last executing test programs: 8.221826184s ago: executing program 2 (id=1888): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000005c0)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000600)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000640)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc00c5512, &(0x7f00000000c0)=@usbdevfs_driver={0x1089, 0x5ad, &(0x7f0000000000)="d224600a65dd3b09fdda3d73f537a717eae4cef831ad1798382ed566d830debea5e8d164767a2249152c4cd10e87e396291a265f349fc99fc80eb751e19040ccca57e02b3ef27a11d15f90e5e1c615a2d1b5482172fa1843dae8fb3362848be72cbb50bea1fa9f64ab4cc957410388a36f47ed292be27d824f7041ea08222707e0446ef959a79582d9675f1cddc0"}) connect$unix(r3, &(0x7f00000006c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000740), 0x318, 0x0) recvmmsg(r3, &(0x7f0000000780), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000007c0)=0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r5 = userfaultfd(0x1) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000880)={0xaa, 0x140}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f00000009c0)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r5, 0xc028aa05, &(0x7f0000000a00)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) 6.899006843s ago: executing program 2 (id=1896): r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x2730, 0x800, 0x0, 0x82}, &(0x7f0000000180)=0x0, 0x0, &(0x7f0000000240)=0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000040)=[{0x0}, {&(0x7f00000000c0)=""/250, 0xfa}], 0x2}}], 0x1, 0x34000, 0x0) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000040)={0x30, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r1, 0x0, r2, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r0}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f00000001c0)=@broute={'broute\x00', 0x20, 0xff00, 0x90, [0x40000000, 0x0, 0x0, 0x0, 0x0, 0x80000100], 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00ff0000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000001100000000000000000000000000000000020000000000000000000000fcffffff000000000000f1f59bf897f706345619b3b0d18661eb00"/138]}, 0xda) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r4 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) openat$vimc0(0xffffff9c, &(0x7f00000005c0), 0x2, 0x0) syz_emit_vhci(&(0x7f0000000640)=ANY=[@ANYBLOB="043e0612fa"], 0x9) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000780), 0x4980) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYRESOCT=r3], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r5 = socket(0x2b, 0x80801, 0x1) connect$vsock_stream(r4, &(0x7f0000000700)={0x28, 0x0, 0xffffffff, @hyper, 0x1}, 0x10) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r5, 0x894b, &(0x7f0000000600)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0x7, 0x2) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) syz_80211_inject_frame(&(0x7f0000000100)=@broadcast, &(0x7f00000001c0)=ANY=[@ANYBLOB="98a60800080211000000ffffffffffff080211000001308d020b06008d81cf4f9c70a31e0efeafb0aba3c86d1539921c8d8dae2b2533a5305c67d0d64f57dd34376429688b409b579318bc44285f55ee01b8bc65bc3ebd7b365d3031f549b3c8dfab03ef901a996c4b16fb3ce305485a45d16feb37a6443cdaeb85f9f840a0cdc8c29a9ee784bb52cd2b9c3dad5e1ec836727eeaf969e13101378f9e93e8c3e1ddd72ee0d5959b711fdf6033907c7c7de23282ed773d0ed8d305be0d3c49fe36ecc4dcfbba3825392f72f5e95228354ad7b977e7a4b205cfc1675debcf68115c51979e7d96a281515743aac44179fbf053406363bd8446d2ebd0f6390789f149c647302faa3d211d352222adf7d8f223e406103aabce27f3feb12446d46208ec8bb77836ad7bf73d066f751f32e3754e51eac3689ef3e668ce6a91b93fc9ce21f61024e6f697ff0ab1e2aefde9953286add0bd8f53387c6907a8d6250c384090e5845d8fbf4d6afd6be0f13962064050b752cd575ae3fb15d7bc7c9cd3ee6f526dca5ed29944f96e8d80c81586891282bae3c754f7533016cfd68e1d4eaae7827f6797b8be5b495b248010a249bcfcf52ea070fa88c3f90b1bc6dc3aa7cd8ab0650631aba2179ff630d31e50db6107468c5567b35c1598a5190e1eebd8a0eb896cc099aaec06beac711f2cfd2ce39701dc3abad626350efdefef2f49cf8e86b9454913af699fdcc66f1db575faf35a5af0f916fd8a8b4d8803ed6121e873bbdb35cbdc1ee9b7a8e546d4f71937031f0336834b3da252211bf47b22c7e6cb7c9b6ee264e6ba3218beb5d7bbf0e01e1d6b73f53928fd16b1160a7c1f6554c0a6c8cfc9d494d164932ab83eaba0b2da1b8679b81997af7c48aaf7fca8e33f57f93256ddc15a71dc560a94a6b89f2992d6650afddf1cf684053f7455d55d57186c63be4ae6e44b539592abc32e8b1bb77da499e83b3ccd54f67bd680b955b106ecfc84dba132900014212f44211602bf40f027cf81d5f26952e7547ae2b6cc16917b2ed0080151449954f8e739bb2885ff0951a3331794e56fa0de7257bb9bc0cc5be3b912e9b7"], 0x305) r6 = socket$vsock_seqpacket(0x28, 0x5, 0x0) fsetxattr$trusted_overlay_nlink(r6, &(0x7f0000000680), &(0x7f00000006c0)={'U+', 0x7}, 0x16, 0x1) 6.153964966s ago: executing program 2 (id=1904): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000040)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000a40)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000a80)="0e00000002000204", 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) syz_usb_connect(0x6, 0x0, 0x0, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000000100)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x200) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f0000000140)=0xdfe5) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) r3 = socket(0x2, 0x3, 0xff) setsockopt$inet_int(r3, 0x0, 0x3, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000000340)=[{{&(0x7f0000000380)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000400)="bcb0b6080bc2", 0x6}, {&(0x7f0000000440)="54d9b7a069fb02b4e96e12d872dd182e2becb6f1457b6e0aabe3427159015f4c4a57a21bc3f122b2f904000000cea665", 0x30}, {&(0x7f0000000480)="d746bf7de7b2afdb11cbe10dfdcec916cee4726e50a324c76a37f53ceb1788945f3848c7930de354e8e58262d906f3ba0e15dc0af8d852598483c089bb370efda83b216c8279f427e422dc94e30b2af886dc00838d47d041f709bfd92b1f550848664866ba107bba9cf40e42f727bb0bdb58795b0f331197b43c538f4e73f44ec5c8802233237cd59be4dea6efd1cb8f45e43c7d80bef22276d81cc1b63f891539df2fa962ad242ef318a011cdfc98aace3735ad6c7174feea983eef0067c9670d2776a4eb35234d1ebf2374cc199d911a61478aaf312787bc1b562b08b1d16fc2174cea0cdc4f6e2c7caeb61c6884fa4aa8c8afcf0a7472256fbea830c51107c24d03045c6b604c066076bd16e395b2ce26be15ff4248b906a301777820affdaa37c38ffe5c6cadae4b47566406c0a62f31786ec163f3253e675679d3a7fdf472bb68fbb4e4bd59dab659d6c4b3798f4276a35d2b19a31c3a53022d700f3f82f41b61a71871b34b4d6b8df2985b3688d4d3fb9bb68f2305f3f715425f2f0cc6f2e3513109cf1bd9b163d6054a471e39529c1e85710aea7ac157ba293ef7a691eee32508762f68fd383566965806436f09b4a891c79f045785b5b192ec879661e8d62a0dccf31f8c4ef1e078ee6d7b87e96f8cf8aefc6519921effa15cbb12a11eac73864ca9f1afa3ee34f5a52ad49339b9a87aa2f8b2c482bc177494fc044363c5dd0fb7f5daacdff6431b43a3c1116ebbdd5f625f84d4e85ec154f6d8f863c753f127e41f192674de5c55237fdd60b3b3438618163a918bc67a72431af805229d3c235203d44c279eb4a1d175c2c0e5946e6240d44a2728801caec3d07a51d501f38a10dbf5b4e71b61ff7b39260d676689b24a3c381d8343a7780920ef96c11d9a8fa89ae40ceb7659ef4952ea1bdccfee4a0a5b289f5c72ed913c5945c6757309a0fe6531ce9d9dec9d3568f02c6dee66b35047706006f80f92b6ad0e8cd5611b63a2425aa14b93f8a8baa79271ba61313940de8bd3c9a2802fece2bb414f6991c01c2bd101fd70c5ef73284b57865a2af4443fcc6887c0afeb352e3f0e7269630b27c726a6dd22cde5712ca7d27b98724a802cf4c4451de643820c0acf39e460c89586aca3930cd38d6e936a13c40fdda0580ba7d542ca0a6407f4eea078ff9e4f636785660e397d96dac81543adeb4c0b2dc676fabce647e566e27c850ee999cacea12151889e3d3291588249779417f2cd5894fb57e893d9202b36d1452af6880fb7eae769ca9a0c7fcac71ec7398c5bf29cbf237342f02c9646475cd644cba22ec7b50256b648b144b6e8873c18d135baa2826b219f4a5cad74ebe447cf957e240392becb94eaa7eeed36e35fd1fdd2f3c5474d9861d657d8c66e85550b933b085cb73c379fa8cb770a1c0ddd6def03ca06a69258b79904e719b9393aab63a124ad3c059eee5608f2789e59c31bfa2aaa2c1eac5b8eb5ba6c078e8fa9a5a63f3ea0b843b62696d4b1fe93f33ec6dd0ec4faa03ec293ad2f48803588c038962a4a4abb4bc477c0af8fdc872859207a4148152c072325ae1193de0b79088bfa0301087356f1ff018a8827f4eb40eb49fb2a53760ab049f3340a89bc4a9c69bbfb12e67f09dab43eb659fd8be98589b10e9f494876aee33cdd2778cfeabc045dde5fc7e8e6c128e3c2a258072df144a60c7779efdd8372640c81bf07be8830a2e110af576986829fc695d382534bd182e0bb5d201501730df4c8de83f700fa61a66cd7d133c4f2501faac2e14a5443569d9631fb14ae2431e525bcd09181e70eed69fcd443304455cf6dd7462728a15fb3e8940d43fdad810db6010574bbde7e9c6d04cd6a3f54376f61ff7948f1dbdfe71dc97482e6375582b76c3fe35dd086f93a96fb9dae8783215894d7bbe2ea2ddb6916b3430b7462f5deceebfa91bd2ba1086ebb0a2af00a1f3d3ab186127bd57b30f5cdb874d743849792f72dcfa0b4de82d6f6091783d761c8749d8159e81b", 0x593}], 0x3}}], 0x1, 0x4) recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x40010120, 0x0, 0x0) mount(0x0, &(0x7f00000001c0)='./sys\x00', 0x0, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0) write(r4, &(0x7f0000000280)='wwnn=0x2000000010000001,wwpn=0x2000000010000002,lpwwnn=0x1000000010000001,lpwwpn=0x1000000010000002,roles=32', 0x6c) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sync_file_range(0xffffffffffffffff, 0x400, 0xd8eb, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r5, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x7}) 4.092323475s ago: executing program 2 (id=1916): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/wireless\x00') mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x8) socket$netlink(0x10, 0x3, 0x4) mount(0x0, 0x0, &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) mq_open(&(0x7f0000000500)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a\x9e@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\x8a\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e*\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|L\xca%;5w?R', 0x2, 0x4, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r4) sendmsg$NL80211_CMD_RELOAD_REGDB(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r5, 0x501, 0x70bd2c, 0x25dfdbf8}, 0x14}, 0x1, 0x0, 0x0, 0x20008001}, 0x40) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4041) preadv(r2, &(0x7f0000000800), 0x0, 0xfffffffe, 0x3) read$FUSE(r2, &(0x7f0000008880)={0x2020}, 0x2020) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000040)=@arm64) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4104aec6, &(0x7f0000000d80)={0x1, [{0x1, 0x10, 0x101, &(0x7f0000000080)="29e3"}, {0x1, 0x0, 0xff, &(0x7f0000000180)}, {0x0, 0x0, 0xfffffff8, 0x0}, {0x2, 0x0, 0x7, 0x0}, {0x1, 0x0, 0x1, 0x0}, {0x2, 0x0, 0x80000001, 0x0}, {0x1, 0x0, 0x6f5, 0x0}, {0x2, 0x0, 0x2, 0x0}, {0x6, 0x0, 0xc6c2, 0x0}, {0xb7d4904c39f7106e, 0x0, 0x1, 0x0}, {0x2, 0x0, 0x6aa, 0x0}, {0x0, 0x0, 0x7, 0x0}, {0x49b7499af3df3cdb, 0x0, 0x7, 0x0}, {0x2, 0x0, 0x0, 0x0}, {0x2, 0x0, 0x1000000, 0x0}, {0x3, 0x0, 0x22f, 0x0}]}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000480)}) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/tty/ttyS0/rx_trig_bytes\x00', 0x2, 0x0) 3.153547512s ago: executing program 1 (id=1923): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x2c, r1, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xa8}]}, 0x2c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)={0x48, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x22, 0x33, @action={{{}, {}, @device_a, @device_a, @random="a7e97e5efc56", {0x0, 0xff}}, @ext_ch_sw={0x4, 0x4, {{0x0, 0x0, 0x5}, @void}}}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x8, 0xcd, [0x0, 0x9]}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r5) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x675f, 0x9, 0x3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @multicast}) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) r10 = socket$kcm(0x11, 0x3, 0x0) r11 = socket(0x400000000010, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r10, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x4, 0x7, 0xb, 0xdc}, 0x1, r12}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(r10, 0x107, 0xf, &(0x7f0000000400), 0x56) sendmsg$kcm(r10, &(0x7f0000000440)={&(0x7f0000000480)=@xdp={0x2c, 0x0, r9, 0x42}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000540)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 2.934381481s ago: executing program 2 (id=1925): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000040)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000a40)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000a80)="0e00000002000204", 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) syz_usb_connect(0x6, 0x0, 0x0, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000000100)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x200) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f0000000140)=0xdfe5) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) r3 = socket(0x2, 0x3, 0xff) setsockopt$inet_int(r3, 0x0, 0x3, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000000340)=[{{&(0x7f0000000380)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000400)="bcb0b6080bc2", 0x6}, {&(0x7f0000000440)="54d9b7a069fb02b4e96e12d872dd182e2becb6f1457b6e0aabe3427159015f4c4a57a21bc3f122b2f904000000cea665", 0x30}, {&(0x7f0000000480)="d746bf7de7b2afdb11cbe10dfdcec916cee4726e50a324c76a37f53ceb1788945f3848c7930de354e8e58262d906f3ba0e15dc0af8d852598483c089bb370efda83b216c8279f427e422dc94e30b2af886dc00838d47d041f709bfd92b1f550848664866ba107bba9cf40e42f727bb0bdb58795b0f331197b43c538f4e73f44ec5c8802233237cd59be4dea6efd1cb8f45e43c7d80bef22276d81cc1b63f891539df2fa962ad242ef318a011cdfc98aace3735ad6c7174feea983eef0067c9670d2776a4eb35234d1ebf2374cc199d911a61478aaf312787bc1b562b08b1d16fc2174cea0cdc4f6e2c7caeb61c6884fa4aa8c8afcf0a7472256fbea830c51107c24d03045c6b604c066076bd16e395b2ce26be15ff4248b906a301777820affdaa37c38ffe5c6cadae4b47566406c0a62f31786ec163f3253e675679d3a7fdf472bb68fbb4e4bd59dab659d6c4b3798f4276a35d2b19a31c3a53022d700f3f82f41b61a71871b34b4d6b8df2985b3688d4d3fb9bb68f2305f3f715425f2f0cc6f2e3513109cf1bd9b163d6054a471e39529c1e85710aea7ac157ba293ef7a691eee32508762f68fd383566965806436f09b4a891c79f045785b5b192ec879661e8d62a0dccf31f8c4ef1e078ee6d7b87e96f8cf8aefc6519921effa15cbb12a11eac73864ca9f1afa3ee34f5a52ad49339b9a87aa2f8b2c482bc177494fc044363c5dd0fb7f5daacdff6431b43a3c1116ebbdd5f625f84d4e85ec154f6d8f863c753f127e41f192674de5c55237fdd60b3b3438618163a918bc67a72431af805229d3c235203d44c279eb4a1d175c2c0e5946e6240d44a2728801caec3d07a51d501f38a10dbf5b4e71b61ff7b39260d676689b24a3c381d8343a7780920ef96c11d9a8fa89ae40ceb7659ef4952ea1bdccfee4a0a5b289f5c72ed913c5945c6757309a0fe6531ce9d9dec9d3568f02c6dee66b35047706006f80f92b6ad0e8cd5611b63a2425aa14b93f8a8baa79271ba61313940de8bd3c9a2802fece2bb414f6991c01c2bd101fd70c5ef73284b57865a2af4443fcc6887c0afeb352e3f0e7269630b27c726a6dd22cde5712ca7d27b98724a802cf4c4451de643820c0acf39e460c89586aca3930cd38d6e936a13c40fdda0580ba7d542ca0a6407f4eea078ff9e4f636785660e397d96dac81543adeb4c0b2dc676fabce647e566e27c850ee999cacea12151889e3d3291588249779417f2cd5894fb57e893d9202b36d1452af6880fb7eae769ca9a0c7fcac71ec7398c5bf29cbf237342f02c9646475cd644cba22ec7b50256b648b144b6e8873c18d135baa2826b219f4a5cad74ebe447cf957e240392becb94eaa7eeed36e35fd1fdd2f3c5474d9861d657d8c66e85550b933b085cb73c379fa8cb770a1c0ddd6def03ca06a69258b79904e719b9393aab63a124ad3c059eee5608f2789e59c31bfa2aaa2c1eac5b8eb5ba6c078e8fa9a5a63f3ea0b843b62696d4b1fe93f33ec6dd0ec4faa03ec293ad2f48803588c038962a4a4abb4bc477c0af8fdc872859207a4148152c072325ae1193de0b79088bfa0301087356f1ff018a8827f4eb40eb49fb2a53760ab049f3340a89bc4a9c69bbfb12e67f09dab43eb659fd8be98589b10e9f494876aee33cdd2778cfeabc045dde5fc7e8e6c128e3c2a258072df144a60c7779efdd8372640c81bf07be8830a2e110af576986829fc695d382534bd182e0bb5d201501730df4c8de83f700fa61a66cd7d133c4f2501faac2e14a5443569d9631fb14ae2431e525bcd09181e70eed69fcd443304455cf6dd7462728a15fb3e8940d43fdad810db6010574bbde7e9c6d04cd6a3f54376f61ff7948f1dbdfe71dc97482e6375582b76c3fe35dd086f93a96fb9dae8783215894d7bbe2ea2ddb6916b3430b7462f5deceebfa91bd2ba1086ebb0a2af00a1f3d3ab186127bd57b30f5cdb874d743849792f72dcfa0b4de82d6f6091783d761c8749d8159e81b", 0x593}], 0x3}}], 0x1, 0x4) recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x40010120, 0x0, 0x0) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r4, &(0x7f0000000280)='wwnn=0x2000000010000001,wwpn=0x2000000010000002,lpwwnn=0x1000000010000001,lpwwpn=0x1000000010000002,roles=32', 0x6c) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sync_file_range(0xffffffffffffffff, 0x400, 0xd8eb, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r5, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x7}) 2.750221931s ago: executing program 1 (id=1928): ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000180)={0x1, 0xaa4, 0x0, 0x0}) mkdir(&(0x7f00000000c0)='./sys_mount\x00', 0x12c) setpriority(0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000100)='./sys_mount\x00', &(0x7f0000000140)='sysfs\x00', 0x10000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys_mount/block/loop0/queue/scheduler\x00', 0x2, 0x0) r1 = getuid() read$FUSE(r0, &(0x7f00000002c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) chown(&(0x7f0000000280)='./sys_mount\x00', r1, r2) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000002300)={'ip6_vti0\x00', &(0x7f0000002340)={'ip6_vti0\x00', 0x0, 0x4, 0x4f, 0x6, 0x6, 0x9, @private2={0xfc, 0x2, '\x00', 0x4}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x7, 0x80, 0x3ff, 0x2}}) r4 = fanotify_init(0x40, 0x400) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000002600)={0x0, 0x0, &(0x7f0000002640)={&(0x7f0000002680)={0x20, 0x2f, 0x107, 0x70bd2e, 0x25dfdbfb, {0x2, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @u32=0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) fanotify_mark(r4, 0x200, 0x40000010, r0, &(0x7f00000023c0)='./sys_mount/block/loop0/queue/scheduler\x00') write(r0, &(0x7f0000000200)='bfq', 0x3) sendfile(r0, r0, &(0x7f0000000240)=0x8, 0x8) socket$inet(0x2, 0x2, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) r7 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x40010, r7, 0x40000000) setxattr$system_posix_acl(&(0x7f00000026c0)='.\x00', &(0x7f0000002700)='system.posix_acl_access\x00', &(0x7f0000002740)={{}, {0x20}, [], {0x4, 0x4}, [], {}, {0x20, 0x7}}, 0x24, 0x1) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000002780)=0x0) r9 = syz_open_procfs$namespace(r8, &(0x7f0000000000)='ns/cgroup\x00') open_by_handle_at(r9, &(0x7f0000000040)=ANY=[@ANYBLOB="20000000f1000100", @ANYRES64=r6], 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r10, &(0x7f0000002400)={0xa, 0x4e23, 0x40000000, @loopback}, 0x1c) sendmmsg$inet6(r10, &(0x7f0000002440)=[{{&(0x7f0000002480)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, &(0x7f00000024c0)=[{&(0x7f0000002500)='\b', 0x1}], 0x1}}, {{&(0x7f0000002540)={0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, '\x00', 0x35}, 0x9}, 0x1c, &(0x7f0000002580)=[{&(0x7f00000025c0)="9220", 0x2}], 0x1}}], 0x2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0xa22102, 0x0) 2.662362665s ago: executing program 1 (id=1930): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/wireless\x00') mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x8) socket$netlink(0x10, 0x3, 0x4) mount(0x0, 0x0, &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) mq_open(&(0x7f0000000500)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a\x9e@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\x8a\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e*\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|L\xca%;5w?R', 0x2, 0x4, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r4) sendmsg$NL80211_CMD_RELOAD_REGDB(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r5, 0x501, 0x70bd2c, 0x25dfdbf8}, 0x14}, 0x1, 0x0, 0x0, 0x20008001}, 0x40) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4041) preadv(r2, &(0x7f0000000800), 0x0, 0xfffffffe, 0x3) read$FUSE(r2, &(0x7f0000008880)={0x2020}, 0x2020) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000040)=@arm64) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4104aec6, &(0x7f0000000d80)={0x1, [{0x1, 0x10, 0x101, &(0x7f0000000080)="29e3"}, {0x1, 0x0, 0xff, &(0x7f0000000180)}, {0x0, 0x0, 0xfffffff8, 0x0}, {0x2, 0x0, 0x7, 0x0}, {0x1, 0x0, 0x1, 0x0}, {0x2, 0x0, 0x80000001, 0x0}, {0x1, 0x0, 0x6f5, 0x0}, {0x2, 0x0, 0x2, 0x0}, {0x6, 0x0, 0xc6c2, 0x0}, {0xb7d4904c39f7106e, 0x0, 0x1, 0x0}, {0x2, 0x0, 0x6aa, 0x0}, {0x0, 0x0, 0x7, 0x0}, {0x49b7499af3df3cdb, 0x0, 0x7, 0x0}, {0x2, 0x0, 0x0, 0x0}, {0x2, 0x0, 0x1000000, 0x0}, {0x3, 0x0, 0x22f, 0x0}]}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000480)}) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/tty/ttyS0/rx_trig_bytes\x00', 0x2, 0x0) 1.733688199s ago: executing program 1 (id=1934): ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000100)={"b46474f815e8d5535f0887c44335cc824dc6121bc72a77f532ff5dad4d643a9cab29d2310e04be14eb26c0af4985fe45e3b3b0680b3ec92725d74b9716e0f7c3119a2c9a0ae65ff4772e2e12733cb013c4308fe40863480747c0a7ddb9361b1578015ca1bb2c1677ebae096f08345476f567443842946ed946434c75916d1db83fe305920de65bfaf9bd940672216846cb16b8ae67cd3affc61375381f91b3b9f1cc5e38cafe5239aee71dcd481fbe1ecd2547ffbaad4469a74697c28fb9beefa6a5d736712a55eb9110c2cf7964062ba8cbc1c038e84f0f5db7fc7053118bf5221e3efa6fc3edb5d0ca3cde7054dd0751a332520aa8478b1775d552c5cc24d3c2df9eb333e5ca3aa06c1c2cf8526714f5caff2f55b41976fc20b64f1fc61d5b44f50953582a1825d32130a31abfeafd1987317879e29ac51b93c9659e023fff3ddb5e39dd19cc3ef1d883c78b9e073d08a9197fb3717df238b9831831214b186693be9dd2568bb77272e80df5dfed03e8c467627bedfbd93359a9f79a3aa37e873dc1357b37b43d813ea85267b0dc8b1c4cc51bd985328833beb2679b7fb762555bbea2da936b36f8f1673fd5f606b2b6eb23b72bf947206e8dbfeb40ca6f265a3485c8446e0f0da652860b88328073d2282c14b48a7774e62754a968b60e92205e8fafcdd70a55c3c4d1a4821ff44e6e3681f15ae091262e3a3290a24d8ceae30ebbf9d24287bb8a5d73c608d47d287f9e716cf02b4796a83fb0c05e45b89de9ef8bce834e6d7a0be6e30d2c66cb6e640cb01898454ad361bc0701d8fe56113335ae6adec59300db04691cc4a689034272a8e086a32ce7061b4f79fa8afbb48a6ce4b62bdc44af013d78980457e1fa61eb9204818606f4c3b03c0f33cd2a841ac9bc2b73151a96e31ab99e6ec969b5f2c3edd5f9abc69845e487af992758ba445368da93dae1d44360d52a534a88276b8aaf349841d8a4788c60408618437c442308dbf70efeda2e54e9b9e4fe5f76997c9dcb945a26bd75748c85d19ca8b99264dce50580e8d4dbda401dad7df31e9a7a6a3a83bfbdfb5394abd581ac0824fbcd75d2f5205c0b7c9188e6f26bfd97734d9a20433f6cdba9d14a5f32a4d97a57f4603b21146fd1aebf082e863d463c224ad623c17d8043d3bf083f0322408dd6ead6915ac6a4222ab51480eb6e11a8913348219515170d9df90d72d7363bbda3e327d19f98c0a856f98076380e788e602e8a2ae0a1930786874dc21a2e99abda15f35457cf1dcb440c4b41350d0eda352aad7f57a0adc8a6914da06460635ed21c4c11cd1a8ec778064c9f62efba2927828b23f94b16619a5520731c2c40ab8583c9f2e73233d74b84f4877ce6b35bb1180300"}) (async) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000100)={"b46474f815e8d5535f0887c44335cc824dc6121bc72a77f532ff5dad4d643a9cab29d2310e04be14eb26c0af4985fe45e3b3b0680b3ec92725d74b9716e0f7c3119a2c9a0ae65ff4772e2e12733cb013c4308fe40863480747c0a7ddb9361b1578015ca1bb2c1677ebae096f08345476f567443842946ed946434c75916d1db83fe305920de65bfaf9bd940672216846cb16b8ae67cd3affc61375381f91b3b9f1cc5e38cafe5239aee71dcd481fbe1ecd2547ffbaad4469a74697c28fb9beefa6a5d736712a55eb9110c2cf7964062ba8cbc1c038e84f0f5db7fc7053118bf5221e3efa6fc3edb5d0ca3cde7054dd0751a332520aa8478b1775d552c5cc24d3c2df9eb333e5ca3aa06c1c2cf8526714f5caff2f55b41976fc20b64f1fc61d5b44f50953582a1825d32130a31abfeafd1987317879e29ac51b93c9659e023fff3ddb5e39dd19cc3ef1d883c78b9e073d08a9197fb3717df238b9831831214b186693be9dd2568bb77272e80df5dfed03e8c467627bedfbd93359a9f79a3aa37e873dc1357b37b43d813ea85267b0dc8b1c4cc51bd985328833beb2679b7fb762555bbea2da936b36f8f1673fd5f606b2b6eb23b72bf947206e8dbfeb40ca6f265a3485c8446e0f0da652860b88328073d2282c14b48a7774e62754a968b60e92205e8fafcdd70a55c3c4d1a4821ff44e6e3681f15ae091262e3a3290a24d8ceae30ebbf9d24287bb8a5d73c608d47d287f9e716cf02b4796a83fb0c05e45b89de9ef8bce834e6d7a0be6e30d2c66cb6e640cb01898454ad361bc0701d8fe56113335ae6adec59300db04691cc4a689034272a8e086a32ce7061b4f79fa8afbb48a6ce4b62bdc44af013d78980457e1fa61eb9204818606f4c3b03c0f33cd2a841ac9bc2b73151a96e31ab99e6ec969b5f2c3edd5f9abc69845e487af992758ba445368da93dae1d44360d52a534a88276b8aaf349841d8a4788c60408618437c442308dbf70efeda2e54e9b9e4fe5f76997c9dcb945a26bd75748c85d19ca8b99264dce50580e8d4dbda401dad7df31e9a7a6a3a83bfbdfb5394abd581ac0824fbcd75d2f5205c0b7c9188e6f26bfd97734d9a20433f6cdba9d14a5f32a4d97a57f4603b21146fd1aebf082e863d463c224ad623c17d8043d3bf083f0322408dd6ead6915ac6a4222ab51480eb6e11a8913348219515170d9df90d72d7363bbda3e327d19f98c0a856f98076380e788e602e8a2ae0a1930786874dc21a2e99abda15f35457cf1dcb440c4b41350d0eda352aad7f57a0adc8a6914da06460635ed21c4c11cd1a8ec778064c9f62efba2927828b23f94b16619a5520731c2c40ab8583c9f2e73233d74b84f4877ce6b35bb1180300"}) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x400142, 0x0) (async) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x400142, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x40000071, 0x0, 0x40040304}]}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) (async) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000600)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r3 = accept4$alg(r2, 0x0, 0x0, 0x80000) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000640), 0x1c3902, 0x0) sendfile(r3, r4, 0x0, 0x20000006) (async) sendfile(r3, r4, 0x0, 0x20000006) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f0000000500)="1aac930ddf505fee9e8f49291cb5540545b7dc60a41fa92ebfdf57f0fe44a8a85d44cdc9311d0dc0620af1dd7f11cd86708a6d895659f8d087fc528b1ed12b96e30a63599a6ffb0ae67860afda3b374b70f32895f04dfd7184a93f0f9f759f0820f9cdc9a189427891ad626c0918614720e468b43a7e25a80692cee1bd132cdb610d2feb393e4cca991d598815509246841e101f9a46300b044e6e8ef0b875692ed1f8a29699cf250c8ee8cfe34d4465fb9b7358e461f793815e06d82db53ef38bdc0587ddd048359005787c11b2e90bfc25514061f6bced17e773cf28a142bf45e4ac66c8eb9242e79822a2ae45b6f329084399360a77c5371fb6a8206ffad2") r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000800)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000c00)="570000000600011000200000", 0xc) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) socket$can_bcm(0x1d, 0x2, 0x2) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000680)={'vxcan1\x00'}) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x525042, 0x0) add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x1}, 0x0, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) ptrace(0x10, 0x0) (async) ptrace(0x10, 0x0) ptrace$setregset(0x4205, 0x0, 0x1, 0x0) (async) ptrace$setregset(0x4205, 0x0, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xa, 0x4, &(0x7f0000000800)=ANY=[], &(0x7f0000000840)='GPL\x00', 0xa, 0xca, &(0x7f0000000880)=""/202, 0x60680, 0x40, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, &(0x7f0000000980)={0xfffffffc, 0x6}, 0x8, 0x10, &(0x7f00000009c0)={0x0, 0x0, 0x90a}, 0x10}, 0x94) getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000a00), 0x0) sched_setscheduler(0x0, 0x1, 0x0) (async) sched_setscheduler(0x0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="5c0000000206050800000000000000000000000005000400000000000900020073797a30000000001400078008001340000000000800064000000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="440000000a0605000000000000000000010000050900020073797a30000000000500010007000000080009400000000114000880100007800a001100aa"], 0x44}, 0x1, 0x0, 0x0, 0x8040}, 0x44000) (async) sendmsg$IPSET_CMD_ADD(r8, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="440000000a0605000000000000000000010000050900020073797a30000000000500010007000000080009400000000114000880100007800a001100aa"], 0x44}, 0x1, 0x0, 0x0, 0x8040}, 0x44000) 1.389445985s ago: executing program 3 (id=1936): r0 = semget(0x1, 0x4, 0x194) (async, rerun: 64) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) (rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x11, r1, 0xd2862000) (async) msync(&(0x7f0000ac9000/0x3000)=nil, 0x3000, 0x4) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) semctl$GETNCNT(r0, 0x4, 0xe, &(0x7f0000001b80)=""/4096) (async) r2 = open(&(0x7f0000002b80)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) fcntl$lock(r2, 0x410, &(0x7f0000002bc0)={0x1, 0x1, 0x1, 0xfffe}) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f0000002c00), 0x0, 0x0) fcntl$setstatus(r3, 0x4, 0x42000) (async) ioperm(0x3, 0x9, 0x80) timer_create(0x0, &(0x7f0000002c40)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000002c80)=0x0) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000002cc0)={0x0, 0x0, 0x10001, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000002d00)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) timer_getoverrun(r4) fremovexattr(0xffffffffffffffff, &(0x7f0000002d80)=@known='system.posix_acl_default\x00') unlink(&(0x7f0000002dc0)='./file1\x00') (async) socketpair(0x1, 0x100000005, 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002e00)={0x1, &(0x7f0000002e40)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000002e80)) getpid() semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000002ec0)) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) fsopen(&(0x7f0000001040)='cgroup2\x00', 0x0) 1.349285074s ago: executing program 0 (id=1937): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000780)={'syzkaller1\x00', 0x5001}) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000007c0)={'syzkaller1\x00', 0x1}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000800)={'syzkaller1\x00', {0x2, 0x0, @dev={0xac, 0x14, 0x0, 0x1}}}) write$tun(0xffffffffffffffff, &(0x7f0000000880)={@void, @val={0x1, 0x3, 0x1c, 0x10, 0x14, 0x6}, @ipv4=@udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x40, 0x11, 0x0, @dev={0xac, 0x14, 0x0, 0x2}, @dev={0xac, 0x14, 0x0, 0x1}}, {0x1234, 0x4e22, 0x18, 0x0, @wg=@data={0x4, 0x4, 0x4}}}}, 0x36) 1.209662886s ago: executing program 3 (id=1938): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9c000000000101060000000000000000020000003400018014000180080001007f000001080002007f0000011c0002800500010011000000060002004e2000000600030006b700003400028014000180080001007f000001080002007f0000011c00028005000100110000000600020006b70000060003004e20000008000700000003e80c00058008000100524153000c000d80080001007f00"], 0x9c}}, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$TCFLSH(r2, 0x400455c8, 0xfffffffe) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001340)=@newsa={0xf8, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@empty, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x3c}, @in6=@private0, {0x10001, 0x0, 0x2, 0x0, 0x1, 0x0, 0x59}, {0x3, 0x200000, 0x7}, {0x40000, 0x8, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x78}, [@sec_ctx={0xc, 0x8, {0x8, 0x8, 0x1}}]}, 0xf8}}, 0x0) 1.209272648s ago: executing program 0 (id=1939): sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r0 = getpid() ioprio_get$pid(0x2, r0) ptrace$setopts(0x4200, r0, 0x2, 0x1) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f0000000440)={@my=0x1}) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000940), 0x100, 0x0) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)=ANY=[@ANYBLOB="3000946d760bc732000000020601080073797a30000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x8080}, 0xc000814) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000980)={0xbf48ce7, "1803c8098800f42505f92d975e2ccd9e0003000000e4ff00", 0xffffffffffffffff}) syz_emit_ethernet(0x8e, &(0x7f0000000480)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa5}, @val={@val={0x88a8, 0x6, 0x1, 0x1}, {0x8100, 0x0, 0x0, 0xffd}}, {@x25={0x805, {0x1, 0x9, 0xf3, "3dcd06186da5f5c9716aa883ff7692cd760b1726e4e09161a7c06b6c82ebee3940e3c3b6fe5e8d4ce03ea1c5aca3a546976312a4644df982ddab9d95d95b8b66e6896685aedeb11ea8c1ba7b5d7346322a99916fd61bbb566ca76a7d174425c46e6fe2c28e4fbf615b6cd26fe8b7d397a18bd5d642"}}}}, 0x0) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000009c0), 0x1, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000a40)={"6739669f274d13b691ebe45b00e4f5b53e0ca34dd02acecdc67c5e3126628168", r4, 0xffffffffffffffff}) mkdir(&(0x7f0000000cc0)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000d00)='./config\x00', &(0x7f0000000d40)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000d80)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000dc0)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/file\x00', 0x2, 0x0) write(r7, &(0x7f0000000e40)='f', 0x1) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000a80)={0x9, "34e6498c270e0000b56a000005000000000000000000000000000100", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f0000000ac0)={"0e337b42cc00d331ff0007000000000000001a00", r8}) r9 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r9, &(0x7f00000008c0), 0x10) connect$vsock_stream(r9, &(0x7f0000000900)={0x28, 0x0, 0x0, @my=0x1}, 0x10) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r10, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000800)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x88, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4f}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x37}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}]}}}, {0x24, 0x1, 0x0, 0x1, @synproxy={{}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xb0}, 0x1, 0x0, 0x0, 0x40}, 0x24000840) socket$nl_route(0x10, 0x3, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000140)) 1.207729142s ago: executing program 3 (id=1946): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x675f, 0x9, 0x3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x4, 0x7, 0xb, 0xdc}, 0x1, r8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000400), 0x56) sendmsg$kcm(r6, &(0x7f0000000440)={&(0x7f0000000480)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000540)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 1.169677972s ago: executing program 0 (id=1940): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=ANY=[@ANYBLOB="4c0000003e00070127bd7000fefdffff017c0000040042800c00018008000600", @ANYRES32=0x0, @ANYBLOB="28000280f859ecf3bc0be63d0000ffff0541999abbb84c095c45399b51cfbb0659cc3239d12b3c8b"], 0x4c}, 0x1, 0x0, 0x0, 0x404c855}, 0xc0d4) r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$nmem0(0xffffff9c, &(0x7f0000000c00), 0x402042, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r2, 0xc018937c, &(0x7f0000000c40)={{0x1, 0x1, 0x18, r2, {0x1}}, './sys/bus/pci/devices/0000:00:04.0/remove\x00'}) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, 0x0) mkdir(&(0x7f0000000040)='./sys\x00', 0x1ff) r4 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CURSOR(r4, 0xc01c64a3, &(0x7f0000000980)={0x1, 0x0, 0x0, 0x1, 0x80, 0x4, 0x3}) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:04.0/remove\x00', 0x1, 0x0) write(r5, &(0x7f0000000140)='1', 0x1) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0x10, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000004000000b705000008000000850000006a00000095"], &(0x7f00000008c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000900)={r6}, 0xc) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r7, &(0x7f00000001c0)='1', 0x1) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000200)="adcd1a9a3fc36e96", 0x8) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000240)={'syz0\x00', {0x3, 0x402, 0x6, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0xa425, 0x2, 0x3, 0x5a720039, 0xa6, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x80000006, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x1, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c5, 0x1, 0xfffffffc, 0x5, 0x0, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10004, 0x2, 0xff, 0x5, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x208, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x1, 0x0, 0x3, 0x3, 0x4000005, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c9368f, 0xe79, 0x8000], [0x7, 0x405, 0x7, 0x1, 0xfffffffd, 0xff, 0x4, 0x2000000b, 0x6, 0x7fff, 0x0, 0x9, 0xb, 0x4, 0x5, 0x2, 0xfffffffd, 0x1ef, 0x5, 0xfffffff7, 0x86, 0x3, 0x303a, 0xfffffffd, 0xb, 0x5, 0xfffffffb, 0x6, 0x400001, 0x6, 0x7f, 0x6d05, 0x2, 0x34, 0x800003, 0x200, 0x83, 0x3, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x8a6, 0x1, 0x7, 0xffffffff, 0x5, 0x1c, 0x120000, 0x2008077f, 0x2026, 0x7, 0x4, 0x2], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x2, 0x80000000, 0xb9, 0xce4, 0x5, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x14000, 0x0, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14b, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x4, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x4, 0x200af, 0x0, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xff7]}, 0x45c) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b40)={0xffffffffffffffff, 0x300, 0x36, 0x0, &(0x7f0000000bc0)='`\x00\x00\x00\x00\x00\x00/\x00\x00\x00\x00\x00\x00', 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ppoll(&(0x7f00000006c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r8 = socket(0x2d, 0x2, 0x0) bind$xdp(r8, &(0x7f0000000700)={0x2d, 0x0, 0x0, 0xc}, 0x10) io_setup(0x8, &(0x7f0000000f40)=0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)=[0xfff8, 0xba, 0x2f]) io_submit(r9, 0x4, &(0x7f0000000f80)=[&(0x7f0000000fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000001000)='%', 0x1a000}, &(0x7f0000001040)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffe23}]) 993.516276ms ago: executing program 3 (id=1941): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000000000000000000ffffffff180800002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000400008500000004000000b7080000000000007baaf8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc) 970.693109ms ago: executing program 2 (id=1942): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a00), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000a40)={'syzkaller0\x00', 0x2}) write(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$ppp(0xffffffffffffff9c, 0x0, 0x40082, 0x0) mount(0x0, 0x0, &(0x7f0000000000)='sysfs\x00', 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x100008b}, 0x0) r1 = fsopen(&(0x7f00000000c0)='befs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000100)='uid', &(0x7f0000000140)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\bb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xd7\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000002c0), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000300), 0x2, 0x141102) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000340)=0x1000000) writev(r2, &(0x7f0000000380)=[{&(0x7f00000003c0)="94", 0xf000}, {0x0}], 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000400), 0x28041, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_GET(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[], 0x2c}}, 0x0) r4 = syz_io_uring_setup(0x26af, &(0x7f0000000500)={0x0, 0xa30d, 0x10000, 0x0, 0x3a5}, &(0x7f0000000580)=0x0, &(0x7f00000005c0)=0x0, &(0x7f0000000600)) syz_io_uring_modify_offsets$generic(r5, r6, 0x2c, 0x10000) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, 0x0) io_uring_enter(r4, 0x2883, 0xf1bd, 0x0, 0x0, 0x0) io_uring_enter(r4, 0xed4, 0x3766, 0x1, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000a80)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000884) 959.00132ms ago: executing program 3 (id=1943): r0 = io_uring_setup(0x1b56, &(0x7f0000000100)={0x0, 0x1, 0x20, 0x0, 0x2c1}) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f0000000080)=&(0x7f0000000040)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000280)={'vcan0\x00', &(0x7f0000000140)=@ethtool_link_settings={0x1, 0x8, 0x3, 0x40, 0x0, 0x5, 0x7, 0x9, 0x30, 0xe, [0x2, 0x1, 0x1ff, 0xec96, 0x5, 0xffffff7f, 0x6, 0x1]}}) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x1}) syz_io_uring_setup(0xf00, &(0x7f0000000000)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, 0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, 0x0, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) r4 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r9 = syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0xc, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)) syz_open_dev$ublk_chdev(&(0x7f0000002000), r9, 0x2) gettid() sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)=@newqdisc={0x8c, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2a, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffa]}}]}}]}, 0x8c}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0x3, &(0x7f0000000600)=ANY=[], &(0x7f0000000640)='GPL\x00', 0x2, 0xaf, &(0x7f0000000680)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000740)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000780)=0x7) r10 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000007c0)=0x400000000002) r11 = openat$sndseq(0xffffff9c, &(0x7f0000000800), 0x20000) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r11, 0xc0a45320, &(0x7f0000000840)={0x80, 0x0, 'client1\x00', 0x80000001, "786281f043ca447c", "b437067509007708e18f85bb3d22ac7a6568af9ebb8891fdffa0225452869ac0", 0x0, 0xfffffffe}) sched_setscheduler(r10, 0x2, &(0x7f0000000900)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r12, &(0x7f0000000980)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r13, &(0x7f0000000a00), 0x400000000000041, 0x0) sched_setaffinity(r10, 0x8, &(0x7f0000000a40)=0x2) recvmmsg(r12, &(0x7f0000000a80), 0x10106, 0x2, 0x0) openat$zero(0xffffff9c, &(0x7f0000000ac0), 0x0, 0x0) 894.468996ms ago: executing program 1 (id=1944): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x1c) mount$tmpfs(0x0, &(0x7f0000000280)='./file0/../file0\x00', &(0x7f00000002c0), 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='mountinfo\x00') ppoll(&(0x7f00000003c0)=[{r1, 0x24b0}], 0x1, 0x0, 0x0, 0x0) umount2(&(0x7f0000000400)='./file0/../file0\x00', 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000000000000000000ffffffff180800002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000400008500000004000000b7080000000000007baaf8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = open(&(0x7f0000000040)='./file0\x00', 0x22000, 0x2) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180), 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x1a, 0x0, 0x9, 0x7f, 0x8000, r0, 0x9, '\x00', 0x0, r4, 0x1, 0x2, 0x0, 0x0, @value=r3}, 0x50) write$9p(r3, &(0x7f0000000080)="e66fccb2a23894a2e50d1a1e77603c64de6453dab637a87fa60dd13c67373dfcfae9369cb87e71f03c8d2b5f4d38706a1cef1722c6df7a147febafa872b09c896f2a911333a86005a18e62cb6327b44930125fc945fe2094eab2bf8e60c5b37fc85da056ebb7ec706d2deca0fc0fc3d307e7186649ee7468585227b1a082ea5fb713e3d34a7748f8e6313b18b9e31215fc16a1b08a9a21a8c53e76c43a8f782542f0e58ad8664e1841e69339b36cfde51e28fb6ddd3f7024b87bcbff16de04a75368", 0xc2) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc) 867.739854ms ago: executing program 0 (id=1945): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000180)={0x1d, r1, 0x0, {0x0, 0xec}, 0x1}, 0x18) sendmsg$can_j1939(r0, &(0x7f0000000340)={&(0x7f0000000380)={0x1d, r1, 0x0, {0x0, 0xeb}, 0xfe}, 0x18, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x44001}, 0x0) (fail_nth: 2) 780.656935ms ago: executing program 0 (id=1947): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r0) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x1c, r1, 0x1, 0x70bd25, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x4008000) 666.939242ms ago: executing program 1 (id=1948): r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000000)={0xfff, 0x0, 0x3, 0x14, 0x4}) ioctl$DVB_DEMUX_DMX_ADD_PID(r0, 0x40026f33, &(0x7f00000000c0)=0x7) ioctl$DVB_DEMUX_DMX_START(r0, 0x6f29) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000480)='/proc/bus/input/devices\x00', 0x0, 0x0) poll(&(0x7f00000004c0)=[{r2, 0x402}], 0x1, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@newlink={0x50, 0x10, 0x401, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_ID={0x8, 0x1, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x50}}, 0x2000000) sendmsg$nl_xfrm(r2, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000580)=ANY=[@ANYBLOB="14002000250000023029bd7000fbdbdf25080000c94a9772392ac02c7f29f73173635d427e55aae3724d487dc0b9ea427d5fb2578583c46a17d2e67a438b8692140b5a1c2cc3aa045f036454", @ANYRESOCT=r0], 0x14}, 0x1, 0x0, 0x0, 0x4004}, 0x4040841) r3 = syz_usb_connect(0x3, 0x40, &(0x7f0000000240)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050204e5"], 0x0) socket$inet_udp(0x2, 0x2, 0x0) setns(0xc9, 0x0) r4 = socket(0x8, 0x5, 0x5) syz_usb_ep_read(r3, 0x1, 0x0, 0x0) syz_usb_ep_write(r3, 0x81, 0x40, &(0x7f0000000300)="900100"/64) ioctl$sock_SIOCOUTQNSD(r4, 0x400261f3, &(0x7f0000000340)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r10, 0xf3, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x1, 0x0, r9, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) sendmsg$NBD_CMD_CONNECT(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000080)={0x3c, r8, 0x1, 0x70bd2a, 0xffe, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) r11 = openat2$dir(0xffffff9c, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x800, 0x8, 0x9}, 0x18) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000000a499d0000000000000000020000010900010073797a310000000008000240000000030400060014000000110001"], 0x54}}, 0x0) sendmsg$NFT_MSG_GETTABLE(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000010a0101"], 0x14}, 0x1, 0x0, 0x0, 0x400c895}, 0x24000800) sendmsg$TIPC_NL_BEARER_ENABLE(r5, &(0x7f00000008c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000880)={&(0x7f00000006c0)={0x1ac, 0x0, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0xa4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00'}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x80000001, @dev={0xfe, 0x80, '\x00', 0x3f}, 0xfffffff5}}}}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x51}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x174c21e3}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'ip6_vti0\x00'}}]}, @TIPC_NLA_BEARER={0xf4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}}, {0x20, 0x2, @in6={0xa, 0x65d, 0x10, @local}}}}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'eth', 0x3a, 'wg0\x00'}}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'bond_slave_1\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, '\x00', 0x40}}}, {0x14, 0x2, @in={0x2, 0x4e22, @loopback}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1d}]}]}, 0x1ac}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) faccessat(r11, &(0x7f0000000140)='./file0\x00', 0x79) 600.731176ms ago: executing program 0 (id=1949): bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040}, 0x80) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, &(0x7f00000008c0)) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=ANY=[@ANYBLOB="40010000100001040000000000000000ac1414aa0000000000edffffffffffff6301010100000000000000000000000000000000000000000200000073000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414aa000000000000000000000000000004d232000000ac1414bb000000000000000000000000ffffffffffffff7fffffffffffffff7fffffffffffffff7fffffffffffffff7f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000020005090000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500210001000000"], 0x140}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r1, 0x107, 0xb, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000680)={'netpci0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x0}) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000100)={0x703}, 0x8) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000140)={'bridge0\x00', 0x1}) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="3800000054000104000000000000000007000000", @ANYRES32=r4, @ANYBLOB="20000100", @ANYRES32=r5, @ANYBLOB="016401010100000000200086dd0000"], 0x38}}, 0x0) r6 = openat$kvm(0xffffff9c, &(0x7f0000000240), 0x80800, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r9 = syz_ublk_setup_io_uring(0x20, &(0x7f00000006c0)={0x0, 0x5, 0x40, 0xfffffffd}, &(0x7f0000000340)=0x0, &(0x7f0000000380)=0x0, &(0x7f00000003c0)=0x0) syz_ublk_add_dev(r9, r10, r11, r12, &(0x7f0000000400)={0x2e, 0xc, 0x0, r8, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000480)=@new_dev={0x1, 0x104, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bdb5}}}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f00000004c0)={0x4, 0x0, 0xf000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000500)={[0xfffffffffffffffb, 0x806, 0x0, 0x5, 0x10003, 0x0, 0x400200cc4, 0x5, 0x7d, 0x0, 0x0, 0x0, 0x5, 0x1, 0xb9, 0x8d], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) syz_usb_connect$uac1(0x6, 0xe4, &(0x7f0000000740)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xd2, 0x3, 0x1, 0x20, 0x28, 0x8, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xfff, 0x49}, [@extension_unit={0xd, 0x24, 0x8, 0x6, 0x3, 0x5, "927307dcc9aa"}, @extension_unit={0xb, 0x24, 0x8, 0x4, 0x8000, 0x7, "52f28c9b"}, @processing_unit={0x7, 0x24, 0x7, 0x1, 0x5, 0xb7}, @feature_unit={0x9, 0x24, 0x6, 0x2, 0x5, 0x1, [0x9], 0x9}, @processing_unit={0x8, 0x24, 0x7, 0x5, 0xc, 0xfe, 'G'}, @feature_unit={0xf, 0x24, 0x6, 0x3, 0x1, 0x4, [0x4, 0x7, 0x2, 0x8], 0x81}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x2b1, 0x3, 0x2, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x12, 0x2, 0x7, {0x7, 0x25, 0x1, 0x8, 0x90, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x7f, 0xb7, 0xc, 0xf5, 0x7}, @format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x71, 0xa1, 0x2, "af"}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x4, 0x3, 0x5, 0x8, "87", "d1063d"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x0, 0x8aa, 0xf0, 0xfe}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x4, 0x7, 0xb, {0x7, 0x25, 0x1, 0x4, 0x0, 0x5}}}}}}}}]}}, &(0x7f0000000c00)={0xa, &(0x7f0000000840)={0xa, 0x6, 0x300, 0x4, 0x3, 0x6, 0x40, 0x2}, 0x13, &(0x7f0000000880)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0xc, 0xc5, 0x7, 0x7, 0xfffe, 0x3}]}, 0x3, [{0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x3c0a}}, {0xbc, &(0x7f0000000c40)=ANY=[@ANYBLOB="bc03d9bd7b02bc8179d16195affe2b8a416460471511628971b954adaec5652d600ee67439aa631515b804bb806c2d76933592109d5d1219bd1ea1ad9ba9e12213871a54c907d772bc1b9084205c2561579e0278784cc07f3abdd2cf8c14f368a9ae9e7c02454f656053d502c0a05a68852ad5b172f07509a12aa5f3193108cb7eae1da40700000000000000004ed926f842a297c603cd691c35ade9885a36663045880c31500ae25e88fe33c64b15e9b92fb128f3f8ea13d39079ac08646619598f025355f8e5cf0fc8b03f"]}, {0x4, &(0x7f0000000bc0)=@lang_id={0x4, 0x3, 0x425}}]}) r14 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x120) write(r14, &(0x7f0000000640)='0', 0x1) 0s ago: executing program 3 (id=1950): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x200000, 0x200000, 0x7}) kcmp(r0, r0, 0x7, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$BTRFS_IOC_QUOTA_RESCAN(0xffffffffffffffff, 0x4040942c, &(0x7f0000000440)={0x0, 0x7f, [0x3, 0x80000000, 0x9, 0x22b, 0x401, 0x7]}) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) read(r1, &(0x7f0000000800)=""/153, 0x99) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000007, 0x10010, r1, 0xd0fbc000) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f00000008c0)={{&(0x7f0000c67000/0x4000)=nil, 0x4000}}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1b00000000000000000000000080", @ANYRESHEX=r0, @ANYRES64, @ANYRESDEC=r1, @ANYRESHEX=r1, @ANYRES16=r0, @ANYRESDEC=r1], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1d2) mount(0x0, &(0x7f0000000240)='./sys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/usb/devices/usb1/bConfigurationValue\x00', 0x2, 0x15d) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="21032cbd7000fedbdf2501000000040003000400018028000280"], 0x44}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) write(r3, &(0x7f0000000380)="31c5dc9bb839", 0x6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000ffdbdf253b00000008000300", @ANYRES32=r6, @ANYRES64=0x0], 0x4c}, 0x1, 0x0, 0x0, 0x20028805}, 0x24000846) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000a80)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_STOP_NAN(r4, &(0x7f0000000b40)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x1c, r7, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r8}, @void}}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x0) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) syz_open_dev$radio(&(0x7f0000000180), 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x6, 0x1c, &(0x7f0000000b80)=ANY=[@ANYBLOB="18080000180000080000010001000000181100003c21cffbeba7dcb761c3", @ANYRES32=r9, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000035090100000000009500000000000000b509020002000000739a00fe00000000b509000004000000c39a04fef1000000bf8700000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000020000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x44, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f00000000c0)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0xc}, 0x94) kernel console output (not intermixed with test programs): 0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 467.677010][T12548] pci 0000:00:04.0: enabling Extended Tags [ 467.685185][T12548] pci 0000:00:04.0: Adding to iommu group 4 [ 467.693526][T12548] pci 0000:00:04.0: PCI bridge to [bus 01] [ 467.696590][T12548] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 467.696619][T12548] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 467.696687][T12548] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 467.696702][T12548] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 467.696717][T12548] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 467.696779][T12548] pci 0000:00:04.0: PCI bridge to [bus 01] [ 467.696892][T12548] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 467.699337][T12548] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 467.700306][T12548] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 467.748586][T12548] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 467.756037][T12548] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 467.917438][T12554] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1753'. [ 467.957139][T12554] pci_bus 0000:01: busn_res: [bus 01] is released [ 467.981565][T12554] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 467.986159][T12554] pci 0000:00:04.0: PCI bridge to [bus 01] [ 467.986339][T12554] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 467.986462][T12554] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 467.987973][T12554] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 467.988522][T12554] pci 0000:00:04.0: enabling Extended Tags [ 467.999389][T12554] pci 0000:00:04.0: Adding to iommu group 4 [ 468.008180][T12554] pci 0000:00:04.0: PCI bridge to [bus 01] [ 468.011219][T12554] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 468.011248][T12554] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 468.011316][T12554] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 468.011332][T12554] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 468.011346][T12554] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 468.011408][T12554] pci 0000:00:04.0: PCI bridge to [bus 01] [ 468.011464][T12554] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 468.013170][T12554] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 468.014215][T12554] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 468.058629][T12554] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 468.061686][T12554] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 468.372752][T12561] netlink: 'syz.1.1755': attribute type 2 has an invalid length. [ 468.413234][T12561] pci_bus 0000:01: busn_res: [bus 01] is released [ 468.451411][T12561] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 468.456207][T12561] pci 0000:00:04.0: PCI bridge to [bus 01] [ 468.456395][T12561] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 468.456523][T12561] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 468.458135][T12561] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 468.458702][T12561] pci 0000:00:04.0: enabling Extended Tags [ 468.468082][T12561] pci 0000:00:04.0: Adding to iommu group 4 [ 468.474039][T12561] pci 0000:00:04.0: PCI bridge to [bus 01] [ 468.476372][T12561] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 468.476399][T12561] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 468.476467][T12561] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 468.476482][T12561] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 468.476497][T12561] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 468.476562][T12561] pci 0000:00:04.0: PCI bridge to [bus 01] [ 468.476745][T12561] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 468.478012][T12561] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 468.479162][T12561] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 468.524507][T12561] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 468.534004][T12561] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 468.878610][T12571] FAULT_INJECTION: forcing a failure. [ 468.878610][T12571] name failslab, interval 1, probability 0, space 0, times 0 [ 468.878637][T12571] CPU: 1 UID: 0 PID: 12571 Comm: syz.2.1758 Not tainted syzkaller #0 PREEMPT(full) [ 468.878658][T12571] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 468.878671][T12571] Call Trace: [ 468.878703][T12571] [ 468.878712][T12571] dump_stack_lvl+0x100/0x190 [ 468.878747][T12571] should_fail_ex.cold+0x5/0xa [ 468.878774][T12571] should_failslab+0xc2/0x120 [ 468.878798][T12571] kmem_cache_alloc_noprof+0x92/0x6a0 [ 468.878831][T12571] ? dst_alloc+0x99/0x1a0 [ 468.878862][T12571] dst_alloc+0x99/0x1a0 [ 468.878891][T12571] rt_dst_alloc+0x35/0x3a0 [ 468.878919][T12571] ip_route_output_key_hash_rcu+0x87a/0x2870 [ 468.878959][T12571] ip_route_output_key_hash+0x118/0x2b0 [ 468.878989][T12571] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 468.879032][T12571] tcp_v4_connect+0x8b6/0x1c30 [ 468.879076][T12571] ? __pfx_tcp_v4_connect+0x10/0x10 [ 468.879108][T12571] ? __local_bh_enable_ip+0xa5/0x120 [ 468.879131][T12571] mptcp_connect+0x4e0/0xb70 [ 468.879161][T12571] __inet_stream_connect+0x208/0xff0 [ 468.879192][T12571] ? lock_acquire+0x1d1/0x380 [ 468.879212][T12571] ? __pfx___inet_stream_connect+0x10/0x10 [ 468.879239][T12571] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 468.879269][T12571] ? __local_bh_enable_ip+0xa5/0x120 [ 468.879291][T12571] inet_stream_connect+0x57/0xa0 [ 468.879319][T12571] __sys_connect_file+0x146/0x1a0 [ 468.879349][T12571] __sys_connect+0x141/0x170 [ 468.879372][T12571] ? __pfx___sys_connect+0x10/0x10 [ 468.879407][T12571] ? __might_fault+0xc5/0x140 [ 468.879430][T12571] ? __might_fault+0xc5/0x140 [ 468.879458][T12571] __ia32_sys_connect+0x71/0xb0 [ 468.879484][T12571] __do_fast_syscall_32+0x14b/0x8c0 [ 468.879513][T12571] do_fast_syscall_32+0x32/0x70 [ 468.879537][T12571] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 468.879560][T12571] RIP: 0023:0xf7ff8fbc [ 468.879575][T12571] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 468.879593][T12571] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 000000000000016a [ 468.879614][T12571] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000540 [ 468.879628][T12571] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 468.879640][T12571] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 468.879650][T12571] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 468.879662][T12571] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 468.879688][T12571] [ 469.309145][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 469.309328][ T5144] Bluetooth: hci0: command 0x0c24 tx timeout [ 469.493647][T12577] netlink: 'syz.2.1767': attribute type 2 has an invalid length. [ 469.494630][T12578] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1759'. [ 469.541563][T12577] pci_bus 0000:01: busn_res: [bus 01] is released [ 469.553208][T12578] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 469.556926][T12578] pci 0000:00:04.0: PCI bridge to [bus 01] [ 469.557142][T12578] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 469.557235][T12578] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 469.558820][T12578] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 469.560732][T12578] pci 0000:00:04.0: enabling Extended Tags [ 469.570082][T12578] pci 0000:00:04.0: Adding to iommu group 4 [ 469.585200][T12578] pci 0000:00:04.0: PCI bridge to [bus 01] [ 469.587742][T12578] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 469.587770][T12578] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 469.587865][T12578] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 469.587883][T12578] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 469.587899][T12578] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 469.587962][T12578] pci 0000:00:04.0: PCI bridge to [bus 01] [ 469.588016][T12578] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 469.590681][T12578] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 469.592089][T12578] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 469.635521][T12578] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 469.641797][T12578] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 469.813115][T12586] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1761'. [ 469.886123][T12586] pci_bus 0000:01: busn_res: [bus 01] is released [ 469.905200][T12587] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 469.910429][T12587] pci 0000:00:04.0: PCI bridge to [bus 01] [ 469.910597][T12587] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 469.910725][T12587] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 469.912598][T12587] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 469.913247][T12587] pci 0000:00:04.0: enabling Extended Tags [ 469.922476][T12587] pci 0000:00:04.0: Adding to iommu group 4 [ 469.934821][T12587] pci 0000:00:04.0: PCI bridge to [bus 01] [ 469.942442][T12587] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 469.942474][T12587] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 469.942548][T12587] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 469.942564][T12587] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 469.942580][T12587] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 469.948076][T12587] pci 0000:00:04.0: PCI bridge to [bus 01] [ 469.948150][T12587] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 469.949984][T12587] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 469.952833][T12587] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 470.018204][T12587] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 470.021096][T12587] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 470.088742][T12592] nvme_fcloop: unknown parameter or missing value 'roles' [ 470.192633][T12594] netlink: 'syz.3.1762': attribute type 2 has an invalid length. [ 470.252719][T12594] pci_bus 0000:01: busn_res: [bus 01] is released [ 470.268926][T12595] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 470.274672][T12595] pci 0000:00:04.0: PCI bridge to [bus 01] [ 470.274853][T12595] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 470.274963][T12595] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 470.277097][T12595] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 470.277530][T12595] pci 0000:00:04.0: enabling Extended Tags [ 470.284707][T12595] pci 0000:00:04.0: Adding to iommu group 4 [ 470.291214][T12595] pci 0000:00:04.0: PCI bridge to [bus 01] [ 470.293736][T12595] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 470.293763][T12595] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 470.293838][T12595] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 470.293855][T12595] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 470.293872][T12595] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 470.293935][T12595] pci 0000:00:04.0: PCI bridge to [bus 01] [ 470.294001][T12595] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 470.295715][T12595] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 470.296896][T12595] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 470.337008][T12595] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 470.341277][T12595] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 470.477083][T12598] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1763'. [ 470.512293][T12598] pci_bus 0000:01: busn_res: [bus 01] is released [ 470.526209][T12598] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 470.529297][T12598] pci 0000:00:04.0: PCI bridge to [bus 01] [ 470.529472][T12598] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 470.529575][T12598] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 470.531017][T12598] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 470.531469][T12598] pci 0000:00:04.0: enabling Extended Tags [ 470.537677][T12598] pci 0000:00:04.0: Adding to iommu group 4 [ 470.544593][T12598] pci 0000:00:04.0: PCI bridge to [bus 01] [ 470.546969][T12598] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 470.546996][T12598] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 470.547063][T12598] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 470.547078][T12598] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 470.547094][T12598] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 470.547156][T12598] pci 0000:00:04.0: PCI bridge to [bus 01] [ 470.547210][T12598] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 470.548628][T12598] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 470.549757][T12598] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 470.599186][T12598] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 470.608785][T12598] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 470.778538][T12602] netlink: 'syz.3.1764': attribute type 2 has an invalid length. [ 470.822320][T12602] pci_bus 0000:01: busn_res: [bus 01] is released [ 470.869536][T12602] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 470.874067][T12602] pci 0000:00:04.0: PCI bridge to [bus 01] [ 470.874257][T12602] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 470.874387][T12602] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 470.876356][T12602] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 470.876922][T12602] pci 0000:00:04.0: enabling Extended Tags [ 470.887137][T12602] pci 0000:00:04.0: Adding to iommu group 4 [ 470.895744][T12602] pci 0000:00:04.0: PCI bridge to [bus 01] [ 470.899940][T12602] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 470.899986][T12602] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 470.900112][T12602] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 470.900141][T12602] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 470.900165][T12602] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 470.900276][T12602] pci 0000:00:04.0: PCI bridge to [bus 01] [ 470.900355][T12602] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 470.902365][T12602] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 470.903570][T12602] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 470.960777][T12602] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 470.967499][T12602] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 471.145550][T12610] netlink: 'syz.3.1766': attribute type 2 has an invalid length. [ 471.202663][T12610] pci_bus 0000:01: busn_res: [bus 01] is released [ 471.233631][T12610] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 471.238816][T12610] pci 0000:00:04.0: PCI bridge to [bus 01] [ 471.239010][T12610] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 471.240018][T12610] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 471.242437][T12610] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 471.243240][T12610] pci 0000:00:04.0: enabling Extended Tags [ 471.258357][T12610] pci 0000:00:04.0: Adding to iommu group 4 [ 471.270217][T12610] pci 0000:00:04.0: PCI bridge to [bus 01] [ 471.273279][T12610] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 471.273309][T12610] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 471.273379][T12610] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 471.273394][T12610] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 471.273409][T12610] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 471.273470][T12610] pci 0000:00:04.0: PCI bridge to [bus 01] [ 471.273526][T12610] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 471.275614][T12610] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 471.277293][T12610] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 471.338526][T12610] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 471.343012][T12610] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 471.389252][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 471.399260][ T5144] Bluetooth: hci0: command 0x0c24 tx timeout [ 471.399391][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 471.532734][T12614] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1768'. [ 471.577304][T12614] pci_bus 0000:01: busn_res: [bus 01] is released [ 471.605446][T12614] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 471.608513][T12614] pci 0000:00:04.0: PCI bridge to [bus 01] [ 471.608649][T12614] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 471.608742][T12614] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 471.610241][T12614] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 471.610760][T12614] pci 0000:00:04.0: enabling Extended Tags [ 471.618510][T12614] pci 0000:00:04.0: Adding to iommu group 4 [ 471.626183][T12614] pci 0000:00:04.0: PCI bridge to [bus 01] [ 471.628441][T12614] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 471.628469][T12614] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 471.628537][T12614] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 471.628553][T12614] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 471.628568][T12614] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 471.628706][T12614] pci 0000:00:04.0: PCI bridge to [bus 01] [ 471.628786][T12614] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 471.630969][T12614] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 471.632579][T12614] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 471.690554][T12614] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 471.696565][T12614] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 471.852285][T12618] netlink: 'syz.3.1770': attribute type 2 has an invalid length. [ 471.875080][T12620] netlink: 'syz.2.1771': attribute type 2 has an invalid length. [ 471.914534][T12618] pci_bus 0000:01: busn_res: [bus 01] is released [ 471.932281][T12620] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 471.935708][T12620] pci 0000:00:04.0: PCI bridge to [bus 01] [ 471.935896][T12620] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 471.936023][T12620] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 471.938346][T12620] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 471.938810][T12620] pci 0000:00:04.0: enabling Extended Tags [ 471.946779][T12620] pci 0000:00:04.0: Adding to iommu group 4 [ 471.961706][T12620] pci 0000:00:04.0: PCI bridge to [bus 01] [ 471.964444][T12620] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 471.964474][T12620] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 471.964548][T12620] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 471.964564][T12620] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 471.964580][T12620] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 471.964646][T12620] pci 0000:00:04.0: PCI bridge to [bus 01] [ 471.964715][T12620] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 471.966329][T12620] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 471.967807][T12620] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 471.989775][T12624] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1772'. [ 472.010627][T12620] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 472.013474][T12620] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 472.075628][T12624] pci_bus 0000:01: busn_res: [bus 01] is released [ 472.087013][T12626] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 472.093830][T12626] pci 0000:00:04.0: PCI bridge to [bus 01] [ 472.093971][T12626] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 472.094064][T12626] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 472.095283][T12626] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 472.095710][T12626] pci 0000:00:04.0: enabling Extended Tags [ 472.105188][T12626] pci 0000:00:04.0: Adding to iommu group 4 [ 472.113863][T12626] pci 0000:00:04.0: PCI bridge to [bus 01] [ 472.118704][T12626] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 472.118745][T12626] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 472.118823][T12626] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 472.118840][T12626] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 472.118857][T12626] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 472.118922][T12626] pci 0000:00:04.0: PCI bridge to [bus 01] [ 472.118998][T12626] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 472.121191][T12626] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 472.122435][T12626] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 472.154868][T12628] FAULT_INJECTION: forcing a failure. [ 472.154868][T12628] name failslab, interval 1, probability 0, space 0, times 0 [ 472.154896][T12628] CPU: 1 UID: 0 PID: 12628 Comm: syz.3.1773 Not tainted syzkaller #0 PREEMPT(full) [ 472.154939][T12628] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 472.154951][T12628] Call Trace: [ 472.154959][T12628] [ 472.154968][T12628] dump_stack_lvl+0x100/0x190 [ 472.155000][T12628] should_fail_ex.cold+0x5/0xa [ 472.155029][T12628] should_failslab+0xc2/0x120 [ 472.155051][T12628] kmem_cache_alloc_noprof+0x92/0x6a0 [ 472.155083][T12628] ? dst_alloc+0x99/0x1a0 [ 472.155113][T12628] dst_alloc+0x99/0x1a0 [ 472.155143][T12628] rt_dst_alloc+0x35/0x3a0 [ 472.155169][T12628] ip_route_output_key_hash_rcu+0x87a/0x2870 [ 472.155206][T12628] ip_route_output_key_hash+0x118/0x2b0 [ 472.155234][T12628] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 472.155275][T12628] tcp_v4_connect+0x8b6/0x1c30 [ 472.155322][T12628] ? __pfx_tcp_v4_connect+0x10/0x10 [ 472.155355][T12628] ? __local_bh_enable_ip+0xa5/0x120 [ 472.155379][T12628] mptcp_connect+0x4e0/0xb70 [ 472.155407][T12628] __inet_stream_connect+0x208/0xff0 [ 472.155438][T12628] ? lock_acquire+0x1d1/0x380 [ 472.155458][T12628] ? __pfx___inet_stream_connect+0x10/0x10 [ 472.155491][T12628] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 472.155523][T12628] ? __local_bh_enable_ip+0xa5/0x120 [ 472.155545][T12628] inet_stream_connect+0x57/0xa0 [ 472.155572][T12628] __sys_connect_file+0x146/0x1a0 [ 472.155599][T12628] __sys_connect+0x141/0x170 [ 472.155620][T12628] ? __pfx___sys_connect+0x10/0x10 [ 472.155651][T12628] ? __might_fault+0xc5/0x140 [ 472.155673][T12628] ? __might_fault+0xc5/0x140 [ 472.155699][T12628] __ia32_sys_connect+0x71/0xb0 [ 472.155721][T12628] __do_fast_syscall_32+0x14b/0x8c0 [ 472.155749][T12628] do_fast_syscall_32+0x32/0x70 [ 472.155774][T12628] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 472.155822][T12628] RIP: 0023:0xf73befbc [ 472.155839][T12628] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 472.155858][T12628] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 000000000000016a [ 472.155880][T12628] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000540 [ 472.155892][T12628] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 472.155903][T12628] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 472.155913][T12628] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 472.155924][T12628] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 472.155950][T12628] [ 472.174291][T12630] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1774'. [ 472.187188][T12626] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 472.192318][T12626] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 472.231635][T12630] pci_bus 0000:01: busn_res: [bus 01] is released [ 472.241909][T12632] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 472.246078][T12632] pci 0000:00:04.0: PCI bridge to [bus 01] [ 472.246305][T12632] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 472.246433][T12632] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 472.248160][T12632] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 472.248763][T12632] pci 0000:00:04.0: enabling Extended Tags [ 472.259844][T12632] pci 0000:00:04.0: Adding to iommu group 4 [ 472.272808][T12632] pci 0000:00:04.0: PCI bridge to [bus 01] [ 472.275564][T12632] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 472.275610][T12632] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 472.275735][T12632] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 472.275761][T12632] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 472.275815][T12632] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 472.275937][T12632] pci 0000:00:04.0: PCI bridge to [bus 01] [ 472.276016][T12632] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 472.277814][T12632] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 472.279196][T12632] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 472.352340][T12632] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 472.356592][T12632] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 472.403690][T12635] netlink: 'syz.0.1775': attribute type 2 has an invalid length. [ 472.441529][T12635] pci_bus 0000:01: busn_res: [bus 01] is released [ 472.474844][T12635] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 472.477696][T12635] pci 0000:00:04.0: PCI bridge to [bus 01] [ 472.478074][T12635] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 472.478168][T12635] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 472.479577][T12635] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 472.480099][T12635] pci 0000:00:04.0: enabling Extended Tags [ 472.487120][T12635] pci 0000:00:04.0: Adding to iommu group 4 [ 472.500200][T12635] pci 0000:00:04.0: PCI bridge to [bus 01] [ 472.502379][T12635] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 472.502412][T12635] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 472.502481][T12635] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 472.502496][T12635] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 472.502512][T12635] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 472.502620][T12635] pci 0000:00:04.0: PCI bridge to [bus 01] [ 472.502693][T12635] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 472.504024][T12635] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 472.505182][T12635] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 472.570047][T12635] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 472.573191][T12635] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 472.952551][T12649] pci_bus 0000:01: busn_res: [bus 01] is released [ 472.993605][T12650] nvme_fcloop: unknown parameter or missing value 'lpwwpn=' [ 472.995995][T12649] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 473.004009][T12649] pci 0000:00:04.0: PCI bridge to [bus 01] [ 473.004177][T12649] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 473.004292][T12649] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 473.007919][T12649] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 473.008528][T12649] pci 0000:00:04.0: enabling Extended Tags [ 473.024468][T12649] pci 0000:00:04.0: Adding to iommu group 4 [ 473.032749][T12649] pci 0000:00:04.0: PCI bridge to [bus 01] [ 473.036597][T12649] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 473.036627][T12649] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 473.036697][T12649] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 473.036711][T12649] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 473.036727][T12649] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 473.036787][T12649] pci 0000:00:04.0: PCI bridge to [bus 01] [ 473.036847][T12649] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 473.038814][T12649] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 473.039845][T12649] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 473.095495][T12649] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 473.101122][T12649] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 473.469163][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 473.479307][ T5144] Bluetooth: hci0: command 0x0c24 tx timeout [ 473.479340][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 474.346971][T12655] netlink: 'syz.2.1780': attribute type 2 has an invalid length. [ 474.413753][T12655] pci_bus 0000:01: busn_res: [bus 01] is released [ 474.427056][T12658] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 474.435270][T12658] pci 0000:00:04.0: PCI bridge to [bus 01] [ 474.435471][T12658] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 474.435604][T12658] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 474.437986][T12658] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 474.438561][T12658] pci 0000:00:04.0: enabling Extended Tags [ 474.448034][T12658] pci 0000:00:04.0: Adding to iommu group 4 [ 474.456975][T12658] pci 0000:00:04.0: PCI bridge to [bus 01] [ 474.460772][T12658] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 474.460815][T12658] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 474.460894][T12658] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 474.460910][T12658] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 474.460927][T12658] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 474.461030][T12658] pci 0000:00:04.0: PCI bridge to [bus 01] [ 474.461100][T12658] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 474.462764][T12658] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 474.464032][T12658] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 474.502674][T12658] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 474.505790][T12658] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 474.641878][T12662] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1781'. [ 474.676853][T12664] netlink: 'syz.0.1782': attribute type 2 has an invalid length. [ 474.692132][T12662] pci_bus 0000:01: busn_res: [bus 01] is released [ 474.712573][T12664] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 474.716706][T12664] pci 0000:00:04.0: PCI bridge to [bus 01] [ 474.716845][T12664] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 474.717016][T12664] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 474.719161][T12664] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 474.719909][T12664] pci 0000:00:04.0: enabling Extended Tags [ 474.727750][T12664] pci 0000:00:04.0: Adding to iommu group 4 [ 474.735218][T12664] pci 0000:00:04.0: PCI bridge to [bus 01] [ 474.739191][T12664] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 474.739219][T12664] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 474.739295][T12664] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 474.739311][T12664] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 474.739328][T12664] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 474.739428][T12664] pci 0000:00:04.0: PCI bridge to [bus 01] [ 474.739495][T12664] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 474.741427][T12664] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 474.742632][T12664] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 474.793739][T12664] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 474.800014][T12664] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 474.988603][T12673] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1784'. [ 475.061120][T12673] pci_bus 0000:01: busn_res: [bus 01] is released [ 475.086494][T12676] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 475.092367][T12676] pci 0000:00:04.0: PCI bridge to [bus 01] [ 475.092568][T12676] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 475.092823][T12676] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 475.095520][T12676] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 475.096362][T12676] pci 0000:00:04.0: enabling Extended Tags [ 475.116189][T12676] pci 0000:00:04.0: Adding to iommu group 4 [ 475.147814][T12676] pci 0000:00:04.0: PCI bridge to [bus 01] [ 475.157046][T12676] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 475.157098][T12676] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 475.157217][T12676] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 475.157245][T12676] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 475.157273][T12676] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 475.157390][T12676] pci 0000:00:04.0: PCI bridge to [bus 01] [ 475.157625][T12676] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 475.161754][T12676] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 475.164437][T12676] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 475.261415][T12676] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 475.272828][T12676] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 475.559213][ T5144] Bluetooth: hci0: command 0x0c24 tx timeout [ 475.559309][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 476.028028][T12687] mmap: syz.0.1789 (12687) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 476.044390][T12688] nvme_fcloop: unknown parameter or missing value 'lpwwpn=' [ 476.387746][T12691] netlink: 'syz.1.1790': attribute type 2 has an invalid length. [ 476.448196][T12691] pci_bus 0000:01: busn_res: [bus 01] is released [ 476.464057][T12692] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 476.468235][T12692] pci 0000:00:04.0: PCI bridge to [bus 01] [ 476.468414][T12692] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 476.468536][T12692] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 476.480014][T12692] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 476.480602][T12692] pci 0000:00:04.0: enabling Extended Tags [ 476.490328][T12692] pci 0000:00:04.0: Adding to iommu group 4 [ 476.503006][T12692] pci 0000:00:04.0: PCI bridge to [bus 01] [ 476.506459][T12692] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 476.506501][T12692] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 476.506606][T12692] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 476.506630][T12692] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 476.506654][T12692] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 476.506810][T12692] pci 0000:00:04.0: PCI bridge to [bus 01] [ 476.506896][T12692] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 476.510212][T12692] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 476.511541][T12692] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 476.564870][T12692] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 476.568410][T12692] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 476.578140][T12695] netlink: 'syz.0.1791': attribute type 2 has an invalid length. [ 476.637500][T12695] pci_bus 0000:01: busn_res: [bus 01] is released [ 476.653040][T12696] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 476.657556][T12696] pci 0000:00:04.0: PCI bridge to [bus 01] [ 476.657747][T12696] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 476.657875][T12696] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 476.664212][T12696] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 476.664770][T12696] pci 0000:00:04.0: enabling Extended Tags [ 476.672678][T12696] pci 0000:00:04.0: Adding to iommu group 4 [ 476.680311][T12696] pci 0000:00:04.0: PCI bridge to [bus 01] [ 476.682156][T12696] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 476.682197][T12696] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 476.682271][T12696] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 476.682291][T12696] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 476.682307][T12696] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 476.682492][T12696] pci 0000:00:04.0: PCI bridge to [bus 01] [ 476.682554][T12696] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 476.684213][T12696] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 476.685427][T12696] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 476.725289][T12696] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 476.731797][T12696] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 476.952592][T12705] nvme_fcloop: unknown parameter or missing value 'lpwwpn=' [ 476.957590][T12702] FAULT_INJECTION: forcing a failure. [ 476.957590][T12702] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 476.957606][T12702] CPU: 1 UID: 0 PID: 12702 Comm: syz.0.1793 Not tainted syzkaller #0 PREEMPT(full) [ 476.957618][T12702] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 476.957625][T12702] Call Trace: [ 476.957629][T12702] [ 476.957634][T12702] dump_stack_lvl+0x100/0x190 [ 476.957654][T12702] should_fail_ex.cold+0x5/0xa [ 476.957669][T12702] _copy_from_user+0x2e/0xd0 [ 476.957687][T12702] move_addr_to_kernel+0x65/0x170 [ 476.957701][T12702] get_compat_msghdr+0x3c7/0x480 [ 476.957729][T12702] ? __pfx_get_compat_msghdr+0x10/0x10 [ 476.957746][T12702] ___sys_sendmsg+0x1b6/0x1e0 [ 476.957759][T12702] ? __pfx____sys_sendmsg+0x10/0x10 [ 476.957776][T12702] ? find_held_lock+0x2b/0x80 [ 476.957799][T12702] __sys_sendmsg+0x160/0x210 [ 476.957815][T12702] ? __pfx___sys_sendmsg+0x10/0x10 [ 476.957836][T12702] __do_fast_syscall_32+0x14b/0x8c0 [ 476.957850][T12702] ? lockdep_hardirqs_on+0x7d/0x110 [ 476.957864][T12702] do_fast_syscall_32+0x32/0x70 [ 476.957878][T12702] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 476.957892][T12702] RIP: 0023:0xf748efbc [ 476.957901][T12702] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 476.957911][T12702] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 476.957922][T12702] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000440 [ 476.957933][T12702] RDX: 0000000020004801 RSI: 0000000000000000 RDI: 0000000000000000 [ 476.957939][T12702] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 476.957958][T12702] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 476.957964][T12702] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 476.957978][T12702] [ 477.096955][T12709] syzkaller0: entered promiscuous mode [ 477.096971][T12709] syzkaller0: entered allmulticast mode [ 477.639163][ T5144] Bluetooth: hci0: command 0x0c24 tx timeout [ 477.640249][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 478.383105][T12720] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1796'. [ 478.433752][T12720] pci_bus 0000:01: busn_res: [bus 01] is released [ 478.457523][T12725] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 478.464544][T12725] pci 0000:00:04.0: PCI bridge to [bus 01] [ 478.464913][T12725] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 478.465101][T12725] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 478.467362][T12725] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 478.468050][T12725] pci 0000:00:04.0: enabling Extended Tags [ 478.481019][T12725] pci 0000:00:04.0: Adding to iommu group 4 [ 478.497861][T12725] pci 0000:00:04.0: PCI bridge to [bus 01] [ 478.503454][T12725] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 478.503484][T12725] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 478.503553][T12725] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 478.503567][T12725] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 478.503583][T12725] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 478.503648][T12725] pci 0000:00:04.0: PCI bridge to [bus 01] [ 478.503714][T12725] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 478.508105][T12725] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 478.512683][T12725] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 478.619630][T12725] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 478.629899][T12725] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 478.820781][T12733] netlink: 'syz.0.1800': attribute type 2 has an invalid length. [ 479.319426][T12733] pci_bus 0000:01: busn_res: [bus 01] is released [ 479.361699][T12735] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 479.366450][T12735] pci 0000:00:04.0: PCI bridge to [bus 01] [ 479.366632][T12735] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 479.366755][T12735] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 479.368733][T12735] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 479.369595][T12735] pci 0000:00:04.0: enabling Extended Tags [ 479.381826][T12735] pci 0000:00:04.0: Adding to iommu group 4 [ 479.398628][T12735] pci 0000:00:04.0: PCI bridge to [bus 01] [ 479.402705][T12735] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 479.402751][T12735] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 479.403194][T12735] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 479.403224][T12735] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 479.403252][T12735] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 479.403366][T12735] pci 0000:00:04.0: PCI bridge to [bus 01] [ 479.403445][T12735] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 479.405080][T12735] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 479.406249][T12735] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 479.476707][T12735] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 479.487194][T12735] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 479.575455][T12740] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1801'. [ 479.634704][T12740] pci_bus 0000:01: busn_res: [bus 01] is released [ 479.654372][T12743] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 479.657766][T12743] pci 0000:00:04.0: PCI bridge to [bus 01] [ 479.657920][T12743] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 479.658033][T12743] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 479.660270][T12743] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 479.660974][T12743] pci 0000:00:04.0: enabling Extended Tags [ 479.675387][T12743] pci 0000:00:04.0: Adding to iommu group 4 [ 479.691096][T12743] pci 0000:00:04.0: PCI bridge to [bus 01] [ 479.694865][T12743] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 479.694914][T12743] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 479.695032][T12743] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 479.695060][T12743] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 479.695088][T12743] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 479.695331][T12743] pci 0000:00:04.0: PCI bridge to [bus 01] [ 479.695414][T12743] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 479.698049][T12743] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 479.702692][T12743] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 479.709371][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 479.709656][ T5144] Bluetooth: hci0: command 0x0c24 tx timeout [ 479.709739][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 479.793571][T12743] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 479.803787][T12743] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 480.779503][T12768] netlink: 'syz.3.1809': attribute type 2 has an invalid length. [ 480.822521][T12768] pci_bus 0000:01: busn_res: [bus 01] is released [ 480.856340][T12768] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 480.862445][T12768] pci 0000:00:04.0: PCI bridge to [bus 01] [ 480.862831][T12768] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 480.862977][T12768] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 480.866327][T12768] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 480.867502][T12768] pci 0000:00:04.0: enabling Extended Tags [ 480.884226][T12768] pci 0000:00:04.0: Adding to iommu group 4 [ 480.900715][T12768] pci 0000:00:04.0: PCI bridge to [bus 01] [ 480.905189][T12768] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 480.905237][T12768] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 480.905367][T12768] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 480.905396][T12768] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 480.905425][T12768] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 480.906666][T12768] pci 0000:00:04.0: PCI bridge to [bus 01] [ 480.906752][T12768] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 480.908645][T12768] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 480.911911][T12768] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 481.005947][T12768] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 481.010110][T12768] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 481.142382][T12772] netlink: 'syz.3.1810': attribute type 2 has an invalid length. [ 481.187730][T12772] pci_bus 0000:01: busn_res: [bus 01] is released [ 481.230728][T12772] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 481.234642][T12772] pci 0000:00:04.0: PCI bridge to [bus 01] [ 481.235072][T12772] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 481.235165][T12772] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 481.236799][T12772] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 481.237226][T12772] pci 0000:00:04.0: enabling Extended Tags [ 481.243794][T12772] pci 0000:00:04.0: Adding to iommu group 4 [ 481.250561][T12775] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1811'. [ 481.254072][T12772] pci 0000:00:04.0: PCI bridge to [bus 01] [ 481.256263][T12772] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 481.256291][T12772] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 481.256358][T12772] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 481.256373][T12772] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 481.256388][T12772] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 481.256451][T12772] pci 0000:00:04.0: PCI bridge to [bus 01] [ 481.256530][T12772] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 481.258069][T12772] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 481.259241][T12772] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 481.301400][T12772] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 481.308106][T12772] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 481.341503][T12775] pci_bus 0000:01: busn_res: [bus 01] is released [ 481.349917][T12777] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 481.353665][T12777] pci 0000:00:04.0: PCI bridge to [bus 01] [ 481.353802][T12777] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 481.353896][T12777] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 481.355395][T12777] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 481.355883][T12777] pci 0000:00:04.0: enabling Extended Tags [ 481.363103][T12777] pci 0000:00:04.0: Adding to iommu group 4 [ 481.371250][T12777] pci 0000:00:04.0: PCI bridge to [bus 01] [ 481.374302][T12777] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 481.374332][T12777] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 481.374488][T12777] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 481.374506][T12777] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 481.374522][T12777] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 481.374584][T12777] pci 0000:00:04.0: PCI bridge to [bus 01] [ 481.374749][T12777] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 481.376126][T12777] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 481.377120][T12777] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 481.417281][T12777] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 481.419788][T12777] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 481.583032][T12783] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1813'. [ 481.623427][T12783] pci_bus 0000:01: busn_res: [bus 01] is released [ 481.665275][T12785] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 481.669703][T12785] pci 0000:00:04.0: PCI bridge to [bus 01] [ 481.669863][T12785] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 481.669977][T12785] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 481.675080][T12785] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 481.675877][T12785] pci 0000:00:04.0: enabling Extended Tags [ 481.698397][T12785] pci 0000:00:04.0: Adding to iommu group 4 [ 481.734038][T12785] pci 0000:00:04.0: PCI bridge to [bus 01] [ 481.738791][T12785] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 481.738822][T12785] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 481.738892][T12785] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 481.738907][T12785] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 481.738923][T12785] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 481.738984][T12785] pci 0000:00:04.0: PCI bridge to [bus 01] [ 481.741393][T12785] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 481.742813][T12785] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 481.746124][T12785] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 481.789227][ T5144] Bluetooth: hci0: command 0x0c24 tx timeout [ 481.789313][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 481.952963][T12785] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 482.008531][T12785] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 482.454085][T12793] netlink: 'syz.3.1817': attribute type 2 has an invalid length. [ 482.584506][T12793] pci_bus 0000:01: busn_res: [bus 01] is released [ 482.786084][T12800] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 482.791670][T12800] pci 0000:00:04.0: PCI bridge to [bus 01] [ 482.791875][T12800] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 482.800694][T12800] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 482.801825][T12800] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 482.802291][T12800] pci 0000:00:04.0: enabling Extended Tags [ 482.826540][T12800] pci 0000:00:04.0: Adding to iommu group 4 [ 482.839203][T12800] pci 0000:00:04.0: PCI bridge to [bus 01] [ 482.843467][T12800] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 482.843498][T12800] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 482.843566][T12800] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 482.843581][T12800] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 482.843596][T12800] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 482.843658][T12800] pci 0000:00:04.0: PCI bridge to [bus 01] [ 482.845960][T12800] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 482.847676][T12800] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 482.849004][T12800] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 482.920817][T12800] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 482.923134][T12800] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 483.162581][T12808] device-mapper: table: 248:0: crypt: Integrity profile not supported. (-EINVAL) [ 483.162605][T12808] device-mapper: ioctl: error adding target to table [ 483.277642][T12817] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1822'. [ 483.325507][T12817] pci_bus 0000:01: busn_res: [bus 01] is released [ 483.446494][T12818] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 483.454803][T12818] pci 0000:00:04.0: PCI bridge to [bus 01] [ 483.454981][T12818] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 483.455127][T12818] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 483.457166][T12818] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 483.458182][T12818] pci 0000:00:04.0: enabling Extended Tags [ 483.471060][T12818] pci 0000:00:04.0: Adding to iommu group 4 [ 483.486175][T12818] pci 0000:00:04.0: PCI bridge to [bus 01] [ 483.492479][T12818] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 483.492525][T12818] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 483.492643][T12818] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 483.492668][T12818] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 483.492694][T12818] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 483.492807][T12818] pci 0000:00:04.0: PCI bridge to [bus 01] [ 483.492900][T12818] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 483.495517][T12818] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 483.497170][T12818] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 483.552709][T12818] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 483.557073][T12818] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 483.869137][ T5144] Bluetooth: hci0: command 0x0c24 tx timeout [ 483.869224][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 485.959683][ T5144] Bluetooth: hci0: command 0x0c24 tx timeout [ 485.959783][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 486.005232][T12852] netlink: 'syz.2.1832': attribute type 2 has an invalid length. [ 486.059808][T12852] pci_bus 0000:01: busn_res: [bus 01] is released [ 486.075690][T12855] FAULT_INJECTION: forcing a failure. [ 486.075690][T12855] name fail_futex, interval 1, probability 0, space 0, times 0 [ 486.075709][T12855] CPU: 2 UID: 0 PID: 12855 Comm: syz.0.1829 Not tainted syzkaller #0 PREEMPT(full) [ 486.075747][T12855] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 486.075754][T12855] Call Trace: [ 486.075758][T12855] [ 486.075763][T12855] dump_stack_lvl+0x100/0x190 [ 486.075785][T12855] should_fail_ex.cold+0x5/0xa [ 486.075801][T12855] get_futex_key+0x1c9/0x13e0 [ 486.075818][T12855] ? __pfx_get_futex_key+0x10/0x10 [ 486.075836][T12855] futex_wait_setup+0x91/0x540 [ 486.075851][T12855] __futex_wait+0x19f/0x360 [ 486.075863][T12855] ? __pfx___futex_wait+0x10/0x10 [ 486.075874][T12855] ? __pfx_try_to_wake_up+0x10/0x10 [ 486.075885][T12855] ? futex_hash+0x311/0x400 [ 486.075900][T12855] ? __pfx_futex_wake_mark+0x10/0x10 [ 486.075912][T12855] ? find_held_lock+0x2b/0x80 [ 486.075927][T12855] ? futex_wake+0x4ea/0x5e0 [ 486.075941][T12855] futex_wait+0xe6/0x370 [ 486.075953][T12855] ? __pfx_futex_wait+0x10/0x10 [ 486.075967][T12855] ? __css_rstat_updated+0x1ce/0x590 [ 486.075980][T12855] ? __pfx___handle_mm_fault+0x10/0x10 [ 486.075993][T12855] ? __pfx___css_rstat_updated+0x10/0x10 [ 486.076008][T12855] do_futex+0x265/0x440 [ 486.076023][T12855] ? __pfx_do_futex+0x10/0x10 [ 486.076041][T12855] __ia32_sys_futex_time32+0x2f4/0x470 [ 486.076059][T12855] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 486.076075][T12855] ? __might_fault+0xc5/0x140 [ 486.076091][T12855] __do_fast_syscall_32+0x14b/0x8c0 [ 486.076108][T12855] do_fast_syscall_32+0x32/0x70 [ 486.076122][T12855] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 486.076135][T12855] RIP: 0023:0xf748efbc [ 486.076144][T12855] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 486.076153][T12855] RSP: 002b:00000000f54a65bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 486.076165][T12855] RAX: ffffffffffffffda RBX: 00000000f74b4f88 RCX: 0000000000000080 [ 486.076171][T12855] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f74b4f8c [ 486.076178][T12855] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 486.076184][T12855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 486.076190][T12855] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 486.076205][T12855] [ 486.078942][T12854] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 486.090907][T12855] rxe_eth0 speed is unknown, defaulting to 1000 [ 486.172753][T12854] pci 0000:00:04.0: PCI bridge to [bus 01] [ 486.172892][T12854] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 486.172988][T12854] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 486.174462][T12854] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 486.176607][T12854] pci 0000:00:04.0: enabling Extended Tags [ 486.187906][T12854] pci 0000:00:04.0: Adding to iommu group 4 [ 486.200087][T12854] pci 0000:00:04.0: PCI bridge to [bus 01] [ 486.202813][T12854] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 486.202862][T12854] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 486.202973][T12854] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 486.202998][T12854] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 486.203023][T12854] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 486.203147][T12854] pci 0000:00:04.0: PCI bridge to [bus 01] [ 486.203229][T12854] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 486.205578][T12854] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 486.207024][T12854] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 486.267101][T12854] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 486.269878][T12854] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 486.347821][T12861] netlink: 'syz.1.1835': attribute type 2 has an invalid length. [ 486.627559][T12861] pci_bus 0000:01: busn_res: [bus 01] is released [ 486.786972][T12878] netlink: 'syz.3.1837': attribute type 2 has an invalid length. [ 486.795836][T12878] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 486.802118][T12878] pci 0000:00:04.0: PCI bridge to [bus 01] [ 486.802256][T12878] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 486.802349][T12878] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 486.803879][T12878] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 486.804402][T12878] pci 0000:00:04.0: enabling Extended Tags [ 486.818204][T12878] pci 0000:00:04.0: Adding to iommu group 4 [ 486.832915][T12878] pci 0000:00:04.0: PCI bridge to [bus 01] [ 486.834879][T12878] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 486.834906][T12878] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 486.835048][T12878] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 486.835066][T12878] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 486.835156][T12878] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 486.835222][T12878] pci 0000:00:04.0: PCI bridge to [bus 01] [ 486.835293][T12878] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 486.836975][T12878] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 486.838244][T12878] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 486.954114][T12878] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 486.963968][T12878] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 487.408235][T12887] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1840'. [ 487.408262][T12887] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1840'. [ 487.423284][T12887] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1840'. [ 487.599749][T12896] device-mapper: table: 248:2: crypt: Integrity profile not supported. (-EINVAL) [ 487.599767][T12896] device-mapper: ioctl: error adding target to table [ 488.029131][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 488.029160][ T5144] Bluetooth: hci0: command 0x0c24 tx timeout [ 488.278056][T12904] FAULT_INJECTION: forcing a failure. [ 488.278056][T12904] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 488.278083][T12904] CPU: 0 UID: 0 PID: 12904 Comm: syz.2.1846 Not tainted syzkaller #0 PREEMPT(full) [ 488.278104][T12904] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 488.278114][T12904] Call Trace: [ 488.278121][T12904] [ 488.278129][T12904] dump_stack_lvl+0x100/0x190 [ 488.278160][T12904] should_fail_ex.cold+0x5/0xa [ 488.278187][T12904] _copy_from_iter+0x1f4/0x16c0 [ 488.278237][T12904] ? __pfx__copy_from_iter+0x10/0x10 [ 488.278264][T12904] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 488.278289][T12904] ? lock_acquire+0x1d1/0x380 [ 488.278318][T12904] copy_page_from_iter+0x238/0x300 [ 488.278347][T12904] tun_build_skb.constprop.0+0x2ea/0x18f0 [ 488.278414][T12904] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 488.278438][T12904] ? __lock_acquire+0x5c0/0x1f40 [ 488.278467][T12904] ? lock_acquire+0x1d1/0x380 [ 488.278484][T12904] ? aa_file_perm+0x197/0x14d0 [ 488.278508][T12904] tun_get_user+0x1763/0x3ee0 [ 488.278536][T12904] ? __lock_acquire+0x5c0/0x1f40 [ 488.278555][T12904] ? __pfx_tun_get_user+0x10/0x10 [ 488.278576][T12904] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 488.278608][T12904] ? find_held_lock+0x2b/0x80 [ 488.278632][T12904] ? tun_get+0x191/0x370 [ 488.278647][T12904] ? tun_get+0x191/0x370 [ 488.278670][T12904] tun_chr_write_iter+0xdc/0x200 [ 488.278691][T12904] vfs_write+0x6af/0x1050 [ 488.278711][T12904] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 488.278732][T12904] ? __pfx_vfs_write+0x10/0x10 [ 488.278748][T12904] ? find_held_lock+0x2b/0x80 [ 488.278789][T12904] ksys_write+0x12a/0x250 [ 488.278806][T12904] ? __pfx_ksys_write+0x10/0x10 [ 488.278833][T12904] do_int80_emulation+0x166/0x650 [ 488.278860][T12904] asm_int80_emulation+0x1a/0x20 [ 488.278879][T12904] RIP: 0023:0xf71e7f6b [ 488.278893][T12904] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 488.278909][T12904] RSP: 002b:00000000f54a644c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 488.278926][T12904] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000580 [ 488.278938][T12904] RDX: 0000000000000046 RSI: 0000000000000000 RDI: 0000000000000000 [ 488.278949][T12904] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 488.278958][T12904] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 488.278968][T12904] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 488.278992][T12904] [ 488.293279][T12906] netlink: 'syz.1.1845': attribute type 2 has an invalid length. [ 488.598237][T12906] pci_bus 0000:01: busn_res: [bus 01] is released [ 488.746226][T12912] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 488.764945][T12912] pci 0000:00:04.0: PCI bridge to [bus 01] [ 488.784987][T12912] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 488.785145][T12912] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 488.786845][T12912] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 488.793853][T12912] pci 0000:00:04.0: enabling Extended Tags [ 488.829502][T12912] pci 0000:00:04.0: Adding to iommu group 4 [ 488.844200][T12912] pci 0000:00:04.0: PCI bridge to [bus 01] [ 488.846488][T12912] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 488.846517][T12912] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 488.846587][T12912] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 488.846601][T12912] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 488.846617][T12912] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 488.846680][T12912] pci 0000:00:04.0: PCI bridge to [bus 01] [ 488.846737][T12912] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 488.848470][T12912] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 488.849683][T12912] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 488.896289][T12912] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 488.898990][T12912] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 490.033500][T12929] netlink: 'syz.1.1851': attribute type 2 has an invalid length. [ 490.109244][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 490.119180][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 490.119286][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 490.246096][T12935] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1852'. [ 490.246137][T12935] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1852'. [ 490.255478][T12935] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1852'. [ 490.486093][T12942] netlink: 'syz.1.1854': attribute type 1 has an invalid length. [ 490.497969][T12942] 8021q: adding VLAN 0 to HW filter on device bond1 [ 490.818831][T12949] FAULT_INJECTION: forcing a failure. [ 490.818831][T12949] name failslab, interval 1, probability 0, space 0, times 0 [ 490.818851][T12949] CPU: 0 UID: 0 PID: 12949 Comm: syz.3.1856 Not tainted syzkaller #0 PREEMPT(full) [ 490.818863][T12949] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 490.818869][T12949] Call Trace: [ 490.818873][T12949] [ 490.818878][T12949] dump_stack_lvl+0x100/0x190 [ 490.818898][T12949] should_fail_ex.cold+0x5/0xa [ 490.818914][T12949] should_failslab+0xc2/0x120 [ 490.818927][T12949] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 490.818944][T12949] ? __alloc_skb+0x5b7/0x710 [ 490.818958][T12949] ? __alloc_skb+0x140/0x710 [ 490.818974][T12949] __alloc_skb+0x140/0x710 [ 490.818987][T12949] ? __alloc_skb+0x5b7/0x710 [ 490.819000][T12949] ? __pfx___alloc_skb+0x10/0x10 [ 490.819018][T12949] netlink_alloc_large_skb+0x69/0x150 [ 490.819060][T12949] netlink_sendmsg+0x755/0x10c0 [ 490.819078][T12949] ? __pfx_netlink_sendmsg+0x10/0x10 [ 490.819096][T12949] ? apparmor_socket_sendmsg+0x165/0x280 [ 490.819112][T12949] ? ____sys_sendmsg+0xa99/0xc30 [ 490.819122][T12949] ____sys_sendmsg+0xa99/0xc30 [ 490.819133][T12949] ? __pfx_netlink_sendmsg+0x10/0x10 [ 490.819149][T12949] ? __pfx_____sys_sendmsg+0x10/0x10 [ 490.819166][T12949] ___sys_sendmsg+0x190/0x1e0 [ 490.819179][T12949] ? __pfx____sys_sendmsg+0x10/0x10 [ 490.819197][T12949] ? find_held_lock+0x2b/0x80 [ 490.819221][T12949] __sys_sendmsg+0x160/0x210 [ 490.819236][T12949] ? __pfx___sys_sendmsg+0x10/0x10 [ 490.819258][T12949] __do_fast_syscall_32+0x14b/0x8c0 [ 490.819273][T12949] ? lockdep_hardirqs_on+0x7d/0x110 [ 490.819287][T12949] do_fast_syscall_32+0x32/0x70 [ 490.819301][T12949] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 490.819314][T12949] RIP: 0023:0xf73befbc [ 490.819323][T12949] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 490.819333][T12949] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 490.819344][T12949] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080001640 [ 490.819351][T12949] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 490.819357][T12949] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 490.819363][T12949] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 490.819370][T12949] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 490.819383][T12949] [ 490.822625][T12950] syz.1.1857 uses obsolete (PF_INET,SOCK_PACKET) [ 490.824500][T12950] FAULT_INJECTION: forcing a failure. [ 490.824500][T12950] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 490.824516][T12950] CPU: 2 UID: 0 PID: 12950 Comm: syz.1.1857 Not tainted syzkaller #0 PREEMPT(full) [ 490.824527][T12950] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 490.824533][T12950] Call Trace: [ 490.824538][T12950] [ 490.824542][T12950] dump_stack_lvl+0x100/0x190 [ 490.824562][T12950] should_fail_ex.cold+0x5/0xa [ 490.824577][T12950] _copy_from_iter+0x1f4/0x16c0 [ 490.824594][T12950] ? __lock_acquire+0x5c0/0x1f40 [ 490.824606][T12950] ? __pfx__copy_from_iter+0x10/0x10 [ 490.824623][T12950] ? lock_acquire+0x1d1/0x380 [ 490.824633][T12950] ? aa_file_perm+0x197/0x14d0 [ 490.824647][T12950] tun_get_user+0x3ba/0x3ee0 [ 490.824664][T12950] ? __lock_acquire+0x5c0/0x1f40 [ 490.824675][T12950] ? __pfx_tun_get_user+0x10/0x10 [ 490.824698][T12950] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 490.824718][T12950] ? find_held_lock+0x2b/0x80 [ 490.824732][T12950] ? tun_get+0x191/0x370 [ 490.824741][T12950] ? tun_get+0x191/0x370 [ 490.824754][T12950] tun_chr_write_iter+0xdc/0x200 [ 490.824767][T12950] vfs_write+0x6af/0x1050 [ 490.824778][T12950] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 490.824791][T12950] ? __pfx_vfs_write+0x10/0x10 [ 490.824800][T12950] ? find_held_lock+0x2b/0x80 [ 490.824822][T12950] ksys_write+0x12a/0x250 [ 490.824833][T12950] ? __pfx_ksys_write+0x10/0x10 [ 490.824847][T12950] __do_fast_syscall_32+0x14b/0x8c0 [ 490.824862][T12950] ? lockdep_hardirqs_on+0x7d/0x110 [ 490.824876][T12950] do_fast_syscall_32+0x32/0x70 [ 490.824890][T12950] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 490.824903][T12950] RIP: 0023:0xf745efbc [ 490.824912][T12950] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 490.824922][T12950] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 490.824933][T12950] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800001c0 [ 490.824939][T12950] RDX: 0000000000000078 RSI: 0000000000000000 RDI: 0000000000000000 [ 490.824945][T12950] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 490.824951][T12950] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 490.824957][T12950] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 490.824971][T12950] [ 491.016419][T12954] openvswitch: netlink: ufid size 24 bytes exceeds the range (1, 16) [ 491.026506][T12956] netlink: 'syz.3.1862': attribute type 2 has an invalid length. [ 491.063961][T12962] netlink: 'syz.1.1863': attribute type 2 has an invalid length. [ 491.097765][T12962] pci_bus 0000:01: busn_res: [bus 01] is released [ 491.146317][T12962] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 491.151954][T12962] pci 0000:00:04.0: PCI bridge to [bus 01] [ 491.152091][T12962] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 491.152183][T12962] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 491.153610][T12962] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 491.154031][T12962] pci 0000:00:04.0: enabling Extended Tags [ 491.161255][T12962] pci 0000:00:04.0: Adding to iommu group 4 [ 491.169023][T12962] pci 0000:00:04.0: PCI bridge to [bus 01] [ 491.172796][T12962] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 491.172824][T12962] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 491.172899][T12962] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 491.172913][T12962] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 491.172930][T12962] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 491.173020][T12962] pci 0000:00:04.0: PCI bridge to [bus 01] [ 491.173076][T12962] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 491.174721][T12962] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 491.175862][T12962] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 491.225070][T12962] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 491.241770][T12962] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 492.192207][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 492.192269][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 492.595288][T12991] netlink: 'syz.3.1871': attribute type 2 has an invalid length. [ 492.607858][T12995] netlink: 'syz.1.1872': attribute type 2 has an invalid length. [ 492.632679][T12991] pci_bus 0000:01: busn_res: [bus 01] is released [ 492.654527][T12991] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 492.657920][T12991] pci 0000:00:04.0: PCI bridge to [bus 01] [ 492.658058][T12991] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 492.658151][T12991] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 492.659676][T12991] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 492.660151][T12991] pci 0000:00:04.0: enabling Extended Tags [ 492.668177][T12991] pci 0000:00:04.0: Adding to iommu group 4 [ 492.678237][T12991] pci 0000:00:04.0: PCI bridge to [bus 01] [ 492.682751][T12991] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 492.682781][T12991] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 492.682848][T12991] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 492.682863][T12991] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 492.682879][T12991] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 492.682941][T12991] pci 0000:00:04.0: PCI bridge to [bus 01] [ 492.682997][T12991] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 492.684520][T12991] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 492.685622][T12991] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 492.692086][T12997] FAULT_INJECTION: forcing a failure. [ 492.692086][T12997] name failslab, interval 1, probability 0, space 0, times 0 [ 492.692102][T12997] CPU: 0 UID: 0 PID: 12997 Comm: syz.0.1873 Not tainted syzkaller #0 PREEMPT(full) [ 492.692114][T12997] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 492.692121][T12997] Call Trace: [ 492.692125][T12997] [ 492.692130][T12997] dump_stack_lvl+0x100/0x190 [ 492.692150][T12997] should_fail_ex.cold+0x5/0xa [ 492.692166][T12997] should_failslab+0xc2/0x120 [ 492.692179][T12997] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 492.692196][T12997] ? __alloc_skb+0x5b7/0x710 [ 492.692210][T12997] ? __alloc_skb+0x140/0x710 [ 492.692227][T12997] __alloc_skb+0x140/0x710 [ 492.692240][T12997] ? __alloc_skb+0x5b7/0x710 [ 492.692253][T12997] ? __pfx___alloc_skb+0x10/0x10 [ 492.692271][T12997] alloc_skb_with_frags+0xdb/0x750 [ 492.692286][T12997] ? __might_fault+0xc5/0x140 [ 492.692298][T12997] ? __might_fault+0xc5/0x140 [ 492.692313][T12997] sock_alloc_send_pskb+0x86a/0x9e0 [ 492.692330][T12997] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 492.692346][T12997] ? lock_acquire+0x1d1/0x380 [ 492.692358][T12997] ? aa_file_perm+0x197/0x14d0 [ 492.692371][T12997] tun_get_user+0x7ce/0x3ee0 [ 492.692388][T12997] ? __lock_acquire+0x5c0/0x1f40 [ 492.692399][T12997] ? __pfx_tun_get_user+0x10/0x10 [ 492.692411][T12997] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 492.692429][T12997] ? find_held_lock+0x2b/0x80 [ 492.692443][T12997] ? tun_get+0x191/0x370 [ 492.692452][T12997] ? tun_get+0x191/0x370 [ 492.692465][T12997] tun_chr_write_iter+0xdc/0x200 [ 492.692478][T12997] vfs_write+0x6af/0x1050 [ 492.692489][T12997] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 492.692502][T12997] ? __pfx_vfs_write+0x10/0x10 [ 492.692511][T12997] ? find_held_lock+0x2b/0x80 [ 492.692533][T12997] ksys_write+0x12a/0x250 [ 492.692544][T12997] ? __pfx_ksys_write+0x10/0x10 [ 492.692559][T12997] __do_fast_syscall_32+0x14b/0x8c0 [ 492.692573][T12997] ? lockdep_hardirqs_on+0x7d/0x110 [ 492.692587][T12997] do_fast_syscall_32+0x32/0x70 [ 492.692601][T12997] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 492.692615][T12997] RIP: 0023:0xf748efbc [ 492.692624][T12997] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 492.692634][T12997] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 492.692645][T12997] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 492.692652][T12997] RDX: 0000000000000007 RSI: 0000000000000000 RDI: 0000000000000000 [ 492.692658][T12997] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 492.692664][T12997] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 492.692670][T12997] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 492.692683][T12997] [ 492.779816][T12991] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 492.794851][T12991] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 492.928754][T13019] netlink: 'syz.2.1878': attribute type 2 has an invalid length. [ 493.027482][T13019] pci_bus 0000:01: busn_res: [bus 01] is released [ 493.077648][T13024] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 493.103726][T13024] pci 0000:00:04.0: PCI bridge to [bus 01] [ 493.103867][T13024] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 493.106176][T13024] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 493.112685][T13024] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 493.113141][T13024] pci 0000:00:04.0: enabling Extended Tags [ 493.130841][T13024] pci 0000:00:04.0: Adding to iommu group 4 [ 493.154478][T13024] pci 0000:00:04.0: PCI bridge to [bus 01] [ 493.165255][T13024] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 493.165302][T13024] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 493.165373][T13024] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 493.165387][T13024] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 493.165403][T13024] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 493.165488][T13024] pci 0000:00:04.0: PCI bridge to [bus 01] [ 493.165560][T13024] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 493.169993][T13024] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 493.175027][T13024] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 493.248245][T13024] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 493.264215][T13024] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 494.167542][T13049] netlink: 'syz.3.1882': attribute type 2 has an invalid length. [ 494.223200][T13049] pci_bus 0000:01: busn_res: [bus 01] is released [ 494.251863][T13052] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 494.258991][T13052] pci 0000:00:04.0: PCI bridge to [bus 01] [ 494.259206][T13052] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 494.259302][T13052] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 494.260816][T13052] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 494.261339][T13052] pci 0000:00:04.0: enabling Extended Tags [ 494.269661][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 494.269715][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 494.270877][T13052] pci 0000:00:04.0: Adding to iommu group 4 [ 494.285233][T13052] pci 0000:00:04.0: PCI bridge to [bus 01] [ 494.287148][T13052] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 494.287175][T13052] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 494.287242][T13052] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 494.287257][T13052] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 494.287272][T13052] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 494.287334][T13052] pci 0000:00:04.0: PCI bridge to [bus 01] [ 494.287432][T13052] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 494.293759][T13052] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 494.295010][T13052] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 494.351785][T13052] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 494.366776][T13052] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 495.236491][T13077] netlink: 'syz.0.1887': attribute type 2 has an invalid length. [ 495.304760][T13077] pci_bus 0000:01: busn_res: [bus 01] is released [ 495.330012][T13081] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 495.334757][T13081] pci 0000:00:04.0: PCI bridge to [bus 01] [ 495.334995][T13081] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 495.335127][T13081] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 495.337281][T13081] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 495.337857][T13081] pci 0000:00:04.0: enabling Extended Tags [ 495.354625][T13081] pci 0000:00:04.0: Adding to iommu group 4 [ 495.367730][T13081] pci 0000:00:04.0: PCI bridge to [bus 01] [ 495.373108][T13081] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 495.373158][T13081] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 495.373289][T13081] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 495.373317][T13081] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 495.373345][T13081] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 495.373462][T13081] pci 0000:00:04.0: PCI bridge to [bus 01] [ 495.373544][T13081] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 495.375988][T13081] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 495.377566][T13081] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 495.430758][T13081] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 495.435043][T13081] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 495.881017][T13114] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1892'. [ 495.917156][T13118] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1893'. [ 495.993708][T13123] bond0: option arp_interval: invalid value (100) [ 495.993725][T13123] bond0: option arp_interval: allowed values 0 - 2147483647 [ 496.349227][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 496.349329][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 496.654385][T13125] FAULT_INJECTION: forcing a failure. [ 496.654385][T13125] name failslab, interval 1, probability 0, space 0, times 0 [ 496.654405][T13125] CPU: 0 UID: 0 PID: 13125 Comm: syz.1.1895 Not tainted syzkaller #0 PREEMPT(full) [ 496.654429][T13125] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 496.654437][T13125] Call Trace: [ 496.654441][T13125] [ 496.654446][T13125] dump_stack_lvl+0x100/0x190 [ 496.654467][T13125] should_fail_ex.cold+0x5/0xa [ 496.654482][T13125] should_failslab+0xc2/0x120 [ 496.654496][T13125] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 496.654513][T13125] ? __alloc_skb+0x5b7/0x710 [ 496.654528][T13125] ? __alloc_skb+0x140/0x710 [ 496.654544][T13125] __alloc_skb+0x140/0x710 [ 496.654557][T13125] ? __alloc_skb+0x5b7/0x710 [ 496.654570][T13125] ? __pfx___alloc_skb+0x10/0x10 [ 496.654588][T13125] netlink_alloc_large_skb+0x69/0x150 [ 496.654605][T13125] netlink_sendmsg+0x755/0x10c0 [ 496.654622][T13125] ? __pfx_netlink_sendmsg+0x10/0x10 [ 496.654641][T13125] ? apparmor_socket_sendmsg+0x165/0x280 [ 496.654657][T13125] ? ____sys_sendmsg+0xa99/0xc30 [ 496.654668][T13125] ____sys_sendmsg+0xa99/0xc30 [ 496.654678][T13125] ? __pfx_netlink_sendmsg+0x10/0x10 [ 496.654694][T13125] ? __pfx_____sys_sendmsg+0x10/0x10 [ 496.654712][T13125] ___sys_sendmsg+0x190/0x1e0 [ 496.654725][T13125] ? __pfx____sys_sendmsg+0x10/0x10 [ 496.654743][T13125] ? find_held_lock+0x2b/0x80 [ 496.654766][T13125] __sys_sendmsg+0x160/0x210 [ 496.654781][T13125] ? __pfx___sys_sendmsg+0x10/0x10 [ 496.654803][T13125] __do_fast_syscall_32+0x14b/0x8c0 [ 496.654818][T13125] ? lockdep_hardirqs_on+0x7d/0x110 [ 496.654832][T13125] do_fast_syscall_32+0x32/0x70 [ 496.654846][T13125] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 496.654860][T13125] RIP: 0023:0xf745efbc [ 496.654869][T13125] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 496.654878][T13125] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 496.654889][T13125] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000800000c0 [ 496.654896][T13125] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 496.654902][T13125] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 496.654908][T13125] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 496.654915][T13125] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 496.654928][T13125] [ 496.816371][T13132] netlink: 'syz.3.1898': attribute type 2 has an invalid length. [ 496.854368][T13129] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 496.866912][T13132] pci_bus 0000:01: busn_res: [bus 01] is released [ 496.885026][T13132] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 496.887863][T13132] pci 0000:00:04.0: PCI bridge to [bus 01] [ 496.888000][T13132] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 496.888093][T13132] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 496.890009][T13132] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 496.890640][T13132] pci 0000:00:04.0: enabling Extended Tags [ 496.900938][T13132] pci 0000:00:04.0: Adding to iommu group 4 [ 496.912217][T13132] pci 0000:00:04.0: PCI bridge to [bus 01] [ 496.914488][T13132] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 496.914515][T13132] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 496.914583][T13132] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 496.914598][T13132] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 496.914613][T13132] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 496.914675][T13132] pci 0000:00:04.0: PCI bridge to [bus 01] [ 496.914730][T13132] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 496.916340][T13132] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 496.917370][T13132] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 496.967007][T13132] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 496.973559][T13132] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 497.173490][T13144] FAULT_INJECTION: forcing a failure. [ 497.173490][T13144] name failslab, interval 1, probability 0, space 0, times 0 [ 497.173509][T13144] CPU: 3 UID: 0 PID: 13144 Comm: syz.3.1901 Not tainted syzkaller #0 PREEMPT(full) [ 497.173521][T13144] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 497.173527][T13144] Call Trace: [ 497.173532][T13144] [ 497.173536][T13144] dump_stack_lvl+0x100/0x190 [ 497.173557][T13144] should_fail_ex.cold+0x5/0xa [ 497.173573][T13144] should_failslab+0xc2/0x120 [ 497.173586][T13144] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 497.173603][T13144] ? __alloc_skb+0x5b7/0x710 [ 497.173618][T13144] ? __alloc_skb+0x140/0x710 [ 497.173633][T13144] __alloc_skb+0x140/0x710 [ 497.173646][T13144] ? __alloc_skb+0x5b7/0x710 [ 497.173659][T13144] ? __pfx___alloc_skb+0x10/0x10 [ 497.173677][T13144] netlink_alloc_large_skb+0x69/0x150 [ 497.173694][T13144] netlink_sendmsg+0x755/0x10c0 [ 497.173711][T13144] ? __pfx_netlink_sendmsg+0x10/0x10 [ 497.173730][T13144] ? apparmor_socket_sendmsg+0x165/0x280 [ 497.173745][T13144] ? ____sys_sendmsg+0xa99/0xc30 [ 497.173756][T13144] ____sys_sendmsg+0xa99/0xc30 [ 497.173766][T13144] ? __pfx_netlink_sendmsg+0x10/0x10 [ 497.173782][T13144] ? __pfx_____sys_sendmsg+0x10/0x10 [ 497.173799][T13144] ___sys_sendmsg+0x190/0x1e0 [ 497.173812][T13144] ? __pfx____sys_sendmsg+0x10/0x10 [ 497.173830][T13144] ? find_held_lock+0x2b/0x80 [ 497.173852][T13144] __sys_sendmsg+0x160/0x210 [ 497.173868][T13144] ? __pfx___sys_sendmsg+0x10/0x10 [ 497.173889][T13144] __do_fast_syscall_32+0x14b/0x8c0 [ 497.173904][T13144] ? lockdep_hardirqs_on+0x7d/0x110 [ 497.173918][T13144] do_fast_syscall_32+0x32/0x70 [ 497.173932][T13144] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 497.173946][T13144] RIP: 0023:0xf73befbc [ 497.173955][T13144] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 497.173965][T13144] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 497.173976][T13144] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000240 [ 497.173983][T13144] RDX: 0000000024040810 RSI: 0000000000000000 RDI: 0000000000000000 [ 497.173989][T13144] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 497.173995][T13144] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 497.174001][T13144] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 497.174014][T13144] [ 497.202892][ T43] audit: type=1807 audit(1793649957.223:2): action=measure res=1 [ 497.203601][T13146] ima: policy update completed [ 497.204159][ T43] audit: type=1802 audit(1793649957.223:3): pid=13146 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=completed comm="syz.3.1902" res=1 errno=0 [ 497.238119][T13148] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1903'. [ 497.290890][ T43] audit: type=1800 audit(1793649957.313:4): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=4887 res=0 errno=-22 [ 498.439134][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 498.439206][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 498.458288][T13168] FAULT_INJECTION: forcing a failure. [ 498.458288][T13168] name failslab, interval 1, probability 0, space 0, times 0 [ 498.458314][T13168] CPU: 2 UID: 0 PID: 13168 Comm: syz.3.1907 Not tainted syzkaller #0 PREEMPT(full) [ 498.458334][T13168] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 498.458346][T13168] Call Trace: [ 498.458352][T13168] [ 498.458360][T13168] dump_stack_lvl+0x100/0x190 [ 498.458394][T13168] should_fail_ex.cold+0x5/0xa [ 498.458418][T13168] should_failslab+0xc2/0x120 [ 498.458441][T13168] __kvmalloc_node_noprof+0x113/0x9b0 [ 498.458469][T13168] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 498.458510][T13168] ? percpu_ref_init+0xec/0x3f0 [ 498.458532][T13168] ? io_alloc_cache_init+0x38/0x170 [ 498.458559][T13168] io_alloc_cache_init+0x38/0x170 [ 498.458583][T13168] io_uring_setup.cold+0x450/0x1c0e [ 498.458608][T13168] ? __pfx_io_uring_setup+0x10/0x10 [ 498.458640][T13168] ? __lock_acquire+0x5c0/0x1f40 [ 498.458674][T13168] ? find_held_lock+0x2b/0x80 [ 498.458699][T13168] ? __might_fault+0xc5/0x140 [ 498.458719][T13168] ? __might_fault+0xc5/0x140 [ 498.458746][T13168] __ia32_sys_io_uring_setup+0xc2/0x170 [ 498.458774][T13168] __do_fast_syscall_32+0x14b/0x8c0 [ 498.458823][T13168] do_fast_syscall_32+0x32/0x70 [ 498.458850][T13168] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 498.458875][T13168] RIP: 0023:0xf73befbc [ 498.458890][T13168] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 498.458908][T13168] RSP: 002b:00000000f53d64bc EFLAGS: 00000282 ORIG_RAX: 00000000000001a9 [ 498.458926][T13168] RAX: ffffffffffffffda RBX: 00000000000008bf RCX: 00000000800005c0 [ 498.458938][T13168] RDX: 00000000f7141997 RSI: 0000000000000001 RDI: 00000000f53d653c [ 498.458950][T13168] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 498.458960][T13168] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 498.458970][T13168] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 498.458995][T13168] [ 498.485677][T13168] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1907'. [ 498.579940][T13170] netlink: 'syz.3.1908': attribute type 2 has an invalid length. [ 498.585295][ T43] audit: type=1800 audit(1793649958.603:5): pid=13170 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1908" name="remove" dev="sysfs" ino=188816 res=0 errno=-13 [ 498.626347][T13170] pci_bus 0000:01: busn_res: [bus 01] is released [ 498.627277][ T43] audit: type=1800 audit(1793649958.643:6): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=188815 res=0 errno=-22 [ 498.640258][ T43] audit: type=1800 audit(1793649958.663:7): pid=13171 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1908" name="rescan" dev="sysfs" ino=820 res=0 errno=-13 [ 498.643933][T13171] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 498.648043][T13171] pci 0000:00:04.0: PCI bridge to [bus 01] [ 498.648179][T13171] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 498.648272][T13171] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 498.650266][T13171] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 498.650946][T13171] pci 0000:00:04.0: enabling Extended Tags [ 498.657345][ T43] audit: type=1800 audit(1793649958.673:8): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=189186 res=0 errno=-22 [ 498.660782][T13171] pci 0000:00:04.0: Adding to iommu group 4 [ 498.663746][ T43] audit: type=1800 audit(1793649958.683:9): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=189201 res=0 errno=-22 [ 498.669998][ T43] audit: type=1800 audit(1793649958.683:10): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=189265 res=0 errno=-22 [ 498.670271][T13171] pci 0000:00:04.0: PCI bridge to [bus 01] [ 498.673075][T13171] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 498.673115][T13171] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 498.673235][T13171] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 498.673260][T13171] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 498.673284][T13171] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 498.673390][T13171] pci 0000:00:04.0: PCI bridge to [bus 01] [ 498.673466][T13171] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 498.675190][T13171] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 498.676317][T13171] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 498.724583][T13171] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 498.726383][ T43] audit: type=1800 audit(1793649958.743:11): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=189308 res=0 errno=-22 [ 498.727204][T13171] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 498.921191][T13174] netlink: 'syz.3.1909': attribute type 2 has an invalid length. [ 498.959762][T13174] pci_bus 0000:01: busn_res: [bus 01] is released [ 498.983588][T13174] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 498.986476][T13174] pci 0000:00:04.0: PCI bridge to [bus 01] [ 498.986612][T13174] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 498.986705][T13174] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 498.988057][T13174] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 498.988581][T13174] pci 0000:00:04.0: enabling Extended Tags [ 498.995861][T13174] pci 0000:00:04.0: Adding to iommu group 4 [ 499.002971][T13174] pci 0000:00:04.0: PCI bridge to [bus 01] [ 499.005867][T13174] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 499.005895][T13174] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 499.005964][T13174] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 499.005979][T13174] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 499.005994][T13174] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 499.006056][T13174] pci 0000:00:04.0: PCI bridge to [bus 01] [ 499.006143][T13174] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 499.007681][T13174] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 499.008840][T13174] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 499.048011][T13174] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 499.051124][T13174] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 499.273876][T13190] Set syz1 is full, maxelem 1029 reached [ 499.379341][T13193] 8021q: VLANs not supported on lo [ 499.495601][T13198] 9p: p9: multiple sources not supported [ 499.515564][T13202] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1918'. [ 499.519760][T13202] FAULT_INJECTION: forcing a failure. [ 499.519760][T13202] name failslab, interval 1, probability 0, space 0, times 0 [ 499.519777][T13202] CPU: 1 UID: 0 PID: 13202 Comm: syz.1.1918 Not tainted syzkaller #0 PREEMPT(full) [ 499.519789][T13202] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 499.519795][T13202] Call Trace: [ 499.519800][T13202] [ 499.519805][T13202] dump_stack_lvl+0x100/0x190 [ 499.519830][T13202] should_fail_ex.cold+0x5/0xa [ 499.519845][T13202] should_failslab+0xc2/0x120 [ 499.519858][T13202] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 499.519875][T13202] ? __alloc_skb+0x5b7/0x710 [ 499.519890][T13202] ? __alloc_skb+0x140/0x710 [ 499.519905][T13202] __alloc_skb+0x140/0x710 [ 499.519918][T13202] ? __alloc_skb+0x5b7/0x710 [ 499.519931][T13202] ? __pfx___alloc_skb+0x10/0x10 [ 499.519948][T13202] netlink_alloc_large_skb+0x69/0x150 [ 499.519965][T13202] netlink_sendmsg+0x755/0x10c0 [ 499.519982][T13202] ? __pfx_netlink_sendmsg+0x10/0x10 [ 499.520000][T13202] ? apparmor_socket_sendmsg+0x165/0x280 [ 499.520016][T13202] ? ____sys_sendmsg+0xa99/0xc30 [ 499.520026][T13202] ____sys_sendmsg+0xa99/0xc30 [ 499.520036][T13202] ? __pfx_netlink_sendmsg+0x10/0x10 [ 499.520052][T13202] ? __pfx_____sys_sendmsg+0x10/0x10 [ 499.520069][T13202] ___sys_sendmsg+0x190/0x1e0 [ 499.520082][T13202] ? __pfx____sys_sendmsg+0x10/0x10 [ 499.520099][T13202] ? find_held_lock+0x2b/0x80 [ 499.520122][T13202] __sys_sendmsg+0x160/0x210 [ 499.520137][T13202] ? __pfx___sys_sendmsg+0x10/0x10 [ 499.520158][T13202] __do_fast_syscall_32+0x14b/0x8c0 [ 499.520173][T13202] ? lockdep_hardirqs_on+0x7d/0x110 [ 499.520187][T13202] do_fast_syscall_32+0x32/0x70 [ 499.520201][T13202] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 499.520215][T13202] RIP: 0023:0xf745efbc [ 499.520224][T13202] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 499.520234][T13202] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 499.520245][T13202] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 499.520251][T13202] RDX: 0000000004004800 RSI: 0000000000000000 RDI: 0000000000000000 [ 499.520258][T13202] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 499.520264][T13202] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 499.520270][T13202] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 499.520283][T13202] [ 499.572594][T13204] 9p: p9: multiple sources not supported [ 499.572640][T13204] 9p: p9: multiple sources not supported [ 499.828624][T13220] [U]  [ 499.828639][T13220] [U] K{ [ 499.828704][T13220] [U] T 1ŠFFˊ`GJǘGO/MC [ 499.828991][T13220] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 499.834409][T13220] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 499.835696][T13220] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 499.836289][T13220] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 499.836421][T13220] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 499.836545][T13220] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 499.836810][T13220] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 499.838115][T13220] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 499.838268][T13220] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 499.838297][T13220] [U] 22Ʃ۩X?0;3U [ 499.838586][T13220] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 499.838686][T13220] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 499.838771][T13220] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 499.838823][T13220] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 499.838955][T13220] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 499.838967][T13220] [U] EC [ 499.841461][T13220] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 499.845604][T13219] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 500.008624][T13223] netlink: 'syz.1.1922': attribute type 2 has an invalid length. [ 500.069215][T13223] pci_bus 0000:01: busn_res: [bus 01] is released [ 500.159638][T13223] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 500.163032][T13223] pci 0000:00:04.0: PCI bridge to [bus 01] [ 500.163170][T13223] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 500.163310][T13223] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 500.164704][T13223] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 500.165123][T13223] pci 0000:00:04.0: enabling Extended Tags [ 500.171262][T13223] pci 0000:00:04.0: Adding to iommu group 4 [ 500.178588][T13223] pci 0000:00:04.0: PCI bridge to [bus 01] [ 500.180642][T13223] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 500.180669][T13223] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 500.180792][T13223] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 500.180811][T13223] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 500.180827][T13223] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 500.180926][T13223] pci 0000:00:04.0: PCI bridge to [bus 01] [ 500.181053][T13223] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 500.182301][T13223] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 500.183161][T13223] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 500.234132][T13223] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 500.236294][T13223] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 500.428175][T13227] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1924'. [ 500.480173][T13228] FAULT_INJECTION: forcing a failure. [ 500.480173][T13228] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 500.480191][T13228] CPU: 1 UID: 0 PID: 13228 Comm: syz.3.1924 Not tainted syzkaller #0 PREEMPT(full) [ 500.480203][T13228] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 500.480210][T13228] Call Trace: [ 500.480214][T13228] [ 500.480218][T13228] dump_stack_lvl+0x100/0x190 [ 500.480245][T13228] should_fail_ex.cold+0x5/0xa [ 500.480261][T13228] _copy_from_iter+0x1f4/0x16c0 [ 500.480294][T13228] ? __pfx__copy_from_iter+0x10/0x10 [ 500.480310][T13228] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 500.480325][T13228] ? lock_acquire+0x1d1/0x380 [ 500.480339][T13228] copy_page_from_iter+0x238/0x300 [ 500.480356][T13228] tun_build_skb.constprop.0+0x2ea/0x18f0 [ 500.480373][T13228] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 500.480387][T13228] ? __lock_acquire+0x5c0/0x1f40 [ 500.480404][T13228] ? lock_acquire+0x1d1/0x380 [ 500.480414][T13228] ? aa_file_perm+0x197/0x14d0 [ 500.480427][T13228] tun_get_user+0x1763/0x3ee0 [ 500.480443][T13228] ? __lock_acquire+0x5c0/0x1f40 [ 500.480454][T13228] ? __pfx_tun_get_user+0x10/0x10 [ 500.480466][T13228] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 500.480483][T13228] ? find_held_lock+0x2b/0x80 [ 500.480497][T13228] ? tun_get+0x191/0x370 [ 500.480506][T13228] ? tun_get+0x191/0x370 [ 500.480519][T13228] tun_chr_write_iter+0xdc/0x200 [ 500.480531][T13228] vfs_write+0x6af/0x1050 [ 500.480543][T13228] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 500.480555][T13228] ? __pfx_vfs_write+0x10/0x10 [ 500.480565][T13228] ? find_held_lock+0x2b/0x80 [ 500.480587][T13228] ksys_write+0x12a/0x250 [ 500.480597][T13228] ? __pfx_ksys_write+0x10/0x10 [ 500.480612][T13228] do_int80_emulation+0x166/0x650 [ 500.480628][T13228] asm_int80_emulation+0x1a/0x20 [ 500.480639][T13228] RIP: 0023:0xf7117f6b [ 500.480648][T13228] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 500.480658][T13228] RSP: 002b:00000000f53b544c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 500.480669][T13228] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000200 [ 500.480676][T13228] RDX: 000000000000006e RSI: 0000000000000000 RDI: 0000000000000000 [ 500.480682][T13228] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 500.480688][T13228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 500.480694][T13228] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 500.480708][T13228] [ 500.509343][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 500.509594][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 500.629319][T13230] syzkaller0: entered promiscuous mode [ 500.629346][T13230] syzkaller0: entered allmulticast mode [ 500.681086][T13232] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1926'. [ 500.746589][T13236] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1927'. [ 500.747616][T13236] FAULT_INJECTION: forcing a failure. [ 500.747616][T13236] name failslab, interval 1, probability 0, space 0, times 0 [ 500.747632][T13236] CPU: 3 UID: 0 PID: 13236 Comm: syz.3.1927 Not tainted syzkaller #0 PREEMPT(full) [ 500.747645][T13236] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 500.747651][T13236] Call Trace: [ 500.747674][T13236] [ 500.747679][T13236] dump_stack_lvl+0x100/0x190 [ 500.747699][T13236] should_fail_ex.cold+0x5/0xa [ 500.747716][T13236] should_failslab+0xc2/0x120 [ 500.747729][T13236] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 500.747746][T13236] ? __alloc_skb+0x5b7/0x710 [ 500.747762][T13236] ? __alloc_skb+0x140/0x710 [ 500.747778][T13236] __alloc_skb+0x140/0x710 [ 500.747790][T13236] ? __alloc_skb+0x5b7/0x710 [ 500.747804][T13236] ? __pfx___alloc_skb+0x10/0x10 [ 500.747821][T13236] netlink_alloc_large_skb+0x69/0x150 [ 500.747838][T13236] netlink_sendmsg+0x755/0x10c0 [ 500.747855][T13236] ? __pfx_netlink_sendmsg+0x10/0x10 [ 500.747873][T13236] ? apparmor_socket_sendmsg+0x165/0x280 [ 500.747889][T13236] ? ____sys_sendmsg+0xa99/0xc30 [ 500.747899][T13236] ____sys_sendmsg+0xa99/0xc30 [ 500.747909][T13236] ? __pfx_netlink_sendmsg+0x10/0x10 [ 500.747926][T13236] ? __pfx_____sys_sendmsg+0x10/0x10 [ 500.747943][T13236] ___sys_sendmsg+0x190/0x1e0 [ 500.747955][T13236] ? __pfx____sys_sendmsg+0x10/0x10 [ 500.747973][T13236] ? find_held_lock+0x2b/0x80 [ 500.747996][T13236] __sys_sendmsg+0x160/0x210 [ 500.748011][T13236] ? __pfx___sys_sendmsg+0x10/0x10 [ 500.748032][T13236] __do_fast_syscall_32+0x14b/0x8c0 [ 500.748047][T13236] ? lockdep_hardirqs_on+0x7d/0x110 [ 500.748061][T13236] do_fast_syscall_32+0x32/0x70 [ 500.748074][T13236] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 500.748088][T13236] RIP: 0023:0xf73befbc [ 500.748097][T13236] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 500.748107][T13236] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 500.748118][T13236] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000440 [ 500.748125][T13236] RDX: 00000000200440c4 RSI: 0000000000000000 RDI: 0000000000000000 [ 500.748131][T13236] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 500.748137][T13236] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 500.748143][T13236] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 500.748157][T13236] [ 500.786239][T13239] netlink: 'syz.1.1928': attribute type 1 has an invalid length. [ 500.991061][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.991111][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.067305][ T5785] svc: failed to register nfsdv3 RPC service (errno 5). [ 502.067319][ T5785] failed to unregister tcp with rpcbind [ 502.323813][ T43] kauditd_printk_skb: 21 callbacks suppressed [ 502.323831][ T43] audit: type=1804 audit(1793649962.343:33): pid=13283 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1939" name="/newroot/sys/kernel/debug/sync/sw_sync" dev="debugfs" ino=3557 res=1 errno=0 [ 502.325840][T13283] LUN: removable file: (no medium) [ 502.328458][ T43] audit: type=1800 audit(1793649962.343:34): pid=13283 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1939" name="file" dev="configfs" ino=63722 res=0 errno=-22 [ 502.330282][T13283] mass_storage.0/lun.0: unable to open backing file: f [ 502.344592][T13283] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1939'. [ 502.344611][T13283] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1939'. [ 502.364376][T13285] syzkaller0: entered promiscuous mode [ 502.364396][T13285] syzkaller0: entered allmulticast mode [ 502.404089][T13287] netlink: 'syz.0.1940': attribute type 2 has an invalid length. [ 502.410094][ T43] audit: type=1800 audit(1793649962.433:35): pid=13287 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1940" name="remove" dev="sysfs" ino=189671 res=0 errno=-13 [ 502.442804][T13287] pci_bus 0000:01: busn_res: [bus 01] is released [ 502.475425][ T43] audit: type=1800 audit(1793649962.493:36): pid=13287 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1940" name="rescan" dev="sysfs" ino=820 res=0 errno=-13 [ 502.476930][T13287] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 502.480985][T13287] pci 0000:00:04.0: PCI bridge to [bus 01] [ 502.481206][T13287] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 502.481345][T13287] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 502.483212][T13287] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 502.484009][T13287] pci 0000:00:04.0: enabling Extended Tags [ 502.493579][T13287] pci 0000:00:04.0: Adding to iommu group 4 [ 502.493833][ T43] audit: type=1800 audit(1793649962.513:37): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=190290 res=0 errno=-22 [ 502.497365][ T43] audit: type=1800 audit(1793649962.513:38): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=190305 res=0 errno=-22 [ 502.503480][T13287] pci 0000:00:04.0: PCI bridge to [bus 01] [ 502.506133][ T43] audit: type=1800 audit(1793649962.523:39): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=190369 res=0 errno=-22 [ 502.507470][T13287] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 502.507497][T13287] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 502.507567][T13287] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 502.507582][T13287] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 502.507597][T13287] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 502.507680][T13287] pci 0000:00:04.0: PCI bridge to [bus 01] [ 502.507736][T13287] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 502.510103][T13287] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 502.511475][T13287] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 502.548671][ T43] audit: type=1800 audit(1793649962.563:40): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=190412 res=0 errno=-22 [ 502.550729][T13287] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 502.555510][ T43] audit: type=1800 audit(1793649962.573:41): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=190433 res=0 errno=-22 [ 502.559672][T13287] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 502.589194][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 502.596383][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 502.596448][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 502.624726][ T43] audit: type=1800 audit(1793649962.643:42): pid=5196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=190522 res=0 errno=-22 [ 502.705667][T13301] FAULT_INJECTION: forcing a failure. [ 502.705667][T13301] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 502.705687][T13301] CPU: 3 UID: 0 PID: 13301 Comm: syz.0.1945 Tainted: G L syzkaller #0 PREEMPT(full) [ 502.705702][T13301] Tainted: [L]=SOFTLOCKUP [ 502.705706][T13301] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 502.705712][T13301] Call Trace: [ 502.705717][T13301] [ 502.705721][T13301] dump_stack_lvl+0x100/0x190 [ 502.705741][T13301] should_fail_ex.cold+0x5/0xa [ 502.705758][T13301] _copy_from_user+0x2e/0xd0 [ 502.705774][T13301] move_addr_to_kernel+0x65/0x170 [ 502.705787][T13301] get_compat_msghdr+0x3c7/0x480 [ 502.705801][T13301] ? __pfx_get_compat_msghdr+0x10/0x10 [ 502.705818][T13301] ___sys_sendmsg+0x1b6/0x1e0 [ 502.705831][T13301] ? __pfx____sys_sendmsg+0x10/0x10 [ 502.705849][T13301] ? find_held_lock+0x2b/0x80 [ 502.705872][T13301] __sys_sendmsg+0x160/0x210 [ 502.705887][T13301] ? __pfx___sys_sendmsg+0x10/0x10 [ 502.705909][T13301] __do_fast_syscall_32+0x14b/0x8c0 [ 502.705924][T13301] ? lockdep_hardirqs_on+0x7d/0x110 [ 502.705938][T13301] do_fast_syscall_32+0x32/0x70 [ 502.705952][T13301] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 502.705966][T13301] RIP: 0023:0xf748efbc [ 502.705975][T13301] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 502.705985][T13301] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 502.705996][T13301] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000340 [ 502.706003][T13301] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 502.706009][T13301] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 502.706015][T13301] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 502.706021][T13301] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 502.706035][T13301] [ 502.935313][T13310] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1949'. [ 503.149141][ T5892] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 503.319617][ T5892] usb 6-1: New USB device found: idVendor=0572, idProduct=cafe, bcdDevice=1.00 [ 503.320651][ T5892] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 503.320684][ T5892] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 503.320700][ T5892] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 503.320728][ T5892] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.607379][T13319] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1950'. [ 503.619826][T13319] usb 1-1: USB disconnect, device number 2 [ 503.721936][T13319] hub 1-0:1.0: USB hub found [ 503.722209][T13319] hub 1-0:1.0: 6 ports detected [ 503.740982][T13304] block nbd0: server does not support multiple connections per device. [ 503.748089][T13304] block nbd0: shutting down sockets [ 503.781510][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 503.783864][ T7596] [ 503.787297][ T7596] ====================================================== [ 503.789507][ T7596] WARNING: possible circular locking dependency detected [ 503.791598][ T7596] syzkaller #0 Tainted: G L [ 503.793503][ T7596] ------------------------------------------------------ [ 503.795710][ T7596] udevd/7596 is trying to acquire lock: [ 503.797480][ T7596] ffff8880789f9500 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2360 [ 503.800810][ T7596] [ 503.800810][ T7596] but task is already holding lock: [ 503.803106][ T7596] ffff888027294478 (sb_writers#5){.+.+}-{0:0}, at: path_openat+0x1920/0x23f0 [ 503.805816][ T7596] [ 503.805816][ T7596] which lock already depends on the new lock. [ 503.805816][ T7596] [ 503.809114][ T7596] [ 503.809114][ T7596] the existing dependency chain (in reverse order) is: [ 503.811944][ T7596] [ 503.811944][ T7596] -> #4 (sb_writers#5){.+.+}-{0:0}: [ 503.814280][ T7596] lock_acquire+0x1d1/0x380 [ 503.815939][ T7596] mnt_want_write+0x6a/0x420 [ 503.817636][ T7596] lookup_open+0x8e9/0x19e0 [ 503.819245][ T7596] path_openat+0xe75/0x23f0 [ 503.820882][ T7596] do_file_open+0x20e/0x430 [ 503.822483][ T7596] file_open_name+0x1c3/0x3e0 [ 503.824161][ T7596] filp_open+0x2e/0x50 [ 503.825665][ T7596] fsg_lun_open+0x6b/0x7b0 [ 503.827315][ T7596] fsg_store_file+0x1e7/0x450 [ 503.828992][ T7596] configfs_write_iter+0x302/0x4e0 [ 503.830855][ T7596] vfs_write+0x6af/0x1050 [ 503.832440][ T7596] ksys_write+0x12a/0x250 [ 503.833997][ T7596] __do_fast_syscall_32+0x14b/0x8c0 [ 503.835831][ T7596] do_fast_syscall_32+0x32/0x70 [ 503.837549][ T7596] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 503.839701][ T7596] [ 503.839701][ T7596] -> #3 (&common->filesem){++++}-{4:4}: [ 503.842046][ T7596] lock_acquire+0x1d1/0x380 [ 503.843680][ T7596] down_read+0x94/0x4c0 [ 503.845170][ T7596] fsg_show_file+0x20/0x180 [ 503.846788][ T7596] configfs_read_iter+0x426/0x6f0 [ 503.848577][ T7596] __kernel_read+0x397/0xad0 [ 503.850383][ T7596] integrity_kernel_read+0x7e/0xb0 [ 503.852407][ T7596] ima_calc_file_hash_tfm+0x25e/0x350 [ 503.854531][ T7596] ima_calc_file_hash+0x1e3/0x380 [ 503.856538][ T7596] ima_collect_measurement+0x952/0xb30 [ 503.858655][ T7596] process_measurement+0xe04/0x2360 [ 503.860717][ T7596] ima_file_check+0xc8/0x120 [ 503.862578][ T7596] security_file_post_open+0xc4/0x210 [ 503.864750][ T7596] path_openat+0x5d0/0x23f0 [ 503.866750][ T7596] do_file_open+0x20e/0x430 [ 503.868738][ T7596] do_sys_openat2+0x163/0x1d0 [ 503.870519][ T7596] __ia32_compat_sys_openat+0x12d/0x210 [ 503.872741][ T7596] __do_fast_syscall_32+0x14b/0x8c0 [ 503.874857][ T7596] do_fast_syscall_32+0x32/0x70 [ 503.876870][ T7596] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 503.879394][ T7596] [ 503.879394][ T7596] -> #2 (&p->frag_sem){.+.+}-{4:4}: [ 503.882132][ T7596] lock_acquire+0x1d1/0x380 [ 503.883994][ T7596] down_read+0x94/0x4c0 [ 503.885801][ T7596] configfs_read_iter+0x346/0x6f0 [ 503.888022][ T7596] __kernel_read+0x397/0xad0 [ 503.889864][ T7596] integrity_kernel_read+0x7e/0xb0 [ 503.891934][ T7596] ima_calc_file_hash_tfm+0x25e/0x350 [ 503.894151][ T7596] ima_calc_file_hash+0x1e3/0x380 [ 503.896178][ T7596] ima_collect_measurement+0x952/0xb30 [ 503.898240][ T7596] process_measurement+0xe04/0x2360 [ 503.900482][ T7596] ima_file_check+0xc8/0x120 [ 503.902399][ T7596] security_file_post_open+0xc4/0x210 [ 503.904348][ T7596] path_openat+0x5d0/0x23f0 [ 503.905868][ T7596] do_file_open+0x20e/0x430 [ 503.907389][ T7596] do_sys_openat2+0x163/0x1d0 [ 503.908968][ T7596] __ia32_compat_sys_openat+0x12d/0x210 [ 503.910739][ T7596] __do_fast_syscall_32+0x14b/0x8c0 [ 503.912420][ T7596] do_fast_syscall_32+0x32/0x70 [ 503.914001][ T7596] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 503.916040][ T7596] [ 503.916040][ T7596] -> #1 (&buffer->mutex){+.+.}-{4:4}: [ 503.918215][ T7596] lock_acquire+0x1d1/0x380 [ 503.919711][ T7596] __mutex_lock+0x19f/0x1c10 [ 503.921211][ T7596] configfs_read_iter+0x79/0x6f0 [ 503.922806][ T7596] __kernel_read+0x397/0xad0 [ 503.924341][ T7596] integrity_kernel_read+0x7e/0xb0 [ 503.926002][ T7596] ima_calc_file_hash_tfm+0x25e/0x350 [ 503.927825][ T7596] ima_calc_file_hash+0x1e3/0x380 [ 503.929526][ T7596] ima_collect_measurement+0x952/0xb30 [ 503.931366][ T7596] process_measurement+0xe04/0x2360 [ 503.933120][ T7596] ima_file_check+0xc8/0x120 [ 503.934671][ T7596] security_file_post_open+0xc4/0x210 [ 503.936524][ T7596] path_openat+0x5d0/0x23f0 [ 503.938075][ T7596] do_file_open+0x20e/0x430 [ 503.939661][ T7596] do_sys_openat2+0x163/0x1d0 [ 503.941257][ T7596] __ia32_compat_sys_openat+0x12d/0x210 [ 503.943116][ T7596] __do_fast_syscall_32+0x14b/0x8c0 [ 503.944865][ T7596] do_fast_syscall_32+0x32/0x70 [ 503.946511][ T7596] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 503.948602][ T7596] [ 503.948602][ T7596] -> #0 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 503.951203][ T7596] check_prev_add+0xeb/0xe60 [ 503.952771][ T7596] __lock_acquire+0x1528/0x1f40 [ 503.954415][ T7596] lock_acquire+0x1d1/0x380 [ 503.955977][ T7596] __mutex_lock+0x19f/0x1c10 [ 503.957563][ T7596] process_measurement+0x5ab/0x2360 [ 503.959305][ T7596] ima_file_check+0xc8/0x120 [ 503.960892][ T7596] security_file_post_open+0xc4/0x210 [ 503.962708][ T7596] path_openat+0x5d0/0x23f0 [ 503.964268][ T7596] do_file_open+0x20e/0x430 [ 503.965820][ T7596] do_sys_openat2+0x163/0x1d0 [ 503.967421][ T7596] __x64_sys_openat+0x12d/0x210 [ 503.969102][ T7596] do_syscall_64+0x121/0x770 [ 503.970683][ T7596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.972645][ T7596] [ 503.972645][ T7596] other info that might help us debug this: [ 503.972645][ T7596] [ 503.975729][ T7596] Chain exists of: [ 503.975729][ T7596] &ima_iint_mutex_key[depth] --> &common->filesem --> sb_writers#5 [ 503.975729][ T7596] [ 503.979965][ T7596] Possible unsafe locking scenario: [ 503.979965][ T7596] [ 503.982220][ T7596] CPU0 CPU1 [ 503.983863][ T7596] ---- ---- [ 503.985518][ T7596] rlock(sb_writers#5); [ 503.986831][ T7596] lock(&common->filesem); [ 503.988965][ T7596] lock(sb_writers#5); [ 503.990992][ T7596] lock(&ima_iint_mutex_key[depth]); [ 503.992654][ T7596] [ 503.992654][ T7596] *** DEADLOCK *** [ 503.992654][ T7596] [ 503.995112][ T7596] locks held by udevd/7596: 1, last CPU#3: [ 503.996946][ T7596] #0: ffff888027294478 (sb_writers#5){.+.+}-{0:0}, at: path_openat+0x1920/0x23f0 [ 503.999764][ T7596] [ 503.999764][ T7596] stack backtrace: [ 504.001571][ T7596] CPU: 3 UID: 0 PID: 7596 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(full) [ 504.004727][ T7596] Tainted: [L]=SOFTLOCKUP [ 504.006080][ T7596] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 504.009158][ T7596] Call Trace: [ 504.010202][ T7596] [ 504.011126][ T7596] dump_stack_lvl+0x100/0x190 [ 504.012596][ T7596] print_circular_bug.cold+0x178/0x1be [ 504.014271][ T7596] check_noncircular+0x146/0x160 [ 504.015817][ T7596] check_prev_add+0xeb/0xe60 [ 504.017272][ T7596] __lock_acquire+0x1528/0x1f40 [ 504.018786][ T7596] lock_acquire+0x1d1/0x380 [ 504.020209][ T7596] ? process_measurement+0x5ab/0x2360 [ 504.021885][ T7596] ? __pfx___might_resched+0x10/0x10 [ 504.023528][ T7596] __mutex_lock+0x19f/0x1c10 [ 504.024970][ T7596] ? process_measurement+0x5ab/0x2360 [ 504.026636][ T7596] ? process_measurement+0x5ab/0x2360 [ 504.028296][ T7596] ? __pfx___mutex_lock+0x10/0x10 [ 504.029856][ T7596] ? rcu_is_watching+0x13/0xc0 [ 504.031342][ T7596] ? trace_kmem_cache_alloc+0xdd/0x100 [ 504.033079][ T7596] ? __kasan_slab_alloc+0x89/0x90 [ 504.034698][ T7596] ? find_held_lock+0x2b/0x80 [ 504.036183][ T7596] ? process_measurement+0x5ab/0x2360 [ 504.037808][ T7596] process_measurement+0x5ab/0x2360 [ 504.039419][ T7596] ? find_held_lock+0x2b/0x80 [ 504.040830][ T7596] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 504.042654][ T7596] ? __pfx_process_measurement+0x10/0x10 [ 504.044333][ T7596] ? __pfx___fsnotify_parent+0x10/0x10 [ 504.045990][ T7596] ima_file_check+0xc8/0x120 [ 504.047489][ T7596] ? __pfx_ima_file_check+0x10/0x10 [ 504.049075][ T7596] ? vfs_open_consume+0x334/0x460 [ 504.050622][ T7596] security_file_post_open+0xc4/0x210 [ 504.052261][ T7596] path_openat+0x5d0/0x23f0 [ 504.053647][ T7596] ? __pfx_path_openat+0x10/0x10 [ 504.055145][ T7596] do_file_open+0x20e/0x430 [ 504.056580][ T7596] ? __pfx_do_file_open+0x10/0x10 [ 504.058100][ T7596] ? _raw_spin_unlock+0x28/0x50 [ 504.059572][ T7596] ? alloc_fd+0x471/0x7a0 [ 504.060897][ T7596] do_sys_openat2+0x163/0x1d0 [ 504.062362][ T7596] ? __pfx_do_sys_openat2+0x10/0x10 [ 504.063977][ T7596] __x64_sys_openat+0x12d/0x210 [ 504.065490][ T7596] ? __pfx___x64_sys_openat+0x10/0x10 [ 504.067157][ T7596] do_syscall_64+0x121/0x770 [ 504.068597][ T7596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.070416][ T7596] RIP: 0033:0x7fb2632a7407 [ 504.071808][ T7596] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 504.077686][ T7596] RSP: 002b:00007fff0a80ad80 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 504.080242][ T7596] RAX: ffffffffffffffda RBX: 00007fb263a24880 RCX: 00007fb2632a7407 [ 504.082659][ T7596] RDX: 00000000000a0241 RSI: 00007fff0a80ba40 RDI: ffffffffffffff9c [ 504.085088][ T7596] RBP: 000055dc20e254e0 R08: 0000000000000000 R09: 0000000000000000 [ 504.087519][ T7596] R10: 0000000000000124 R11: 0000000000000202 R12: 000055dc20bfc830 [ 504.089943][ T7596] R13: 00007fff0a80ba40 R14: 00007fff0a80b640 R15: 00007fff0a80b240 [ 504.092374][ T7596] [ 504.097472][ T5892] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 504.097482][ T5892] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 504.101659][ T5892] cxacru 6-1:1.0: probe with driver cxacru failed with error -71 [ 504.106506][ T1350] kernel write not supported for file /input/event0 (pid: 1350 comm: kworker/1:2) [ 504.118752][ T5892] usb 6-1: USB disconnect, device number 3 [ 504.169122][ T5879] usb 1-1: new high-speed USB device number 3 using ehci-pci [ 504.339589][ T5879] usb 1-1: New USB device found: idVendor=0627, idProduct=0001, bcdDevice=0.00 [ 504.351997][ T5879] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 504.352012][ T5879] usb 1-1: Product: QEMU USB Tablet [ 504.352020][ T5879] usb 1-1: Manufacturer: QEMU [ 504.352028][ T5879] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 504.373042][ T5879] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0002/input/input7 [ 504.432475][ T5879] hid-generic 0003:0627:0001.0002: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 504.669281][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 504.669350][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 506.749290][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 506.749493][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 508.829173][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 508.829210][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 510.909212][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 510.909328][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 512.989221][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110 [ 512.999191][T12932] Bluetooth: hci0: command 0x0c24 tx timeout [ 512.999244][ T67] Bluetooth: hci0: Opcode 0x0c24 failed: -110