netlink: 220 bytes leftover after parsing attributes in process `syz.0.885'. [ 7670.253548][ T6439] netlink: 12 bytes leftover after parsing attributes in process `syz.0.914'. [ 7789.914824][ T6477] binder: BC_ACQUIRE_RESULT not supported [ 7789.919371][ T6477] binder: 6475:6477 ioctl c0306201 2000000003c0 returned -22 [ 7864.073023][ T6504] macvlan1: entered promiscuous mode [ 7864.095789][ T6504] macvlan1: entered allmulticast mode [ 7869.851556][ T6504] veth1_vlan: entered allmulticast mode [ 7894.699699][ T6515] binder: 6513:6515 ioctl c0306201 200000000480 returned -14 [ 7903.336398][ T6518] netlink: 'syz.0.943': attribute type 1 has an invalid length. [ 7903.340467][ T6518] netlink: 'syz.0.943': attribute type 2 has an invalid length. [ 8061.459846][ T5700] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 8061.951332][ T5700] usb 2-1: Using ep0 maxpacket: 16 [ 8062.162716][ T5700] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 8062.175763][ T5700] usb 2-1: config 0 has no interface number 0 [ 8062.190941][ T5700] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 8062.205160][ T5700] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 8062.220001][ T5700] usb 2-1: New USB device found, idVendor=04d9, idProduct=a081, bcdDevice= 0.00 [ 8062.227792][ T5700] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 8062.899950][ T5700] usb 2-1: config 0 descriptor?? [ 8069.193293][ T5700] usbhid 2-1:0.1: can't add hid device: -32 [ 8069.240769][ T5700] usbhid 2-1:0.1: probe with driver usbhid failed with error -32 [ 8074.682212][ T6087] usb 2-1: USB disconnect, device number 7 [ 8080.370417][ T6610] macvlan0: entered allmulticast mode [ 8080.383263][ T6610] veth1_vlan: entered allmulticast mode [ 8089.309617][ T6614] bond0: option all_slaves_active: invalid value (7) [ 8103.675179][ T6621] input: syz1 as /devices/virtual/input/input9 [ 8256.075619][ T6690] binder: 6689:6690 ioctl c0306201 200000000640 returned -22 [ 8271.536551][ T6697] macvlan1: entered promiscuous mode [ 8271.558797][ T6697] macvlan1: entered allmulticast mode [ 8381.324788][ T6751] veth1_vlan: left allmulticast mode [ 8382.984226][ T6752] veth1_vlan: entered allmulticast mode [ 8418.394867][ T6772] veth1_vlan: left allmulticast mode [ 8419.820584][ T6772] veth1_vlan: entered allmulticast mode [ 8433.566075][ T6777] netlink: 'syz.0.1038': attribute type 29 has an invalid length. [ 8527.911360][ T6820] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1052'. [ 8539.521950][ T31] audit: type=1326 audit(8538.080:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6823 comm="syz.1.1054" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff945339ce code=0x7fc00000 [ 8598.191249][ T6849] netlink: 'syz.1.1062': attribute type 1 has an invalid length. [ 8618.394860][ T6858] binder: BC_ATTEMPT_ACQUIRE not supported [ 8618.396159][ T6858] binder: 6857:6858 ioctl c0306201 2000000001c0 returned -22 [ 8663.360653][ T6358] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 8663.810478][ T6358] usb 2-1: Using ep0 maxpacket: 16 [ 8664.388720][ T6358] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 8664.392652][ T6358] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 8664.400701][ T6358] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 8664.406529][ T6358] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 8664.411576][ T6358] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 8664.643620][ T6358] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 8664.650913][ T6358] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 8664.662710][ T6358] usb 2-1: Manufacturer: syz [ 8664.843039][ T6358] usb 2-1: config 0 descriptor?? [ 8673.146698][ T6358] rc_core: IR keymap rc-hauppauge not found [ 8673.168596][ T6358] Registered IR keymap rc-empty [ 8673.333625][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8673.413566][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8673.614729][ T6358] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 8673.680072][ T6358] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input10 [ 8674.066325][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8674.104304][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8674.154347][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8674.236562][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8674.293660][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8674.331512][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8674.366471][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8674.482655][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8674.612292][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8674.655323][ T6358] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 8675.239924][ T6358] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 8675.241364][ T6358] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 8676.101328][ T6358] usb 2-1: USB disconnect, device number 8 [ 8759.365833][ T6951] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1098'. [ 8759.473748][ T6951] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1098'. [ 8829.115552][ T6996] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1113'. [ 8829.130455][ T6996] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1113'. [ 8856.761402][ T6987] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 8858.773990][ T6987] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 8858.776349][ T6987] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 8858.799049][ T6987] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 8858.802066][ T6987] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 8859.944960][ T7011] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 8861.099161][ T6987] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 8866.251544][ T6987] usb 1-1: USB disconnect, device number 10 [ 9000.748303][ T7118] xt_hashlimit: size too large, truncated to 1048576 [ 9084.642874][ T31] audit: type=1326 audit(9083.320:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7158 comm="syz.0.1170" exe="/syz-executor" sig=31 arch=c00000f3 syscall=98 compat=0 ip=0x7fffa93339ce code=0x0 [ 9158.809806][ T6087] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 9160.063639][ T6087] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 130, using maximum allowed: 30 [ 9160.065588][ T6087] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 9160.072572][ T6087] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 9160.089207][ T6087] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 130 [ 9160.112972][ T6087] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1b3e, bcdDevice= 0.00 [ 9160.118418][ T6087] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 9160.603525][ T6087] usb 1-1: config 0 descriptor?? [ 9162.285378][ T6087] corsair 0003:1B1C:1B3E.0001: unknown main item tag 0x0 [ 9162.304951][ T6087] corsair 0003:1B1C:1B3E.0001: unknown main item tag 0x0 [ 9162.330604][ T6087] corsair 0003:1B1C:1B3E.0001: unknown main item tag 0x0 [ 9162.341091][ T6087] corsair 0003:1B1C:1B3E.0001: unknown main item tag 0x0 [ 9162.362543][ T6087] corsair 0003:1B1C:1B3E.0001: unknown main item tag 0x0 [ 9162.373393][ T6087] corsair 0003:1B1C:1B3E.0001: unknown main item tag 0x0 [ 9162.381721][ T6087] corsair 0003:1B1C:1B3E.0001: unknown main item tag 0x0 [ 9162.388783][ T6087] corsair 0003:1B1C:1B3E.0001: unknown main item tag 0x0 [ 9162.398535][ T6087] corsair 0003:1B1C:1B3E.0001: unknown main item tag 0x0 [ 9162.403357][ T6087] corsair 0003:1B1C:1B3E.0001: unknown main item tag 0x0 [ 9162.464504][ T6087] corsair 0003:1B1C:1B3E.0001: unexpected long global item [ 9162.565581][ T6087] corsair 0003:1B1C:1B3E.0001: parse failed [ 9162.652715][ T6087] corsair 0003:1B1C:1B3E.0001: probe with driver corsair failed with error -22 [ 9163.733268][ T6087] usb 1-1: USB disconnect, device number 11 [ 9198.524251][ T7234] misc userio: Can't change port type on an already running userio instance [ 9249.145473][ T7261] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1208'. [ 9585.682098][ T7301] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 9586.702051][ T7301] usb 1-1: config 1 has an invalid interface number: 7 but max is 0 [ 9586.705450][ T7301] usb 1-1: config 1 has no interface number 0 [ 9586.735675][ T7301] usb 1-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 9586.760054][ T7301] usb 1-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1023 [ 9586.765185][ T7301] usb 1-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 9587.434950][ T7301] usb 1-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 9587.449576][ T7301] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 9587.455619][ T7301] usb 1-1: Product: syz [ 9587.461560][ T7301] usb 1-1: Manufacturer: syz [ 9587.466257][ T7301] usb 1-1: SerialNumber: syz [ 9588.504630][ T7430] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 9593.933058][ T7301] usb 1-1: Error in usbnet_get_endpoints (-110) [ 9595.049429][ T7301] usb 1-1: USB disconnect, device number 12 [ 9649.785467][ T7475] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1286'. [ 9743.336087][ T7529] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1304'. [ 9743.358051][ T7529] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 9743.461189][ T7529] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1304'. [ 9743.462803][ T7529] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 9824.449740][ T7570] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1321'. [ 9888.676305][ T7600] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1333'. [ 9940.009778][ T7626] input: syz0 as /devices/virtual/input/input12 [ 9977.774726][ T50] block nbd1: Receive control failed (result -32) [ 9977.992715][ T50] block nbd1: Receive control failed (result -32) [ 9977.998421][ T50] block nbd1: Receive control failed (result -32) [ 9978.222742][ T7645] nbd1: detected capacity change from 0 to 127 [10099.687485][ T7729] [10099.688157][ T7729] ====================================================== [10099.688774][ T7729] WARNING: possible circular locking dependency detected [10099.689847][ T7729] syzkaller #0 Tainted: G W L [10099.690639][ T7729] ------------------------------------------------------ [10099.691367][ T7729] syz.0.1369/7729 is trying to acquire lock: [10099.692228][ T7729] ffffaf8020024068 (&nsock->tx_lock){+.+.}-{4:4}, at: nbd_queue_rq+0x372/0xe44 [10099.694258][ T7729] [10099.694258][ T7729] but task is already holding lock: [10099.695012][ T7729] ffffaf801ae40178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc4/0xe44 [10099.696581][ T7729] [10099.696581][ T7729] which lock already depends on the new lock. [10099.696581][ T7729] [10099.697454][ T7729] [10099.697454][ T7729] the existing dependency chain (in reverse order) is: [10099.698341][ T7729] [10099.698341][ T7729] -> #6 (&cmd->lock){+.+.}-{4:4}: [10099.699882][ T7729] lock_acquire+0x246/0x500 [10099.700692][ T7729] __mutex_lock+0x164/0x18d4 [10099.701431][ T7729] mutex_lock_nested+0x14/0x1c [10099.702200][ T7729] nbd_queue_rq+0xc4/0xe44 [10099.702891][ T7729] blk_mq_dispatch_rq_list+0x3cc/0x1ac0 [10099.703611][ T7729] __blk_mq_sched_dispatch_requests+0xe12/0x13cc [10099.704494][ T7729] blk_mq_sched_dispatch_requests+0xb2/0x174 [10099.705441][ T7729] blk_mq_run_hw_queue+0x268/0x6c4 [10099.706339][ T7729] blk_mq_dispatch_list+0x52c/0x13e0 [10099.707065][ T7729] blk_mq_flush_plug_list+0x114/0x55c [10099.707760][ T7729] __blk_flush_plug+0x270/0x464 [10099.708717][ T7729] __submit_bio+0x42e/0x504 [10099.709532][ T7729] submit_bio_noacct_nocheck+0x458/0xdec [10099.710403][ T7729] submit_bio_noacct+0x6fe/0x2168 [10099.711244][ T7729] submit_bio+0xb6/0x5b8 [10099.712319][ T7729] submit_bh_wbc+0x4d8/0x6bc [10099.713034][ T7729] block_read_full_folio+0x396/0x788 [10099.713812][ T7729] blkdev_read_folio+0x26/0x30 [10099.714785][ T7729] filemap_read_folio+0xc2/0x270 [10099.715998][ T7729] do_read_cache_folio+0x22e/0x518 [10099.716678][ T7729] read_cache_folio+0x4e/0x68 [10099.717315][ T7729] read_part_sector+0xbc/0x408 [10099.718076][ T7729] read_lba+0x1b6/0x32c [10099.719199][ T7729] find_valid_gpt.constprop.0+0x212/0x21ec [10099.720626][ T7729] efi_partition+0xfa/0xae0 [10099.721613][ T7729] bdev_disk_changed+0x5b8/0x11b4 [10099.722611][ T7729] blkdev_get_whole+0x168/0x25c [10099.723591][ T7729] bdev_open+0x288/0xcc4 [10099.724567][ T7729] blkdev_open+0x2ec/0x450 [10099.725518][ T7729] do_dentry_open+0x418/0x1170 [10099.726446][ T7729] vfs_open+0xba/0x3a8 [10099.727361][ T7729] path_openat+0x144e/0x2f28 [10099.728235][ T7729] do_file_open+0x1ae/0x398 [10099.729076][ T7729] do_sys_openat2+0xfe/0x1c0 [10099.729967][ T7729] __riscv_sys_openat+0x122/0x1e4 [10099.730934][ T7729] syscall_handler+0x92/0x114 [10099.731839][ T7729] do_trap_ecall_u+0x3dc/0x61c [10099.732975][ T7729] handle_exception+0x15e/0x16a [10099.734116][ T7729] [10099.734116][ T7729] -> #5 (set->srcu){.+.+}-{0:0}: [10099.735726][ T7729] lock_sync+0xea/0x1cc [10099.736619][ T7729] __synchronize_srcu+0xd0/0x2a4 [10099.737621][ T7729] synchronize_srcu+0x194/0x9e4 [10099.738600][ T7729] blk_mq_quiesce_queue+0x124/0x194 [10099.739527][ T7729] elevator_switch+0x16a/0x4e4 [10099.740445][ T7729] elevator_change+0x2f4/0x4ac [10099.741356][ T7729] elevator_set_default+0x280/0x370 [10099.742431][ T7729] blk_register_queue+0x40c/0x598 [10099.743311][ T7729] __add_disk+0x69a/0xda4 [10099.744328][ T7729] add_disk_fwnode+0xe8/0x48c [10099.745265][ T7729] device_add_disk+0x28/0x38 [10099.746272][ T7729] nbd_dev_add+0x692/0xaec [10099.747072][ T7729] nbd_init+0x3d4/0x3f8 [10099.748022][ T7729] do_one_initcall+0x18c/0xcc8 [10099.748823][ T7729] kernel_init_freeable+0x6d2/0x7bc [10099.749874][ T7729] kernel_init+0x28/0x240 [10099.750739][ T7729] ret_from_fork_kernel+0x94/0xef8 [10099.751675][ T7729] ret_from_fork_kernel_asm+0x16/0x18 [10099.752893][ T7729] [10099.752893][ T7729] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [10099.754313][ T7729] lock_acquire+0x246/0x500 [10099.755240][ T7729] __mutex_lock+0x164/0x18d4 [10099.756173][ T7729] mutex_lock_nested+0x14/0x1c [10099.757194][ T7729] elevator_change+0x192/0x4ac [10099.758112][ T7729] elevator_set_none+0xa8/0x120 [10099.759226][ T7729] blk_mq_update_nr_hw_queues+0x43a/0x13a0 [10099.760293][ T7729] nbd_start_device+0x156/0xb74 [10099.761301][ T7729] nbd_genl_connect+0xe74/0x1a4c [10099.762355][ T7729] genl_family_rcv_msg_doit+0x1f6/0x2d8 [10099.763637][ T7729] genl_rcv_msg+0x4b2/0x73c [10099.764831][ T7729] netlink_rcv_skb+0x1e8/0x394 [10099.765992][ T7729] genl_rcv+0x32/0x4c [10099.767119][ T7729] netlink_unicast+0x4f6/0x7c0 [10099.768296][ T7729] netlink_sendmsg+0x7e0/0xd64 [10099.769414][ T7729] __sock_sendmsg+0xca/0x160 [10099.770462][ T7729] ____sys_sendmsg+0x636/0x794 [10099.771501][ T7729] ___sys_sendmsg+0x1a4/0x1e8 [10099.772651][ T7729] __sys_sendmsg+0x18e/0x234 [10099.773812][ T7729] __riscv_sys_sendmsg+0x70/0xa4 [10099.775003][ T7729] syscall_handler+0x92/0x114 [10099.776109][ T7729] do_trap_ecall_u+0x3dc/0x61c [10099.777321][ T7729] handle_exception+0x15e/0x16a [10099.778507][ T7729] [10099.778507][ T7729] -> #3 (&q->q_usage_counter(io)#20){++++}-{0:0}: [10099.780532][ T7729] lock_acquire+0x246/0x500 [10099.781561][ T7729] blk_alloc_queue+0x5b4/0x6f4 [10099.782862][ T7729] blk_mq_alloc_queue+0x15e/0x250 [10099.783882][ T7729] __blk_mq_alloc_disk+0x2a/0xd8 [10099.784974][ T7729] nbd_dev_add+0x426/0xaec [10099.785969][ T7729] nbd_init+0x3d4/0x3f8 [10099.787110][ T7729] do_one_initcall+0x18c/0xcc8 [10099.788124][ T7729] kernel_init_freeable+0x6d2/0x7bc [10099.789110][ T7729] kernel_init+0x28/0x240 [10099.790051][ T7729] ret_from_fork_kernel+0x94/0xef8 [10099.791113][ T7729] ret_from_fork_kernel_asm+0x16/0x18 [10099.792507][ T7729] [10099.792507][ T7729] -> #2 (fs_reclaim){+.+.}-{0:0}: [10099.794298][ T7729] lock_acquire+0x246/0x500 [10099.795325][ T7729] fs_reclaim_acquire+0xbe/0xf8 [10099.796380][ T7729] kmem_cache_alloc_node_noprof+0x40/0x6dc [10099.797556][ T7729] __alloc_skb+0x17c/0x768 [10099.798594][ T7729] tcp_stream_alloc_skb+0x2e/0x4d8 [10099.799614][ T7729] tcp_sendmsg_locked+0xe1a/0x3f98 [10099.800695][ T7729] tcp_sendmsg+0x32/0x50 [10099.801720][ T7729] inet_sendmsg+0x9a/0xd8 [10099.802949][ T7729] __sock_sendmsg+0xca/0x160 [10099.804070][ T7729] sock_write_iter+0x298/0x3e8 [10099.805126][ T7729] vfs_write+0x648/0xc78 [10099.806047][ T7729] ksys_write+0x1f4/0x238 [10099.806983][ T7729] __riscv_sys_write+0x6e/0x94 [10099.807934][ T7729] syscall_handler+0x92/0x114 [10099.809022][ T7729] do_trap_ecall_u+0x3dc/0x61c [10099.810230][ T7729] handle_exception+0x15e/0x16a [10099.811413][ T7729] [10099.811413][ T7729] -> #1 (sk_lock-AF_INET){+.+.}-{0:0}: [10099.813307][ T7729] lock_acquire+0x246/0x500 [10099.814616][ T7729] lock_sock_nested+0x38/0xf8 [10099.815928][ T7729] tcp_sendmsg+0x28/0x50 [10099.816989][ T7729] inet_sendmsg+0x9a/0xd8 [10099.818116][ T7729] sock_sendmsg+0x206/0x2d4 [10099.819159][ T7729] __sock_xmit+0x244/0x578 [10099.820145][ T7729] nbd_disconnect.isra.0+0x312/0x3e8 [10099.821254][ T7729] nbd_ioctl+0xbc8/0xbd4 [10099.822214][ T7729] blkdev_ioctl+0x4cc/0x12e4 [10099.823355][ T7729] __riscv_sys_ioctl+0x17c/0x1e4 [10099.824556][ T7729] syscall_handler+0x92/0x114 [10099.825677][ T7729] do_trap_ecall_u+0x3dc/0x61c [10099.826967][ T7729] handle_exception+0x15e/0x16a [10099.828227][ T7729] [10099.828227][ T7729] -> #0 (&nsock->tx_lock){+.+.}-{4:4}: [10099.829917][ T7729] check_noncircular+0x138/0x14c [10099.830995][ T7729] __lock_acquire+0xe9c/0x25ac [10099.832124][ T7729] lock_acquire+0x246/0x500 [10099.833220][ T7729] __mutex_lock+0x164/0x18d4 [10099.834284][ T7729] mutex_lock_nested+0x14/0x1c [10099.835327][ T7729] nbd_queue_rq+0x372/0xe44 [10099.836351][ T7729] blk_mq_dispatch_rq_list+0x3cc/0x1ac0 [10099.837334][ T7729] __blk_mq_sched_dispatch_requests+0xe12/0x13cc [10099.838460][ T7729] blk_mq_sched_dispatch_requests+0xb2/0x174 [10099.839562][ T7729] blk_mq_run_hw_queue+0x268/0x6c4 [10099.840776][ T7729] blk_mq_dispatch_list+0x52c/0x13e0 [10099.841810][ T7729] blk_mq_flush_plug_list+0x114/0x55c [10099.842906][ T7729] __blk_flush_plug+0x270/0x464 [10099.844258][ T7729] __submit_bio+0x42e/0x504 [10099.845709][ T7729] submit_bio_noacct_nocheck+0x458/0xdec [10099.847182][ T7729] submit_bio_noacct+0x6fe/0x2168 [10099.848617][ T7729] submit_bio+0xb6/0x5b8 [10099.849956][ T7729] submit_bh_wbc+0x4d8/0x6bc [10099.851099][ T7729] block_read_full_folio+0x396/0x788 [10099.852355][ T7729] blkdev_read_folio+0x26/0x30 [10099.853662][ T7729] filemap_read_folio+0xc2/0x270 [10099.854632][ T7729] do_read_cache_folio+0x22e/0x518 [10099.855621][ T7729] read_cache_folio+0x4e/0x68 [10099.856604][ T7729] read_part_sector+0xbc/0x408 [10099.857742][ T7729] read_lba+0x1b6/0x32c [10099.858902][ T7729] find_valid_gpt.constprop.0+0x212/0x21ec [10099.860191][ T7729] efi_partition+0xfa/0xae0 [10099.861322][ T7729] bdev_disk_changed+0x5b8/0x11b4 [10099.862559][ T7729] blkdev_get_whole+0x168/0x25c [10099.863791][ T7729] bdev_open+0x288/0xcc4 [10099.864963][ T7729] blkdev_open+0x2ec/0x450 [10099.865843][ T7729] do_dentry_open+0x418/0x1170 [10099.866985][ T7729] vfs_open+0xba/0x3a8 [10099.868095][ T7729] path_openat+0x144e/0x2f28 [10099.869100][ T7729] do_file_open+0x1ae/0x398 [10099.870120][ T7729] do_sys_openat2+0xfe/0x1c0 [10099.871263][ T7729] __riscv_sys_openat+0x122/0x1e4 [10099.872491][ T7729] syscall_handler+0x92/0x114 [10099.873619][ T7729] do_trap_ecall_u+0x3dc/0x61c [10099.874829][ T7729] handle_exception+0x15e/0x16a [10099.876081][ T7729] [10099.876081][ T7729] other info that might help us debug this: [10099.876081][ T7729] [10099.877144][ T7729] Chain exists of: [10099.877144][ T7729] &nsock->tx_lock --> set->srcu --> &cmd->lock [10099.877144][ T7729] [10099.879307][ T7729] Possible unsafe locking scenario: [10099.879307][ T7729] [10099.880097][ T7729] CPU0 CPU1 [10099.880764][ T7729] ---- ---- [10099.881434][ T7729] lock(&cmd->lock); [10099.882458][ T7729] lock(set->srcu); [10099.883798][ T7729] lock(&cmd->lock); [10099.885058][ T7729] lock(&nsock->tx_lock); [10099.886079][ T7729] [10099.886079][ T7729] *** DEADLOCK *** [10099.886079][ T7729] [10099.886959][ T7729] 3 locks held by syz.0.1369/7729: [10099.887771][ T7729] #0: ffffaf801ad1d350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x3c4/0xcc4 [10099.890299][ T7729] #1: ffffaf801a61e718 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_hw_queue+0x248/0x6c4 [10099.892896][ T7729] #2: ffffaf801ae40178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc4/0xe44 [10099.895310][ T7729] [10099.895310][ T7729] stack backtrace: [10099.896499][ T7729] CPU: 0 UID: 0 PID: 7729 Comm: syz.0.1369 Tainted: G W L syzkaller #0 PREEMPT [10099.897284][ T7729] Tainted: [W]=WARN, [L]=SOFTLOCKUP [10099.897475][ T7729] Hardware name: riscv-virtio,qemu (DT) [10099.897699][ T7729] Call Trace: [10099.897886][ T7729] [] dump_backtrace+0x2e/0x3c [10099.898530][ T7729] [] show_stack+0x30/0x3c [10099.898965][ T7729] [] dump_stack_lvl+0x114/0x1ac [10099.899681][ T7729] [] dump_stack+0x1c/0x28 [10099.900374][ T7729] [] print_circular_bug+0x250/0x29c [10099.900907][ T7729] [] check_noncircular+0x138/0x14c [10099.901429][ T7729] [] __lock_acquire+0xe9c/0x25ac [10099.901953][ T7729] [] lock_acquire+0x246/0x500 [10099.902497][ T7729] [] __mutex_lock+0x164/0x18d4 [10099.903066][ T7729] [] mutex_lock_nested+0x14/0x1c [10099.903667][ T7729] [] nbd_queue_rq+0x372/0xe44 [10099.904209][ T7729] [] blk_mq_dispatch_rq_list+0x3cc/0x1ac0 [10099.904684][ T7729] [] __blk_mq_sched_dispatch_requests+0xe12/0x13cc [10099.905282][ T7729] [] blk_mq_sched_dispatch_requests+0xb2/0x174 [10099.905876][ T7729] [] blk_mq_run_hw_queue+0x268/0x6c4 [10099.906578][ T7729] [] blk_mq_dispatch_list+0x52c/0x13e0 [10099.907028][ T7729] [] blk_mq_flush_plug_list+0x114/0x55c [10099.907494][ T7729] [] __blk_flush_plug+0x270/0x464 [10099.908226][ T7729] [] __submit_bio+0x42e/0x504 [10099.908934][ T7729] [] submit_bio_noacct_nocheck+0x458/0xdec [10099.909677][ T7729] [] submit_bio_noacct+0x6fe/0x2168 [10099.910374][ T7729] [] submit_bio+0xb6/0x5b8 [10099.911045][ T7729] [] submit_bh_wbc+0x4d8/0x6bc [10099.911538][ T7729] [] block_read_full_folio+0x396/0x788 [10099.912137][ T7729] [] blkdev_read_folio+0x26/0x30 [10099.912864][ T7729] [] filemap_read_folio+0xc2/0x270 [10099.913338][ T7729] [] do_read_cache_folio+0x22e/0x518 [10099.913892][ T7729] [] read_cache_folio+0x4e/0x68 [10099.914361][ T7729] [] read_part_sector+0xbc/0x408 [10099.915038][ T7729] [] read_lba+0x1b6/0x32c [10099.915696][ T7729] [] find_valid_gpt.constprop.0+0x212/0x21ec [10099.916460][ T7729] [] efi_partition+0xfa/0xae0 [10099.917131][ T7729] [] bdev_disk_changed+0x5b8/0x11b4 [10099.917813][ T7729] [] blkdev_get_whole+0x168/0x25c [10099.918482][ T7729] [] bdev_open+0x288/0xcc4 [10099.919130][ T7729] [] blkdev_open+0x2ec/0x450 [10099.919547][ T7729] [] do_dentry_open+0x418/0x1170 [10099.920177][ T7729] [] vfs_open+0xba/0x3a8 [10099.920800][ T7729] [] path_openat+0x144e/0x2f28 [10099.921357][ T7729] [] do_file_open+0x1ae/0x398 [10099.921892][ T7729] [] do_sys_openat2+0xfe/0x1c0 [10099.922556][ T7729] [] __riscv_sys_openat+0x122/0x1e4 [10099.923254][ T7729] [] syscall_handler+0x92/0x114 [10099.923929][ T7729] [] do_trap_ecall_u+0x3dc/0x61c [10099.924705][ T7729] [] handle_exception+0x15e/0x16a [10100.211021][ T7729] block nbd0: Dead connection, failed to find a fallback [10100.275089][ T7729] block nbd0: shutting down sockets SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [10100.335178][ T7729] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [10100.433651][ T7729] Buffer I/O error on dev nbd0, logical block 0, async page read [10100.560291][ T7729] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [10100.605722][ T7729] Buffer I/O error on dev nbd0, logical block 1, async page read [10100.763212][ T7729] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [10100.785756][ T7729] Buffer I/O error on dev nbd0, logical block 2, async page read [10100.980151][ T7729] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [10101.033580][ T7729] Buffer I/O error on dev nbd0, logical block 3, async page read [10101.171374][ T7729] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [10101.182448][ T7729] Buffer I/O error on dev nbd0, logical block 0, async page read [10101.235365][ T7729] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [10101.302847][ T7729] Buffer I/O error on dev nbd0, logical block 1, async page read [10101.371944][ T7729] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [10101.393179][ T7729] Buffer I/O error on dev nbd0, logical block 2, async page read [10101.431387][ T7729] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [10101.452129][ T7729] Buffer I/O error on dev nbd0, logical block 3, async page read [10101.522229][ T7729] nbd0: unable to read partition table