last executing test programs: 3m57.696446101s ago: executing program 0 (id=605): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/consoles\x00', 0x0, 0x0) pread64(r0, &(0x7f0000002100)=""/171, 0xab, 0x9a) 3m57.694447873s ago: executing program 0 (id=606): socket(0x40000000015, 0x5, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x150d, 0x103) openat(0xffffffffffffff9c, &(0x7f0000001040)='./file1\x00', 0x4003f, 0xa9) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x106, 0x5}}, 0x20) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) prlimit64(0x0, 0xe, 0x0, 0x0) rmdir(&(0x7f0000000980)='.\x00') r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'gre0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000940)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xf}, {0xffff}, {0x10}}, [@TCA_EGRESS_BLOCK={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x2f9, 0xffffca88, &(0x7f0000000040)="b90103600040f000009e0ff008001fffffe100004000632f77fb7f0200017f020001be3e7d2a182fff", 0x0, 0x104, 0x6000000000000000, 0x0, 0xfeb9, &(0x7f0000000400)="9209558f0c5fb25cd57f98113135c3171b8b331fbc04f0e6955a796ff8e3aae3cac46cec3030dfc999058aea01f0e6dcf2f9d480d328655aca003927bd50ed49d4843c8a0a2a4b26ceb747947200bd644c85e7a8a7d7cfce840c02a7d69c9e0bca410f64d43290abbbf3131e1fa8bd8c3e5f19d5a491d3d4c1a0fe47de9eebaf073ac3da6256bdb681d18fbd607c9b0d710442bcf78bc36fd3c035812bde582a262bff0e4d6181c818fccf542868c6e602d97bea23a101955dc76bcc984142ab305387aa348566d688edd291a3e9d08952adbdf60462bb7f7faebcdfccf17115708b0d73d0f3a469ce7d8374219b3f92c92bcec4958d474bb281c26691949d054b784a5866f081e53eb9cfd7"}, 0x28) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_emit_ethernet(0x3b6, &(0x7f0000001240)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb86dd6000000003803afffe8000000000000000000000000000bbff020000000000000000000000000001860090780000f800fcffffff00000000050aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c35b37adac15084dbaf736b41e5af180200010000000000000000000000001818fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978001d06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3e808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d000000000000003f0b17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4610001394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003210700000000000000000000000200000000000000000000000000008879e66485201a0015ca837400000000000000000000001c000000000000145e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c0305d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed90c18b40cb6ca01500e1554cb45945ebd87fd3bbcfedc42f617ba39e23585c666345516f8db892bd8f6d1f5b3d6514d85e55412126036eecd9a6b8e01cc45fc4cee090daf894f30c8fbd13682514f77f06c5cc52191a08dede751209af4135bc0828af2278b772260e7d4ae74ae9b6fdb2bf1d7ea713954710a7edec314cd4111f3977bd623da4bc510a65b4"], 0x0) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt(0xffffffffffffffff, 0x84, 0x81, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) fcntl$setsig(r6, 0xa, 0x2d) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000100)={0x9, 0xa, 0x3, 0x0, 0x4}) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) 3m56.736842647s ago: executing program 0 (id=616): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f00000007c0)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x810, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) r5 = syz_open_dev$video(&(0x7f0000000040), 0x7, 0x8000) ioctl$VIDIOC_S_PARM(r5, 0xc0cc5616, &(0x7f0000000280)={0x1, @output={0x0, 0x1, {0x2f1, 0xfffffffa}, 0x2, 0xfffffdf8}}) io_setup(0x2, &(0x7f0000000000)) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f00000000c0)=0xffffffffffffffff) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0185647, &(0x7f0000000440)={0xa00000, 0x7, 0x6, r6, 0x0, &(0x7f00000003c0)={0x9e0906, 0x8, '\x00', @value=0xef8f}}) syz_clone3(0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) ioctl$SYNC_IOC_FILE_INFO(0xffffffffffffffff, 0x40103e05, 0x0) r7 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r7, &(0x7f00000002c0)={0x1, 0x5}, 0x2) r8 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="1c0000005e007f029e3b470ded9b72ab25399c3683e5caa9bb22d956", 0x1c}], 0x1}, 0x4000084) 3m55.880339158s ago: executing program 0 (id=619): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000140)={@my=0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000000)={{@my=0x1, 0xffffffff}, @local, 0x0, 0x800000000, 0x8000000, 0x0, 0x6, 0x7fc}) 3m55.827600615s ago: executing program 0 (id=620): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x100) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x20) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) rename(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000100)='./file0\x00') sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r1, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @multicast2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x4000080) sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x38, r1, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000805}, 0x48815) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x4, 0xb5, &(0x7f00000000c0)=""/181}, 0x94) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x289c2, 0x1) mount(&(0x7f0000000100), &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x8c, &(0x7f0000000300)='trans=rdma,') r3 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) poll(&(0x7f0000000040)=[{r3, 0x644}], 0x1, 0x7f) ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, &(0x7f00000000c0)=0x1) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x6, 0x84000) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYRESOCT=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x24040992}, 0x2000088c) 3m55.600263903s ago: executing program 0 (id=622): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db6", 0xb}], 0x1}}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xd, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) readv(0xffffffffffffffff, &(0x7f0000000740)=[{0x0}], 0x1) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_freezer_state(r1, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r2, &(0x7f0000000040)='FROZEN\x00', 0x7) mkdirat$cgroup(r1, &(0x7f0000000100)='syz0\x00', 0x1ff) sendfile(r2, r2, 0x0, 0x9) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/devices/system/clocksource/clocksource0/current_clocksource\x00', 0x1, 0x0) write(r5, &(0x7f0000000240)='kvm-clock\n', 0xa) write$P9_RVERSION(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r3], 0x15) 3m40.433734726s ago: executing program 32 (id=622): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db6", 0xb}], 0x1}}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xd, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) readv(0xffffffffffffffff, &(0x7f0000000740)=[{0x0}], 0x1) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_freezer_state(r1, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r2, &(0x7f0000000040)='FROZEN\x00', 0x7) mkdirat$cgroup(r1, &(0x7f0000000100)='syz0\x00', 0x1ff) sendfile(r2, r2, 0x0, 0x9) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/devices/system/clocksource/clocksource0/current_clocksource\x00', 0x1, 0x0) write(r5, &(0x7f0000000240)='kvm-clock\n', 0xa) write$P9_RVERSION(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r3], 0x15) 1m45.527986174s ago: executing program 4 (id=1583): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x3c, r0, 0x1, 0x70bd2b, 0x25dfd3f6, {{0x12}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0x7fff}, @NL80211_ATTR_STA_FLAGS={0xc, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_AUTHENTICATED={0x4}, @NL80211_STA_FLAG_TDLS_PEER={0x4}]}]}, 0x3c}}, 0x84) 1m45.519393687s ago: executing program 4 (id=1584): write$binfmt_register(0xffffffffffffffff, &(0x7f0000000480)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0x4, 0x3a, 'B\xd4GGI\x82\\4\xbb\xbb\xbb\xb3\xd4)\xed\x8f\xaa\xf4\xd2{\xc5\t\xa9\xed\xf8e\xaa\xb9\xf5\r\xe3T\x0e\x8a\xd6\x9a_?G\x05\x00\x00\x00\x00\x00\x00\x00\x1e\x9a\xce\xac&x3\x15\x14y\xbf\xc6)\xa8\b/\x01\x00\x00\f\x8e1\xc4\xa1\xb2]I\xa5\x13}9\x1b0x0) timer_settime(r0, 0x1, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) pipe2(&(0x7f0000000180), 0x80000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x3, 0x3, 0x40) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xffdff7e8, 0x0, 0x3, 0x1000000}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffffb}, 0x21}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd21, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0xb}, {}, {0xfff2, 0xd}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x5, 0x4, 0x2, 0x8}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="50000000150000c9bdbd7000fedbdf250a7882c8", @ANYRES32=r4, @ANYBLOB="140006000300000004000000010000000b00000008000a000300000008000a00010000001400010000000000000000000000ffffe0000001"], 0x50}, 0x1, 0x0, 0x0, 0x400c098}, 0x4000080) timer_settime(0x0, 0x1, &(0x7f0000000240)={{0x77359400}, {0x0, 0x3938700}}, &(0x7f0000000380)) accept4$packet(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0x14, 0x81000) socket$inet6(0xa, 0x2, 0x3a) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1, 0x11, r8, 0x800000000000) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x0, 0x806, 0x5, 0xffffffff}, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) syz_io_uring_setup(0x10a, &(0x7f0000000140)={0x0, 0x5885, 0x0, 0x0, 0xffffffff}, &(0x7f0000000340), 0x0, &(0x7f0000000000)) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x1) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r10, 0x4020aed2, &(0x7f00000000c0)={0xffff1000, 0x301000, 0x8}) socket$nl_route(0x10, 0x3, 0x0) 3.51023288s ago: executing program 1 (id=2256): socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000740)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000010000000c00060001000000000000000c00020000000000000000001c0007"], 0x48}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000a80)=ANY=[@ANYRES16=r5, @ANYBLOB="0100feffffff0000000001000000040007800c000200ffff000000000000"], 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) syz_open_dev$sndpcmp(0x0, 0x1, 0x2000) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4048aecb, &(0x7f0000000480)={0x5, 0x0, [{0xa, 0xffffffff, 0x1, 0xffffff89, 0x800, 0x6, 0x48d4}, {0x8000000e, 0x8, 0x1, 0x3ff, 0x7ffffdff, 0x8005, 0xffff}, {0x80000019, 0x2, 0x1, 0x7, 0xdf1, 0x2, 0x80000001}, {0x80000000, 0x100, 0x4, 0x6, 0x3, 0x2, 0x3}, {0x80000001, 0x2, 0xb, 0xfffffff7, 0xfffffff9, 0xff, 0x6}]}) syz_init_net_socket$llc(0x1a, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) creat(&(0x7f00000002c0)='./file0\x00', 0x0) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 2.141234273s ago: executing program 3 (id=2261): mkdir(&(0x7f0000000150)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r1, 0x0, 0x88000cc, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000740)={{{@in6=@loopback, @in=@dev}}, {{@in=@empty}, 0x0, @in6=@empty}}, &(0x7f0000000840)=0xe4) mkdir(&(0x7f0000000300)='./config/usb_gadget/g_syz\x00', 0x1ff) mkdir(&(0x7f0000000400)='./config/usb_gadget/g_syz/configs/c.1\x00', 0x1ff) statx(r1, &(0x7f0000000240)='./config\x00', 0x1000, 0x40, &(0x7f0000000880)) mkdir(&(0x7f0000000500)='./config/usb_gadget/g_syz/functions/ecm.usb0\x00', 0x1ff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008000500090000001400040073"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) fsconfig$FSCONFIG_SET_FLAG(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) setrlimit(0x7, &(0x7f0000000400)) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000040)={0x4}) 2.141026683s ago: executing program 3 (id=2262): write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_GET_EVENT(0xffffffffffffffff, &(0x7f0000000500)={0xc, 0x8, 0xfa00, {&(0x7f0000000380)}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={0x18, 0x110, 0xfa00, {r0, 0x7fffffff, 0x12, 0x0, 0x0, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e20, @loopback}}}, 0x118) 2.140793325s ago: executing program 2 (id=2263): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$XFS_IOC_FSINUMBERS(0xffffffffffffffff, 0xc0205867, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xd, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xe, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41100, 0x4a, '\x00', 0x0, @sk_skb=0x5, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x4, 0x200008, 0x8, 0x20001}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r2], 0x4c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x6293a, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x300, 0x40845}, 0x4000000) 2.059177928s ago: executing program 2 (id=2264): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @sock_ops}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYRES16=r2, @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x81}, 0x0) 2.05845417s ago: executing program 2 (id=2265): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket(0x80000000000000a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x1, 0x800, 0x0) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c000000100005ff04000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32], 0x3c}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f0000000240)={r4, @in6={{0xa, 0x4e21, 0xd, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, 0xff, 0x103}, 0x90) r7 = syz_open_dev$vim2m(&(0x7f0000000140), 0x20000000fe, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000180)=0x5, 0x4) ioctl$vim2m_VIDIOC_STREAMOFF(r7, 0x40045612, &(0x7f0000000100)=0x1) dup3(r2, r6, 0x80000) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000840)={r4, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xfd, 0x7, 0x4}, 0x9c) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000140)="41000200010078", 0x7) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0186405, &(0x7f0000000000)={0xfff, 0x5, {0xffffffffffffffff}, {}, 0x2, 0x6}) sched_setscheduler(r8, 0x2, &(0x7f0000000040)=0x1) 1.953485921s ago: executing program 3 (id=2267): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = socket(0xa, 0x3, 0xff) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x15, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040), &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000001f40)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r10 = openat$ublk_ctrl(0xffffff9c, &(0x7f00000002c0), 0x2, 0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000001ec0)={0x2e, 0x20, 0x0, r10, 0xc0207504, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001e80)=@any_dev={0x1, 0x6e4, 0x0, 0x0, 0x1000, 0x4, r9, 0x0, 0x72}}}, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x1, 0x40055}, &(0x7f00000000c0)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r11, r12, r13, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) syz_io_uring_submit(r2, r7, r13, &(0x7f0000000040)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x2, r0, 0x0, 0x0, 0x0, 0x40000100, 0x1, {0x2}}) r14 = socket$inet(0x2, 0x80001, 0x84) openat$ppp(0xffffff9c, &(0x7f0000000340), 0x145140, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r14, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) write$tun(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB="f7ffffff0001080006040007000000000000ffffffff0180c2b3000000ffffff"], 0x20) r15 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r16 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0x7b165bbd3dc1767a, &(0x7f0000001180)=ANY=[@ANYBLOB="18050000080000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r15, @ANYBLOB="0000000000000000b7040000080000008500000095000000850000000500000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r16, 0xfffff000, 0xe, 0x0, &(0x7f0000000300)="882f1242a03c3f98722780b605a7", 0x0, 0x8, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}, 0x4c) setsockopt$inet6_int(r0, 0x29, 0x7, &(0x7f00000000c0)=0x7f, 0x4) 1.907390659s ago: executing program 3 (id=2269): r0 = userfaultfd(0x80001) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') syz_clone3(&(0x7f00000023c0)={0x400000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0, 0x0, {r1}}, 0x58) syz_genetlink_get_family_id$gtp(&(0x7f0000002080), r1) read$FUSE(r1, &(0x7f0000002440)={0x2020}, 0x2020) 1.587658478s ago: executing program 5 (id=2272): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000000)=0xffffffff, 0x4) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) write(0xffffffffffffffff, &(0x7f0000000340), 0x11000) pipe(0x0) close(0xffffffffffffffff) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x480, 0x0) r2 = getpid() socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(r2, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x7ffe, 0x0, 0x9, 0xffffffff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000002500)=@raw={'raw\x00', 0x3c1, 0x3, 0x5f0, 0x3b8, 0xffffff80, 0x178, 0x0, 0x178, 0x520, 0x22b, 0x258, 0x520, 0x258, 0x2034, 0x0, {[{{@uncond, 0x1d, 0x398, 0x3b8, 0x340, {0x1e0002a8, 0x7203000000000000}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x1a, 0x64, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x6}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x8000}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0xa}, {}, {}, {0xfffc}]}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "e22e50439abb066265e088a63e13552b8b2fec412753ac647d17d2ebca69d17a9722bd2f5be411676d5993fb4cc74168209fb9f43b63bab2a88206d7dd8158d916b865d0f713f772c59ad6e6b572e9a6c498fb6459888a281e8c071a9a7229f9fe02cb8e9ba7637a2591a5367c770c87034734be6eda195ce135517efa85da52", 0x1}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x100, 0x168, 0x0, {}, [@common=@ah={{0x30}, {[], 0x0, 0x1}}, @common=@ipv6header={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x12, 0x0, 0x0, 0x0, '\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x650) r5 = socket(0x10, 0x2, 0x0) write(r5, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) sendmsg$SOCK_DIAG_BY_FAMILY(r5, &(0x7f0000000a40)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000a00)={&(0x7f0000000680)={0x37c, 0x14, 0x200, 0x70bd28, 0x25dfdbff, {0x27, 0x40}, [@INET_DIAG_REQ_BYTECODE={0x9e, 0x1, "aff87d1ac0db071912df26e2a1297800530f5193c3242fe5da8c249ffed310f8ede2e824dfb21a901137e638354c3e74642ff590a830c933ca2420ac967663aa27fdb7f5d267447fde3ddacd83f4f006559e5ff1ba04f60e7043fc38b7cc3720338ccada5257c085c5e8f951452c4546d816f24521f3553734661bd953089580b821fde378ed1eb82206a2c86d2d5a55c4502060b75a4b7743fd"}, @INET_DIAG_REQ_BYTECODE={0xba, 0x1, "7ea2b22786d0363254c99282486be2c19e44526b5f49de494cb6b7e8fb6f753358c21c9e3499bffdcdef7e500aa71e6d7210d39cbbbb05abec1f8b7c588df01515a23a822b5589aa07b201041e3088ecfbddd691b513746f95d43299397c9c15301991094b34515d869dd46bd3486c3404f8c28e0fcb0eebaf7c180b6cf8c766a385d2832e2c0163251e6a7c669f506b6457b9befb6d4d5a2185d25a4be3604ee61869a4eee49f5005ff22b5869188618fb34c0bed20"}, @INET_DIAG_REQ_BYTECODE={0x100, 0x1, "a5e92c8ab7239e96e0e88c98bf8363dbdc5b2afa04d61ba7f1df35c9475b249609b2326b61c315c2fef6817cfe8f6bf1c217400036b6063bf8dea0af9e2fabd0ef52e4144ac72a46f3b439788f29cf93a06e08eb7be13ea38cf692b8bc027e52e77423a75b202bddc3d8d9e7001993f4180494f60e8bc7859c3aa6f6a213e91c3a8671346de6e5185804c16ea941cabb905406a7b9c62ba1769182e238308d5706f3db5d2dd9d0fe2acc5fd16cf3510c3a93706ba701d2db97e3ea9967db0df79ef9ab58bb7fd7afd67d4d6be897a8223e2750044f28e85d27af1857afccb981768014270ab66658f17ead83ce55b07171000b4163a058ea16719ba2"}, @INET_DIAG_REQ_BYTECODE={0x2f, 0x1, "2b385a0dce0de7f43a4d831c7954261eea7f9909b761ba10cd6724e32261afec5417dcecfafa590b6f4700"}, @INET_DIAG_REQ_BYTECODE={0x2b, 0x1, "979b5753bdf3c72a4ca01f3c016826c167feedacd8a23c5e7eed78fc2fc5e05839b3aab9e44aea"}, @INET_DIAG_REQ_BYTECODE={0x8a, 0x1, "5fd88e3b7746bc90fb4c7b58a1b554c37f2dbafbbd4d654dd019100e4d1bf2e6fdad844c170b6f3f73baf3c8fd45dc574995db36858e469c73a37b056b4d176755840a854a6beeb172adc4d6accbb3d5c3e9b579a17f4530480816ab8724db4c7cb0c7c92ec3a0067456e1b888e62c179ebd661d688f1c936adb29398a741401af2f3d66a789"}, @INET_DIAG_REQ_BYTECODE={0x24, 0x1, "0ab1d0d7b1ff6d0f05e1471b6b66ed435800eee9ee0d153c5bf4aaa41f68cf21"}]}, 0x37c}, 0x1, 0x0, 0x0, 0x20000082}, 0x20000) recvmmsg(r5, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') sendmsg$nl_route_sched(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@deltaction={0x134, 0x31, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}, @TCA_ACT_TAB={0x40, 0x1, [{0x14, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffffc}}]}, @TCA_ACT_TAB={0x4c, 0x1, [{0xc, 0x22, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe19}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xde}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}, @TCA_ACT_TAB={0x20, 0x1, [{0xc, 0xf, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}]}, @TCA_ACT_TAB={0x60, 0x1, [{0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x800000c}}, {0x14, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xbb88}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3ff}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x185}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2d}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x8bdc6132919770f3}, 0x40040) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000003c0)={'pcl818\x00', [0x4f23, 0x2, 0xfffffffd, 0x4000, 0x7, 0x5, 0x8, 0xd287, 0xa, 0xfd, 0x7, 0x23, 0x4, 0x1, 0x6, 0x101, 0x80000000, 0x1ff, 0x80000001, 0x0, 0x10000008, 0x927, 0x7, 0x8401, 0x40f, 0xe69, 0x4, 0x10008, 0x3, 0x1cdc, 0xfbfffff8, 0x1]}) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000700)=ANY=[], 0x8) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)={{0x1, 0x1, 0x18, r7}, './file0\x00'}) 958.121362ms ago: executing program 3 (id=2273): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x78) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x168) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) epoll_create1(0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r3 = io_uring_setup(0x3450, &(0x7f0000000080)={0x0, 0x2ed2, 0x8000, 0xfffffffd}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) 598.882291ms ago: executing program 5 (id=2274): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000380)={[{@lowerdir, 0x3a}], [], 0x2f}) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'dummy0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x20700, 0x2000000, {0x0, 0x0, 0x0, 0x0, 0x8203}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x20004885}, 0x4054) 299.691805ms ago: executing program 2 (id=2275): write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_GET_EVENT(0xffffffffffffffff, &(0x7f0000000500)={0xc, 0x8, 0xfa00, {&(0x7f0000000380)}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000cc0)={0x18, 0x110, 0xfa00, {r0, 0x7fffffff, 0x12, 0x0, 0x0, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e20, @loopback}}}, 0x118) 297.543639ms ago: executing program 5 (id=2276): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x6, 0x82, &(0x7f0000000000)="0000000000000002", 0x8) syz_init_net_socket$bt_l2cap(0x1f, 0x63c8a3eb1056e477, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000000080)=@in6={0xa, 0x4e22, 0xb, @loopback, 0x80000000}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x4}], 0x1, 0x4001) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) clock_nanosleep(0x8, 0x1, &(0x7f0000000080), 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) dup2(r0, r3) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) process_madvise(r5, 0x0, 0x0, 0x67, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @empty, 0x4}], 0x1c) sendto$inet6(r3, &(0x7f00000000c0)='l', 0x1, 0x7ddfdbdfafa51cdd, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @loopback, 0xffffffff}, 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000000140)={r2, 0x7f}, 0x8) 216.283868ms ago: executing program 1 (id=2277): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000003c0)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x7, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000100)={0x6, 0x8000, 0x4, 0x1}, &(0x7f0000000140)=0x10) (fail_nth: 2) 214.846543ms ago: executing program 5 (id=2278): pipe(&(0x7f0000002680)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f00000005c0)='fd', 0x0, r1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x0) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x0, 0x0, 0x5}) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000140)="441f08d600270bee724ef54e91eeffbe1e68d5040d73161feeb0f24cb1", 0x1d) 212.846549ms ago: executing program 5 (id=2279): mknod$loop(&(0x7f0000000100)='./file0\x00', 0xfff, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) r1 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000700)={0xe0, 0x10, 0x50b, 0x0, 0x0, "", [@generic="6f6d8864d22a3f2ffaa46c88bc", @typed={0xa9, 0x0, 0x0, 0x0, @binary="2b0e13e735a3184f1b3d6da2f1acfac0ee50d2b184b27db1f302de337c0004060000000000bf852c89867f6691b01b2d44e4ff2d5f28732c5fbd9423debbb86f9dba4a2dba4dbe076c02262600c446a567de243ab0d67683f7bb11c9cab3b3eed8a8bef4ff1631aa78acefca03c1a66db4424a8ba100022db228bb7b5eb5100100000000000000a0912086d9f4606d2e4cc898739222c5d3a83cb6b707f3336336ebb7d681"}, @nested={0x11, 0x0, 0x0, 0x1, [@generic="a64a6f8911da357ba323a96d75"]}]}, 0xe0}], 0x1}, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000008340)={0x2020, 0x0, 0x0}, 0x206f) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x34014c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001bbd9097000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c5675bdd7f4e838e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x0, 0x0, {0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) r4 = dup(r3) write$P9_RSTATFS(r4, 0x0, 0x0) syz_emit_ethernet(0x26, &(0x7f0000000100)={@broadcast, @local, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x0, @random="ba1aed2bd9ca", @multicast1, @broadcast, @rand_addr=0x64010101}}}}, 0x0) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f0000000300)) r5 = openat2$dir(0xffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x240002, 0x80, 0x30}, 0x18) r6 = openat(r5, &(0x7f0000000240)='./file0\x00', 0x0, 0x0) umount2(&(0x7f0000000180)='./file0\x00', 0xb) readv(r6, &(0x7f0000000580)=[{&(0x7f0000000680)=""/134, 0x86}], 0x1) 49.502389ms ago: executing program 2 (id=2280): mkdir(&(0x7f0000000150)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r1, 0x0, 0x88000cc, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000740)={{{@in6=@loopback, @in=@dev}}, {{@in=@empty}, 0x0, @in6=@empty}}, &(0x7f0000000840)=0xe4) mkdir(&(0x7f0000000300)='./config/usb_gadget/g_syz\x00', 0x1ff) mkdir(&(0x7f0000000400)='./config/usb_gadget/g_syz/configs/c.1\x00', 0x1ff) statx(r1, &(0x7f0000000240)='./config\x00', 0x1000, 0x40, &(0x7f0000000880)) mkdir(&(0x7f0000000500)='./config/usb_gadget/g_syz/functions/ecm.usb0\x00', 0x1ff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008000500090000001400040073"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) fsconfig$FSCONFIG_SET_FLAG(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) setrlimit(0x7, &(0x7f0000000400)) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000040)={0x4}) 49.348274ms ago: executing program 1 (id=2281): mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000e, 0x6c2f2, 0xffffffffffffffff, 0x0) syz_clone(0x2280700, 0x0, 0x0, 0x0, 0x0, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x20000, 0x0, 0x0, 0x2) 28.873074ms ago: executing program 3 (id=2282): r0 = gettid() openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="020300090a0000000000000000000000030006000000000002000000fd1414000000000000000000020001000000000000000002fffffffb030005000000000002000000000000000000000000000000c9cb8c463843f41976dfe9fe674d72b1fd3f90a3d417b1043a198ee752902e387d77b0c946c68cf54ed8ac16eb829e0150961673ca881301d3a9ec003e233673d83a2061ad18146cc39c5e59cd1910912dd907bf2251dd5d78fd7354b5f194483ef0db04df"], 0x50}}, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x12}, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) sendmsg$key(r1, &(0x7f0000000000)={0x9, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="bed200099400000005140000ffaf966cabd08ffc62e6dbdf25"], 0x10}}, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc0e99db6de761f86, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1, 0x2) fsopen(0x0, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x2c41, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000180)={@loopback={0xfec0ffff00000000}, 0x8000000, 0x0, 0x2, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000180)={@mcast1, 0x8000000, 0x0, 0xff, 0x8, 0x1, 0x2}, 0x20) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/gser.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/gser.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/gser.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f00000004c0)="dd2ac7a476835c711b45a013dadf5c6012048704b0c5563c154e0b4c83c6749dcf8faa895b1308fc7d74e51d41aa6b00d17c1a9361de6b4799bb5a1ee925045fa0f2fa51077e192eb20440434627", 0x8) r6 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r6, &(0x7f0000000400)='\n', 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 28.449197ms ago: executing program 1 (id=2283): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0000:00:02.0\x00', 0xd) close(r0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000280)='dummy_udc.0\n', 0xc) sendmsg$SMC_PNETID_DEL(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x34, r2, 0x1, 0x0, 0x25dfdbfe, {0x2, 0x2, 0x2}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x34}, 0x1, 0x40030000000000, 0x0, 0x800}, 0x80) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r0, 0x7af, &(0x7f0000000380)={@host, 0x4}) sendmsg$SMC_PNETID_FLUSH(r0, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x50, r2, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'batadv0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'tunl0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20008041}, 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x14, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x140}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfff}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x33}}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r5, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 28.138152ms ago: executing program 5 (id=2284): openat$random(0xffffff9c, &(0x7f0000000180), 0x408180, 0x0) syz_io_uring_setup(0xeff, &(0x7f0000000400)={0x0, 0xf7f0, 0x400, 0x3, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r0, r1, r2, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) socket$nl_route(0x10, 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r3 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x1b}, &(0x7f0000000100), &(0x7f00000000c0), &(0x7f0000000000)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r5, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) creat(&(0x7f0000000080)='./bus\x00', 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000500)=@xdp={0x2c, 0x7, 0x0, 0x7}, 0x80, 0x0}, 0x4000011) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc01100, 0x0, 0x0, 0x0, 0x2) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x40050) sendmsg$RDMA_NLDEV_CMD_DELLINK(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000015c0)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a08786eb807e0000000000000000000009fe70ba83a7a66e67a0bae5cfaccbbb81e28d7b568", @ANYRESOCT], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) r7 = socket$nl_sock_diag(0x10, 0x3, 0x4) io_uring_register$IORING_REGISTER_RING_FDS(r3, 0x14, &(0x7f0000008580)=[{0x4, 0x0, 0x0}, {0x2, 0x0, 0x0}, {0x2, 0x0, 0x0}, {0x3, 0x0, 0x0}, {0x5, 0x1, 0x0}, {0x2, 0x0, 0x0}, {0x4, 0x0, 0x0}, {0x8, 0x0, 0x0}, {0x9, 0x1, 0x0}], 0x9) sendmsg$SOCK_DIAG_BY_FAMILY(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001400050126bc70006bdbdf2511000d000100c80e4501a254722eaea6d93916f8d66cffe8ef8d00000000"], 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x548c0) 0s ago: executing program 2 (id=2285): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB="180500000800000000000000000000008500000075000000850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0xfffff000, 0xe, 0x0, &(0x7f0000000300)="882f1242a03c3f98722780b605a7", 0x0, 0x990d, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x50) kernel console output (not intermixed with test programs): h speed hub [ 318.200605][ T5749] usb 8-1: config 3 has an invalid interface number: 255 but max is 0 [ 318.209458][ T5827] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 318.239450][T16302] ceph: No mds server is up or the cluster is laggy [ 318.244536][ T5749] usb 8-1: config 3 has an invalid descriptor of length 242, skipping remainder of the config [ 318.257903][ T5749] usb 8-1: config 3 has no interface number 0 [ 318.260689][ T5749] usb 8-1: config 3 interface 255 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 6 [ 318.266714][ T5749] usb 8-1: config 3 interface 255 has no altsetting 0 [ 318.273259][ T5749] usb 8-1: language id specifier not provided by device, defaulting to English [ 318.286792][ T5749] usb 8-1: New USB device found, idVendor=24d2, idProduct=1084, bcdDevice=50.4f [ 318.290159][ T5749] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.330781][ T6884] usb 10-1: unable to get BOS descriptor or descriptor too short [ 318.334553][ T6884] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 318.338010][ T6884] usb 10-1: config 1 interface 1 altsetting 1 endpoint 0x82 is Bulk; changing to Interrupt [ 318.341743][ T6884] usb 10-1: config 1 interface 1 altsetting 1 endpoint 0x3 is Bulk; changing to Interrupt [ 318.564513][T16383] FAULT_INJECTION: forcing a failure. [ 318.564513][T16383] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 318.568363][T16383] CPU: 3 UID: 0 PID: 16383 Comm: syz.2.1893 Tainted: G S L syzkaller #0 PREEMPT(full) [ 318.568382][T16383] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 318.568387][T16383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 318.568395][T16383] Call Trace: [ 318.568400][T16383] [ 318.568406][T16383] dump_stack_lvl+0x100/0x190 [ 318.568423][T16383] should_fail_ex.cold+0x5/0xa [ 318.568438][T16383] _copy_from_user+0x2e/0xd0 [ 318.568457][T16383] generic_map_update_batch+0x4bb/0x800 [ 318.568475][T16383] ? __pfx_generic_map_update_batch+0x10/0x10 [ 318.568490][T16383] ? __pfx_generic_map_update_batch+0x10/0x10 [ 318.568503][T16383] bpf_map_do_batch+0x66f/0x6d0 [ 318.568520][T16383] __sys_bpf+0x4ce/0x4e80 [ 318.568537][T16383] ? __pfx___sys_bpf+0x10/0x10 [ 318.568550][T16383] ? find_held_lock+0x2b/0x80 [ 318.568565][T16383] ? get_pid_task+0xfc/0x250 [ 318.568580][T16383] ? get_pid_task+0xfc/0x250 [ 318.568598][T16383] ? proc_fail_nth_write+0x9f/0x220 [ 318.568630][T16383] ? find_held_lock+0x2b/0x80 [ 318.568647][T16383] ? rcu_read_lock_any_held+0x6a/0xa0 [ 318.568664][T16383] ? find_held_lock+0x2b/0x80 [ 318.568678][T16383] ? ksys_write+0x190/0x250 [ 318.568689][T16383] ? ksys_write+0x190/0x250 [ 318.568709][T16383] ? fput+0x79/0x100 [ 318.568723][T16383] ? __ia32_sys_bpf+0xcc/0x170 [ 318.568735][T16383] __ia32_sys_bpf+0xcc/0x170 [ 318.568761][T16383] ? __do_fast_syscall_32+0x98/0x970 [ 318.568778][T16383] __do_fast_syscall_32+0xe7/0x970 [ 318.568793][T16383] ? lockdep_hardirqs_on+0x78/0x100 [ 318.568809][T16383] do_fast_syscall_32+0x32/0x70 [ 318.568824][T16383] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 318.568839][T16383] RIP: 0023:0xf6ffefec [ 318.568854][T16383] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 318.568859][T16383] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 318.568871][T16383] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 00000000800009c0 [ 318.568878][T16383] RDX: 0000000000000038 RSI: 0000000000000000 RDI: 0000000000000000 [ 318.568885][T16383] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 318.568891][T16383] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 318.568898][T16383] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 318.568912][T16383] [ 318.666034][ T5749] usb 8-1: USB disconnect, device number 5 [ 319.191187][T16397] input: syz1 as /devices/virtual/input/input21 [ 319.308806][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 319.351607][T16406] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 319.354683][T16406] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 319.357746][T16406] overlayfs: missing 'lowerdir' [ 319.719535][T16407] kvm: Disabled LAPIC found during irq injection [ 320.418899][ T5889] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 320.568879][ T5889] usb 6-1: Using ep0 maxpacket: 8 [ 320.572918][ T5889] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 320.577288][ T5889] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 320.581490][ T5889] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 320.586134][ T5889] usb 6-1: config 0 descriptor?? [ 320.798052][ T5889] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 320.894070][ T6884] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 320.896934][ T6884] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.902230][ T6884] usb 10-1: can't set config #1, error -71 [ 320.904814][ T6884] usb 10-1: USB disconnect, device number 10 [ 320.985898][T16448] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 321.009526][ T5749] usb 6-1: USB disconnect, device number 36 [ 321.011468][ C2] iowarrior 6-1:0.0: iowarrior_callback - usb_submit_urb failed with result -19 [ 321.538919][ T5889] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 321.718840][ T5889] usb 10-1: Using ep0 maxpacket: 8 [ 321.721819][ T5889] usb 10-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 321.725980][ T5889] usb 10-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 321.729957][ T5889] usb 10-1: config 0 interface 0 has no altsetting 0 [ 321.732654][ T5889] usb 10-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 321.736079][ T5889] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.741597][ T5889] usb 10-1: config 0 descriptor?? [ 322.047133][T16504] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1914'. [ 322.160603][ T5889] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 322.162805][ T5889] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 322.164720][ T5889] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 322.166752][ T5889] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 322.169135][ T5889] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 322.171557][ T5889] mcp2221 0003:04D8:00DD.0007: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 322.179916][ T9] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 322.333469][ T9] usb 7-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 322.336255][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 322.338627][ T9] usb 7-1: Product: syz [ 322.339913][ T9] usb 7-1: Manufacturer: syz [ 322.341344][ T9] usb 7-1: SerialNumber: syz [ 322.346763][ T9] usb 7-1: config 0 descriptor?? [ 322.355406][ T9] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 322.358300][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 322.365492][ T5917] usb 10-1: USB disconnect, device number 11 [ 322.374632][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 322.378045][ T9] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 322.378482][ T9] usb 7-1: media controller created [ 322.383938][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 322.561453][T16493] cxusb: i2c wr: len=80 is too big! [ 322.561453][T16493] [ 322.578263][ T9] cxusb: set interface failed [ 322.580020][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 322.602331][ T9] DVB: Unable to find symbol mt352_attach() [ 322.604544][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 322.613105][ T9] zl10353_read_register: readreg error (reg=127, ret==-121) [ 322.615544][ T9] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 322.669048][ T9] rc_core: IR keymap rc-dvico-mce not found [ 322.671152][ T9] Registered IR keymap rc-empty [ 322.674267][ T9] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0 [ 322.678329][ T9] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.2/usb7/7-1/rc/rc0/input22 [ 322.684090][ T9] dvb-usb: schedule remote query interval to 100 msecs. [ 322.686388][ T9] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 322.693812][ T9] usb 7-1: USB disconnect, device number 31 [ 322.735351][ T9] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 323.170193][T16590] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1921'. [ 323.344113][T16600] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1924'. [ 323.384539][ T5917] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 323.462639][T16613] tipc: Enabled bearer , priority 0 [ 323.465915][T16613] syzkaller0: entered promiscuous mode [ 323.467973][T16613] syzkaller0: entered allmulticast mode [ 323.487206][T16613] tipc: Resetting bearer [ 323.490656][T16612] tipc: Resetting bearer [ 323.523459][T16612] tipc: Disabling bearer [ 323.534722][ T5917] usb 10-1: device descriptor read/64, error -71 [ 323.645862][T16618] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 323.668867][ T9] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 323.711129][T16624] kthread_run failed with err -4 [ 323.759194][T16599] lo speed is unknown, defaulting to 1000 [ 323.770189][T16599] wg2 speed is unknown, defaulting to 1000 [ 323.778871][ T5917] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 323.830238][ T9] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 323.833638][ T9] usb 8-1: config 0 has no interfaces? [ 323.835444][ T9] usb 8-1: New USB device found, idVendor=056a, idProduct=030c, bcdDevice= 0.00 [ 323.838394][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.843628][ T9] usb 8-1: config 0 descriptor?? [ 323.909246][ T5917] usb 10-1: device descriptor read/64, error -71 [ 324.020253][ T5917] usb usb10-port1: attempt power cycle [ 324.052802][ T9] usb 8-1: string descriptor 0 read error: -71 [ 324.058670][ T9] usb 8-1: USB disconnect, device number 6 [ 324.373758][ T5917] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 324.400490][ T5917] usb 10-1: device descriptor read/8, error -71 [ 324.651318][ T5917] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 324.669805][ T5917] usb 10-1: device descriptor read/8, error -71 [ 324.697216][T16671] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 324.791347][ T5917] usb usb10-port1: unable to enumerate USB device [ 325.718281][T16702] syzkaller0: entered promiscuous mode [ 325.720878][T16702] syzkaller0: entered allmulticast mode [ 325.861372][T16718] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1938'. [ 325.868986][T16718] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1938'. [ 325.935142][T16728] syzkaller0: entered promiscuous mode [ 325.936958][T16728] syzkaller0: entered allmulticast mode [ 325.941028][T16728] FAULT_INJECTION: forcing a failure. [ 325.941028][T16728] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 325.946503][T16728] CPU: 2 UID: 0 PID: 16728 Comm: syz.2.1941 Tainted: G S L syzkaller #0 PREEMPT(full) [ 325.946523][T16728] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 325.946529][T16728] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 325.946538][T16728] Call Trace: [ 325.946543][T16728] [ 325.946548][T16728] dump_stack_lvl+0x100/0x190 [ 325.946567][T16728] should_fail_ex.cold+0x5/0xa [ 325.946582][T16728] _copy_from_user+0x2e/0xd0 [ 325.946601][T16728] kstrtouint_from_user+0xd6/0x1d0 [ 325.946614][T16728] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 325.946627][T16728] ? __lock_acquire+0x49f/0x1a40 [ 325.946652][T16728] proc_fail_nth_write+0x83/0x220 [ 325.946669][T16728] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 325.946689][T16728] vfs_write+0x2aa/0x1050 [ 325.946701][T16728] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 325.946718][T16728] ? __pfx_vfs_write+0x10/0x10 [ 325.946727][T16728] ? find_held_lock+0x2b/0x80 [ 325.946741][T16728] ? __fget_files+0x215/0x3d0 [ 325.946755][T16728] ? __fget_files+0x21f/0x3d0 [ 325.946769][T16728] ksys_write+0x12a/0x250 [ 325.946780][T16728] ? __pfx_ksys_write+0x10/0x10 [ 325.946794][T16728] do_int80_emulation+0x14b/0x720 [ 325.946812][T16728] asm_int80_emulation+0x1a/0x20 [ 325.946823][T16728] RIP: 0023:0xf71373eb [ 325.946833][T16728] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 325.946845][T16728] RSP: 002b:00000000f53ed4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 325.946856][T16728] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f53ed5d0 [ 325.946864][T16728] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 325.946870][T16728] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 325.946877][T16728] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 325.946883][T16728] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 325.946897][T16728] [ 326.058406][T16737] netlink: 'syz.1.1942': attribute type 4 has an invalid length. [ 326.067255][T16737] netlink: 'syz.1.1942': attribute type 4 has an invalid length. [ 326.204203][T16750] tipc: Enabled bearer , priority 0 [ 326.207091][T16750] syzkaller0: entered promiscuous mode [ 326.267118][T16750] syzkaller0: entered allmulticast mode [ 326.282815][T16771] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1946'. [ 326.356874][T16766] tipc: Resetting bearer [ 326.477558][T16799] FAULT_INJECTION: forcing a failure. [ 326.477558][T16799] name failslab, interval 1, probability 0, space 9, times 0 [ 326.483484][T16799] CPU: 3 UID: 0 PID: 16799 Comm: syz.5.1952 Tainted: G S L syzkaller #0 PREEMPT(full) [ 326.483506][T16799] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 326.483511][T16799] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 326.483518][T16799] Call Trace: [ 326.483523][T16799] [ 326.483528][T16799] dump_stack_lvl+0x100/0x190 [ 326.483546][T16799] should_fail_ex.cold+0x5/0xa [ 326.483560][T16799] should_failslab+0xc2/0x120 [ 326.483580][T16799] kmem_cache_alloc_noprof+0x91/0x6a0 [ 326.483596][T16799] ? __anon_vma_prepare+0x344/0x5e0 [ 326.483610][T16799] __anon_vma_prepare+0x344/0x5e0 [ 326.483620][T16799] ? __pfx___pte_alloc+0x10/0x10 [ 326.483637][T16799] __vmf_anon_prepare+0x11f/0x250 [ 326.483654][T16799] do_anonymous_page+0x51b/0x2080 [ 326.483670][T16799] __handle_mm_fault+0x1d2c/0x2a00 [ 326.483684][T16799] ? mt_find+0x45e/0x8e0 [ 326.483715][T16799] ? __pfx___handle_mm_fault+0x10/0x10 [ 326.483728][T16799] ? __pfx_mt_find+0x10/0x10 [ 326.483780][T16799] ? find_vma+0xbf/0x140 [ 326.483796][T16799] ? __pfx_find_vma+0x10/0x10 [ 326.483812][T16799] handle_mm_fault+0x37b/0xa30 [ 326.483827][T16799] do_user_addr_fault+0x74c/0x12f0 [ 326.483848][T16799] exc_page_fault+0x6f/0xd0 [ 326.483862][T16799] asm_exc_page_fault+0x26/0x30 [ 326.483875][T16799] RIP: 0010:__put_user_8+0xd/0x30 [ 326.483889][T16799] Code: 89 01 31 c9 0f 01 ca e9 51 db 03 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <48> 89 01 31 c9 0f 01 ca c3 cc cc cc cc 66 0f 1f 44 00 00 90 90 90 [ 326.483900][T16799] RSP: 0018:ffffc90006507e68 EFLAGS: 00050206 [ 326.483911][T16799] RAX: 00000000000000e7 RBX: 0000000000000000 RCX: 00000000800000c0 [ 326.483918][T16799] RDX: ffff8880133ba540 RSI: ffffffff825c1591 RDI: ffffffff8c400a80 [ 326.483925][T16799] RBP: 00000000800000c0 R08: 0000000000000001 R09: 00000000000001cf [ 326.483932][T16799] R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000001024 [ 326.483939][T16799] R13: 0000000000000180 R14: 0000000000000000 R15: 0000000000000000 [ 326.483950][T16799] ? __might_fault+0x111/0x140 [ 326.483964][T16799] fpu_xstate_prctl+0x3f9/0xa10 [ 326.483978][T16799] ? ksys_write+0x1ac/0x250 [ 326.483989][T16799] ? __pfx_ksys_write+0x10/0x10 [ 326.484001][T16799] __ia32_sys_arch_prctl+0xf6/0x1d0 [ 326.484021][T16799] __do_fast_syscall_32+0xe7/0x970 [ 326.484036][T16799] ? lockdep_hardirqs_on+0x78/0x100 [ 326.484051][T16799] do_fast_syscall_32+0x32/0x70 [ 326.484066][T16799] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 326.484080][T16799] RIP: 0023:0xf708efec [ 326.484094][T16799] Code: Unable to access opcode bytes at 0xf708efc2. [ 326.484100][T16799] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000180 [ 326.484110][T16799] RAX: ffffffffffffffda RBX: 0000000000001024 RCX: 00000000800000c0 [ 326.484117][T16799] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 326.484124][T16799] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 326.484131][T16799] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 326.484138][T16799] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 326.484152][T16799] [ 326.596239][T16800] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1950'. [ 326.618408][T16806] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1953'. [ 326.680775][T16807] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1802 [ 326.982066][T16749] tipc: Resetting bearer [ 326.997898][T16749] tipc: Disabling bearer [ 327.035607][T16817] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1957'. [ 327.202688][T16817] veth3: entered allmulticast mode [ 327.256834][T16817] bond1: (slave veth3): Enslaving as an active interface with an up link [ 327.294885][T17065] bond1 (unregistering): (slave veth3): Releasing backup interface [ 327.304782][T17065] bond1 (unregistering): Released all slaves [ 327.323610][T17445] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1960'. [ 327.397744][T17486] FAULT_INJECTION: forcing a failure. [ 327.397744][T17486] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 327.405090][T17486] CPU: 3 UID: 0 PID: 17486 Comm: syz.3.1962 Tainted: G S L syzkaller #0 PREEMPT(full) [ 327.405111][T17486] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 327.405116][T17486] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 327.405130][T17486] Call Trace: [ 327.405134][T17486] [ 327.405140][T17486] dump_stack_lvl+0x100/0x190 [ 327.405159][T17486] should_fail_ex.cold+0x5/0xa [ 327.405173][T17486] _copy_from_user+0x2e/0xd0 [ 327.405193][T17486] __do_sys_kcmp+0xaea/0xd70 [ 327.405211][T17486] ? __pfx___do_sys_kcmp+0x10/0x10 [ 327.405225][T17486] ? ksys_write+0x1ac/0x250 [ 327.405236][T17486] ? __pfx_ksys_write+0x10/0x10 [ 327.405250][T17486] __do_fast_syscall_32+0xe7/0x970 [ 327.405266][T17486] ? lockdep_hardirqs_on+0x78/0x100 [ 327.405281][T17486] do_fast_syscall_32+0x32/0x70 [ 327.405297][T17486] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 327.405312][T17486] RIP: 0023:0xf7fd2fec [ 327.405327][T17486] Code: Unable to access opcode bytes at 0xf7fd2fc2. [ 327.405333][T17486] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 000000000000015d [ 327.405345][T17486] RAX: ffffffffffffffda RBX: 0000000000000061 RCX: 0000000000000063 [ 327.405352][T17486] RDX: 0000000000000007 RSI: 0000000000000005 RDI: 0000000080000100 [ 327.405359][T17486] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 327.405366][T17486] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 327.405372][T17486] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 327.405387][T17486] [ 327.589581][T17445] veth5: entered allmulticast mode [ 327.650754][T17445] bond6: (slave veth5): Enslaving as an active interface with an up link [ 327.910350][T18064] netlink: 'syz.3.1965': attribute type 1 has an invalid length. [ 328.665935][T17637] FAULT_INJECTION: forcing a failure. [ 328.665935][T17637] name failslab, interval 1, probability 0, space 9, times 0 [ 328.672325][T17637] CPU: 3 UID: 0 PID: 17637 Comm: syz.2.1960 Tainted: G S L syzkaller #0 PREEMPT(full) [ 328.672346][T17637] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 328.672351][T17637] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 328.672358][T17637] Call Trace: [ 328.672363][T17637] [ 328.672368][T17637] dump_stack_lvl+0x100/0x190 [ 328.672386][T17637] should_fail_ex.cold+0x5/0xa [ 328.672400][T17637] should_failslab+0xc2/0x120 [ 328.672417][T17637] __kmalloc_noprof+0xfc/0x820 [ 328.672431][T17637] ? do_raw_spin_lock+0x128/0x260 [ 328.672445][T17637] ? ethnl_default_notify+0x1c3/0x9f0 [ 328.672461][T17637] ethnl_default_notify+0x1c3/0x9f0 [ 328.672475][T17637] ? __pfx_ethnl_default_notify+0x10/0x10 [ 328.672487][T17637] ? __wake_up+0x3f/0x60 [ 328.672501][T17637] ? consume_skb+0x67/0x110 [ 328.672522][T17637] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 328.672541][T17637] ? dev_map_notification+0x504/0xb20 [ 328.672558][T17637] ? __pfx_ethnl_default_notify+0x10/0x10 [ 328.672570][T17637] ethnl_notify+0x17c/0x360 [ 328.672582][T17637] ethnl_netdev_event+0x152/0x190 [ 328.672595][T17637] notifier_call_chain+0x99/0x3f0 [ 328.672614][T17637] call_netdevice_notifiers_info+0xbe/0x110 [ 328.672633][T17637] netdev_update_features+0xca/0xe0 [ 328.672650][T17637] ? __pfx_netdev_update_features+0x10/0x10 [ 328.672667][T17637] ? veth_disable_xdp+0x266/0x350 [ 328.675941][T17637] veth_xdp+0x512/0x8c0 [ 328.675959][T17637] netif_xdp_propagate+0x420/0x640 [ 328.675976][T17637] dev_xdp_propagate+0xb2/0x260 [ 328.675994][T17637] bond_xdp+0x2ea/0x860 [ 328.676270][T17637] ? __pfx_bond_xdp+0x10/0x10 [ 328.676286][T17637] ? schedule+0x225/0x2c0 [ 328.676307][T17637] dev_xdp_install+0x5cb/0x950 [ 328.676323][T17637] ? __pfx_bond_xdp+0x10/0x10 [ 328.676339][T17637] ? __pfx_dev_xdp_install+0x10/0x10 [ 328.676356][T17637] ? lockdep_rtnl_is_held+0x26/0x40 [ 328.676369][T17637] ? tcx_uninstall+0x33f/0x6d0 [ 328.676386][T17637] unregister_netdevice_many_notify+0xead/0x2140 [ 328.676404][T17637] ? __pfx_bond_xdp+0x10/0x10 [ 328.676423][T17637] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 328.676441][T17637] ? unregister_netdevice_queue+0x22e/0x3c0 [ 328.676458][T17637] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 328.676479][T17637] rtnl_dellink+0x472/0xb40 [ 328.676495][T17637] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 328.676518][T17637] ? kasan_save_track+0x14/0x30 [ 328.676532][T17637] ? kasan_save_free_info+0x3b/0x70 [ 328.676542][T17637] ? __kasan_slab_free+0x5f/0x80 [ 328.676560][T17637] ? __pfx_rtnl_dellink+0x10/0x10 [ 328.676574][T17637] ? nlmon_xmit+0xa5/0xe0 [ 328.676590][T17637] ? dev_hard_start_xmit+0x121/0x760 [ 328.676601][T17637] ? __dev_queue_xmit+0x1bbf/0x4970 [ 328.676614][T17637] ? netlink_sendmsg+0x8b0/0xda0 [ 328.676627][T17637] ? ____sys_sendmsg+0xa4d/0xbe0 [ 328.676662][T17637] ? __lock_acquire+0x49f/0x1a40 [ 328.676687][T17637] ? find_held_lock+0x2b/0x80 [ 328.676708][T17637] ? find_held_lock+0x2b/0x80 [ 328.676724][T17637] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 328.676745][T17637] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 328.676765][T17637] ? __pfx_rtnl_dellink+0x10/0x10 [ 328.676781][T17637] rtnetlink_rcv_msg+0x95e/0xe90 [ 328.676803][T17637] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 328.676824][T17637] ? ref_tracker_free+0x37e/0x6c0 [ 328.676848][T17637] netlink_rcv_skb+0x159/0x420 [ 328.676860][T17637] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 328.676878][T17637] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 328.676898][T17637] ? netlink_deliver_tap+0x1ae/0xcc0 [ 328.676913][T17637] netlink_unicast+0x585/0x850 [ 328.676927][T17637] ? __pfx_netlink_unicast+0x10/0x10 [ 328.676944][T17637] netlink_sendmsg+0x8b0/0xda0 [ 328.676958][T17637] ? __pfx_netlink_sendmsg+0x10/0x10 [ 328.676973][T17637] ? apparmor_socket_sendmsg+0x15b/0x270 [ 328.676988][T17637] ____sys_sendmsg+0xa4d/0xbe0 [ 328.676999][T17637] ? __pfx_netlink_sendmsg+0x10/0x10 [ 328.677017][T17637] ? __pfx_____sys_sendmsg+0x10/0x10 [ 328.677035][T17637] ___sys_sendmsg+0x190/0x1e0 [ 328.677048][T17637] ? __pfx____sys_sendmsg+0x10/0x10 [ 328.677071][T17637] ? find_held_lock+0x2b/0x80 [ 328.677093][T17637] __sys_sendmsg+0x160/0x210 [ 328.677110][T17637] ? __pfx___sys_sendmsg+0x10/0x10 [ 328.677129][T17637] ? __pfx_ksys_write+0x10/0x10 [ 328.677143][T17637] __do_fast_syscall_32+0xe7/0x970 [ 328.677158][T17637] ? lockdep_hardirqs_on+0x78/0x100 [ 328.677173][T17637] do_fast_syscall_32+0x32/0x70 [ 328.677189][T17637] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 328.677204][T17637] RIP: 0023:0xf6ffefec [ 328.677220][T17637] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 328.677225][T17637] RSP: 002b:00000000f53cc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 328.677237][T17637] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000100 [ 328.677244][T17637] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 328.677251][T17637] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 328.677258][T17637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 328.677264][T17637] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 328.677278][T17637] [ 329.062818][T17637] bond6 (unregistering): (slave veth5): Releasing backup interface [ 329.066956][T17637] bond6 (unregistering): Released all slaves [ 329.087234][T18053] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1966'. [ 329.088351][T18056] overlayfs: overlapping lowerdir path [ 329.095812][T18105] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1967'. [ 329.155139][T18112] Cannot find add_set index 1 as target [ 329.157923][T18053] random: crng reseeded on system resumption [ 329.205382][T18116] overlayfs: missing 'lowerdir' [ 329.225519][T18116] uhci_hcd 0000:00:1d.0: remove, state 4 [ 329.234629][T18116] usb usb2: USB disconnect, device number 1 [ 329.280470][T18116] uhci_hcd 0000:00:1d.0: USB bus 2 deregistered [ 329.338953][ T5749] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 329.342505][T18126] vxcan1: tx drop: invalid da for name 0x0000000000000003 [ 329.462066][T18123] pci 0000:00:1d.0: [8086:2934] type 00 class 0x0c0300 conventional PCI endpoint [ 329.471909][T18123] pci 0000:00:1d.0: BAR 4 [io 0xc0e0-0xc0ff] [ 329.487098][T18123] pci 0000:00:1d.0: Adding to iommu group 7 [ 329.490270][ T5749] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 329.496418][T18123] pci 0000:00:1d.0: BAR 4 [io 0x2020-0x203f]: assigned [ 329.497528][ T5749] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.500665][T18123] pci 0000:00:04.0: PCI bridge to [bus 01] [ 329.505452][T18123] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 329.510807][T18123] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 329.515574][T18123] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 329.606377][T18123] pci 0000:00:1d.0: quirk_usb_early_handoff+0x0/0x1360 took 82773 usecs [ 329.655874][T18123] uhci_hcd 0000:00:1d.0: UHCI Host Controller [ 329.667830][T18123] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 2 [ 329.674189][T18123] uhci_hcd 0000:00:1d.0: detected 2 ports [ 329.684558][T18123] uhci_hcd 0000:00:1d.0: irq 16, io port 0x00002020 [ 329.694295][T18123] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 7.02 [ 329.698357][T18123] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 329.701035][T18123] usb usb2: Product: UHCI Host Controller [ 329.702944][T18123] usb usb2: Manufacturer: Linux syzkaller uhci_hcd [ 329.705080][T18123] usb usb2: SerialNumber: 0000:00:1d.0 [ 329.731208][ T5749] cdc_acm 10-1:1.0: ttyACM0: USB ACM device [ 329.734087][T18123] hub 2-0:1.0: USB hub found [ 329.744135][T18123] hub 2-0:1.0: 2 ports detected [ 329.872379][T18165] lo speed is unknown, defaulting to 1000 [ 329.875012][T18165] wg2 speed is unknown, defaulting to 1000 [ 330.090963][T18181] Invalid ELF header magic: != ELF [ 330.103785][T18181] overlayfs: overlapping lowerdir path [ 330.401170][T18066] syzkaller0: entered promiscuous mode [ 330.406313][T18066] syzkaller0: entered allmulticast mode [ 330.590102][T18201] syzkaller0: entered promiscuous mode [ 330.591913][T18201] syzkaller0: entered allmulticast mode [ 331.329978][T18245] FAULT_INJECTION: forcing a failure. [ 331.329978][T18245] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 331.334281][T18245] CPU: 2 UID: 0 PID: 18245 Comm: syz.1.1984 Tainted: G S L syzkaller #0 PREEMPT(full) [ 331.334302][T18245] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 331.334307][T18245] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 331.334314][T18245] Call Trace: [ 331.334320][T18245] [ 331.334325][T18245] dump_stack_lvl+0x100/0x190 [ 331.334344][T18245] should_fail_ex.cold+0x5/0xa [ 331.334359][T18245] _copy_from_user+0x2e/0xd0 [ 331.334379][T18245] get_compat_msghdr+0xb3/0x480 [ 331.334398][T18245] ? __pfx_get_compat_msghdr+0x10/0x10 [ 331.334416][T18245] ? rcu_is_watching+0x12/0xc0 [ 331.334431][T18245] ? ___sys_sendmsg+0x19d/0x1e0 [ 331.334443][T18245] ? kfree+0x1e5/0x6c0 [ 331.334454][T18245] ? __pfx__kstrtoull+0x10/0x10 [ 331.334468][T18245] ___sys_sendmsg+0x1b6/0x1e0 [ 331.334482][T18245] ? __pfx____sys_sendmsg+0x10/0x10 [ 331.334494][T18245] ? __lock_acquire+0x49f/0x1a40 [ 331.334524][T18245] ? __pfx___might_resched+0x10/0x10 [ 331.334545][T18245] __sys_sendmmsg+0x309/0x440 [ 331.334563][T18245] ? __pfx___sys_sendmmsg+0x10/0x10 [ 331.334579][T18245] ? find_held_lock+0x2b/0x80 [ 331.334597][T18245] ? __mutex_unlock_slowpath+0x35d/0x930 [ 331.334620][T18245] ? fput+0x79/0x100 [ 331.334633][T18245] ? ksys_write+0x1ac/0x250 [ 331.334646][T18245] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 331.334665][T18245] ? lockdep_hardirqs_on+0x78/0x100 [ 331.334680][T18245] __do_fast_syscall_32+0xe7/0x970 [ 331.334695][T18245] ? lockdep_hardirqs_on+0x78/0x100 [ 331.334710][T18245] do_fast_syscall_32+0x32/0x70 [ 331.334726][T18245] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 331.334741][T18245] RIP: 0023:0xf7f14fec [ 331.334756][T18245] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 331.334761][T18245] RSP: 002b:00000000f53b550c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 331.334773][T18245] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000000 [ 331.334780][T18245] RDX: 00000000000001f2 RSI: 00000000000000fc RDI: 0000000000000000 [ 331.334787][T18245] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 331.334794][T18245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 331.334800][T18245] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 331.334814][T18245] [ 331.468957][T18247] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1986'. [ 331.496416][T18253] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1985'. [ 331.656105][T18258] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1988'. [ 332.545195][T18258] veth7: entered allmulticast mode [ 332.550505][ T5757] Bluetooth: hci4: command 0x0405 tx timeout [ 332.647366][T18258] bond6: (slave veth7): Enslaving as an active interface with an up link [ 332.809741][T18294] bond6 (unregistering): (slave veth7): Releasing backup interface [ 332.816629][T18294] bond6 (unregistering): Released all slaves [ 333.045880][T18890] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 333.054602][T18890] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 333.475674][ T43] kauditd_printk_skb: 3 callbacks suppressed [ 333.475688][ T43] audit: type=1800 audit(1785571071.746:4741): pid=18897 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1992" name="enable" dev="configfs" ino=45415 res=0 errno=0 [ 333.499203][ T36] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 333.591786][T18899] usb usb8: usbfs: interface 0 claimed by hub while 'syz.2.1992' resets device [ 334.457601][T18934] overlayfs: failed to decode file handle (len=5, type=0, flags=0, err=-22) [ 334.630529][ T5757] Bluetooth: hci4: command 0x0405 tx timeout [ 334.798891][ T5749] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 334.948956][ T5749] usb 7-1: Using ep0 maxpacket: 32 [ 334.954929][ T5749] usb 7-1: unable to get BOS descriptor or descriptor too short [ 334.958585][ T5749] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 334.961510][ T5749] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 334.964537][ T5749] usb 7-1: config 14 has no interface number 0 [ 334.966870][ T5749] usb 7-1: config 14 has no interface number 1 [ 334.971456][ T5749] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 334.988860][ T5749] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 334.992584][ T5749] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 334.996098][ T5749] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 335.001994][ T5749] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 335.010389][ T5749] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 335.018902][ T5749] usb 7-1: config 14 interface 57 has no altsetting 0 [ 335.028903][ T5749] usb 7-1: config 14 interface 228 has no altsetting 0 [ 335.032960][ T5749] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 335.037456][ T5749] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.042438][ T5749] usb 7-1: Product: syz [ 335.043808][ T5749] usb 7-1: Manufacturer: syz [ 335.047638][ T5749] usb 7-1: SerialNumber: syz [ 335.320638][T18958] TCP: TCP_TX_DELAY enabled [ 335.419234][T18962] netlink: 4724 bytes leftover after parsing attributes in process `syz.1.2005'. [ 335.437150][ T9] usb 10-1: USB disconnect, device number 16 [ 335.452514][T18969] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2004'. [ 336.236359][ T43] audit: type=1804 audit(1785571074.506:4742): pid=18984 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2006" name="/newroot/455/file0" dev="tmpfs" ino=2504 res=1 errno=0 [ 336.393395][ T5102] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 336.558800][ C0] tipc: RX(1000001): key[1] is activated [ 337.519296][ T5749] legousbtower 7-1:14.57: interrupt endpoints not found [ 337.580500][ T5749] legousbtower 7-1:14.228: get version request failed: -71 [ 337.583301][ T5749] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 337.585066][T18993] cdrom: dropping to single frame dma [ 337.589713][ T5749] usb 7-1: USB disconnect, device number 32 [ 338.814001][T19043] binder: 19034:19043 ioctl 4c0a 0 returned -22 [ 338.889170][T19043] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2014'. [ 338.962128][T19052] FAULT_INJECTION: forcing a failure. [ 338.962128][T19052] name failslab, interval 1, probability 0, space 9, times 0 [ 338.966206][T19052] CPU: 0 UID: 0 PID: 19052 Comm: syz.5.2019 Tainted: G S L syzkaller #0 PREEMPT(full) [ 338.966227][T19052] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 338.966232][T19052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 338.966239][T19052] Call Trace: [ 338.966244][T19052] [ 338.966249][T19052] dump_stack_lvl+0x100/0x190 [ 338.966268][T19052] should_fail_ex.cold+0x5/0xa [ 338.966282][T19052] should_failslab+0xc2/0x120 [ 338.966300][T19052] kmem_cache_alloc_noprof+0x91/0x6a0 [ 338.966315][T19052] ? alloc_empty_file+0x5b/0x1c0 [ 338.966332][T19052] alloc_empty_file+0x5b/0x1c0 [ 338.966347][T19052] dentry_open+0x46/0xd0 [ 338.966362][T19052] vfs_open_tree+0x852/0xae0 [ 338.966386][T19052] ? __pfx_vfs_open_tree+0x10/0x10 [ 338.966403][T19052] __ia32_sys_open_tree+0xa3/0x150 [ 338.966418][T19052] __do_fast_syscall_32+0xe7/0x970 [ 338.966434][T19052] ? lockdep_hardirqs_on+0x78/0x100 [ 338.966449][T19052] do_fast_syscall_32+0x32/0x70 [ 338.966465][T19052] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 338.966479][T19052] RIP: 0023:0xf708efec [ 338.966494][T19052] Code: Unable to access opcode bytes at 0xf708efc2. [ 338.966500][T19052] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 00000000000001ac [ 338.966511][T19052] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000000 [ 338.966519][T19052] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 338.966526][T19052] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 338.966532][T19052] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 338.966539][T19052] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 338.966553][T19052] [ 339.265503][T19060] trusted_key: encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false [ 339.299219][ T5889] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 339.327961][T19064] netlink: 'syz.2.2023': attribute type 11 has an invalid length. [ 339.459065][ T5889] usb 10-1: Using ep0 maxpacket: 8 [ 339.463172][ T5889] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 339.622356][ T5889] usb 10-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 339.625318][ T5889] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.629272][ T5889] usb 10-1: config 0 descriptor?? [ 339.810847][T19083] overlayfs: failed to decode file handle (len=5, type=0, flags=0, err=-22) [ 339.842895][ T5889] iowarrior 10-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 339.950611][T19096] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 340.023995][T19089] 8021q: adding VLAN 0 to HW filter on device bond0 [ 340.041974][ T9] usb 10-1: USB disconnect, device number 17 [ 340.044383][ C0] iowarrior 10-1:0.0: iowarrior_callback - usb_submit_urb failed with result -19 [ 340.058593][T19089] 8021q: adding VLAN 0 to HW filter on device team0 [ 340.076744][T19089] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 340.088003][T19089] tipc: Resetting bearer [ 340.141572][T19089] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 340.151405][T19089] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 340.164845][T19089] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 340.171632][T19089] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 340.192650][T19089] veth1_vlan: left promiscuous mode [ 340.198338][T19089] veth0_vlan: left promiscuous mode [ 340.203306][T19089] veth0_vlan: entered promiscuous mode [ 340.210237][T19089] veth1_vlan: entered promiscuous mode [ 340.222018][T19089] veth1_macvtap: left promiscuous mode [ 340.229908][T19089] veth0_macvtap: left promiscuous mode [ 340.230517][ T6884] usb 8-1: new low-speed USB device number 7 using dummy_hcd [ 340.236627][T19089] veth0_macvtap: entered promiscuous mode [ 340.244950][T19089] veth1_macvtap: entered promiscuous mode [ 340.254385][T19089] macsec0: left promiscuous mode [ 340.283821][T19089] 8021q: adding VLAN 0 to HW filter on device bond1 [ 340.297270][T19089] bridge1: left promiscuous mode [ 340.304379][T19089] bridge2: left promiscuous mode [ 340.318662][T19089] 8021q: adding VLAN 0 to HW filter on device eth0 [ 340.337381][T19089] 8021q: adding VLAN 0 to HW filter on device eth1 [ 340.349501][T19089] 8021q: adding VLAN 0 to HW filter on device eth2 [ 340.361002][T19089] 8021q: adding VLAN 0 to HW filter on device eth3 [ 340.383070][T19089] bridge3: left promiscuous mode [ 340.392994][T13548] bridge0: port 2(bridge_slave_1) entered blocking state [ 340.395397][T13548] bridge0: port 2(bridge_slave_1) entered forwarding state [ 340.400564][ T6884] usb 8-1: unable to get BOS descriptor or descriptor too short [ 340.404753][ T6884] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x6 is Bulk; changing to Interrupt [ 340.413829][ T6884] usb 8-1: string descriptor 0 read error: -22 [ 340.415918][ T6884] usb 8-1: New USB device found, idVendor=041e, idProduct=3042, bcdDevice= 0.40 [ 340.419044][ T6884] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.428368][T19098] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 340.434945][ T6884] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 340.437318][ T6884] usb 8-1: MIDIStreaming interface descriptor not found [ 340.449564][T11298] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 340.452671][T11298] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.455328][T11298] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 340.458371][T11298] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.473955][T11298] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 340.478214][T11298] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.486109][T11298] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 340.489111][T11298] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.637549][ T5917] usb 8-1: USB disconnect, device number 7 [ 341.161196][T19159] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2033'. [ 341.216456][T19159] binder_alloc: 19158: binder_alloc_buf, no vma [ 341.218723][T19159] binder: 19158:19159 ioctl c0185500 80000400 returned -22 [ 341.667948][T19179] FAULT_INJECTION: forcing a failure. [ 341.667948][T19179] name failslab, interval 1, probability 0, space 9, times 0 [ 341.672643][T19179] CPU: 2 UID: 0 PID: 19179 Comm: syz.1.2036 Tainted: G S L syzkaller #0 PREEMPT(full) [ 341.672666][T19179] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 341.672670][T19179] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 341.672678][T19179] Call Trace: [ 341.672684][T19179] [ 341.672689][T19179] dump_stack_lvl+0x100/0x190 [ 341.672707][T19179] should_fail_ex.cold+0x5/0xa [ 341.672720][T19179] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 341.672734][T19179] should_failslab+0xc2/0x120 [ 341.672752][T19179] kmem_cache_alloc_noprof+0x91/0x6a0 [ 341.672767][T19179] ? skb_clone+0x190/0x400 [ 341.672787][T19179] skb_clone+0x190/0x400 [ 341.672810][T19179] netlink_deliver_tap+0xaed/0xcc0 [ 341.672831][T19179] netlink_unicast+0x62b/0x850 [ 341.672854][T19179] ? __pfx_netlink_unicast+0x10/0x10 [ 341.672880][T19179] netlink_sendmsg+0x8b0/0xda0 [ 341.672903][T19179] ? __pfx_netlink_sendmsg+0x10/0x10 [ 341.672920][T19179] ? apparmor_socket_sendmsg+0x15b/0x270 [ 341.672936][T19179] ____sys_sendmsg+0xa4d/0xbe0 [ 341.672947][T19179] ? __pfx_netlink_sendmsg+0x10/0x10 [ 341.672960][T19179] ? __pfx_____sys_sendmsg+0x10/0x10 [ 341.672979][T19179] ___sys_sendmsg+0x190/0x1e0 [ 341.672992][T19179] ? __pfx____sys_sendmsg+0x10/0x10 [ 341.673015][T19179] ? find_held_lock+0x2b/0x80 [ 341.673039][T19179] __sys_sendmsg+0x160/0x210 [ 341.673056][T19179] ? __pfx___sys_sendmsg+0x10/0x10 [ 341.673076][T19179] ? __pfx_ksys_write+0x10/0x10 [ 341.673090][T19179] __do_fast_syscall_32+0xe7/0x970 [ 341.673106][T19179] ? lockdep_hardirqs_on+0x78/0x100 [ 341.673122][T19179] do_fast_syscall_32+0x32/0x70 [ 341.673137][T19179] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 341.673153][T19179] RIP: 0023:0xf7f14fec [ 341.673168][T19179] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 341.673174][T19179] RSP: 002b:00000000f539450c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 341.673186][T19179] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000280 [ 341.673193][T19179] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 341.673200][T19179] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 341.673206][T19179] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 341.673213][T19179] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 341.673227][T19179] [ 341.844546][T19179] bridge_slave_1: left promiscuous mode [ 341.847257][T19179] bridge0: port 2(bridge_slave_1) entered disabled state [ 341.858540][T19179] bond0: (slave bond_slave_0): Releasing backup interface [ 341.874151][T19179] bond0: (slave bond_slave_1): Releasing backup interface [ 341.889286][T19179] team0: Port device team_slave_0 removed [ 341.896346][T19179] team0: Port device team_slave_1 removed [ 341.900787][T19179] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 341.903529][T19179] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 341.907661][T19179] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 341.914514][T19179] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 341.917855][T19179] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 342.092325][T19196] fuse: Unknown parameter 'd' [ 342.795826][T19214] pim6reg1: entered promiscuous mode [ 342.798418][T19214] pim6reg1: entered allmulticast mode [ 343.037779][T19223] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(7) [ 343.040538][T19223] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 343.073143][T19223] vhci_hcd vhci_hcd.0: Device attached [ 343.350447][ T5730] usb 48-1: SetAddress Request (2) to port 0 [ 343.352850][ T5730] usb 48-1: new SuperSpeed USB device number 2 using vhci_hcd [ 343.658950][T19224] vhci_hcd: connection reset by peer [ 343.759251][ T5820] vhci_hcd vhci_hcd.5: stop threads [ 343.762757][ T5820] vhci_hcd vhci_hcd.5: release socket [ 343.765227][ T5820] vhci_hcd vhci_hcd.5: disconnect device [ 344.470120][ T43] audit: type=1800 audit(1785571082.746:4743): pid=19233 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2048" name="bDeviceClass" dev="configfs" ino=45726 res=0 errno=0 [ 345.115225][T19239] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2049'. [ 346.151985][T19266] netlink: 'syz.5.2053': attribute type 1 has an invalid length. [ 346.256898][T19286] bond1: (slave geneve2): making interface the new active one [ 346.260163][T19286] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 346.328344][T11247] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 346.332371][T11247] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 346.336280][T11247] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 346.340245][T11247] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 346.361707][T19266] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2053'. [ 346.375128][T19266] bridge0: port 2(bridge_slave_1) entered disabled state [ 346.803611][T19322] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2059'. [ 346.839978][T19326] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2060'. [ 347.136079][T19340] block nbd3: shutting down sockets [ 347.150591][T19345] binder: 19344:19345 ioctl c00c6211 0 returned -14 [ 347.529006][ T5827] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 347.549047][ T5749] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 347.591538][T19386] bridge0: port 1(dummy0) entered blocking state [ 347.595607][T19386] bridge0: port 1(dummy0) entered disabled state [ 347.603640][T19386] dummy0: entered allmulticast mode [ 347.613747][T19386] dummy0: entered promiscuous mode [ 347.616154][T19386] bridge0: port 1(dummy0) entered blocking state [ 347.620223][T19386] bridge0: port 1(dummy0) entered forwarding state [ 347.631961][T19386] dummy0: left allmulticast mode [ 347.633970][T19386] dummy0: left promiscuous mode [ 347.638668][T19386] bridge0: port 1(dummy0) entered disabled state [ 347.678920][ T5749] usb 10-1: device descriptor read/64, error -71 [ 347.690741][ T5827] usb 8-1: config 7 has an invalid interface number: 10 but max is 0 [ 347.698831][ T5827] usb 8-1: config 7 has no interface number 0 [ 347.700726][ T5827] usb 8-1: config 7 interface 10 has no altsetting 0 [ 347.710502][ T5827] usb 8-1: New USB device found, idVendor=1199, idProduct=9063, bcdDevice=2f.3f [ 347.713370][ T5827] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.715838][ T5827] usb 8-1: Product: syz [ 347.717179][ T5827] usb 8-1: Manufacturer: 駏૗䕹좺蒺歴䩍ᇚ떼欵톭泏瞷凿ሎ뛍옃袕䝡ꐒ콵 [ 347.720609][ T5827] usb 8-1: SerialNumber: syz [ 347.726606][ T5827] usb 8-1: rejected 1 configuration due to insufficient available bus power [ 347.734960][ T5827] usb 8-1: no configuration chosen from 1 choice [ 347.918958][ T5749] usb 10-1: new high-speed USB device number 19 using dummy_hcd [ 348.048992][ T5749] usb 10-1: device descriptor read/64, error -71 [ 348.161673][ T5749] usb usb10-port1: attempt power cycle [ 348.389004][ T5730] usb 48-1: device descriptor read/8, error -110 [ 348.510443][ T5749] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 348.540204][ T5749] usb 10-1: device descriptor read/8, error -71 [ 348.779531][ T5749] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 348.799464][ T5730] usb usb48-port1: attempt power cycle [ 348.812352][ T5749] usb 10-1: device descriptor read/8, error -71 [ 348.919124][ T5749] usb usb10-port1: unable to enumerate USB device [ 349.231939][T19410] netlink: 'syz.2.2079': attribute type 4 has an invalid length. [ 349.360926][ T5730] usb usb48-port1: unable to enumerate USB device [ 349.573071][T19428] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2083'. [ 349.576657][T19428] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2083'. [ 349.579952][T19428] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2083'. [ 350.004762][ T5827] usb 8-1: USB disconnect, device number 8 [ 350.313340][T19457] ip_vti0: entered promiscuous mode [ 350.545475][T19466] syzkaller0: entered promiscuous mode [ 350.547575][T19466] syzkaller0: entered allmulticast mode [ 350.584152][T19470] FAULT_INJECTION: forcing a failure. [ 350.584152][T19470] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 350.588510][T19470] CPU: 2 UID: 0 PID: 19470 Comm: syz.2.2092 Tainted: G S L syzkaller #0 PREEMPT(full) [ 350.588530][T19470] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 350.588536][T19470] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 350.588544][T19470] Call Trace: [ 350.588561][T19470] [ 350.588567][T19470] dump_stack_lvl+0x100/0x190 [ 350.588657][T19470] should_fail_ex.cold+0x5/0xa [ 350.588678][T19470] _copy_from_iter+0x1f4/0x1690 [ 350.588728][T19470] ? _copy_from_iter+0x270/0x1690 [ 350.588759][T19470] ? __pfx__copy_from_iter+0x10/0x10 [ 350.588778][T19470] ? __pfx__copy_from_iter+0x10/0x10 [ 350.588795][T19470] ? _copy_from_iter+0x270/0x1690 [ 350.588815][T19470] copy_page_from_iter+0x238/0x300 [ 350.588835][T19470] skb_copy_datagram_from_iter+0x399/0x720 [ 350.588926][T19470] packet_sendmsg+0x227e/0x5100 [ 350.588956][T19470] ? aa_sk_perm+0x309/0xaa0 [ 350.588986][T19470] ? __pfx_aa_sk_perm+0x10/0x10 [ 350.589001][T19470] ? __pfx_packet_sendmsg+0x10/0x10 [ 350.589015][T19470] ? __might_fault+0xc5/0x140 [ 350.589047][T19470] ? apparmor_socket_sendmsg+0x15b/0x270 [ 350.589063][T19470] __sys_sendto+0x48b/0x4e0 [ 350.589077][T19470] ? __pfx_packet_sendmsg+0x10/0x10 [ 350.589091][T19470] ? __pfx___sys_sendto+0x10/0x10 [ 350.589115][T19470] ? fput+0x79/0x100 [ 350.589131][T19470] ? ksys_write+0x1ac/0x250 [ 350.589143][T19470] __ia32_sys_sendto+0xdd/0x1b0 [ 350.589157][T19470] ? __do_fast_syscall_32+0x98/0x970 [ 350.589187][T19470] ? lockdep_hardirqs_on+0x78/0x100 [ 350.589201][T19470] __do_fast_syscall_32+0xe7/0x970 [ 350.589216][T19470] ? lockdep_hardirqs_on+0x78/0x100 [ 350.589231][T19470] do_fast_syscall_32+0x32/0x70 [ 350.589247][T19470] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 350.589263][T19470] RIP: 0023:0xf6ffefec [ 350.589279][T19470] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 350.589291][T19470] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 350.589302][T19470] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 350.589310][T19470] RDX: 000000000000fce0 RSI: 0000000000000004 RDI: 0000000080000140 [ 350.589317][T19470] RBP: 0000000000000014 R08: 0000000000000000 R09: 0000000000000000 [ 350.589323][T19470] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 350.589330][T19470] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 350.589344][T19470] [ 350.589532][T19466] bridge0: entered allmulticast mode [ 350.948382][T19485] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2096'. [ 350.952357][T19485] netlink: 'syz.2.2096': attribute type 5 has an invalid length. [ 350.955381][T19485] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2096'. [ 350.967584][T19485] geneve2: entered promiscuous mode [ 350.970271][T19485] geneve2: entered allmulticast mode [ 350.979364][ T5820] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 350.983044][ T5820] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 350.986525][ T5820] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 350.991182][ T5820] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 351.089074][ T5827] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 351.249854][ T5827] usb 8-1: Using ep0 maxpacket: 8 [ 351.255608][ T5827] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 351.258485][ T5827] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 351.264519][ T5827] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 351.268679][ T5827] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 351.275942][ T5827] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 351.279992][ T5827] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 351.284198][ T5827] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 351.290025][ T5827] usb 8-1: config 168 interface 0 has no altsetting 0 [ 351.293639][ T5827] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 351.296585][ T5827] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 351.302821][ T5827] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 351.307573][ T5827] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 351.312488][ T5827] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 351.316371][ T5827] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 351.324855][ T5827] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 351.330671][ T5827] usb 8-1: config 168 interface 0 has no altsetting 0 [ 351.335676][ T5827] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 351.340036][ T5827] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 351.345642][ T5827] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 351.352789][ T5827] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 351.357853][ T5827] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 351.363318][ T5827] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 351.368141][ T5827] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 351.374101][ T5827] usb 8-1: config 168 interface 0 has no altsetting 0 [ 351.380599][ T5827] usb 8-1: string descriptor 0 read error: -22 [ 351.383562][ T5827] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 351.387508][ T5827] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 351.406687][T19501] i2c i2c-1: Frontend requested software zigzag, but didn't set the frequency step size [ 351.406708][ T5827] adutux 8-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 351.676752][T19446] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 351.702478][T19446] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 351.705884][T19446] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 351.709274][T19446] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 351.713135][T19446] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 351.735541][T19446] pci 0000:00:01.0: Adding to iommu group 1 [ 351.746451][T19446] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 351.749198][T19446] pci 0000:00:01.0: vgaarb: bridge control possible [ 351.751981][T19446] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 351.762437][T19446] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 351.766181][T19446] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 351.769516][T19446] pci 0000:00:04.0: PCI bridge to [bus 01] [ 351.772091][T19446] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 351.777222][T19446] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 351.782315][T19446] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 351.782537][ T5827] usb 8-1: USB disconnect, device number 9 [ 351.790430][T19446] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 351.808970][T19446] [drm] Found bochs VGA, ID 0xb0c5. [ 351.811256][T19446] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 351.817435][T19515] adutux: No device or device unplugged -19 [ 351.825359][T19516] adutux: No device or device unplugged -19 [ 351.830350][T19446] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 351.890049][T19446] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 352.394445][T19561] batadv_slave_1: entered promiscuous mode [ 352.396552][T19561] batadv_slave_1: entered allmulticast mode [ 352.404642][T19561] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2106'. [ 353.435375][T19584] FAULT_INJECTION: forcing a failure. [ 353.435375][T19584] name failslab, interval 1, probability 0, space 9, times 0 [ 353.441771][T19584] CPU: 0 UID: 0 PID: 19584 Comm: syz.3.2112 Tainted: G S L syzkaller #0 PREEMPT(full) [ 353.441803][T19584] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 353.441811][T19584] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 353.441822][T19584] Call Trace: [ 353.441840][T19584] [ 353.441848][T19584] dump_stack_lvl+0x100/0x190 [ 353.442025][T19584] should_fail_ex.cold+0x5/0xa [ 353.442065][T19584] should_failslab+0xc2/0x120 [ 353.442126][T19584] __kmalloc_noprof+0xfc/0x820 [ 353.442148][T19584] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 353.442166][T19584] ? sctp_auth_create_key+0x35/0xd0 [ 353.442244][T19584] sctp_auth_create_key+0x35/0xd0 [ 353.442268][T19584] sctp_auth_set_key+0x2b0/0xb50 [ 353.442298][T19584] sctp_setsockopt+0x96dd/0xb370 [ 353.442317][T19584] ? __pfx_aa_sk_perm+0x10/0x10 [ 353.442401][T19584] ? __pfx_sctp_setsockopt+0x10/0x10 [ 353.442424][T19584] ? aa_sock_opt_perm+0xfe/0x1b0 [ 353.442443][T19584] ? sock_common_setsockopt+0x2e/0xf0 [ 353.442486][T19584] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 353.442515][T19584] do_sock_setsockopt+0xf3/0x1d0 [ 353.442544][T19584] __sys_setsockopt+0x119/0x190 [ 353.442572][T19584] __ia32_sys_setsockopt+0xbc/0x160 [ 353.442594][T19584] ? __do_fast_syscall_32+0x98/0x970 [ 353.442627][T19584] ? lockdep_hardirqs_on+0x78/0x100 [ 353.442648][T19584] __do_fast_syscall_32+0xe7/0x970 [ 353.442671][T19584] ? lockdep_hardirqs_on+0x78/0x100 [ 353.442693][T19584] do_fast_syscall_32+0x32/0x70 [ 353.442717][T19584] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 353.442742][T19584] RIP: 0023:0xf7fd2fec [ 353.442766][T19584] Code: Unable to access opcode bytes at 0xf7fd2fc2. [ 353.442784][T19584] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 353.442802][T19584] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000084 [ 353.442813][T19584] RDX: 0000000000000017 RSI: 0000000080000300 RDI: 0000000000000009 [ 353.442823][T19584] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 353.442832][T19584] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 353.442860][T19584] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 353.442884][T19584] [ 353.970698][T19601] could not allocate digest TFM handle rmd256-generic [ 354.031670][T19603] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2116'. [ 354.040702][T19603] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2116'. [ 354.062902][T19603] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2116'. [ 354.501317][ T43] audit: type=1800 audit(2000000001.120:4744): pid=19627 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2122" name="file" dev="configfs" ino=48141 res=0 errno=0 [ 355.682620][T19648] FAULT_INJECTION: forcing a failure. [ 355.682620][T19648] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 355.686867][T19648] CPU: 2 UID: 0 PID: 19648 Comm: syz.1.2129 Tainted: G S L syzkaller #0 PREEMPT(full) [ 355.686887][T19648] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 355.686892][T19648] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 355.686899][T19648] Call Trace: [ 355.686904][T19648] [ 355.686910][T19648] dump_stack_lvl+0x100/0x190 [ 355.686929][T19648] should_fail_ex.cold+0x5/0xa [ 355.686943][T19648] _copy_from_user+0x2e/0xd0 [ 355.686980][T19648] get_compat_msghdr+0xb3/0x480 [ 355.687000][T19648] ? __pfx_get_compat_msghdr+0x10/0x10 [ 355.687023][T19648] ___sys_sendmsg+0x1b6/0x1e0 [ 355.687036][T19648] ? __pfx____sys_sendmsg+0x10/0x10 [ 355.687054][T19648] ? find_held_lock+0x2b/0x80 [ 355.687096][T19648] __sys_sendmsg+0x160/0x210 [ 355.687112][T19648] ? __pfx___sys_sendmsg+0x10/0x10 [ 355.687131][T19648] ? __pfx_ksys_write+0x10/0x10 [ 355.687147][T19648] __do_fast_syscall_32+0xe7/0x970 [ 355.687162][T19648] ? lockdep_hardirqs_on+0x78/0x100 [ 355.687178][T19648] do_fast_syscall_32+0x32/0x70 [ 355.687193][T19648] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 355.687208][T19648] RIP: 0023:0xf7f14fec [ 355.687223][T19648] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 355.687229][T19648] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 355.687241][T19648] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 355.687248][T19648] RDX: 0000000000044000 RSI: 0000000000000000 RDI: 0000000000000000 [ 355.687256][T19648] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 355.687262][T19648] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 355.687269][T19648] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 355.687283][T19648] [ 355.840492][T19652] veth0: entered promiscuous mode [ 355.895861][T19649] veth0: left promiscuous mode [ 356.052449][T19670] overlayfs: missing 'lowerdir' [ 356.304709][T19673] x_tables: ip_tables: TCPMSS target: only valid for protocol 6 [ 356.425450][T19679] binder: 19678:19679 ioctl c00c6211 0 returned -14 [ 356.738280][T19690] FAULT_INJECTION: forcing a failure. [ 356.738280][T19690] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 356.765849][T19690] CPU: 3 UID: 0 PID: 19690 Comm: syz.1.2140 Tainted: G S L syzkaller #0 PREEMPT(full) [ 356.765885][T19690] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 356.765890][T19690] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 356.765898][T19690] Call Trace: [ 356.765904][T19690] [ 356.765911][T19690] dump_stack_lvl+0x100/0x190 [ 356.765936][T19690] should_fail_ex.cold+0x5/0xa [ 356.765948][T19690] ? prepare_alloc_pages+0x16d/0x5f0 [ 356.765967][T19690] should_fail_alloc_page+0xeb/0x140 [ 356.765985][T19690] prepare_alloc_pages+0x1f0/0x5f0 [ 356.766005][T19690] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 356.766021][T19690] ? rcu_is_watching+0x12/0xc0 [ 356.766036][T19690] ? trace_mm_page_alloc+0x164/0x1c0 [ 356.766053][T19690] ? __alloc_frozen_pages_noprof+0x2d1/0x2dc0 [ 356.766066][T19690] ? do_raw_spin_unlock+0x145/0x1e0 [ 356.766080][T19690] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 356.766094][T19690] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 356.766109][T19690] ? trace_hrtimer_start+0x77/0x220 [ 356.766125][T19690] ? hrtimer_start_range_ns_common+0x78e/0x18b0 [ 356.766141][T19690] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 356.766158][T19690] ? mark_held_locks+0x40/0x70 [ 356.766176][T19690] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 356.766189][T19690] ? lockdep_hardirqs_on+0x78/0x100 [ 356.766203][T19690] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 356.766219][T19690] alloc_pages_bulk_noprof+0x5de/0x13c0 [ 356.766235][T19690] ? policy_nodemask+0xed/0x4f0 [ 356.766252][T19690] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 356.766274][T19690] __kasan_populate_vmalloc+0xf0/0x210 [ 356.766291][T19690] alloc_vmap_area+0x95d/0x2bb0 [ 356.766311][T19690] ? kasan_save_track+0x14/0x30 [ 356.766325][T19690] ? __kasan_kmalloc+0xaa/0xb0 [ 356.766339][T19690] ? __pfx_alloc_vmap_area+0x10/0x10 [ 356.766355][T19690] ? __get_vm_area_node+0x101/0x330 [ 356.766373][T19690] __get_vm_area_node+0x1ca/0x330 [ 356.766391][T19690] __vmalloc_node_range_noprof+0x228/0x1630 [ 356.766410][T19690] ? vhost_task_create+0x1db/0x370 [ 356.766427][T19690] ? find_held_lock+0x2b/0x80 [ 356.766445][T19690] ? vhost_task_create+0x1db/0x370 [ 356.766465][T19690] ? __memcg_slab_post_alloc_hook+0x749/0x1160 [ 356.766484][T19690] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 356.766505][T19690] ? trace_kmem_cache_alloc+0xdd/0x100 [ 356.766523][T19690] ? vhost_task_create+0x1db/0x370 [ 356.766539][T19690] __vmalloc_node_noprof+0xad/0xf0 [ 356.766556][T19690] ? vhost_task_create+0x1db/0x370 [ 356.766583][T19690] copy_process+0x7fb/0x8030 [ 356.766606][T19690] ? __pfx_copy_process+0x10/0x10 [ 356.766620][T19690] ? __kasan_kmalloc+0xaa/0xb0 [ 356.766635][T19690] ? lockdep_init_map_type+0x5c/0x250 [ 356.766646][T19690] ? lockdep_init_map_type+0x5c/0x250 [ 356.766657][T19690] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 356.766685][T19690] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 356.766705][T19690] vhost_task_create+0x1db/0x370 [ 356.766722][T19690] ? __pfx_vhost_task_create+0x10/0x10 [ 356.766742][T19690] ? __pfx_vhost_task_fn+0x10/0x10 [ 356.766760][T19690] ? __pfx___mutex_lock+0x10/0x10 [ 356.766779][T19690] kvm_mmu_post_init_vm+0x1b3/0x360 [ 356.766796][T19690] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 356.766812][T19690] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 356.766827][T19690] kvm_vcpu_ioctl+0x730/0x1700 [ 356.766840][T19690] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 356.766852][T19690] ? tomoyo_path_number_perm+0x188/0x580 [ 356.766881][T19690] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 356.766895][T19690] ? find_held_lock+0x2b/0x80 [ 356.766909][T19690] ? finish_task_switch.isra.0+0x2c0/0x10c0 [ 356.766927][T19690] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 356.766960][T19690] ? do_vfs_ioctl+0x226/0x13e0 [ 356.766978][T19690] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 356.767000][T19690] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 356.767012][T19690] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 356.767024][T19690] ? __fget_files+0x21f/0x3d0 [ 356.767038][T19690] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 356.767050][T19690] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 356.767068][T19690] __do_fast_syscall_32+0xe7/0x970 [ 356.767083][T19690] ? lockdep_hardirqs_on+0x78/0x100 [ 356.767101][T19690] do_fast_syscall_32+0x32/0x70 [ 356.767117][T19690] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 356.767132][T19690] RIP: 0023:0xf7f14fec [ 356.767149][T19690] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 356.767154][T19690] RSP: 002b:00000000f53b550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 356.767166][T19690] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000ae80 [ 356.767173][T19690] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 356.767179][T19690] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 356.767186][T19690] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 356.767193][T19690] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 356.767207][T19690] [ 356.767672][T19690] syz.1.2140: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 357.005237][T19690] CPU: 3 UID: 0 PID: 19690 Comm: syz.1.2140 Tainted: G S L syzkaller #0 PREEMPT(full) [ 357.005260][T19690] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 357.005265][T19690] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 357.005272][T19690] Call Trace: [ 357.005278][T19690] [ 357.005283][T19690] dump_stack_lvl+0x100/0x190 [ 357.005302][T19690] warn_alloc.cold+0x94/0xa8 [ 357.005316][T19690] ? __pfx_warn_alloc+0x10/0x10 [ 357.005329][T19690] ? lockdep_hardirqs_on+0x78/0x100 [ 357.005344][T19690] ? __get_vm_area_node+0x2cd/0x330 [ 357.005364][T19690] ? __get_vm_area_node+0x208/0x330 [ 357.005383][T19690] __vmalloc_node_range_noprof+0xccd/0x1630 [ 357.005402][T19690] ? find_held_lock+0x2b/0x80 [ 357.005421][T19690] ? vhost_task_create+0x1db/0x370 [ 357.005441][T19690] ? __memcg_slab_post_alloc_hook+0x749/0x1160 [ 357.005460][T19690] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 357.005481][T19690] ? trace_kmem_cache_alloc+0xdd/0x100 [ 357.005499][T19690] ? vhost_task_create+0x1db/0x370 [ 357.005515][T19690] __vmalloc_node_noprof+0xad/0xf0 [ 357.005548][T19690] ? vhost_task_create+0x1db/0x370 [ 357.005566][T19690] copy_process+0x7fb/0x8030 [ 357.005588][T19690] ? __pfx_copy_process+0x10/0x10 [ 357.005602][T19690] ? __kasan_kmalloc+0xaa/0xb0 [ 357.005617][T19690] ? lockdep_init_map_type+0x5c/0x250 [ 357.005629][T19690] ? lockdep_init_map_type+0x5c/0x250 [ 357.005641][T19690] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 357.005662][T19690] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 357.005681][T19690] vhost_task_create+0x1db/0x370 [ 357.005698][T19690] ? __pfx_vhost_task_create+0x10/0x10 [ 357.005719][T19690] ? __pfx_vhost_task_fn+0x10/0x10 [ 357.005736][T19690] ? __pfx___mutex_lock+0x10/0x10 [ 357.005756][T19690] kvm_mmu_post_init_vm+0x1b3/0x360 [ 357.005772][T19690] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 357.005788][T19690] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 357.005802][T19690] kvm_vcpu_ioctl+0x730/0x1700 [ 357.005815][T19690] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 357.005827][T19690] ? tomoyo_path_number_perm+0x188/0x580 [ 357.005844][T19690] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 357.005858][T19690] ? find_held_lock+0x2b/0x80 [ 357.005872][T19690] ? finish_task_switch.isra.0+0x2c0/0x10c0 [ 357.005888][T19690] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 357.005907][T19690] ? do_vfs_ioctl+0x226/0x13e0 [ 357.005928][T19690] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 357.005951][T19690] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 357.005963][T19690] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 357.005975][T19690] ? __fget_files+0x21f/0x3d0 [ 357.005988][T19690] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 357.006000][T19690] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 357.006019][T19690] __do_fast_syscall_32+0xe7/0x970 [ 357.006034][T19690] ? lockdep_hardirqs_on+0x78/0x100 [ 357.006049][T19690] do_fast_syscall_32+0x32/0x70 [ 357.006065][T19690] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 357.006081][T19690] RIP: 0023:0xf7f14fec [ 357.006096][T19690] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 357.006101][T19690] RSP: 002b:00000000f53b550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 357.006112][T19690] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000ae80 [ 357.006120][T19690] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 357.006126][T19690] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 357.006133][T19690] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 357.006140][T19690] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 357.006154][T19690] [ 357.007650][T19690] Mem-Info: [ 357.145455][T19690] active_anon:5539 inactive_anon:127 isolated_anon:10 [ 357.145455][T19690] active_file:5946 inactive_file:17163 isolated_file:204 [ 357.145455][T19690] unevictable:1769 dirty:393 writeback:0 [ 357.145455][T19690] slab_reclaimable:6886 slab_unreclaimable:93470 [ 357.145455][T19690] mapped:30506 shmem:4631 pagetables:1273 [ 357.145455][T19690] sec_pagetables:306 bounce:0 [ 357.145455][T19690] kernel_misc_reclaimable:0 [ 357.145455][T19690] free:29968 free_pcp:5642 free_cma:0 [ 357.164160][T19690] Node 0 active_anon:44kB inactive_anon:64kB active_file:4kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8384kB pagetables:1052kB sec_pagetables:1124kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 357.177404][T19690] Node 1 active_anon:22180kB inactive_anon:444kB active_file:23780kB inactive_file:69332kB unevictable:5540kB isolated(anon):40kB isolated(file):68kB mapped:121928kB dirty:1572kB writeback:0kB shmem:16988kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8028kB pagetables:4040kB sec_pagetables:100kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 357.190301][T19690] Node 0 DMA free:1680kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:8kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:720kB local_pcp:0kB free_cma:0kB [ 357.209188][T19690] lowmem_reserve[]: 0 280 280 280 280 [ 357.211821][T19690] Node 0 DMA32 free:14232kB boost:4096kB min:16868kB low:20060kB high:23252kB reserved_highatomic:0KB free_highatomic:0KB active_anon:44kB inactive_anon:64kB active_file:0kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:964kB present:1032196kB managed:286900kB mlocked:0kB bounce:0kB free_pcp:10860kB local_pcp:1524kB free_cma:0kB [ 357.234497][T19690] lowmem_reserve[]: 0 0 0 0 0 [ 357.264767][T19690] Node 1 DMA32 free:98924kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22180kB inactive_anon:444kB active_file:23780kB inactive_file:69468kB unevictable:5472kB writepending:1572kB zspages:3620kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:18236kB local_pcp:8104kB free_cma:0kB [ 357.275828][T19690] lowmem_reserve[]: 0 0 0 0 0 [ 357.277421][T19690] Node 0 DMA: 0*4kB 4*8kB (UM) 3*16kB (M) 2*32kB (M) 4*64kB (UM) 0*128kB 3*256kB (UM) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 1680kB [ 357.283880][T19690] Node 0 DMA32: 606*4kB (UE) 164*8kB (UME) 42*16kB (UE) 105*32kB (UME) 15*64kB (E) 11*128kB (ME) 8*256kB (UME) 2*512kB (M) 1*1024kB (U) 0*2048kB 0*4096kB = 14232kB [ 357.669750][ C2] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 358.268922][T19690] Node 1 DMA32: 257*4kB (UME) 171*8kB (UE) 236*16kB (UME) 276*32kB (UME) 300*64kB (UME) 139*128kB (UME) 61*256kB (UME) 29*512kB (UM) 12*1024kB (U) 0*2048kB 0*4096kB = 94748kB [ 358.274939][T19690] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 358.277965][T19690] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 358.305170][T19690] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 358.308227][T19690] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 358.312840][T19690] 25397 total pagecache pages [ 358.314480][T19690] 276 pages in swap cache [ 358.315981][T19690] Free swap = 108256kB [ 358.317392][T19690] Total swap = 124996kB [ 358.319205][T19690] 524155 pages RAM [ 358.320412][T19690] 0 pages HighMem/MovableOnly [ 358.361502][T19690] 211537 pages reserved [ 358.363224][T19690] 0 pages cma reserved [ 358.898970][ T5889] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 359.099716][ T5889] usb 6-1: device descriptor read/64, error -71 [ 359.448976][T19766] FAULT_INJECTION: forcing a failure. [ 359.448976][T19766] name failslab, interval 1, probability 0, space 9, times 0 [ 359.455847][T19766] CPU: 0 UID: 0 PID: 19766 Comm: syz.5.2146 Tainted: G S L syzkaller #0 PREEMPT(full) [ 359.455868][T19766] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 359.455873][T19766] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 359.455881][T19766] Call Trace: [ 359.455933][T19766] [ 359.455939][T19766] dump_stack_lvl+0x100/0x190 [ 359.456055][T19766] should_fail_ex.cold+0x5/0xa [ 359.456085][T19766] should_failslab+0xc2/0x120 [ 359.456118][T19766] kmem_cache_alloc_noprof+0x91/0x6a0 [ 359.456134][T19766] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 359.456156][T19766] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 359.456173][T19766] mmu_topup_memory_caches+0x25/0x170 [ 359.456190][T19766] kvm_mmu_load+0xe2/0x2570 [ 359.456209][T19766] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 359.456227][T19766] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 359.456246][T19766] ? kvm_deliver_exception_payload+0x129/0x210 [ 359.456260][T19766] ? __pfx_kvm_mmu_load+0x10/0x10 [ 359.456273][T19766] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 359.456286][T19766] ? kvm_check_and_inject_events+0x873/0x12a0 [ 359.456304][T19766] vcpu_run+0x3aaa/0x5de0 [ 359.456318][T19766] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 359.456345][T19766] ? __pfx_vcpu_run+0x10/0x10 [ 359.456365][T19766] ? rcu_is_watching+0x12/0xc0 [ 359.456389][T19766] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 359.456405][T19766] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 359.456424][T19766] kvm_vcpu_ioctl+0x730/0x1700 [ 359.456437][T19766] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 359.456449][T19766] ? tomoyo_path_number_perm+0x188/0x580 [ 359.456526][T19766] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 359.456544][T19766] ? get_pid_task+0x106/0x250 [ 359.456563][T19766] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 359.456583][T19766] ? do_vfs_ioctl+0x226/0x13e0 [ 359.456601][T19766] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 359.456623][T19766] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 359.456636][T19766] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 359.456648][T19766] ? __fget_files+0x21f/0x3d0 [ 359.456662][T19766] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 359.456674][T19766] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 359.456693][T19766] __do_fast_syscall_32+0xe7/0x970 [ 359.456743][T19766] ? lockdep_hardirqs_on+0x78/0x100 [ 359.456759][T19766] do_fast_syscall_32+0x32/0x70 [ 359.456774][T19766] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 359.456791][T19766] RIP: 0023:0xf708efec [ 359.456808][T19766] Code: Unable to access opcode bytes at 0xf708efc2. [ 359.456835][T19766] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 359.456847][T19766] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 359.456854][T19766] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 359.456861][T19766] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 359.456867][T19766] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 359.456874][T19766] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 359.456889][T19766] [ 361.013252][T19808] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2165'. [ 361.229865][T19795] ALSA: mixer_oss: invalid OSS volume '' [ 361.232410][T19795] ALSA: mixer_oss: invalid OSS volume 'ұB;T`@$EcXMYd,' [ 361.235849][T19795] ALSA: mixer_oss: invalid OSS volume 'b@h#' [ 361.238446][T19795] ALSA: mixer_oss: invalid OSS volume 'h4XS4v=0_>&' [ 361.242359][T19795] ALSA: mixer_oss: invalid OSS volume '|/"tj' [ 361.245464][T19795] ALSA: mixer_oss: invalid OSS volume '-z5c^J6$' [ 361.248596][T19795] ALSA: mixer_oss: invalid OSS volume '0Ty󉴪jP&at' [ 361.252565][T19795] ALSA: mixer_oss: invalid OSS volume '|~\' [ 361.255160][T19795] ALSA: mixer_oss: invalid OSS volume '@^3bɜ}G$#\("/oL' [ 361.258279][T19795] ALSA: mixer_oss: invalid OSS volume 'I :' [ 361.261651][T19795] ALSA: mixer_oss: invalid OSS volume '%^vhcGJPr('⍯Q=' [ 361.265101][T19795] ALSA: mixer_oss: invalid OSS volume ' Gj;4Ìz3WҼ0F=%' [ 361.268548][T19795] ALSA: mixer_oss: invalid OSS volume ';4 4fh߇GIבQ5oJ' [ 361.272172][T19795] ALSA: mixer_oss: invalid OSS volume 'Wl]Y1-J<A>o' [ 361.632613][T19826] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2164'. [ 361.929261][T19845] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 361.983939][T19850] netlink: 'syz.5.2173': attribute type 11 has an invalid length. [ 362.323964][T19869] netlink: 'syz.2.2177': attribute type 1 has an invalid length. [ 363.638257][T19834] syz.5.2167 (19834) used greatest stack depth: 18712 bytes left [ 363.706728][T19869] 8021q: adding VLAN 0 to HW filter on device bond6 [ 363.719735][T19835] syz.5.2167 (19835) used greatest stack depth: 18568 bytes left [ 363.851073][T19869] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2177'. [ 363.857189][T19914] bond6: (slave veth9): Enslaving as an active interface with a down link [ 363.888611][T19869] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2177'. [ 363.896291][T19869] 8021q: adding VLAN 0 to HW filter on device bond6 [ 364.308122][T19991] FAULT_INJECTION: forcing a failure. [ 364.308122][T19991] name failslab, interval 1, probability 0, space 9, times 0 [ 364.312532][T19991] CPU: 2 UID: 0 PID: 19991 Comm: syz.5.2182 Tainted: G S L syzkaller #0 PREEMPT(full) [ 364.312552][T19991] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 364.312557][T19991] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 364.312564][T19991] Call Trace: [ 364.312568][T19991] [ 364.312573][T19991] dump_stack_lvl+0x100/0x190 [ 364.312591][T19991] should_fail_ex.cold+0x5/0xa [ 364.312605][T19991] should_failslab+0xc2/0x120 [ 364.312623][T19991] __kmalloc_cache_noprof+0x91/0x6c0 [ 364.312635][T19991] ? do_raw_spin_lock+0x128/0x260 [ 364.312649][T19991] ? alloc_fdtable+0xbd/0x2d0 [ 364.312669][T19991] alloc_fdtable+0xbd/0x2d0 [ 364.312687][T19991] dup_fd+0x995/0xd10 [ 364.312700][T19991] ? apparmor_task_alloc+0x2c1/0x3b0 [ 364.312729][T19991] copy_process+0x2c94/0x8030 [ 364.312752][T19991] ? __pfx_copy_process+0x10/0x10 [ 364.312768][T19991] ? get_pid_task+0xfc/0x250 [ 364.312782][T19991] ? get_pid_task+0xfc/0x250 [ 364.312798][T19991] kernel_clone+0x176/0x9d0 [ 364.312812][T19991] ? proc_fail_nth_write+0x9f/0x220 [ 364.312842][T19991] ? __pfx_kernel_clone+0x10/0x10 [ 364.312858][T19991] ? find_held_lock+0x2b/0x80 [ 364.312877][T19991] ? ksys_write+0x190/0x250 [ 364.312888][T19991] ? ksys_write+0x190/0x250 [ 364.312900][T19991] __do_compat_sys_ia32_clone+0xd4/0x120 [ 364.312915][T19991] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 364.312934][T19991] ? fput+0x79/0x100 [ 364.312947][T19991] ? ksys_write+0x1ac/0x250 [ 364.312957][T19991] ? __pfx_ksys_write+0x10/0x10 [ 364.312970][T19991] __do_fast_syscall_32+0xe7/0x970 [ 364.312986][T19991] ? lockdep_hardirqs_on+0x78/0x100 [ 364.313001][T19991] do_fast_syscall_32+0x32/0x70 [ 364.313016][T19991] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 364.313031][T19991] RIP: 0023:0xf708efec [ 364.313046][T19991] Code: Unable to access opcode bytes at 0xf708efc2. [ 364.313051][T19991] RSP: 002b:00000000f547d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000078 [ 364.313063][T19991] RAX: ffffffffffffffda RBX: 0000000000800000 RCX: 0000000000000000 [ 364.313070][T19991] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 364.313076][T19991] RBP: 00000000f7484f80 R08: 0000000000000000 R09: 0000000000000000 [ 364.313083][T19991] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 364.313090][T19991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 364.313103][T19991] [ 364.327463][T19997] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2184'. [ 364.405266][T20000] [U]  [ 364.406220][T20000] [U] K{ [ 364.407219][T20000] [U] t 1ŠFfˊ`GJgo/mC [ 364.409379][T20000] [U] tؖ/,~Ĝj}8'o1"7-JQKWq5c%"H12YX``+(!(z'tXlnIgjݭp~7!" (5Ob̓J [ 364.414683][T20000] [U] k\&}66XHX .`a$40|϶9ި U4Vbz}wMTQΦr 4 [ 364.418711][T20000] [U] ".h6"k[J4In[Z(C|T]z{3c=x4w)\TXJSH{q;칢t+gd.˂>ywUhfNhl]S2\g%O&z)'pul_< ذ`ұT;_"(u{7j2X /'cIHcճV=Ai%wEs RjgrhIa6-DV i"n Asc~48c*OO5/J~wvK+3Y)Mvyq潀DTrOtpem%fejA5T_-X~^aaۂq [ 364.430526][T20000] [U] +wG?]'a: )' B>tf/<'U'hi.+]e.-ɿ%>2`^U8F.63+A«g3p6:^0tv'EtYCnrϩnPj ;Z8!\Aʖ2$­wi.#/Bai`4jdy@zgW5˿B ٜNy"vI2 [ 364.437626][T20000] [U] T_K5tYJ9c$brLNul 9w|G"ʃ%C؝q 3qN^HP*$ .7yӱ2 [ 364.440900][T20000] [U] ? h*37鍾^#Q"0~ (oX Lb,'v=CSGS0ւ`ه=1(p#2DO*Ƀ [ 364.444478][T20000] [U] sgGud-{|&2Lc_!`oz֥B%>rwSsH"yA4O.Y䏄RTԶB[+/<>{q_՝LX8U{Z)7?rR;crhײڣ1>)Măt(aϝ}9ڥJ*Mќġ'Lq DW=|q ÆW;5Ž!dBx`/E`ƦMX"\ [ 364.480326][T20000] [U] {; ٘_o2)o.2W2yx_ HPϱSD:]{ [ 364.482956][T20000] [U] I,> 51^1N4oǶ'0?֒i9w._.WaV`)Zc6GiӹaXL[F*OW)+'\n[K@2Ǭp"^` [ 364.487042][T20000] [U] 22Ʃx?0;3u [ 364.488352][T20000] [U] ޜsObx8W4(~/KUԖoQe+G-ygY_>v3.hә]̈́2)D, D~d+w; A\FPȘ|$)KؐIɿkYT^R癵A=#ܜ aet1ݯ4K.e"RS|s:>p r"z#P!KY"}FN84hޱosߙ̫%Dlwm [ 364.495839][T20000] [U] [['xn' ,mr/1D=!Dx91BwRlfKZ#` l؛˜b~m [ 364.498666][T20000] [U] L>d+d"5h3<iR=F^fnvDOIO:U>Y [ 364.501311][T20000] [U] 'B6v20瞥׌"t8{9FW]쩍 [ 364.503225][T20000] [U] 72uC6τI]8ctۨQSkYI |V'TV/g$[ 9kh`"}[^=0]%̂TF_v4C [ 364.506938][T20000] [U] ec [ 364.507958][T20000] [U] |<:^3$7nK~-@?/mtl۾Iw@g~t{P+$jp| IRipm Y 8tV,l, [ 364.552714][T19993] [U] K)0~ʪiP'fzr @B]5{ʼ'8ƥFUTqUdǩK;70c[yYCذmL8T͚5rxW xoQhVi'8L [ 364.909105][ T5730] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 365.084166][ T5730] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 365.087819][ T5730] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 365.091003][ T5730] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 365.096077][ T5730] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 365.099624][ T5730] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 365.107079][ T5730] usb 6-1: config 0 descriptor?? [ 365.775479][ T5730] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 366.171527][T20059] pim6reg1: entered promiscuous mode [ 366.173309][T20059] pim6reg1: entered allmulticast mode [ 366.378866][ T6884] usb 6-1: USB disconnect, device number 39 [ 366.520938][T20088] xt_hashlimit: overflow, try lower: 18446744073709551614/64 [ 366.623446][T20090] IPv4: Oversized IP packet from 127.202.26.0 [ 366.630041][ T36] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 367.044117][T20063] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 367.047009][T20063] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 367.053198][T20063] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 367.055983][T20063] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 367.112791][T20098] tipc: Resetting bearer [ 367.179306][T20098] tipc: Disabling bearer [ 367.221416][T20100] FAULT_INJECTION: forcing a failure. [ 367.221416][T20100] name failslab, interval 1, probability 0, space 9, times 0 [ 367.226550][T20100] CPU: 2 UID: 0 PID: 20100 Comm: syz.3.2206 Tainted: G S L syzkaller #0 PREEMPT(full) [ 367.226582][T20100] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 367.226590][T20100] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 367.226601][T20100] Call Trace: [ 367.226610][T20100] [ 367.226619][T20100] dump_stack_lvl+0x100/0x190 [ 367.226647][T20100] should_fail_ex.cold+0x5/0xa [ 367.226669][T20100] should_failslab+0xc2/0x120 [ 367.226697][T20100] __kmalloc_noprof+0xfc/0x820 [ 367.226722][T20100] ? fuse_io_alloc+0x92/0x150 [ 367.226794][T20100] fuse_io_alloc+0x92/0x150 [ 367.226818][T20100] fuse_direct_io+0x310/0x23f0 [ 367.226844][T20100] ? __lock_acquire+0x49f/0x1a40 [ 367.226886][T20100] ? is_bpf_text_address+0x8a/0x1a0 [ 367.226914][T20100] ? __pfx_fuse_direct_io+0x10/0x10 [ 367.226945][T20100] ? __lock_acquire+0x49f/0x1a40 [ 367.226973][T20100] ? is_bpf_text_address+0x94/0x1a0 [ 367.226999][T20100] ? kernel_text_address+0x8d/0x100 [ 367.227028][T20100] fuse_direct_read_iter+0x183/0x1d0 [ 367.227055][T20100] ? __pfx_fuse_direct_read_iter+0x10/0x10 [ 367.227098][T20100] ? __pfx_aa_file_perm+0x10/0x10 [ 367.227135][T20100] fuse_file_read_iter+0x362/0x460 [ 367.227163][T20100] do_iter_readv_writev+0x616/0x930 [ 367.227194][T20100] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 367.227227][T20100] ? rw_verify_area+0xce/0x6d0 [ 367.227255][T20100] vfs_readv+0x4d3/0x8d0 [ 367.227281][T20100] ? rcu_is_watching+0x12/0xc0 [ 367.227304][T20100] ? trace_contention_end+0x126/0x160 [ 367.227326][T20100] ? __pfx_vfs_readv+0x10/0x10 [ 367.227369][T20100] ? __fget_files+0x21f/0x3d0 [ 367.227394][T20100] ? do_readv+0x13e/0x340 [ 367.227419][T20100] do_readv+0x13e/0x340 [ 367.227446][T20100] ? __pfx_do_readv+0x10/0x10 [ 367.227473][T20100] ? ksys_write+0x1ac/0x250 [ 367.227491][T20100] ? __pfx_ksys_write+0x10/0x10 [ 367.227516][T20100] __do_fast_syscall_32+0xe7/0x970 [ 367.227541][T20100] ? lockdep_hardirqs_on+0x78/0x100 [ 367.227566][T20100] do_fast_syscall_32+0x32/0x70 [ 367.227617][T20100] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 367.227640][T20100] RIP: 0023:0xf7fd2fec [ 367.227663][T20100] Code: Unable to access opcode bytes at 0xf7fd2fc2. [ 367.227672][T20100] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000091 [ 367.227691][T20100] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000580 [ 367.227702][T20100] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 367.227712][T20100] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 367.227722][T20100] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 367.227732][T20100] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 367.227756][T20100] [ 367.913766][ C2] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 367.918859][ C0] tipc: RX(1000001): key[1] is activated [ 368.308985][ T5750] Bluetooth: hci0: command 0x0c1a tx timeout [ 368.309271][ T5102] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 368.315202][ T5750] Bluetooth: hci1: command 0x0c1a tx timeout [ 368.383948][T20157] netlink: 'syz.3.2217': attribute type 11 has an invalid length. [ 368.596591][T20172] syzkaller0: entered promiscuous mode [ 368.599815][T20172] syzkaller0: entered allmulticast mode [ 368.606657][T20176] FAULT_INJECTION: forcing a failure. [ 368.606657][T20176] name failslab, interval 1, probability 0, space 9, times 0 [ 368.612090][T20176] CPU: 2 UID: 0 PID: 20176 Comm: syz.2.2221 Tainted: G S L syzkaller #0 PREEMPT(full) [ 368.612110][T20176] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 368.612115][T20176] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 368.612122][T20176] Call Trace: [ 368.612128][T20176] [ 368.612133][T20176] dump_stack_lvl+0x100/0x190 [ 368.612151][T20176] should_fail_ex.cold+0x5/0xa [ 368.612165][T20176] should_failslab+0xc2/0x120 [ 368.612183][T20176] __kmalloc_cache_node_noprof+0x94/0x6c0 [ 368.612199][T20176] ? bpf_ksym_find+0x124/0x1c0 [ 368.612213][T20176] ? __get_vm_area_node+0x101/0x330 [ 368.612245][T20176] __get_vm_area_node+0x101/0x330 [ 368.612266][T20176] __vmalloc_node_range_noprof+0x228/0x1630 [ 368.612285][T20176] ? xt_compat_init_offsets+0xe2/0x1f0 [ 368.612319][T20176] ? lock_acquire+0x1b9/0x370 [ 368.612341][T20176] ? xt_compat_init_offsets+0xe2/0x1f0 [ 368.612356][T20176] ? __mutex_lock+0x26d/0x1bd0 [ 368.612372][T20176] ? kasan_save_stack+0x3f/0x50 [ 368.612387][T20176] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 368.612404][T20176] ? __kvmalloc_node_noprof+0x34f/0x970 [ 368.612419][T20176] ? __pfx___mutex_lock+0x10/0x10 [ 368.612433][T20176] ? smc_setsockopt+0x1b6/0xa40 [ 368.612444][T20176] ? do_sock_setsockopt+0xf3/0x1d0 [ 368.612468][T20176] ? __sys_setsockopt+0x119/0x190 [ 368.612483][T20176] ? __do_fast_syscall_32+0xe7/0x970 [ 368.612498][T20176] ? do_fast_syscall_32+0x32/0x70 [ 368.612513][T20176] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 368.612530][T20176] ? xt_compat_init_offsets+0xe2/0x1f0 [ 368.612543][T20176] __vmalloc_node_noprof+0xad/0xf0 [ 368.612560][T20176] ? xt_compat_init_offsets+0xe2/0x1f0 [ 368.612575][T20176] xt_compat_init_offsets+0xe2/0x1f0 [ 368.612590][T20176] translate_compat_table+0x206/0x1330 [ 368.612602][T20176] ? __lock_acquire+0x49f/0x1a40 [ 368.612624][T20176] ? __pfx_translate_compat_table+0x10/0x10 [ 368.612637][T20176] ? find_held_lock+0x2b/0x80 [ 368.612658][T20176] do_arpt_set_ctl+0x47a/0xf70 [ 368.612671][T20176] ? __pfx_do_arpt_set_ctl+0x10/0x10 [ 368.612682][T20176] ? __mutex_lock+0x26d/0x1bd0 [ 368.612696][T20176] ? nf_sockopt_find.isra.0+0x2a/0x290 [ 368.612712][T20176] ? nf_sockopt_find.isra.0+0x222/0x290 [ 368.612726][T20176] ? nf_sockopt_find.isra.0+0x222/0x290 [ 368.612746][T20176] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 368.612763][T20176] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 368.612782][T20176] ? nf_sockopt_find.isra.0+0x222/0x290 [ 368.612798][T20176] nf_setsockopt+0x8d/0xf0 [ 368.612813][T20176] ip_setsockopt+0xcb/0xf0 [ 368.612831][T20176] tcp_setsockopt+0xa7/0x100 [ 368.612851][T20176] smc_setsockopt+0x1b6/0xa40 [ 368.612861][T20176] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 368.612882][T20176] ? __pfx_smc_setsockopt+0x10/0x10 [ 368.612894][T20176] ? aa_sock_opt_perm+0xfe/0x1b0 [ 368.612908][T20176] ? __pfx_smc_setsockopt+0x10/0x10 [ 368.612938][T20176] do_sock_setsockopt+0xf3/0x1d0 [ 368.612957][T20176] __sys_setsockopt+0x119/0x190 [ 368.612974][T20176] __ia32_sys_setsockopt+0xbc/0x160 [ 368.612989][T20176] ? __do_fast_syscall_32+0x98/0x970 [ 368.613004][T20176] ? lockdep_hardirqs_on+0x78/0x100 [ 368.613018][T20176] __do_fast_syscall_32+0xe7/0x970 [ 368.613033][T20176] ? lockdep_hardirqs_on+0x78/0x100 [ 368.613048][T20176] do_fast_syscall_32+0x32/0x70 [ 368.613063][T20176] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 368.613078][T20176] RIP: 0023:0xf6ffefec [ 368.613093][T20176] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 368.613098][T20176] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 368.613110][T20176] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 368.613118][T20176] RDX: 0000000000000060 RSI: 00000000800004c0 RDI: 0000000000000414 [ 368.613125][T20176] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 368.613132][T20176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 368.613139][T20176] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 368.613153][T20176] [ 368.613242][T20176] syz.2.2221: vmalloc error: size 32, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 368.751786][T20176] CPU: 2 UID: 0 PID: 20176 Comm: syz.2.2221 Tainted: G S L syzkaller #0 PREEMPT(full) [ 368.751807][T20176] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 368.751812][T20176] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 368.751819][T20176] Call Trace: [ 368.751824][T20176] [ 368.751829][T20176] dump_stack_lvl+0x100/0x190 [ 368.751848][T20176] warn_alloc.cold+0x94/0xa8 [ 368.751860][T20176] ? __pfx_warn_alloc+0x10/0x10 [ 368.751873][T20176] ? __kasan_kmalloc+0x8a/0xb0 [ 368.751893][T20176] ? __get_vm_area_node+0x208/0x330 [ 368.751918][T20176] __vmalloc_node_range_noprof+0xccd/0x1630 [ 368.751936][T20176] ? lock_acquire+0x1b9/0x370 [ 368.751958][T20176] ? xt_compat_init_offsets+0xe2/0x1f0 [ 368.751974][T20176] ? __mutex_lock+0x26d/0x1bd0 [ 368.751990][T20176] ? kasan_save_stack+0x3f/0x50 [ 368.752004][T20176] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 368.752022][T20176] ? __kvmalloc_node_noprof+0x34f/0x970 [ 368.752037][T20176] ? __pfx___mutex_lock+0x10/0x10 [ 368.752051][T20176] ? smc_setsockopt+0x1b6/0xa40 [ 368.752063][T20176] ? do_sock_setsockopt+0xf3/0x1d0 [ 368.752080][T20176] ? __sys_setsockopt+0x119/0x190 [ 368.752095][T20176] ? __do_fast_syscall_32+0xe7/0x970 [ 368.752110][T20176] ? do_fast_syscall_32+0x32/0x70 [ 368.752124][T20176] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 368.752141][T20176] ? xt_compat_init_offsets+0xe2/0x1f0 [ 368.752154][T20176] __vmalloc_node_noprof+0xad/0xf0 [ 368.752171][T20176] ? xt_compat_init_offsets+0xe2/0x1f0 [ 368.752186][T20176] xt_compat_init_offsets+0xe2/0x1f0 [ 368.752200][T20176] translate_compat_table+0x206/0x1330 [ 368.752213][T20176] ? __lock_acquire+0x49f/0x1a40 [ 368.752235][T20176] ? __pfx_translate_compat_table+0x10/0x10 [ 368.752247][T20176] ? find_held_lock+0x2b/0x80 [ 368.752269][T20176] do_arpt_set_ctl+0x47a/0xf70 [ 368.752282][T20176] ? __pfx_do_arpt_set_ctl+0x10/0x10 [ 368.752293][T20176] ? __mutex_lock+0x26d/0x1bd0 [ 368.752307][T20176] ? nf_sockopt_find.isra.0+0x2a/0x290 [ 368.752322][T20176] ? nf_sockopt_find.isra.0+0x222/0x290 [ 368.752336][T20176] ? nf_sockopt_find.isra.0+0x222/0x290 [ 368.752356][T20176] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 368.752373][T20176] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 368.752392][T20176] ? nf_sockopt_find.isra.0+0x222/0x290 [ 368.752408][T20176] nf_setsockopt+0x8d/0xf0 [ 368.752425][T20176] ip_setsockopt+0xcb/0xf0 [ 368.752442][T20176] tcp_setsockopt+0xa7/0x100 [ 368.752462][T20176] smc_setsockopt+0x1b6/0xa40 [ 368.752473][T20176] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 368.752492][T20176] ? __pfx_smc_setsockopt+0x10/0x10 [ 368.752505][T20176] ? aa_sock_opt_perm+0xfe/0x1b0 [ 368.752519][T20176] ? __pfx_smc_setsockopt+0x10/0x10 [ 368.752531][T20176] do_sock_setsockopt+0xf3/0x1d0 [ 368.752565][T20176] __sys_setsockopt+0x119/0x190 [ 368.752583][T20176] __ia32_sys_setsockopt+0xbc/0x160 [ 368.752597][T20176] ? __do_fast_syscall_32+0x98/0x970 [ 368.752612][T20176] ? lockdep_hardirqs_on+0x78/0x100 [ 368.752626][T20176] __do_fast_syscall_32+0xe7/0x970 [ 368.752641][T20176] ? lockdep_hardirqs_on+0x78/0x100 [ 368.752656][T20176] do_fast_syscall_32+0x32/0x70 [ 368.752671][T20176] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 368.752686][T20176] RIP: 0023:0xf6ffefec [ 368.752704][T20176] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 368.752712][T20176] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 368.752729][T20176] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 368.752739][T20176] RDX: 0000000000000060 RSI: 00000000800004c0 RDI: 0000000000000414 [ 368.752747][T20176] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 368.752754][T20176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 368.752761][T20176] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 368.752776][T20176] [ 368.752899][T20176] Mem-Info: [ 368.875247][T20176] active_anon:566 inactive_anon:1907 isolated_anon:0 [ 368.875247][T20176] active_file:5878 inactive_file:16715 isolated_file:0 [ 368.875247][T20176] unevictable:1768 dirty:210 writeback:0 [ 368.875247][T20176] slab_reclaimable:6931 slab_unreclaimable:92772 [ 368.875247][T20176] mapped:25215 shmem:1825 pagetables:1274 [ 368.875247][T20176] sec_pagetables:306 bounce:0 [ 368.875247][T20176] kernel_misc_reclaimable:0 [ 368.875247][T20176] free:35629 free_pcp:4819 free_cma:0 [ 368.889546][T20176] Node 0 active_anon:84kB inactive_anon:144kB active_file:48kB inactive_file:556kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:44kB dirty:8kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8352kB pagetables:1064kB sec_pagetables:1124kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 368.900676][T20176] Node 1 active_anon:2044kB inactive_anon:7484kB active_file:23464kB inactive_file:66304kB unevictable:5536kB isolated(anon):0kB isolated(file):0kB mapped:100764kB dirty:832kB writeback:0kB shmem:5764kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8028kB pagetables:4032kB sec_pagetables:100kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 368.912751][T20176] Node 0 DMA free:2012kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:40kB inactive_file:160kB unevictable:0kB writepending:0kB zspages:8kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:372kB local_pcp:36kB free_cma:0kB [ 368.923055][T20176] lowmem_reserve[]: 0 280 280 280 280 [ 368.924898][T20176] Node 0 DMA32 free:21680kB boost:6144kB min:18916kB low:22108kB high:25300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:84kB inactive_anon:144kB active_file:8kB inactive_file:396kB unevictable:1536kB writepending:8kB zspages:1448kB present:1032196kB managed:286900kB mlocked:0kB bounce:0kB free_pcp:2276kB local_pcp:908kB free_cma:0kB [ 368.935862][T20176] lowmem_reserve[]: 0 0 0 0 0 [ 368.937458][T20176] Node 1 DMA32 free:118824kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1840kB inactive_anon:7484kB active_file:23464kB inactive_file:66304kB unevictable:5536kB writepending:832kB zspages:3820kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:17028kB local_pcp:2324kB free_cma:0kB [ 368.948086][T20176] lowmem_reserve[]: 0 0 0 0 0 [ 368.949975][T20176] Node 0 DMA: 39*4kB (U) 2*8kB (UM) 3*16kB (UM) 8*32kB (UM) 8*64kB (UM) 0*128kB 2*256kB (UM) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 2012kB [ 368.957012][T20176] Node 0 DMA32: 440*4kB (UE) 162*8kB (UME) 40*16kB (UME) 126*32kB (UME) 70*64kB (UME) 26*128kB (UME) 10*256kB (UME) 5*512kB (UM) 1*1024kB (M) 0*2048kB 0*4096kB = 21680kB [ 368.962641][T20176] Node 1 DMA32: 912*4kB (UE) 459*8kB (UME) 226*16kB (UME) 406*32kB (UME) 326*64kB (UME) 170*128kB (UME) 62*256kB (UME) 31*512kB (UM) 14*1024kB (UM) 1*2048kB (U) 1*4096kB (U) = 118776kB [ 368.968395][T20176] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 368.972134][T20176] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 368.975095][T20176] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 368.978089][T20176] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 368.981544][T20176] 24955 total pagecache pages [ 368.983062][T20176] 536 pages in swap cache [ 368.984498][T20176] Free swap = 105432kB [ 368.985781][T20176] Total swap = 124996kB [ 368.987079][T20176] 524155 pages RAM [ 368.988285][T20176] 0 pages HighMem/MovableOnly [ 368.990322][T20176] 211537 pages reserved [ 368.991732][T20176] 0 pages cma reserved [ 369.034447][T20182] FAULT_INJECTION: forcing a failure. [ 369.034447][T20182] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 369.038340][T20182] CPU: 2 UID: 0 PID: 20182 Comm: syz.2.2224 Tainted: G S L syzkaller #0 PREEMPT(full) [ 369.038364][T20182] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 369.038369][T20182] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 369.038377][T20182] Call Trace: [ 369.038382][T20182] [ 369.038387][T20182] dump_stack_lvl+0x100/0x190 [ 369.038405][T20182] should_fail_ex.cold+0x5/0xa [ 369.038419][T20182] _copy_to_user+0x32/0xd0 [ 369.038457][T20182] put_v4l2_format32+0x117/0x490 [ 369.038479][T20182] ? __pfx_put_v4l2_format32+0x10/0x10 [ 369.038493][T20182] ? rcu_is_watching+0x12/0xc0 [ 369.038507][T20182] ? trace_contention_end+0x126/0x160 [ 369.038520][T20182] ? __mutex_lock+0x26d/0x1bd0 [ 369.038535][T20182] ? __video_do_ioctl+0x50f/0xdf0 [ 369.038551][T20182] ? find_held_lock+0x2b/0x80 [ 369.038565][T20182] ? __video_do_ioctl+0x9d7/0xdf0 [ 369.038581][T20182] v4l2_compat_put_user+0x74e/0x1830 [ 369.038597][T20182] ? __mutex_unlock_slowpath+0x35d/0x930 [ 369.038613][T20182] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 369.038629][T20182] ? __pfx_v4l2_compat_put_user+0x10/0x10 [ 369.038644][T20182] ? vidioc_g_fmt_sliced_vbi_out+0x15c/0x1c0 [ 369.038672][T20182] ? __video_do_ioctl+0x975/0xdf0 [ 369.038689][T20182] ? trace_kmalloc+0xeb/0x110 [ 369.038705][T20182] ? __pfx___video_do_ioctl+0x10/0x10 [ 369.038722][T20182] ? get_pid_task+0x106/0x250 [ 369.038750][T20182] ? video_usercopy+0x145/0x14c0 [ 369.038768][T20182] video_usercopy+0x5ca/0x14c0 [ 369.038785][T20182] ? __pfx___video_do_ioctl+0x10/0x10 [ 369.038802][T20182] ? __pfx_video_usercopy+0x10/0x10 [ 369.038822][T20182] ? __fget_files+0x215/0x3d0 [ 369.038833][T20182] ? hook_file_ioctl_common+0x140/0x440 [ 369.038860][T20182] v4l2_ioctl+0x1bd/0x250 [ 369.038878][T20182] v4l2_compat_ioctl32+0x20f/0x2d0 [ 369.038892][T20182] ? __pfx_v4l2_compat_ioctl32+0x10/0x10 [ 369.038910][T20182] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 369.038929][T20182] __do_fast_syscall_32+0xe7/0x970 [ 369.038944][T20182] ? lockdep_hardirqs_on+0x78/0x100 [ 369.038960][T20182] do_fast_syscall_32+0x32/0x70 [ 369.038975][T20182] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 369.038990][T20182] RIP: 0023:0xf6ffefec [ 369.039004][T20182] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 369.039010][T20182] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 369.039021][T20182] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0cc5604 [ 369.039028][T20182] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 369.039036][T20182] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 369.039042][T20182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 369.039049][T20182] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 369.039063][T20182] [ 369.127448][T20154] Bluetooth: hci4: command 0x0405 tx timeout [ 369.131295][T20154] Bluetooth: hci3: command 0xfc11 tx timeout [ 369.131798][ T65] Bluetooth: hci2: command 0x0406 tx timeout [ 369.136589][ T5757] Bluetooth: hci3: Entering manufacturer mode failed (-110) [ 369.258022][T20195] lo speed is unknown, defaulting to 1000 [ 369.262728][T20195] wg2 speed is unknown, defaulting to 1000 [ 369.528961][ T24] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 369.678931][ T24] usb 7-1: Using ep0 maxpacket: 8 [ 369.682320][ T24] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 369.685052][ T24] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 369.690235][ T24] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 369.693485][ T24] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 369.696655][ T24] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 369.701975][ T24] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 369.705701][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.936369][T20228] netlink: 'syz.5.2227': attribute type 11 has an invalid length. [ 370.165463][ T24] usb 7-1: GET_CAPABILITIES returned 0 [ 370.167796][ T24] usbtmc 7-1:16.0: can't read capabilities [ 370.231249][T20257] bond1: entered allmulticast mode [ 370.378704][ T5917] usb 7-1: USB disconnect, device number 33 [ 370.602199][T20242] netlink: 'syz.1.2229': attribute type 4 has an invalid length. [ 370.609429][T20242] netlink: 'syz.1.2229': attribute type 4 has an invalid length. [ 371.066907][T20328] netlink: 'syz.5.2241': attribute type 11 has an invalid length. [ 371.199111][ T5750] Bluetooth: hci4: command 0x0405 tx timeout [ 371.310613][ T43] audit: type=1326 audit(2000000017.920:4745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20342 comm="syz.5.2244" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf708efec code=0x0 [ 371.407515][T20349] fuse: Bad value for 'group_id' [ 371.409573][T20349] fuse: Bad value for 'group_id' [ 372.030213][T20356] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 372.038278][T20356] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 372.041874][T20356] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 372.044475][T20356] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 372.192922][T20367] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2247'. [ 372.262974][T20356] pci 0000:00:01.0: Adding to iommu group 1 [ 372.309538][T20356] pci 0000:00:01.0: vgaarb: bridge control possible [ 372.311626][T20356] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=none,locks=none [ 372.336990][T20356] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 372.341616][T20356] pci 0000:00:01.0: ROM [mem 0x81000000-0x8100ffff pref]: assigned [ 372.344461][T20356] pci 0000:00:01.0: BAR 2 [mem 0x81010000-0x81010fff]: assigned [ 372.347647][T20356] pci 0000:00:04.0: PCI bridge to [bus 01] [ 372.349889][T20356] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 372.353870][T20356] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 372.357632][T20356] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 372.380759][T20356] bochs-drm 0000:00:01.0: enabling device (0100 -> 0102) [ 372.452525][T20356] [drm] Found bochs VGA, ID 0xb0c5. [ 372.454428][T20356] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81010000. [ 372.713758][T20356] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 372.962355][T20356] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 373.091182][T20337] netlink: 'syz.1.2243': attribute type 4 has an invalid length. [ 373.125181][T20352] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 373.187216][T20380] devpts: Bad value for 'max' [ 373.285449][T20387] netlink: 'syz.5.2252': attribute type 11 has an invalid length. [ 373.316714][T20390] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 373.639312][T20405] FAULT_INJECTION: forcing a failure. [ 373.639312][T20405] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 373.648687][T20405] CPU: 2 UID: 0 PID: 20405 Comm: syz.2.2255 Tainted: G S L syzkaller #0 PREEMPT(full) [ 373.648721][T20405] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 373.648744][T20405] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 373.648755][T20405] Call Trace: [ 373.648764][T20405] [ 373.648773][T20405] dump_stack_lvl+0x100/0x190 [ 373.648802][T20405] should_fail_ex.cold+0x5/0xa [ 373.648820][T20405] ? prepare_alloc_pages+0x16d/0x5f0 [ 373.648868][T20405] should_fail_alloc_page+0xeb/0x140 [ 373.648897][T20405] prepare_alloc_pages+0x1f0/0x5f0 [ 373.648944][T20405] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 373.648976][T20405] ? __lock_acquire+0x49f/0x1a40 [ 373.649006][T20405] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 373.649029][T20405] ? __css_rstat_updated+0x1ce/0x5a0 [ 373.649064][T20405] ? do_raw_spin_lock+0x128/0x260 [ 373.649085][T20405] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 373.649104][T20405] ? find_held_lock+0x2b/0x80 [ 373.649132][T20405] ? __lock_acquire+0x49f/0x1a40 [ 373.649156][T20405] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 373.649183][T20405] ? policy_nodemask+0xed/0x4f0 [ 373.649214][T20405] alloc_pages_mpol+0x1fb/0x540 [ 373.649243][T20405] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 373.649267][T20405] ? __folio_batch_add_and_move+0x5e5/0xc60 [ 373.649291][T20405] folio_alloc_mpol_noprof+0x36/0x260 [ 373.649319][T20405] shmem_alloc_folio+0x135/0x160 [ 373.649348][T20405] shmem_alloc_and_add_folio+0x371/0xd40 [ 373.649376][T20405] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 373.649400][T20405] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 373.649427][T20405] shmem_get_folio_gfp+0x6ad/0x1910 [ 373.649451][T20405] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 373.649471][T20405] ? ktime_get_coarse_real_ts64_mg+0x235/0x300 [ 373.649492][T20405] ? lockdep_hardirqs_on+0x78/0x100 [ 373.649518][T20405] shmem_fault+0x1f9/0xa20 [ 373.649539][T20405] ? __lock_acquire+0x49f/0x1a40 [ 373.649569][T20405] ? __pfx_shmem_fault+0x10/0x10 [ 373.649589][T20405] ? rcu_is_watching+0x12/0xc0 [ 373.649623][T20405] ? __pfx_filemap_map_pages+0x10/0x10 [ 373.649643][T20405] __do_fault+0x10b/0x440 [ 373.649663][T20405] ? find_held_lock+0x2b/0x80 [ 373.649687][T20405] do_fault+0x2db/0x1750 [ 373.649715][T20405] __handle_mm_fault+0x187d/0x2a00 [ 373.649737][T20405] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 373.649762][T20405] ? __pfx___handle_mm_fault+0x10/0x10 [ 373.649784][T20405] ? pte_offset_map_lock+0x174/0x320 [ 373.649807][T20405] ? find_held_lock+0x2b/0x80 [ 373.649834][T20405] ? follow_page_pte+0x4d0/0x13f0 [ 373.649868][T20405] handle_mm_fault+0x37b/0xa30 [ 373.649892][T20405] __get_user_pages+0x1178/0x32a0 [ 373.649925][T20405] ? down_read_killable+0x35e/0x520 [ 373.649954][T20405] ? __pfx___get_user_pages+0x10/0x10 [ 373.649985][T20405] __gup_longterm_locked+0x279/0x16f0 [ 373.650018][T20405] ? __pfx___gup_longterm_locked+0x10/0x10 [ 373.650050][T20405] ? sanity_check_pinned_pages+0x4f2/0x8b0 [ 373.650079][T20405] gup_fast_fallback+0x16dc/0x2790 [ 373.650125][T20405] ? __pfx_gup_fast_fallback+0x10/0x10 [ 373.650153][T20405] ? rcu_is_watching+0x12/0xc0 [ 373.650175][T20405] ? rcu_is_watching+0x12/0xc0 [ 373.650200][T20405] pin_user_pages_fast+0xa7/0xf0 [ 373.650226][T20405] ? __pfx_pin_user_pages_fast+0x10/0x10 [ 373.650255][T20405] ? io_pin_pages+0xc3/0x1d0 [ 373.650284][T20405] io_pin_pages+0xe6/0x1d0 [ 373.650310][T20405] io_sqe_buffer_register+0x1d9/0x1500 [ 373.650338][T20405] ? trace_kmalloc+0xeb/0x110 [ 373.650361][T20405] ? __kasan_kmalloc+0xaa/0xb0 [ 373.650383][T20405] ? __pfx_io_sqe_buffer_register+0x10/0x10 [ 373.650404][T20405] ? __kvmalloc_node_noprof+0x36d/0x970 [ 373.650436][T20405] ? iovec_from_user+0xda/0x140 [ 373.650467][T20405] io_sqe_buffers_register.cold+0x346/0x4c3 [ 373.650500][T20405] ? __pfx_io_sqe_buffers_register+0x10/0x10 [ 373.650526][T20405] ? __fget_files+0x21f/0x3d0 [ 373.650551][T20405] __do_sys_io_uring_register+0x13ce/0x1bc0 [ 373.650578][T20405] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 373.650601][T20405] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 373.650626][T20405] ? __fget_files+0x21f/0x3d0 [ 373.650650][T20405] ? fput+0x79/0x100 [ 373.650670][T20405] ? ksys_write+0x1ac/0x250 [ 373.650686][T20405] ? __pfx_ksys_write+0x10/0x10 [ 373.650707][T20405] __do_fast_syscall_32+0xe7/0x970 [ 373.650730][T20405] ? lockdep_hardirqs_on+0x78/0x100 [ 373.650755][T20405] do_fast_syscall_32+0x32/0x70 [ 373.650781][T20405] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 373.650807][T20405] RIP: 0023:0xf6ffefec [ 373.650833][T20405] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 373.650841][T20405] RSP: 002b:00000000f53ab50c EFLAGS: 00000292 ORIG_RAX: 00000000000001ab [ 373.650864][T20405] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000000000 [ 373.650875][T20405] RDX: 00000000800002c0 RSI: 000000000000011a RDI: 0000000000000000 [ 373.650885][T20405] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 373.650895][T20405] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 373.650905][T20405] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 373.650929][T20405] [ 374.498708][T20413] FAULT_INJECTION: forcing a failure. [ 374.498708][T20413] name failslab, interval 1, probability 0, space 9, times 0 [ 374.503158][T20413] CPU: 3 UID: 0 PID: 20413 Comm: syz.2.2259 Tainted: G S L syzkaller #0 PREEMPT(full) [ 374.503178][T20413] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 374.503183][T20413] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 374.503190][T20413] Call Trace: [ 374.503196][T20413] [ 374.503201][T20413] dump_stack_lvl+0x100/0x190 [ 374.503220][T20413] should_fail_ex.cold+0x5/0xa [ 374.503234][T20413] should_failslab+0xc2/0x120 [ 374.503250][T20413] kmem_cache_alloc_noprof+0x91/0x6a0 [ 374.503267][T20413] ? __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 374.503283][T20413] __kvm_mmu_topup_memory_cache+0x18f/0x5f0 [ 374.503299][T20413] mmu_topup_memory_caches+0x25/0x170 [ 374.503315][T20413] kvm_mmu_load+0xe2/0x2570 [ 374.503330][T20413] ? kvm_apic_has_interrupt+0xfe/0x1f0 [ 374.503348][T20413] ? __pfx_kvm_apic_has_interrupt+0x10/0x10 [ 374.503366][T20413] ? kvm_apic_accept_pic_intr+0xdf/0x1b0 [ 374.503388][T20413] ? __pfx_kvm_mmu_load+0x10/0x10 [ 374.503402][T20413] ? kvm_cpu_has_injectable_intr+0x9c/0x1a0 [ 374.503415][T20413] ? kvm_check_and_inject_events+0x873/0x12a0 [ 374.503430][T20413] ? vmx_load_vmcs01+0x90/0xe0 [ 374.503450][T20413] vcpu_run+0x3aaa/0x5de0 [ 374.503464][T20413] ? vmx_vcpu_load_vmcs+0x21d/0x760 [ 374.503487][T20413] ? __pfx_vcpu_run+0x10/0x10 [ 374.503507][T20413] ? rcu_is_watching+0x12/0xc0 [ 374.503523][T20413] ? kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 374.503539][T20413] kvm_arch_vcpu_ioctl_run+0x103d/0x1960 [ 374.503578][T20413] kvm_vcpu_ioctl+0x730/0x1700 [ 374.503591][T20413] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 374.503603][T20413] ? tomoyo_path_number_perm+0x188/0x580 [ 374.503620][T20413] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 374.503635][T20413] ? get_pid_task+0x106/0x250 [ 374.503654][T20413] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 374.503672][T20413] ? do_vfs_ioctl+0x226/0x13e0 [ 374.503689][T20413] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 374.503711][T20413] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 374.503723][T20413] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 374.503735][T20413] ? __fget_files+0x21f/0x3d0 [ 374.503750][T20413] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 374.503762][T20413] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 374.503780][T20413] __do_fast_syscall_32+0xe7/0x970 [ 374.503796][T20413] ? lockdep_hardirqs_on+0x78/0x100 [ 374.503811][T20413] do_fast_syscall_32+0x32/0x70 [ 374.503826][T20413] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 374.503841][T20413] RIP: 0023:0xf6ffefec [ 374.503857][T20413] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 374.503863][T20413] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 374.503875][T20413] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 374.503882][T20413] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 374.503889][T20413] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 374.503896][T20413] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 374.503903][T20413] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 374.503917][T20413] [ 374.679992][T20418] fuse: Unknown parameter 'group_i00000000000000000000' [ 374.757534][T20420] netlink: 'syz.3.2261': attribute type 11 has an invalid length. [ 375.300429][T20455] netlink: 'syz.5.2271': attribute type 11 has an invalid length. [ 375.441104][T20464] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 375.589833][T20466] comedi comedi3: comedi_config --init_data is deprecated [ 375.822092][T20440] Bluetooth: MGMT ver 1.23 [ 376.386472][T20475] overlayfs: cannot append lower layer [ 376.400862][T20475] macvtap1: entered allmulticast mode [ 376.414298][T20475] dummy0: entered allmulticast mode [ 376.424663][T20475] dummy0: entered promiscuous mode [ 376.430599][T20475] dummy0: left allmulticast mode [ 376.463615][ T34] dummy0: left promiscuous mode [ 376.783625][T20494] FAULT_INJECTION: forcing a failure. [ 376.783625][T20494] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 376.785295][T20496] netlink: 'syz.2.2280': attribute type 11 has an invalid length. [ 376.787845][T20494] CPU: 0 UID: 0 PID: 20494 Comm: syz.1.2277 Tainted: G S L syzkaller #0 PREEMPT(full) [ 376.787866][T20494] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 376.787871][T20494] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 376.787878][T20494] Call Trace: [ 376.787884][T20494] [ 376.787890][T20494] dump_stack_lvl+0x100/0x190 [ 376.787908][T20494] should_fail_ex.cold+0x5/0xa [ 376.787923][T20494] _copy_to_user+0x32/0xd0 [ 376.787944][T20494] sctp_getsockopt+0x2642/0x7090 [ 376.787973][T20494] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 376.787991][T20494] ? __lock_acquire+0x49f/0x1a40 [ 376.788010][T20494] ? __pfx_sctp_getsockopt+0x10/0x10 [ 376.788023][T20494] ? _parse_integer_limit+0x1ac/0x220 [ 376.788042][T20494] ? __pfx___might_resched+0x10/0x10 [ 376.788064][T20494] ? aa_sk_perm+0x309/0xaa0 [ 376.788080][T20494] ? __pfx_aa_sk_perm+0x10/0x10 [ 376.788099][T20494] ? aa_sock_opt_perm+0xfe/0x1b0 [ 376.788112][T20494] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 376.788132][T20494] do_sock_getsockopt+0x50a/0x6e0 [ 376.788144][T20494] ? __lock_acquire+0x49f/0x1a40 [ 376.788163][T20494] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 376.788178][T20494] ? find_held_lock+0x2b/0x80 [ 376.788196][T20494] ? __fget_files+0x21f/0x3d0 [ 376.788211][T20494] __sys_getsockopt+0x133/0x1d0 [ 376.788231][T20494] ? __ia32_sys_getsockopt+0xbc/0x160 [ 376.788246][T20494] __ia32_sys_getsockopt+0xbc/0x160 [ 376.788261][T20494] ? __do_fast_syscall_32+0x98/0x970 [ 376.788277][T20494] ? lockdep_hardirqs_on+0x78/0x100 [ 376.788291][T20494] __do_fast_syscall_32+0xe7/0x970 [ 376.788308][T20494] ? lockdep_hardirqs_on+0x78/0x100 [ 376.788323][T20494] do_fast_syscall_32+0x32/0x70 [ 376.788339][T20494] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 376.788355][T20494] RIP: 0023:0xf7f14fec [ 376.788370][T20494] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 376.788375][T20494] RSP: 002b:00000000f53b550c EFLAGS: 00000292 ORIG_RAX: 000000000000016d [ 376.788387][T20494] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000084 [ 376.788395][T20494] RDX: 0000000000000022 RSI: 0000000080000100 RDI: 0000000080000140 [ 376.788401][T20494] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 376.788408][T20494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 376.788415][T20494] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 376.788429][T20494] [ 376.962406][T20504] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 376.966106][T20504] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 376.968893][T20504] CPU: 3 UID: 0 PID: 20504 Comm: syz.1.2283 Tainted: G S L syzkaller #0 PREEMPT(full) [ 376.972122][T20504] Tainted: [S]=CPU_OUT_OF_SPEC, [L]=SOFTLOCKUP [ 376.974008][T20504] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 376.977024][T20504] RIP: 0010:dummy_udc_stop+0x8f/0x180 [ 376.978720][T20504] Code: c1 ea 03 80 3c 02 00 0f 85 f9 00 00 00 48 8b 9b 90 06 00 00 e8 d2 e0 3a fa 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 c5 00 00 00 48 8b 1b 48 89 df e8 fc 27 ed 03 48 [ 376.984627][T20504] RSP: 0018:ffffc9000610f900 EFLAGS: 00010246 [ 376.986525][T20504] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000cf42000 [ 376.988897][T20504] RDX: 0000000000000000 RSI: ffffffff87cecd2e RDI: ffff88802250d290 [ 376.991350][T20504] RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000005 [ 376.993701][T20504] R10: 0000000000000003 R11: 0000000000000000 R12: ffff888050fba438 [ 376.996148][T20504] R13: ffff8880008ab540 R14: ffff88802250cc00 R15: ffffffff8cb7c320 [ 376.998597][T20504] FS: 0000000000000000(0000) GS:ffff888096ee1000(0063) knlGS:00000000f53d6b40 [ 377.001414][T20504] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 377.003482][T20504] CR2: 00000000f72ae9ea CR3: 0000000060d71000 CR4: 0000000000352ef0 [ 377.005955][T20504] Call Trace: [ 377.007015][T20504] [ 377.007965][T20504] gadget_unbind_driver+0x2ca/0x4f0 [ 377.009530][T20504] ? __pfx_dummy_udc_async_callbacks+0x10/0x10 [ 377.011438][T20504] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 377.013192][T20504] device_remove+0xcb/0x180 [ 377.014580][T20504] device_release_driver_internal+0x44e/0x620 [ 377.016483][T20504] bus_remove_device+0x2bc/0x560 [ 377.018040][T20504] ? __pfx_bus_remove_device+0x10/0x10 [ 377.019769][T20504] ? __pfx_device_remove_attrs+0x10/0x10 [ 377.021582][T20504] device_del+0x376/0x9b0 [ 377.022946][T20504] ? kernfs_remove_by_name_ns+0x103/0x120 [ 377.024746][T20504] ? __pfx_device_del+0x10/0x10 [ 377.026274][T20504] usb_del_gadget+0x1b2/0x2d0 [ 377.027779][T20504] ? __pfx_dummy_udc_remove+0x10/0x10 [ 377.029483][T20504] usb_del_gadget_udc+0x15/0x30 [ 377.031026][T20504] platform_remove+0x5f/0x80 [ 377.032494][T20504] ? __pfx_platform_remove+0x10/0x10 [ 377.034155][T20504] device_remove+0xcb/0x180 [ 377.035446][T20504] device_release_driver_internal+0x44e/0x620 [ 377.037371][T20504] unbind_store+0xf8/0x110 [ 377.038808][T20504] ? __pfx_unbind_store+0x10/0x10 [ 377.040434][T20504] drv_attr_store+0x74/0xb0 [ 377.041906][T20504] ? __pfx_drv_attr_store+0x10/0x10 [ 377.043610][T20504] sysfs_kf_write+0xf2/0x150 [ 377.045122][T20504] kernfs_fop_write_iter+0x3e0/0x5f0 [ 377.046779][T20504] ? __pfx_sysfs_kf_write+0x10/0x10 [ 377.048427][T20504] vfs_write+0x6ac/0x1050 [ 377.049804][T20504] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 377.051661][T20504] ? __pfx_vfs_write+0x10/0x10 [ 377.053154][T20504] ? find_held_lock+0x2b/0x80 [ 377.054595][T20504] ksys_write+0x12a/0x250 [ 377.055956][T20504] ? __pfx_ksys_write+0x10/0x10 [ 377.057485][T20504] __do_fast_syscall_32+0xe7/0x970 [ 377.059114][T20504] ? lockdep_hardirqs_on+0x78/0x100 [ 377.060665][T20504] do_fast_syscall_32+0x32/0x70 [ 377.062186][T20504] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 377.064113][T20504] RIP: 0023:0xf7f14fec [ 377.065368][T20504] Code: Unable to access opcode bytes at 0xf7f14fc2. [ 377.067388][T20504] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 377.069977][T20504] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 377.072432][T20504] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 377.074791][T20504] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 377.077240][T20504] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 377.079632][T20504] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 377.082109][T20504] [ 377.083096][T20504] Modules linked in: [ 377.084750][T20504] ---[ end trace 0000000000000000 ]--- [ 377.096835][T20504] RIP: 0010:dummy_udc_stop+0x8f/0x180 [ 377.100120][T20504] Code: c1 ea 03 80 3c 02 00 0f 85 f9 00 00 00 48 8b 9b 90 06 00 00 e8 d2 e0 3a fa 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 c5 00 00 00 48 8b 1b 48 89 df e8 fc 27 ed 03 48 [ 377.106323][T20504] RSP: 0018:ffffc9000610f900 EFLAGS: 00010246 [ 377.108629][T20504] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000cf42000 [ 377.112126][T20504] RDX: 0000000000000000 RSI: ffffffff87cecd2e RDI: ffff88802250d290 [ 377.115213][T20504] RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000005 [ 377.117893][T20504] R10: 0000000000000003 R11: 0000000000000000 R12: ffff888050fba438 [ 377.120747][T20504] R13: ffff8880008ab540 R14: ffff88802250cc00 R15: ffffffff8cb7c320 [ 377.123493][T20504] FS: 0000000000000000(0000) GS:ffff888096ee1000(0063) knlGS:00000000f53d6b40 [ 377.126509][T20504] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 377.128874][T20504] CR2: 00000000f53b5da4 CR3: 0000000060d71000 CR4: 0000000000352ef0 [ 377.132400][T20504] Kernel panic - not syncing: Fatal exception [ 377.134927][T20504] Kernel Offset: disabled [ 377.136300][T20504] Rebooting in 86400 seconds..