last executing test programs: 5.688983985s ago: executing program 2 (id=1631): r0 = socket(0x40000000015, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', 0x0, 0x0, 0x0, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x96, 0x0, 0x1}, 0x28) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) chdir(0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x0) get_mempolicy(0x0, 0x0, 0x6, &(0x7f0000006000/0x2000)=nil, 0x3) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x339) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) getsockopt(r0, 0x200000000114, 0x271c, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000002780), 0x2280) fcntl$setstatus(r6, 0x4, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="23000000081b000002000000ffff000005"], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 5.040929647s ago: executing program 1 (id=1632): r0 = syz_open_dev$dvb_dvr(0x0, 0x0, 0x8257f) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000008189899a1fea9fd2d3945b80d6327bd32ac2478b7a5b9b719bccbf84270be5534512acf9bfb650ec311885", @ANYRES16=r1, @ANYBLOB="00082bbd7000fddbdf2508000000"], 0x14}, 0x1, 0x0, 0x0, 0x400c0c4}, 0x20000810) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x1c3040, 0x0) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r3 = creat(&(0x7f00000002c0)='./file0\x00', 0x104) r4 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r4, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r3, &(0x7f0000000c40)=ANY=[], 0x13) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r5, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000140)=[0x5], 0x0, 0x0, 0x1, 0x1}}, 0x40) ioctl$DVB_DVR_DMX_SET_BUFFER_SIZE(r0, 0x6f2d, 0x1) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101002, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) 4.799236765s ago: executing program 2 (id=1635): socket$igmp6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffff", 0xb) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x3ff}, 0x1c) readv(r0, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000001c0)='O', 0x1, 0x4000c01, &(0x7f0000000280)={0xa, 0x400, 0xfffffffe, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}, 0x1c) shutdown(r3, 0x1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7c, 0x0, &(0x7f0000000180)) sendmmsg$inet6(r2, &(0x7f0000002940), 0x40000000000017d, 0x811) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r4, 0x4601, &(0x7f0000000380)={0x3c0, 0x78, 0x0, 0x400, 0x7, 0x0, 0x0, 0x2, {}, {0x0, 0x0, 0x4}, {0x4}, {}, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x3, 0x1ff, 0x3d, 0xc, 0x8000, 0x7b, 0x4, 0x1, 0xa}) 3.849414033s ago: executing program 3 (id=1637): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0xfffc, 0x4}, 0x0, [0x9faf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x4, 0xfeffffff, 0x0, 0x0, 0xffff, 0x1, 0x0, 0x0, 0x20000000, 0x0, 0x4, 0x0, 0x6, 0x8, 0x7fff, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffffffc, 0x3, 0x0, 0x401, 0x0, 0xffffffff, 0xdc, 0xa, 0x0, 0x2d52c0], [0x0, 0x1, 0x2, 0xb16, 0x0, 0xffffffcb, 0x0, 0x0, 0x0, 0x2000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x9, 0x0, 0x0, 0xfffffffd, 0xfffffffe, 0x0, 0x0, 0x10, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x1000, 0x0, 0xf, 0xc559, 0x2000002, 0x0, 0x0, 0x0, 0xfffffffe, 0x20000100, 0x1, 0x0, 0x0, 0x66bd, 0x0, 0xfefffffd, 0x1, 0x8, 0xd77, 0x0, 0x0, 0xfffff37a, 0x0, 0x0, 0x9bd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf, 0x0, 0x2], [0x8, 0xa, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x9, 0x0, 0x7, 0x20000, 0xfffffffd, 0x2, 0xe, 0xffff, 0x0, 0x0, 0xffffff7f, 0x9, 0x0, 0x0, 0x0, 0x9, 0x0, 0x2, 0xf, 0x0, 0xd12, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x1000000, 0x8000000, 0x403, 0x0, 0x0, 0x0, 0x80, 0x8, 0x0, 0x7, 0xca, 0x0, 0xfffffffe, 0x4], [0x0, 0xfffffffc, 0xfffffffc, 0xc, 0x6, 0x0, 0x7, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x3, 0x2, 0x0, 0xe, 0x4000000, 0x0, 0x0, 0x8d, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffeffff, 0x1fd, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffd, 0x7fd, 0x0, 0x40002, 0x2, 0x0, 0x0, 0x6, 0x0, 0x401, 0x100000, 0x4, 0x10000, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz0\x00', {0x0, 0x0, 0x0, 0xf}, 0x4d, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x4001, 0x0, 0x2, 0xfffffe00, 0x0, 0xa9, 0x0, 0x1, 0x0, 0x7ff, 0x80, 0x0, 0x4, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x1, 0x0, 0x401, 0x0, 0x0, 0xfffffffe, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4], [0xffffffff, 0x3, 0x10000002, 0x0, 0x0, 0x40000, 0x0, 0x4, 0xfffffffd, 0x800, 0x9262, 0x4, 0x0, 0x0, 0x0, 0x4, 0xffffffff, 0x400000, 0x1, 0x5, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x1000, 0x401f, 0x0, 0x0, 0x0, 0x4, 0xfffffffb, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0xfd5], [0x0, 0xfffffff6, 0x0, 0x20000004, 0x0, 0x5, 0x0, 0x0, 0x5, 0x0, 0xfffffffe, 0x800, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8, 0x80000, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8000000, 0x0, 0x0, 0x6, 0x0, 0x3, 0x6, 0x82, 0xffffffff, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x100, 0x0, 0x6, 0x6, 0x0, 0x5], [0x81, 0x5, 0x5d30, 0x1, 0x0, 0x100000, 0xdbc1, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x6, 0x0, 0x0, 0xfffffffe, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0xffffffff, 0x2, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x4, 0x3, 0x0, 0xffffffdc, 0x2, 0x0, 0xff, 0x0, 0x0, 0x0, 0xe58b, 0xfffffff9, 0x0, 0x3, 0x0, 0x4, 0x1ff]}, 0x45c) 3.846749066s ago: executing program 0 (id=1645): r0 = openat$sndseq(0xffffff9c, &(0x7f0000001240), 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f0000000180)={{0x80, 0xf7}, 'port1\x00', 0x3fb, 0x2062f, 0x4, 0x6, 0x0, 0x1000, 0x8, 0x0, 0x7, 0xfe}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) 3.757110153s ago: executing program 3 (id=1638): mkdir(&(0x7f0000000040)='./myproc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./myproc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./myproc/scsi/device_info\x00', 0x40000, 0x0) read$FUSE(r0, &(0x7f0000000300)={0x2020}, 0x2020) read$FUSE(r0, &(0x7f0000002340)={0x2020}, 0x2020) read$FUSE(r0, &(0x7f00000069c0)={0x2020}, 0x2020) 3.7499302s ago: executing program 0 (id=1647): r0 = socket(0x40000000015, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', 0x0, 0x0, 0x0, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x96, 0x0, 0x1}, 0x28) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) chdir(0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x0) get_mempolicy(0x0, 0x0, 0x6, &(0x7f0000006000/0x2000)=nil, 0x3) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x339) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) getsockopt(r0, 0x200000000114, 0x271c, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000002780), 0x2280) fcntl$setstatus(r6, 0x4, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="23000000081b000002000000ffff000005"], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 3.331347087s ago: executing program 3 (id=1639): write(0xffffffffffffffff, &(0x7f0000000140), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='md0', 0x3) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r1, &(0x7f00000007c0)='active', 0x6) 3.299058538s ago: executing program 1 (id=1640): bpf$PROG_LOAD(0x5, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x2200020, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000008c0)=r1, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r2, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) 2.914858161s ago: executing program 1 (id=1641): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) close(r0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt(r1, 0x84, 0x80, &(0x7f00000002c0)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) sendto$inet6(r1, &(0x7f00000004c0)="b0", 0x1, 0x1f4, &(0x7f0000000240)={0xa, 0x4e23, 0x7, @loopback, 0x4}, 0x1c) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000780)={0x0, @in6={{0xa, 0x4e23, 0x3, @loopback, 0xb578}}}, 0x84) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 2.901831182s ago: executing program 3 (id=1642): r0 = socket(0x40000000015, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x50) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', 0x0, 0x0, 0x0, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x96, 0x0, 0x1}, 0x28) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) chdir(0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x0) get_mempolicy(0x0, 0x0, 0x6, &(0x7f0000006000/0x2000)=nil, 0x3) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x339) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) getsockopt(r0, 0x200000000114, 0x271c, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000002780), 0x2280) fcntl$setstatus(r6, 0x4, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="23000000081b000002000000ffff000005"], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 2.874495953s ago: executing program 1 (id=1643): r0 = socket(0x40000000015, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', 0x0, 0x0, 0x0, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x96, 0x0, 0x1}, 0x28) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) chdir(0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x0) get_mempolicy(0x0, 0x0, 0x6, &(0x7f0000006000/0x2000)=nil, 0x3) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x339) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) getsockopt(r0, 0x200000000114, 0x271c, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000002780), 0x2280) fcntl$setstatus(r6, 0x4, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="23000000081b000002000000ffff000005"], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 2.407537711s ago: executing program 2 (id=1644): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r2, &(0x7f0000000000)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) setsockopt$SO_BINDTODEVICE_wg(r2, 0x1, 0x19, &(0x7f0000000140)='wg1\x00', 0x4) listen(r2, 0x5) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d23210"], 0x4a) 2.240080475s ago: executing program 0 (id=1646): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in6={{0xa, 0x4e24, 0x2, @remote, 0x7fffffff}}, 0x0, 0x0, 0x21, 0x0, "0ed1f49c1be6c77a9794d96f9bf095e367c3dde4fb4b86d880c44648df9cb62c02f654fdb8bbd9dbe941d3c99bc65fe221fa8ac76ae23f3222bb9206f0475fae4a0a6af518d55f7275080000008b9e15"}, 0xd8) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @loopback}, 0x106}, 0x1c) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x3e, &(0x7f0000000980)=0x1000029, 0x4) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 2.187312551s ago: executing program 2 (id=1648): r0 = socket(0x40000000015, 0x5, 0x0) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', 0x0, 0x0, 0x0, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x96, 0x0, 0x1}, 0x28) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) chdir(0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x0) get_mempolicy(0x0, 0x0, 0x6, &(0x7f0000006000/0x2000)=nil, 0x3) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x339) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) getsockopt(r0, 0x200000000114, 0x271c, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000002780), 0x2280) fcntl$setstatus(r6, 0x4, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="23000000081b000002000000ffff000005"], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 2.109102237s ago: executing program 0 (id=1649): openat$ttynull(0xffffffffffffff9c, &(0x7f00000001c0), 0x82084, 0x0) syz_extract_tcp_res(0x0, 0x6, 0x5) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0xc5, &(0x7f0000000300)={0x0, 0x10f211, 0x4, 0x2002, 0x40001c, 0x0, r0}, &(0x7f00000007c0), &(0x7f00000000c0), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, &(0x7f0000000800)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x9, @dev={0xfe, 0x80, '\x00', 0x43}, 0x5}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000680)="92ca3a839be8e27fc536b372000000a296de0d0ffc1741a765bf3f5ca07596cc2ff87ba8aa859a112c04aa9d4840d1624f0a5ae2c074a946be21e2009392db2023965d125247f55fa1bce029e1f40492d9ba71aa7890683c202b50c75f3f955b63ac5826dcdd7d524ff2f656bbfb50275d4b85a96e994dc2746067c63fd67838d6a82cf356296db4e3165011257bc44151dc994f1efde4b8fe73e132d8e94795bc9adc5875f4867021a6d8453cf1ee42700e19f5bb6f58b649e0f75abb081224b04953ecf70e88f0d81c9921efe756ab560100000000000000391e5051d7f5adbadc308cdcd00a51f0f0111213572bcf82fe894f9c12d43b8b860cf06bb97e505d74", 0x102}], 0x1}}, {{&(0x7f0000000580)={0xa, 0x4e24, 0x81, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xb}, 0x1c, &(0x7f0000000600)=[{&(0x7f00000005c0)='j', 0x1}], 0x1}}], 0x2, 0x14) shutdown(r2, 0x1) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="d8000000180081054e81f782db4cb904021d0800fe00fe05e8fe55a10a0015000600142603600e1208000f007f370301a8001600a40002400f000100035c0461c1d67f6f94007134cf6edb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090014d6d9", 0x6c}], 0x1}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0xb, 0x1, 'TCPMSS\x00'}, @NFTA_TARGET_INFO={0xd, 0x3, "ac1a91d256ebf87b31"}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x90}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x2004095) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r5, &(0x7f0000000040), 0x10) setsockopt$PNPIPE_ENCAP(r5, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4) 1.719798324s ago: executing program 3 (id=1650): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket(0xa, 0x2400000001, 0x0) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000100)={0x2, @pix={0x712, 0x4e, 0x32315559, 0x4, 0x7, 0x9, 0x0, 0x2, 0x0, 0x6, 0x0, 0x2}}) getrlimit(0xc, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, @none, 0x7f}, 0xa) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000200)={0x1, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) ioprio_set$uid(0x3, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61105c00000000006113380000000000bfa00000000000000700000008ffffffd50301001874004095000600000000006916360000000000bf67000000000000360607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c747664e9f7478f8200000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) fcntl$lock(r0, 0x25, &(0x7f0000000000)={0x0, 0x0, 0x9, 0x3}) 1.619730859s ago: executing program 1 (id=1651): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)}], 0x1) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f00000048c0)=[{{0x0, 0x0, &(0x7f0000004a00)=[{&(0x7f0000001a00)=""/4099, 0x1003}], 0x1}}], 0x1003, 0x10122, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) ioctl$MEDIA_IOC_G_TOPOLOGY(r6, 0xc0487c04, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffff32, 0x0, 0x0, 0x1c, 0x0, &(0x7f0000000340), 0x0, 0x0, 0x0}) r7 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc0287c02, &(0x7f0000000800)={0x80000000, 0x0, &(0x7f0000000b00)}) close_range(r7, r3, 0x2) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000a40)={0x0, 0x6, 0x0, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}], 0x1, 0x0, &(0x7f0000000780)=[{}], 0x8, 0x0, &(0x7f0000000880)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f0000000980)=[{}, {}, {}, {}]}) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x68050}, 0x0) 1.43968297s ago: executing program 0 (id=1652): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1fe) r0 = socket(0x28, 0x5, 0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$FAT_IOCTL_GET_VOLUME_ID(r1, 0x80047213, &(0x7f00000007c0)) sendmsg$NL80211_CMD_NEW_KEY(r3, 0x0, 0x4040) sendmsg$NL80211_CMD_DEL_STATION(r0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x8000) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3a) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0x6d1, 0x0, 0x0, 0x1000, 0x5}}}, &(0x7f0000000300)=0x0) socket(0x11, 0x3, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000500), 0x8, 0x8000) syz_ublk_setup_queues(0xffffffffffffffff, r4, &(0x7f0000000540)={0x0, 0x1aa5, 0x80, 0x2, 0x20000}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3104, 0x2000, 0x0, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587d, 0x0, 0x1, 0x69}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffe, 0x800, 0x10000, 0x400000}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6253, 0x4000, 0x2}}], 0x1, &(0x7f00000003c0)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x0, 0xdbd, 0x0, 0x0}}, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getdents64(r5, 0x0, 0x22) 1.09614032s ago: executing program 2 (id=1653): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) prlimit64(r1, 0x3, 0x0, 0x0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000340)={'broute\x00', 0x0, 0x0, 0x0, [0x20000001, 0x101, 0x7, 0x5, 0x3, 0xdc0c]}, &(0x7f00000003c0)=0x50) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/lru_gen\x00', 0x2, 0x0) r3 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000340), 0x610000, 0x0) fcntl$setsig(r3, 0x404, 0x21) write(r2, &(0x7f0000000a00)='- 1 0 1\n', 0x8) ioctl$KDGKBMODE(r2, 0x4b44, &(0x7f0000000040)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpid() syz_emit_ethernet(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r5 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="1400000016000b63d25a80648c25940121", 0x11}, {&(0x7f0000000280)="e26248", 0x3}], 0x2}, 0x48050) socket$can_j1939(0x1d, 0x2, 0x7) 839.706835ms ago: executing program 3 (id=1654): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0x29, 0x5, 0x0) write$cgroup_pressure(r1, &(0x7f0000000140)={'full'}, 0xfffffdef) sendmmsg(r1, 0x0, 0x0, 0x88c3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x45) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000004c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x534, 0x3e8, 0x288, 0x0, 0x354, 0x354, 0x4cc, 0x4cc, 0x4cc, 0x4cc, 0x4cc, 0x6, &(0x7f0000000200), {[{{@uncond, 0x0, 0x70, 0x94}, @unspec=@CHECKSUM={0x24}}, {{@uncond, 0x0, 0x1c4, 0x1f4, 0x0, {}, [@common=@inet=@policy={{0x154}, {[{@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, [0xffffff00, 0xff, 0xff, 0xffffffff], @ipv6=@dev={0xfe, 0x80, '\x00', 0x2a}, [0xffffffff, 0xffffff00, 0xffffffff, 0xffffffff], 0x4d2, 0x34ff, 0x4, 0x1, 0xf301d94a6ccd76a1, 0x1}, {@ipv4=@empty, [0xff, 0xff000000, 0xff, 0xffffff00], @ipv4=@loopback, [0xff000000, 0xff, 0x0, 0xffffffff], 0x4d6, 0x34ff, 0x2c, 0x1, 0x6}, {@ipv6=@mcast2, [0x13139661c108bed2, 0xffffffff], @ipv6=@local, [0xffffffff, 0x0, 0x0, 0xff], 0x9, 0x3502, 0x0, 0x1, 0x0, 0xb}, {@ipv6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], @ipv4=@loopback, [0x0, 0xff000000, 0xffffff00, 0xff000000], 0x4d6, 0x3503, 0x6cab86d5531856f4, 0x0, 0x8, 0xc}]}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x5, 0x3, @remote, 0x4e24}}}, {{@uncond, 0x0, 0x70, 0xcc}, @common=@CLUSTERIP={0x5c, 'CLUSTERIP\x00', 0x0, {0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, 0x3, 0x7, [0x23, 0x40, 0x6, 0x26, 0x25, 0x14, 0x2e, 0xd, 0xf, 0x6, 0xd, 0x25, 0xd, 0x3c, 0x2e, 0x2d], 0x1, 0xa50, 0xfffffffc}}}, {{@ip={@private=0xa010102, @broadcast, 0xffffffff, 0x0, 'macvlan1\x00', 'erspan0\x00', {}, {0xff}, 0x2f, 0x1, 0x8}, 0x0, 0x70, 0x94}, @unspec=@CHECKSUM={0x24}}, {{@uncond, 0x0, 0x94, 0xb8, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x7}}]}, @unspec=@CHECKSUM={0x24}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x590) r4 = openat$cdrom(0xffffff9c, &(0x7f00000002c0), 0x101100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) ioctl$CDROMPLAYBLK(r4, 0x5317, &(0x7f0000000000)={0x5, 0x9}) 718.800583ms ago: executing program 2 (id=1655): r0 = socket(0x40000000015, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', 0x0, 0x0, 0x0, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x96, 0x0, 0x1}, 0x28) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) chdir(0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x0) get_mempolicy(0x0, 0x0, 0x6, &(0x7f0000006000/0x2000)=nil, 0x3) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x339) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) getsockopt(r0, 0x200000000114, 0x271c, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000002780), 0x2280) fcntl$setstatus(r6, 0x4, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="23000000081b000002000000ffff000005"], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 479.499652ms ago: executing program 0 (id=1656): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) fsopen(0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$user(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r4, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13, 0x4}) r5 = syz_open_dev$vbi(&(0x7f0000000340), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r5, 0xc0845657, 0x0) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = fcntl$dupfd(r3, 0x406, r3) write$binfmt_elf64(r6, &(0x7f00000004c0)=ANY=[], 0xfffffdcf) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 0s ago: executing program 1 (id=1657): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x2404c040) syz_extract_tcp_res(&(0x7f00000000c0)={0x41424344}, 0x7, 0x7) syz_extract_tcp_res(&(0x7f0000000180)={0x41424344}, 0x3fae613b, 0x54c3) syz_emit_ethernet(0x182, &(0x7f0000001900)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa080047b801740065000003069078ac141413ac1414bb890f2dac1414bbac14143be0000001830bfeac1414aaac1414bb01008307d70a010102830bf00a01010100000000070bdd64010101ac1414bb94040000940988ee18e1bf4d2c00004e244e23", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="4100a200907801010402080a0000000900000009020e7d854cfe7620496ccf8d14660002047f00fe08f989f30f5844131299c5e9404242699d4f7667ed0bd037e6000000eb8718944920b18586c8bc8e5194a214acdd78994244c12a9260d550a40b23785c040aa13b7295dfc11a8fa167d36b184951e6542953dcc782b935e6efca6a8f125bccf3cca586de457cf3122c2600af4cdfb2604ff1a4e9884fe5f945e1f746935cc07cbc47691a8acb47a917b0d2b6cfb27d321884143f6d7c62391edb24908d35cc419d"], 0x0) r2 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e21, @remote}}, 0x0, 0x0, 0x24, 0x0, "e83ae75240c2d6d8ec87bb53fab0910000000000000007a5922406b64cddaeb9d339ba3c35dc0a08df8e61740b7cf2d4e499d58654a4cf0fa0ce1f830c3079cffcfd00"}, 0x8c) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000080)='bbr', 0x3) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r3, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @private=0xa010100}]}, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x3}, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e20, 0x1, @private1, 0x26d8468e}}}, &(0x7f0000000480)=0x84) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f0000000140)=0x4, 0x4) sendmsg$inet(r3, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) syz_open_dev$amidi(&(0x7f0000000380), 0x3, 0x2) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000)=0x9, 0x4) recvmsg(r3, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz1\x00', 0x200002, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)=[{0x0, 0x3c}], 0x1, 0x0, 0x0, 0xb305e06d8ab48273}, 0x48800) openat$cgroup_type(r5, &(0x7f0000000080), 0x2, 0x0) kernel console output (not intermixed with test programs): atadv_slave_1 [ 48.203042][ T5748] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.213041][ T5748] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.224222][ T5746] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.227166][ T5746] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.237096][ T5746] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.243453][ T5742] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.256992][ T5752] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.259643][ T5752] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.269734][ T5752] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.276746][ T5752] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.279189][ T5752] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.288622][ T5752] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.340147][ T5748] hsr_slave_0: entered promiscuous mode [ 48.342950][ T5748] hsr_slave_1: entered promiscuous mode [ 48.348439][ T5742] team0: Port device team_slave_0 added [ 48.351913][ T5742] team0: Port device team_slave_1 added [ 48.391871][ T5742] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.394399][ T5742] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.403087][ T5742] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.411114][ T5746] hsr_slave_0: entered promiscuous mode [ 48.413477][ T5746] hsr_slave_1: entered promiscuous mode [ 48.415713][ T5746] debugfs: 'hsr0' already exists in 'hsr' [ 48.417697][ T5746] Cannot create hsr debugfs directory [ 48.436155][ T5742] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.438686][ T5742] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.449065][ T5742] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.459910][ T5752] hsr_slave_0: entered promiscuous mode [ 48.464280][ T5752] hsr_slave_1: entered promiscuous mode [ 48.467436][ T5752] debugfs: 'hsr0' already exists in 'hsr' [ 48.469683][ T5752] Cannot create hsr debugfs directory [ 48.615177][ T5742] hsr_slave_0: entered promiscuous mode [ 48.618669][ T5742] hsr_slave_1: entered promiscuous mode [ 48.621699][ T5742] debugfs: 'hsr0' already exists in 'hsr' [ 48.624121][ T5742] Cannot create hsr debugfs directory [ 48.828000][ T5748] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.840914][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.845751][ T5748] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.851464][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.854872][ T5748] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 48.860477][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.863396][ T5748] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 48.870612][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.930787][ T5746] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.938884][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.942654][ T5746] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.949101][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.956198][ T5746] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.961644][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.964624][ T5746] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.969553][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.056055][ T5742] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 49.056736][ T5753] Bluetooth: hci2: command tx timeout [ 49.056744][ T5754] Bluetooth: hci1: command tx timeout [ 49.069292][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.073424][ T5742] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 49.079348][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.082585][ T5742] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 49.086533][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.089277][ T5742] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 49.093560][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.135794][ T5753] Bluetooth: hci0: command tx timeout [ 49.135816][ T5754] Bluetooth: hci3: command tx timeout [ 49.166798][ T5752] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 49.173295][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.177601][ T5752] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 49.182712][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.191335][ T5752] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 49.195719][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.198729][ T5752] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 49.202512][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.210214][ T5746] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.217517][ T5748] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.252829][ T5748] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.258166][ T5746] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.272314][ T80] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.275663][ T80] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.282603][ T80] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.285295][ T80] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.301581][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.304522][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.308280][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.311053][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.384994][ T5746] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 49.406704][ T5742] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.439146][ T5742] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.449284][ T5752] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.459493][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.462459][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.484010][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.487162][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.494260][ T5752] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.509940][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.513142][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.529518][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.532632][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.715926][ T5748] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.754240][ T5748] veth0_vlan: entered promiscuous mode [ 49.770174][ T5748] veth1_vlan: entered promiscuous mode [ 49.785298][ T5746] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.823304][ T5748] veth0_macvtap: entered promiscuous mode [ 49.832725][ T5748] veth1_macvtap: entered promiscuous mode [ 49.847613][ T5746] veth0_vlan: entered promiscuous mode [ 49.859521][ T5746] veth1_vlan: entered promiscuous mode [ 49.870361][ T5748] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.879829][ T5742] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.889975][ T5748] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.941236][ T5752] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.946491][ T5746] veth0_macvtap: entered promiscuous mode [ 49.960256][ T5746] veth1_macvtap: entered promiscuous mode [ 49.963808][ T5742] veth0_vlan: entered promiscuous mode [ 49.988071][ T109] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.994848][ T109] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.002246][ T5742] veth1_vlan: entered promiscuous mode [ 50.031510][ T5746] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.036894][ T109] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.040910][ T109] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.047342][ T5746] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.069340][ T5752] veth0_vlan: entered promiscuous mode [ 50.092625][ T5752] veth1_vlan: entered promiscuous mode [ 50.092845][ T5748] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 50.102573][ T5742] veth0_macvtap: entered promiscuous mode [ 50.111767][ T5748] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.114478][ T5742] veth1_macvtap: entered promiscuous mode [ 50.120582][ T5748] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.126588][ T5748] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.144889][ T5748] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.176499][ T5742] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.180603][ T221] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.183389][ T221] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.209307][ T5742] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.221419][ T5752] veth0_macvtap: entered promiscuous mode [ 50.228831][ T109] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.232608][ T109] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.238807][ T5752] veth1_macvtap: entered promiscuous mode [ 50.283141][ T5752] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.419276][ T5752] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.445621][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.478000][ T5820] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.489341][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.504052][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.593338][ T221] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.598995][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.605565][ T221] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.607737][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.637316][ T109] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.643554][ T109] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.656221][ T5820] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.689899][ T5898] 9p: Bad value for 'rfdno' [ 50.689948][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.692269][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.705159][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.710681][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.720050][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.723651][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.727428][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.730897][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.734336][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.765600][ T5820] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.769408][ T5820] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.775799][ T5820] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.780817][ T5820] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.128429][ T5903] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 51.131360][ T5903] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 51.137421][ T5754] Bluetooth: hci2: command tx timeout [ 51.137538][ T5753] Bluetooth: hci1: command tx timeout [ 51.157521][ T5903] vhci_hcd vhci_hcd.0: Device attached [ 51.217000][ T5753] Bluetooth: hci3: command tx timeout [ 51.225563][ T5753] Bluetooth: hci0: command tx timeout [ 51.645753][ T5827] usb 38-1: SetAddress Request (2) to port 0 [ 51.648559][ T5827] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 52.044877][ T5921] loop9: detected capacity change from 0 to 255852544 [ 52.350141][ T5906] vhci_hcd: connection reset by peer [ 52.353976][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 52.356217][ T5820] vhci_hcd vhci_hcd.0: release socket [ 52.361700][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 52.400438][ T5904] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 52.680571][ T5904] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 52.748911][ T5904] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 52.756530][ T5904] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 52.769079][ T5904] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 52.778191][ T5904] pci 0000:00:01.0: pci_fixup_video+0x0/0x280 took 11765 usecs [ 52.855102][ T5904] pci 0000:00:01.0: Adding to iommu group 1 [ 52.869532][ T42] audit: type=1800 audit(1786064882.987:2): pid=5925 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.7" name="file0" dev="overlay" ino=31 res=0 errno=0 [ 53.220107][ T5754] Bluetooth: hci1: command tx timeout [ 53.222405][ T5753] Bluetooth: hci2: command tx timeout [ 53.295631][ T5753] Bluetooth: hci3: command tx timeout [ 53.559989][ T5904] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 53.562251][ T5904] pci 0000:00:01.0: vgaarb: bridge control possible [ 53.564335][ T5904] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 53.584011][ T5904] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 53.633706][ T5904] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 53.669251][ T5904] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 53.688057][ T5904] [drm] Found bochs VGA, ID 0xb0c5. [ 53.689742][ T5904] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 53.696309][ T5904] bochs-drm 0000:00:01.0: probe with driver bochs-drm failed with error -4 [ 53.810252][ T56] libceph: connect (1)[c::]:6789 error -101 [ 53.813650][ T56] libceph: mon0 (1)[c::]:6789 connect error [ 53.945660][ T5753] Bluetooth: hci0: command tx timeout [ 53.955949][ T5929] ceph: No mds server is up or the cluster is laggy [ 54.084365][ T56] libceph: connect (1)[c::]:6789 error -101 [ 54.088348][ T56] libceph: mon0 (1)[c::]:6789 connect error [ 54.883840][ T5949] ======================================================= [ 54.883840][ T5949] WARNING: The mand mount option has been deprecated and [ 54.883840][ T5949] and is ignored by this kernel. Remove the mand [ 54.883840][ T5949] option from the mount to silence this warning. [ 54.883840][ T5949] ======================================================= [ 55.240454][ T5954] netlink: 'syz.0.14': attribute type 1 has an invalid length. [ 55.248608][ T5954] netlink: 756 bytes leftover after parsing attributes in process `syz.0.14'. [ 55.305555][ T5753] Bluetooth: hci2: command tx timeout [ 55.305583][ T5754] Bluetooth: hci1: command tx timeout [ 55.385683][ T5753] Bluetooth: hci3: command tx timeout [ 55.630057][ T5967] 9pnet_virtio: no channels available for device 127.0.0.1 [ 56.462400][ T24] cfg80211: failed to load regulatory.db [ 56.787691][ T5827] usb 38-1: device descriptor read/8, error -110 [ 57.335230][ T5827] usb usb38-port1: attempt power cycle [ 57.368562][ T5980] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 57.371122][ T5980] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 57.475482][ T5980] vhci_hcd vhci_hcd.0: Device attached [ 57.738378][ T29] usb 44-1: SetAddress Request (2) to port 0 [ 57.747617][ T29] usb 44-1: new SuperSpeed USB device number 2 using vhci_hcd [ 58.057605][ T5827] usb usb38-port1: unable to enumerate USB device [ 58.504133][ T5981] vhci_hcd: connection reset by peer [ 58.508096][ T12] vhci_hcd vhci_hcd.3: stop threads [ 58.510299][ T12] vhci_hcd vhci_hcd.3: release socket [ 58.513783][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 59.122648][ T6004] tipc: Started in network mode [ 59.125571][ T6004] tipc: Node identity aaaaaaaaaa24, cluster identity 4711 [ 59.128132][ T6004] tipc: Enabled bearer , priority 10 [ 60.085048][ T6013] syz_tun: entered allmulticast mode [ 60.156522][ T56] tipc: Node number set to 9349802 [ 60.836392][ T6011] syz_tun: left allmulticast mode [ 60.993898][ T6032] syz.2.28 uses obsolete (PF_INET,SOCK_PACKET) [ 61.014110][ T6032] Bluetooth: MGMT ver 1.23 [ 61.018438][ T6032] netlink: 284 bytes leftover after parsing attributes in process `syz.2.28'. [ 61.860137][ T6042] usb 1-1: USB disconnect, device number 2 [ 62.756168][ T6058] netlink: 4 bytes leftover after parsing attributes in process `syz.3.35'. [ 62.815538][ T29] usb 44-1: device descriptor read/8, error -110 [ 63.216457][ T29] usb usb44-port1: attempt power cycle [ 63.445767][ T9] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 63.687101][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 63.695624][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 63.705338][ T9] usb 6-1: config 0 has an invalid interface number: 88 but max is 0 [ 63.711140][ T9] usb 6-1: config 0 has no interface number 0 [ 63.713241][ T9] usb 6-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 63.727814][ T9] usb 6-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid wMaxPacketSize 0 [ 63.732899][ T9] usb 6-1: config 0 interface 88 has no altsetting 0 [ 63.809456][ T9] usb 6-1: string descriptor 0 read error: -22 [ 63.813935][ T9] usb 6-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 63.843232][ T9] usb 6-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 63.913528][ T9] usb 6-1: config 0 descriptor?? [ 63.987225][ T6080] Zero length message leads to an empty skb [ 64.072754][ T9] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.88/input/input5 [ 64.453547][ T29] usb usb44-port1: unable to enumerate USB device [ 64.674942][ T9] input: failed to attach handler mousedev to device input5, error: -5 [ 64.691599][ T9] usb 6-1: USB disconnect, device number 2 [ 64.761784][ T6086] netlink: 188 bytes leftover after parsing attributes in process `syz.0.43'. [ 64.774064][ T5745] udevd[5745]: Error opening device "/dev/input/event3": No such file or directory [ 64.780443][ T5745] udevd[5745]: Unable to EVIOCGABS device "/dev/input/event3" [ 64.790413][ T5745] udevd[5745]: Unable to EVIOCGABS device "/dev/input/event3" [ 64.828105][ T6088] netlink: 'syz.2.44': attribute type 10 has an invalid length. [ 64.848644][ T6088] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 64.857154][ T6088] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 64.878316][ T6088] netlink: 14 bytes leftover after parsing attributes in process `syz.2.44'. [ 64.923113][ T6088] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 64.954923][ T6088] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 64.974768][ T6091] syz.2.44: vmalloc error: size 2147483264, exceeds total pages, mode:0x400cc0(GFP_KERNEL_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 64.996915][ T6088] bond0 (unregistering): (slave netdevsim1): Releasing backup interface [ 65.001381][ T6091] CPU: 1 UID: 0 PID: 6091 Comm: syz.2.44 Not tainted syzkaller #0 PREEMPT(full) [ 65.001409][ T6091] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 65.001445][ T6091] Call Trace: [ 65.001481][ T6091] [ 65.001488][ T6091] dump_stack_lvl+0x100/0x190 [ 65.001631][ T6091] warn_alloc.cold+0x94/0xa8 [ 65.001645][ T6091] ? __pfx_warn_alloc+0x10/0x10 [ 65.001670][ T6091] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 65.001709][ T6091] ? __kernel_text_address+0xd/0x30 [ 65.001741][ T6091] ? unwind_get_return_address+0x59/0xa0 [ 65.001793][ T6091] ? arch_stack_walk+0xa6/0xf0 [ 65.001836][ T6091] __vmalloc_node_range_noprof+0x136c/0x1630 [ 65.001868][ T6091] ? stack_trace_save+0x8e/0xc0 [ 65.001890][ T6091] ? __pfx_stack_trace_save+0x10/0x10 [ 65.001917][ T6091] ? do_replace+0x1c6/0x490 [ 65.002002][ T6091] ? add_lock_to_list+0x99/0x110 [ 65.002037][ T6091] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 65.002064][ T6091] ? __lock_acquire+0x49f/0x1a40 [ 65.002090][ T6091] ? __lock_acquire+0xd5b/0x1a40 [ 65.002118][ T6091] ? do_replace+0x1c6/0x490 [ 65.002138][ T6091] __vmalloc_node_noprof+0xad/0xf0 [ 65.002164][ T6091] ? do_replace+0x1c6/0x490 [ 65.002187][ T6091] __vmalloc_noprof+0xa3/0x120 [ 65.002212][ T6091] ? __pfx___vmalloc_noprof+0x10/0x10 [ 65.002246][ T6091] do_replace+0x1c6/0x490 [ 65.002270][ T6091] ? __pfx_do_replace+0x10/0x10 [ 65.002300][ T6091] ? __lock_acquire+0xd5b/0x1a40 [ 65.002331][ T6091] compat_do_replace+0x589/0x7a0 [ 65.002354][ T6091] ? __pfx_compat_do_replace+0x10/0x10 [ 65.002389][ T6091] ? bpf_lsm_capable+0x9/0x10 [ 65.002430][ T6091] ? security_capable+0x80/0x260 [ 65.002513][ T6091] do_ebt_set_ctl+0x3f4/0x4a0 [ 65.002540][ T6091] ? __pfx_do_ebt_set_ctl+0x10/0x10 [ 65.002593][ T6091] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 65.002638][ T6091] ? nf_sockopt_find.isra.0+0x222/0x290 [ 65.002676][ T6091] nf_setsockopt+0x8d/0xf0 [ 65.002704][ T6091] ip_setsockopt+0xcb/0xf0 [ 65.002736][ T6091] tcp_setsockopt+0xa7/0x100 [ 65.002760][ T6091] smc_setsockopt+0x1b6/0xa40 [ 65.002815][ T6091] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 65.002856][ T6091] ? __pfx_smc_setsockopt+0x10/0x10 [ 65.002882][ T6091] ? aa_sock_opt_perm+0xfe/0x1b0 [ 65.002906][ T6091] ? __pfx_smc_setsockopt+0x10/0x10 [ 65.002929][ T6091] do_sock_setsockopt+0xf3/0x1d0 [ 65.002960][ T6091] __sys_setsockopt+0x119/0x190 [ 65.002991][ T6091] __ia32_sys_setsockopt+0xbc/0x160 [ 65.003017][ T6091] ? __do_fast_syscall_32+0x98/0x970 [ 65.003052][ T6091] ? lockdep_hardirqs_on+0x78/0x100 [ 65.003076][ T6091] __do_fast_syscall_32+0xe7/0x970 [ 65.003106][ T6091] do_fast_syscall_32+0x32/0x70 [ 65.003134][ T6091] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 65.003158][ T6091] RIP: 0023:0xf6fcefec [ 65.003181][ T6091] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 65.003207][ T6091] RSP: 002b:00000000f539c50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 65.003226][ T6091] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000000000000 [ 65.003238][ T6091] RDX: 0000000000000080 RSI: 0000000080000100 RDI: 0000000000000108 [ 65.003250][ T6091] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 65.003261][ T6091] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 65.003273][ T6091] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 65.003298][ T6091] [ 65.177632][ T6093] file system registered [ 65.183753][ T6093] ffs_data_put(): freeing [ 65.206687][ T6091] Mem-Info: [ 65.208099][ T6091] active_anon:7191 inactive_anon:47 isolated_anon:0 [ 65.208099][ T6091] active_file:127 inactive_file:53061 isolated_file:0 [ 65.208099][ T6091] unevictable:768 dirty:544 writeback:0 [ 65.208099][ T6091] slab_reclaimable:9616 slab_unreclaimable:50998 [ 65.208099][ T6091] mapped:24240 shmem:1224 pagetables:1112 [ 65.208099][ T6091] sec_pagetables:296 bounce:0 [ 65.208099][ T6091] kernel_misc_reclaimable:0 [ 65.208099][ T6091] free:37364 free_pcp:17604 free_cma:0 [ 65.231530][ T6091] Node 0 active_anon:2448kB inactive_anon:0kB active_file:508kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:336kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:2048kB kernel_stack:7904kB pagetables:1212kB sec_pagetables:1104kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 65.253397][ T6091] Node 1 active_anon:26516kB inactive_anon:188kB active_file:0kB inactive_file:212244kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:97424kB dirty:2176kB writeback:0kB shmem:3360kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:2048kB kernel_stack:5308kB pagetables:3236kB sec_pagetables:80kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 65.271720][ T6088] bond0 (unregistering): Released all slaves [ 65.284486][ T6091] Node 0 DMA free:2032kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:236kB local_pcp:36kB free_cma:0kB [ 65.345569][ T6091] lowmem_reserve[]: 0 280 280 280 280 [ 65.360881][ T6091] Node 0 DMA32 free:13760kB boost:0kB min:12768kB low:15960kB high:19152kB reserved_highatomic:0KB free_highatomic:0KB active_anon:2428kB inactive_anon:0kB active_file:508kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:1032196kB managed:286908kB mlocked:0kB bounce:0kB free_pcp:12140kB local_pcp:3252kB free_cma:0kB [ 65.377221][ T6091] lowmem_reserve[]: 0 0 0 0 0 [ 65.379354][ T6091] Node 1 DMA32 free:124032kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:27132kB inactive_anon:188kB active_file:0kB inactive_file:212244kB unevictable:1536kB writepending:2176kB zspages:1788kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:63644kB local_pcp:16024kB free_cma:0kB [ 65.409129][ T6091] lowmem_reserve[]: 0 0 0 0 0 [ 65.432375][ T6091] Node 0 DMA: 4*4kB (UE) 4*8kB (UE) 8*16kB (UE) 12*32kB (UE) 7*64kB (UE) 2*128kB (E) 1*256kB (E) 1*512kB (E) 0*1024kB 0*2048kB 0*4096kB = 2032kB [ 65.438903][ T6091] Node 0 DMA32: 38*4kB (UME) 19*8kB (UE) 5*16kB (UE) 62*32kB (UME) 16*64kB (UME) 13*128kB (UME) 14*256kB (UME) 4*512kB (UM) 3*1024kB (ME) 0*2048kB 0*4096kB = 13760kB [ 65.446340][ T6091] Node 1 DMA32: 120*4kB (UME) 154*8kB (UME) 78*16kB (UME) 71*32kB (UME) 27*64kB (UME) 17*128kB (UME) 19*256kB (UME) 14*512kB (UME) 5*1024kB (UM) 5*2048kB (UE) 26*4096kB (UM) = 143024kB [ 65.453266][ T6091] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 65.457976][ T6091] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 65.461024][ T6091] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 65.463980][ T6091] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 65.467397][ T6091] 57085 total pagecache pages [ 65.468924][ T6091] 136 pages in swap cache [ 65.470366][ T6091] Free swap = 122360kB [ 65.471697][ T6091] Total swap = 124996kB [ 65.473027][ T6091] 524155 pages RAM [ 65.474222][ T6091] 0 pages HighMem/MovableOnly [ 65.476397][ T6091] 211535 pages reserved [ 65.477620][ T6091] 0 pages cma reserved [ 65.708230][ T6088] mmap: syz.2.44 (6088) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 65.714773][ T6110] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(11) [ 65.717231][ T6110] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 65.723310][ T6110] vhci_hcd vhci_hcd.0: Device attached [ 66.015549][ T34] usb 44-1: SetAddress Request (6) to port 0 [ 66.018235][ T34] usb 44-1: new SuperSpeed USB device number 6 using vhci_hcd [ 66.382016][ T6112] vhci_hcd: connection reset by peer [ 66.436746][ T6130] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 66.456206][ T5835] vhci_hcd vhci_hcd.3: stop threads [ 66.466184][ T5835] vhci_hcd vhci_hcd.3: release socket [ 66.473944][ T5835] vhci_hcd vhci_hcd.3: disconnect device [ 67.545907][ T10] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 67.996696][ T6145] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input6 [ 68.080008][ T6152] process 'syz.2.55' launched './file2' with NULL argv: empty string added [ 68.195283][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 68.207164][ T10] usb 6-1: not running at top speed; connect to a high speed hub [ 68.394207][ T10] usb 6-1: config 10 has an invalid interface number: 3 but max is 0 [ 68.408200][ T10] usb 6-1: config 10 has no interface number 0 [ 68.419247][ T10] usb 6-1: config 10 interface 3 has no altsetting 0 [ 68.441157][ T10] usb 6-1: New USB device found, idVendor=11ba, idProduct=1003, bcdDevice=14.c2 [ 68.447754][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.451433][ T10] usb 6-1: Product: syz [ 68.453204][ T10] usb 6-1: Manufacturer: syz [ 68.455153][ T10] usb 6-1: SerialNumber: syz [ 68.671675][ T6153] can0: slcan on ttyS3. [ 68.677501][ T6156] retu-mfd 0-0001: could not read Retu revision: -6 [ 68.684605][ T6156] i2c i2c-0: new_device: Instantiated device retu at 0x01 [ 68.889137][ T6160] can0 (unregistered): slcan off ttyS3. [ 69.202415][ T6171] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1022815425 (2045630850 ns) > initial count (1125894 ns). Using initial count to start timer. [ 69.274940][ T10] pvrusb2: Hardware description: OnAir Creator Hybrid USB tuner [ 69.293698][ T10] usb 6-1: selecting invalid altsetting 0 [ 69.299274][ T2513] pvrusb2: Invalid write control endpoint [ 69.319581][ T6176] syz.3.59: attempt to access beyond end of device [ 69.319581][ T6176] sr0: rw=6144, sector=128, nr_sectors = 8 limit=128 [ 69.324406][ T6176] gfs2: error -5 reading superblock [ 69.388769][ T2513] pvrusb2: Invalid write control endpoint [ 69.391442][ T2513] pvrusb2: Invalid write control endpoint [ 69.393536][ T2513] pvrusb2: Invalid write control endpoint [ 69.395588][ T2513] pvrusb2: Invalid write control endpoint [ 69.397499][ T2513] pvrusb2: Invalid write control endpoint [ 69.399879][ T2513] pvrusb2: Invalid write control endpoint [ 69.401711][ T2513] pvrusb2: Invalid write control endpoint [ 69.403807][ T2513] pvrusb2: Invalid write control endpoint [ 69.406358][ T2513] pvrusb2: Invalid write control endpoint [ 69.408251][ T2513] pvrusb2: Invalid write control endpoint [ 69.410162][ T2513] pvrusb2: Invalid write control endpoint [ 69.412444][ T2513] pvrusb2: Invalid write control endpoint [ 69.414528][ T2513] pvrusb2: Invalid write control endpoint [ 69.418415][ T2513] pvrusb2: Invalid write control endpoint [ 69.421002][ T2513] pvrusb2: Invalid write control endpoint [ 69.423041][ T2513] pvrusb2: Invalid write control endpoint [ 69.424864][ T2513] pvrusb2: Invalid write control endpoint [ 69.427132][ T2513] pvrusb2: Invalid write control endpoint [ 69.429424][ T2513] pvrusb2: Invalid write control endpoint [ 69.431482][ T2513] pvrusb2: Invalid write control endpoint [ 69.433339][ T2513] pvrusb2: Invalid write control endpoint [ 69.435261][ T2513] pvrusb2: Invalid write control endpoint [ 69.437224][ T2513] pvrusb2: Invalid write control endpoint [ 69.439067][ T2513] pvrusb2: Invalid write control endpoint [ 69.440891][ T2513] pvrusb2: Invalid write control endpoint [ 69.442775][ T2513] pvrusb2: Invalid write control endpoint [ 69.444544][ T2513] pvrusb2: Invalid write control endpoint [ 69.446458][ T2513] pvrusb2: Invalid write control endpoint [ 69.448430][ T2513] pvrusb2: Invalid write control endpoint [ 69.450809][ T2513] pvrusb2: Invalid write control endpoint [ 69.452654][ T2513] pvrusb2: Invalid write control endpoint [ 69.454533][ T2513] pvrusb2: Invalid write control endpoint [ 69.461714][ T2513] pvrusb2: Module ID 3 (saa7115) for device OnAir Creator Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 69.485281][ T2513] cs53l32a 2-0011: chip found @ 0x22 (pvrusb2_a) [ 69.490132][ T2513] pvrusb2: Invalid write control endpoint [ 69.491992][ T2513] pvrusb2: Invalid write control endpoint [ 69.493828][ T2513] pvrusb2: Invalid write control endpoint [ 69.495700][ T2513] pvrusb2: Invalid write control endpoint [ 69.497477][ T2513] pvrusb2: Invalid write control endpoint [ 69.499292][ T2513] pvrusb2: Invalid write control endpoint [ 69.501188][ T2513] pvrusb2: Invalid write control endpoint [ 69.503223][ T2513] pvrusb2: Invalid write control endpoint [ 69.505070][ T2513] pvrusb2: Invalid write control endpoint [ 69.506986][ T2513] pvrusb2: Invalid write control endpoint [ 69.508790][ T2513] pvrusb2: Invalid write control endpoint [ 69.510648][ T2513] pvrusb2: Invalid write control endpoint [ 69.512494][ T2513] pvrusb2: Invalid write control endpoint [ 69.514276][ T2513] pvrusb2: Invalid write control endpoint [ 69.516124][ T2513] pvrusb2: Invalid write control endpoint [ 69.517914][ T2513] pvrusb2: Invalid write control endpoint [ 69.519720][ T2513] pvrusb2: Invalid write control endpoint [ 69.521524][ T2513] pvrusb2: Invalid write control endpoint [ 69.523306][ T2513] pvrusb2: Invalid write control endpoint [ 69.525084][ T2513] pvrusb2: Invalid write control endpoint [ 69.527006][ T2513] pvrusb2: Invalid write control endpoint [ 69.532803][ T2513] pvrusb2: Attached sub-driver cs53l32a [ 69.551720][ T2513] pvrusb2: Invalid write control endpoint [ 69.554281][ T2513] pvrusb2: Invalid write control endpoint [ 69.557611][ T2513] pvrusb2: Invalid write control endpoint [ 69.560423][ T2513] pvrusb2: Invalid write control endpoint [ 69.562215][ T2513] pvrusb2: Module ID 4 (tuner) for device OnAir Creator Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 69.567603][ T2513] pvrusb2: Device being rendered inoperable [ 69.570836][ T2513] pvrusb2: ***WARNING*** pvrusb2 driver initialization failed due to the failure of one or more sub-device kernel modules. [ 69.575081][ T2513] pvrusb2: You need to resolve the failing condition before this driver can function. There should be some earlier messages giving more information about the problem. [ 69.781189][ T6184] overlay: Unknown parameter '/' [ 69.797592][ T6184] netlink: zone id is out of range [ 69.801092][ T6184] netlink: zone id is out of range [ 69.823175][ T6184] netlink: zone id is out of range [ 69.923469][ T6184] input: syz0 as /devices/virtual/input/input7 [ 70.496020][ T10] usb 6-1: USB disconnect, device number 3 [ 71.055589][ T34] usb 44-1: device descriptor read/8, error -110 [ 71.066737][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.616427][ T34] usb usb44-port1: attempt power cycle [ 71.649768][ T27] process 6194 (syz.0.64) no longer affine to cpu1 [ 71.661734][ C1] process 6193 (syz.0.64) no longer affine to cpu1 [ 71.666815][ T6202] AppArmor: change_hat: Invalid input, NULL hat and NULL magic [ 71.674693][ T6199] netlink: 16 bytes leftover after parsing attributes in process `syz.3.63'. [ 71.689985][ T6196] smpboot: CPU 1 is now offline [ 71.694508][ T6202] netlink: 'syz.0.64': attribute type 1 has an invalid length. [ 71.703946][ T6202] netlink: 12 bytes leftover after parsing attributes in process `syz.0.64'. [ 72.163307][ T6207] 9p: Bad value for 'rfdno' [ 72.187369][ T34] usb usb44-port1: unable to enumerate USB device [ 72.321005][ T6208] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 72.345784][ T6208] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 72.350832][ T6208] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 72.357518][ T6208] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 72.386893][ T6208] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 72.472828][ T6208] pci 0000:00:01.0: Adding to iommu group 1 [ 72.518893][ T6210] ip6t_REJECT: ECHOREPLY is not supported [ 72.590336][ T6208] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 72.593406][ T6208] pci 0000:00:01.0: vgaarb: bridge control possible [ 72.596196][ T6208] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 72.632341][ T6208] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 72.637748][ T6208] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 72.664776][ T6208] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 72.758627][ T6214] db_root: cannot open: ./my_ [ 72.759048][ T6208] [drm] Found bochs VGA, ID 0xb0c5. [ 72.762794][ T6208] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 73.057950][ T6213] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 73.103518][ T6210] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 73.123765][ T6210] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 73.279941][ T6208] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 73.541926][ T6210] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 73.562758][ T6208] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 73.591648][ T6210] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 73.596964][ T6210] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 73.609527][ T6210] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 73.642976][ T6210] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 73.644989][ T6210] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 73.650905][ T6210] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 73.654456][ T6210] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 73.656771][ T6210] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 73.660323][ T6210] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 73.748366][ T6225] 9p: p9: multiple sources not supported [ 73.879448][ T6229] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 75.147120][ T5753] Bluetooth: hci0: command 0x0c1a tx timeout [ 75.615521][ T5753] Bluetooth: hci1: command 0x0c1a tx timeout [ 75.664952][ T5433] IPVS: starting estimator thread 0... [ 75.695689][ T5753] Bluetooth: hci3: command 0x0c1a tx timeout [ 75.698022][ T5753] Bluetooth: hci2: command 0x0c1a tx timeout [ 75.778356][ T6276] IPVS: using max 43 ests per chain, 103200 per kthread [ 75.824107][ T6284] overlay: Unknown parameter '/' [ 75.937080][ T6284] netlink: zone id is out of range [ 75.938955][ T6284] netlink: zone id is out of range [ 75.941210][ T6284] netlink: zone id is out of range [ 75.943219][ T6284] netlink: zone id is out of range [ 75.981977][ T6283] input: syz0 as /devices/virtual/input/input8 [ 76.241262][ T6289] FAT-fs (nbd0): unable to read boot sector [ 76.499357][ T6278] netlink: 88 bytes leftover after parsing attributes in process `syz.0.77'. [ 77.249344][ T5754] Bluetooth: hci0: command 0x0c1a tx timeout [ 77.392560][ T6301] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip6gretap0, syncid = 4, id = 0 [ 77.502811][ T6304] netlink: 8 bytes leftover after parsing attributes in process `syz.2.82'. [ 77.805599][ T5754] Bluetooth: hci1: command 0x0c1a tx timeout [ 77.805798][ T5753] Bluetooth: hci2: command 0x0c1a tx timeout [ 77.808278][ T5754] Bluetooth: hci3: command 0x0c1a tx timeout [ 77.980314][ T6321] netlink: 156 bytes leftover after parsing attributes in process `syz.2.86'. [ 77.991524][ T6322] Cannot find add_set index 0 as target [ 77.997933][ T6321] fuse: fd is not a fuse device [ 78.000797][ T6322] netlink: 16 bytes leftover after parsing attributes in process `syz.3.85'. [ 78.384705][ T6317] configfs-gadget.g1 gadget.0: HOST MAC 5e:73:8b:51:c7:0a [ 78.390386][ T6317] configfs-gadget.g1 gadget.0: MAC 32:91:28:af:7d:15 [ 78.407502][ T6327] lo: entered allmulticast mode [ 78.423553][ T6325] lo: left allmulticast mode [ 78.433481][ T6325] bond0: entered promiscuous mode [ 78.436371][ T6325] bond_slave_0: entered promiscuous mode [ 78.439193][ T6325] bond_slave_1: entered promiscuous mode [ 78.450929][ T6325] batadv0: entered promiscuous mode [ 78.457675][ T6325] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 78.529323][ T6325] bond0: left promiscuous mode [ 78.531458][ T6325] bond_slave_0: left promiscuous mode [ 78.534107][ T6325] bond_slave_1: left promiscuous mode [ 78.569842][ T6325] batadv0: left promiscuous mode [ 78.645538][ T34] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 78.647026][ T6327] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.651528][ T6327] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.798531][ T34] usb 5-1: Dual-Role OTG device on HNP port [ 78.834365][ T34] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 78.847029][ T34] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 78.872464][ T34] gspca_main: spca501-2.14.0 probing 0000:0000 [ 78.882437][ T34] gspca_spca501: reg write: error -32 [ 78.889477][ T34] spca501 5-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 78.898244][ T34] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 79.297549][ T64] Bluetooth: hci0: command 0x0c1a tx timeout [ 79.400018][ T34] cdc_eem 5-1:1.2 usb1: register 'cdc_eem' at usb-dummy_hcd.0-1, CDC EEM Device, ca:78:31:16:d7:98 [ 79.499034][ T42] audit: type=1326 audit(1786064909.577:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6349 comm="syz.2.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 79.518564][ T42] audit: type=1326 audit(1786064909.577:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6349 comm="syz.2.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 79.534447][ T42] audit: type=1326 audit(1786064909.577:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6349 comm="syz.2.92" exe="/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 79.550126][ T42] audit: type=1326 audit(1786064909.577:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6349 comm="syz.2.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 79.572079][ T42] audit: type=1326 audit(1786064909.577:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6349 comm="syz.2.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 79.587683][ T42] audit: type=1326 audit(1786064909.577:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6349 comm="syz.2.92" exe="/syz-executor" sig=0 arch=40000003 syscall=297 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 79.601529][ T42] audit: type=1326 audit(1786064909.587:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6349 comm="syz.2.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 79.613791][ T42] audit: type=1326 audit(1786064909.587:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6349 comm="syz.2.92" exe="/syz-executor" sig=0 arch=40000003 syscall=358 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 79.635273][ T42] audit: type=1326 audit(1786064909.587:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6349 comm="syz.2.92" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 79.663180][ T42] audit: type=1326 audit(1786064909.587:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6349 comm="syz.2.92" exe="/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 79.867656][ T6363] i2c i2c-0: new_device: Instantiated device rt1719 at 0x49 [ 79.872956][ T6363] wusb3801 0-004a: supply vbus not found, using dummy regulator [ 79.892398][ T6363] i2c i2c-0: new_device: Instantiated device wusb3801 at 0x4a [ 79.915934][ T5754] Bluetooth: hci3: command 0x0c1a tx timeout [ 79.919147][ T5754] Bluetooth: hci2: command 0x0c1a tx timeout [ 79.921101][ T5754] Bluetooth: hci1: command 0x0c1a tx timeout [ 80.042899][ T6363] bond1: entered promiscuous mode [ 81.108704][ T6403] geneve2: entered allmulticast mode [ 82.530565][ T6432] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 82.538785][ T6432] CIFS mount error: No usable UNC path provided in device string! [ 82.538785][ T6432] [ 82.543226][ T6432] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 83.269330][ T6446] program syz.0.102 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 83.612745][ T6446] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 83.669765][ T6446] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 83.672921][ T6446] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 83.676621][ T6446] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 83.681563][ T6446] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 83.707573][ T6446] pci 0000:00:01.0: Adding to iommu group 1 [ 83.717279][ T6446] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 83.719525][ T6446] pci 0000:00:01.0: vgaarb: bridge control possible [ 83.721890][ T6446] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 83.734428][ T6446] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 83.738108][ T6446] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 83.741970][ T6446] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 83.752939][ T6446] [drm] Found bochs VGA, ID 0xb0c5. [ 83.754654][ T6446] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 83.784261][ T6446] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 84.198290][ T6450] syz.2.104 (6450) used greatest stack depth: 19104 bytes left [ 84.209850][ T6446] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 84.815603][ T6472] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 84.906245][ T6472] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 84.967920][ T6465] xt_CT: You must specify a L4 protocol and not use inversions on it [ 85.050695][ T6474] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 85.052843][ T6474] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 85.055977][ T6474] vhci_hcd vhci_hcd.0: Device attached [ 85.338201][ T10] usb 38-1: SetAddress Request (6) to port 0 [ 85.340099][ T10] usb 38-1: new SuperSpeed USB device number 6 using vhci_hcd [ 85.610392][ T6477] geneve2: entered allmulticast mode [ 85.780490][ T6473] capability: warning: `syz.3.108' uses 32-bit capabilities (legacy support in use) [ 86.122365][ T6475] vhci_hcd: connection reset by peer [ 86.125720][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 86.127393][ T5835] vhci_hcd vhci_hcd.0: release socket [ 86.139982][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 88.314399][ T64] Bluetooth: hci1: unexpected event for opcode 0x0c03 [ 88.425340][ T6512] netlink: 'syz.2.119': attribute type 10 has an invalid length. [ 88.441816][ T6512] team0: Port device dummy0 added [ 88.519164][ T6512] netlink: 24 bytes leftover after parsing attributes in process `syz.2.119'. [ 90.157757][ T24] IPVS: starting estimator thread 0... [ 90.385661][ T6539] IPVS: using max 43 ests per chain, 103200 per kthread [ 90.415563][ T10] usb 38-1: device descriptor read/8, error -110 [ 90.663620][ T6540] Cannot find add_set index 0 as target [ 90.720153][ T6557] 9pnet_virtio: no channels available for device 127.0.0.1 [ 90.729664][ T6557] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 90.819726][ T10] usb usb38-port1: attempt power cycle [ 92.149149][ T10] usb usb38-port1: unable to enumerate USB device [ 92.327424][ T6128] libceph: connect (1)[c::]:6789 error -101 [ 92.344740][ T6128] libceph: mon0 (1)[c::]:6789 connect error [ 92.359643][ T6546] ceph: No mds server is up or the cluster is laggy [ 92.360859][ T6128] libceph: connect (1)[c::]:6789 error -101 [ 92.485736][ T6128] libceph: mon0 (1)[c::]:6789 connect error [ 93.112650][ T6582] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.135498][ T0] NOHZ tick-stop error: local softirq work is pending, handler #280!!! [ 93.409217][ T6597] kAFS: unable to lookup cell '/,c¾ûL' [ 93.608906][ T6590] netlink: 8 bytes leftover after parsing attributes in process `syz.1.134'. [ 93.902981][ T6582] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.073812][ T6582] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.144998][ T6611] netlink: 'syz.3.138': attribute type 1 has an invalid length. [ 94.147839][ T6611] netlink: 224 bytes leftover after parsing attributes in process `syz.3.138'. [ 94.247442][ T6616] kAFS: unable to lookup cell 'ÿ' [ 94.311096][ T6582] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.373121][ T64] Bluetooth: hci3: unexpected event 0x03 length: 1 < 11 [ 94.485543][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 94.688183][ T6614] kernel profiling enabled (shift: 7) [ 94.796446][ T6614] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 94.861530][ T5835] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.873624][ T5835] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.895592][ T5835] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.906393][ T5835] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.987566][ T6629] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 94.990042][ T6629] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 94.994032][ T6629] vhci_hcd vhci_hcd.0: Device attached [ 95.255633][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 95.383472][ T6642] futex_wake_op: syz.3.139 tries to shift op by 32; fix this program [ 95.545575][ T6089] usb 43-1: new low-speed USB device number 2 using vhci_hcd [ 95.679125][ T6646] netlink: 52 bytes leftover after parsing attributes in process `syz.2.142'. [ 95.972545][ T6648] ./bus: Can't lookup blockdev [ 96.090086][ T6630] vhci_hcd: connection reset by peer [ 96.095559][ T5835] vhci_hcd vhci_hcd.3: stop threads [ 96.097289][ T5835] vhci_hcd vhci_hcd.3: release socket [ 96.101723][ T5835] vhci_hcd vhci_hcd.3: disconnect device [ 96.363781][ T6654] 9pnet_fd: Insufficient options for proto=fd [ 96.983424][ T6666] binder: 6658:6666 ioctl 401c7012 0 returned -22 [ 97.039819][ T6666] netlink: 8 bytes leftover after parsing attributes in process `syz.0.146'. [ 97.467957][ C3] vcan0: j1939_tp_rxtimer: 0xffff888026832000: rx timeout, send abort [ 97.473365][ C3] vcan0: j1939_xtp_rx_abort_one: 0xffff888026832000: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 97.520103][ T6668] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 97.525748][ T6668] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 98.018717][ T6681] program syz.1.152 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 98.024913][ T6680] kAFS: unable to lookup cell 'ÿ' [ 98.366011][ T6681] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 98.408453][ T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!! [ 98.504064][ T6681] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 98.510311][ T6681] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 98.513734][ T6681] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 98.523931][ T6681] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 98.584972][ T6687] 9pnet_fd: Insufficient options for proto=fd [ 98.767597][ T6681] pci 0000:00:01.0: Adding to iommu group 1 [ 98.784173][ T6681] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 98.786445][ T6681] pci 0000:00:01.0: vgaarb: bridge control possible [ 98.788671][ T6681] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 98.800977][ T6681] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 98.805676][ T6681] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 98.811726][ T6681] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 98.812891][ T6698] kAFS: No cell specified [ 99.077240][ T6681] [drm] Found bochs VGA, ID 0xb0c5. [ 99.079632][ T6681] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 99.091008][ T6706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.148415][ T6706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.158950][ T6681] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 99.204867][ T6706] netlink: 44 bytes leftover after parsing attributes in process `syz.0.161'. [ 99.324785][ T6681] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 100.249126][ T64] Bluetooth: hci1: adv larger than maximum supported [ 100.249175][ T64] Bluetooth: hci1: Malformed LE Event: 0x0d [ 100.283861][ T64] Bluetooth: hci1: unexpected Set CIG Parameters response data [ 100.290126][ T64] Bluetooth: hci1: unexpected event for opcode 0x2062 [ 100.646835][ T6089] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 100.859960][ T40] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 101.003456][ T6736] netlink: 4 bytes leftover after parsing attributes in process `syz.2.173'. [ 101.027542][ T40] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 101.038315][ T40] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 101.048205][ T40] usb 6-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 101.051910][ T40] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.055316][ T40] usb 6-1: Product: syz [ 101.057963][ T40] usb 6-1: Manufacturer: syz [ 101.060006][ T40] usb 6-1: SerialNumber: syz [ 101.072253][ T40] usb 6-1: config 0 descriptor?? [ 101.083491][ T40] hub 6-1:0.0: bad descriptor, ignoring hub [ 101.085980][ T40] hub 6-1:0.0: probe with driver hub failed with error -5 [ 101.093992][ T40] input: syz syz as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.0/input/input9 [ 102.436723][ T9] usb 6-1: USB disconnect, device number 4 [ 102.723629][ T6753] SQUASHFS error: Failed to read block 0x0: -5 [ 102.731463][ T6753] unable to read squashfs_super_block [ 103.367609][ T6773] jffs2: notice: (6773) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 104.338290][ T64] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 104.342219][ T64] Bluetooth: hci1: Injecting HCI hardware error event [ 104.348339][ T5754] Bluetooth: hci1: hardware error 0x00 [ 104.527506][ T6790] usb usb8: usbfs: process 6790 (syz.0.192) did not claim interface 0 before use [ 104.689001][ T6800] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 104.995460][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 106.428007][ T5754] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 108.169322][ T6891] netlink: 44 bytes leftover after parsing attributes in process `syz.2.231'. [ 109.392090][ T6929] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.396355][ T6929] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.450618][ T6929] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.475667][ T6930] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.479781][ T6930] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.558187][ T6929] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.696391][ T6929] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.832386][ T6929] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.015655][ T5835] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.022398][ T5835] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.035570][ T5835] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.041572][ T5835] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.262564][ T6988] netlink: 20 bytes leftover after parsing attributes in process `syz.0.265'. [ 113.931477][ T7000] netlink: 44 bytes leftover after parsing attributes in process `syz.2.271'. [ 114.414314][ T6972] Set syz0 is full, maxelem 65536 reached [ 114.622948][ T7015] warning: `syz.3.277' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 116.228307][ T7059] block2mtd: error: cannot open device /dev/loop0 [ 118.884784][ T7101] netlink: 24 bytes leftover after parsing attributes in process `syz.3.309'. [ 118.935634][ T6089] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 119.118557][ T6089] usb 6-1: Using ep0 maxpacket: 32 [ 119.139101][ T6089] usb 6-1: config 0 has an invalid interface number: 85 but max is 0 [ 119.142056][ T6089] usb 6-1: config 0 has no interface number 0 [ 119.143991][ T6089] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 119.153190][ T6089] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 119.156552][ T6089] usb 6-1: config 0 interface 85 has no altsetting 0 [ 119.160315][ T6089] usb 6-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 119.163338][ T6089] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.166068][ T6089] usb 6-1: Product: syz [ 119.167461][ T6089] usb 6-1: Manufacturer: syz [ 119.169011][ T6089] usb 6-1: SerialNumber: syz [ 119.174921][ T6089] usb 6-1: config 0 descriptor?? [ 119.184187][ T7107] netlink: 'syz.2.312': attribute type 9 has an invalid length. [ 119.271362][ T7111] netlink: 'syz.2.314': attribute type 12 has an invalid length. [ 119.273922][ T7111] netlink: 'syz.2.314': attribute type 29 has an invalid length. [ 119.284068][ T7111] netlink: 148 bytes leftover after parsing attributes in process `syz.2.314'. [ 119.584786][ T6089] appletouch 6-1:0.85: Geyser mode initialized. [ 119.587999][ T6089] input: appletouch as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.85/input/input10 [ 119.687452][ T7130] netlink: 'syz.3.322': attribute type 9 has an invalid length. [ 119.795124][ T34] usb 6-1: USB disconnect, device number 5 [ 119.836686][ T34] appletouch 6-1:0.85: input: appletouch disconnected [ 121.425736][ T7174] netlink: 56 bytes leftover after parsing attributes in process `syz.2.341'. [ 121.438443][ T7176] netlink: 32 bytes leftover after parsing attributes in process `syz.1.342'. [ 122.160558][ T7209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 122.175928][ T7209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.666573][ T7274] Driver unsupported XDP return value 0 on prog (id 26) dev N/A, expect packet loss! [ 125.911702][ T7281] netlink: 'syz.1.383': attribute type 13 has an invalid length. [ 125.956222][ T7282] netlink: 44 bytes leftover after parsing attributes in process `syz.2.382'. [ 127.273570][ T7310] netlink: 44 bytes leftover after parsing attributes in process `syz.2.393'. [ 128.739451][ T7351] input input12: cannot allocate more than FF_MAX_EFFECTS effects [ 128.990474][ T7358] netlink: 32 bytes leftover after parsing attributes in process `syz.1.412'. [ 129.506330][ T7366] netlink: 4 bytes leftover after parsing attributes in process `syz.3.415'. [ 129.523875][ T7366] netlink: 20 bytes leftover after parsing attributes in process `syz.3.415'. [ 130.525457][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 130.555458][ T0] NOHZ tick-stop error: local softirq work is pending, handler #282!!! [ 130.565466][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 131.316165][ T7404] Cannot find add_set index 0 as target [ 131.326567][ T7404] netlink: 16 bytes leftover after parsing attributes in process `syz.2.426'. [ 131.878315][ T7407] TCP: tcp_parse_options: Illegal window scaling value 251 > 14 received [ 132.327869][ T7418] netlink: 8 bytes leftover after parsing attributes in process `syz.1.433'. [ 132.534804][ T7423] netlink: 'syz.1.434': attribute type 1 has an invalid length. [ 132.537611][ T7423] netlink: 756 bytes leftover after parsing attributes in process `syz.1.434'. [ 133.215529][ T7437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.223136][ T7437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 135.537980][ T7469] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 135.561585][ T7486] 9pnet_virtio: no channels available for device 127.0.0.1 [ 135.567678][ T7486] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 136.353028][ T7519] MTD: Couldn't look up './dev/mtdblock0': -2 [ 137.123657][ T7522] netlink: 8 bytes leftover after parsing attributes in process `syz.0.472'. [ 137.727584][ T7543] 9pnet_virtio: no channels available for device 127.0.0.1 [ 137.738475][ T7543] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 139.305013][ T7565] netlink: 8 bytes leftover after parsing attributes in process `syz.2.490'. [ 140.171195][ T7586] netlink: 44 bytes leftover after parsing attributes in process `syz.2.496'. [ 141.477907][ T7609] netlink: 4 bytes leftover after parsing attributes in process `syz.1.504'. [ 144.007600][ T7660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.013205][ T7660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.035252][ T7660] netlink: 44 bytes leftover after parsing attributes in process `syz.0.519'. [ 147.065488][ T7721] faux_driver vgem: [drm] Unknown color mode 55545; guessing buffer size. [ 147.195949][ T7727] syzkaller1: entered promiscuous mode [ 147.205282][ T7727] syzkaller1: entered allmulticast mode [ 147.344765][ T7733] capability: warning: `syz.0.550' uses deprecated v2 capabilities in a way that may be insecure [ 147.575480][ T0] NOHZ tick-stop error: local softirq work is pending, handler #280!!! [ 147.928303][ T7748] pim6reg1: entered promiscuous mode [ 147.930767][ T7748] pim6reg1: entered allmulticast mode [ 148.674150][ T7774] Invalid argument reading file caps for ./file0 [ 148.915607][ T9] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 149.087149][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 149.092396][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 149.100079][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 149.110326][ T9] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 149.117321][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.132352][ T9] usb 6-1: config 0 descriptor?? [ 149.612119][ T9] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 151.354086][ T7832] WARNING! power/level is deprecated; use power/control instead [ 151.600463][ T6089] usb 6-1: USB disconnect, device number 6 [ 153.491132][ T7868] overlayfs: failed to clone upperpath [ 153.675360][ T7872] loop6: detected capacity change from 0 to 2640 [ 153.692270][ T7872] Buffer I/O error on dev loop6, logical block 0, async page read [ 153.699117][ T7872] Buffer I/O error on dev loop6, logical block 0, async page read [ 153.702100][ T7872] Buffer I/O error on dev loop6, logical block 0, async page read [ 153.705268][ T7872] Buffer I/O error on dev loop6, logical block 0, async page read [ 153.708874][ T7872] Buffer I/O error on dev loop6, logical block 0, async page read [ 153.711884][ T7872] Buffer I/O error on dev loop6, logical block 0, async page read [ 153.715012][ T7872] Buffer I/O error on dev loop6, logical block 0, async page read [ 153.719102][ T7872] Buffer I/O error on dev loop6, logical block 0, async page read [ 153.722124][ T7872] ldm_validate_partition_table(): Disk read failed. [ 153.722333][ T5745] Buffer I/O error on dev loop6, logical block 0, async page read [ 153.737410][ T7872] Buffer I/O error on dev loop6, logical block 0, async page read [ 153.746793][ T7872] Dev loop6: unable to read RDB block 0 [ 153.754678][ T7872] loop6: unable to read partition table [ 153.764046][ T7872] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 153.979680][ T7888] netlink: 24 bytes leftover after parsing attributes in process `syz.1.605'. [ 155.395556][ T34] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 155.596428][ T34] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 155.601775][ T34] usb 6-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 155.606531][ T34] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.226733][ T34] qmi_wwan 6-1:1.0: cdc-wdm0: USB WDM device [ 156.395535][ T7951] nbd3: detected capacity change from 0 to 8 [ 156.457342][ T34] wwan wwan0: port wwan0qmi0 attached [ 156.549354][ T5989] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 156.550928][ T7952] block nbd3: shutting down sockets [ 156.554967][ T5989] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 156.560164][ T5989] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 156.563308][ T5989] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 156.566453][ T5989] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 156.569710][ T5989] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 156.573003][ T5989] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 156.576121][ T5989] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 156.579201][ T7930] ldm_validate_partition_table(): Disk read failed. [ 156.590996][ T5989] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 156.594577][ T5989] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 156.597812][ T7930] Dev nbd3: unable to read RDB block 0 [ 156.602536][ T34] qmi_wwan 6-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.1-1, WWAN/QMI device, b2:ee:c1:fd:45:52 [ 156.606344][ T7930] nbd3: unable to read partition table [ 156.608281][ T7930] nbd3: partition table beyond EOD, truncated [ 156.617068][ T34] usb 6-1: USB disconnect, device number 7 [ 156.625831][ T5153] ldm_validate_partition_table(): Disk read failed. [ 156.633575][ T34] qmi_wwan 6-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.1-1, WWAN/QMI device [ 156.636329][ T5153] Dev nbd3: unable to read RDB block 0 [ 156.645794][ T5153] nbd3: unable to read partition table [ 156.656217][ T5153] nbd3: partition table beyond EOD, truncated [ 156.677712][ T7930] ldm_validate_partition_table(): Disk read failed. [ 156.680494][ T7930] Dev nbd3: unable to read RDB block 0 [ 156.684567][ T7930] nbd3: unable to read partition table [ 156.687948][ T7930] nbd3: partition table beyond EOD, truncated [ 156.766045][ T34] wwan wwan0: port wwan0qmi0 disconnected [ 157.541621][ T8016] jffs2: notice: (8016) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 157.746678][ T8024] binder: 8022:8024 ioctl c0306201 80000080 returned -14 [ 158.321583][ T8046] netlink: 24 bytes leftover after parsing attributes in process `syz.2.660'. [ 159.335442][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 159.430423][ T42] kauditd_printk_skb: 31 callbacks suppressed [ 159.430436][ T42] audit: type=1326 audit(1786064989.557:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8064 comm="syz.0.666" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fcefec code=0x0 [ 159.564554][ T8071] jffs2: notice: (8071) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 160.588371][ T8091] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 160.604012][ T8091] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 160.641130][ T8091] netlink: 44 bytes leftover after parsing attributes in process `syz.0.674'. [ 160.687389][ T8094] overlayfs: failed to clone upperpath [ 161.677231][ T8133] input: syz0 as /devices/virtual/input/input13 [ 162.306571][ T8159] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 162.308676][ T8159] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 162.312621][ T8159] vhci_hcd vhci_hcd.0: Device attached [ 162.316973][ T8160] vhci_hcd: connection closed [ 162.319967][ T12] vhci_hcd vhci_hcd.1: stop threads [ 162.323308][ T12] vhci_hcd vhci_hcd.1: release socket [ 162.325064][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 162.682083][ T8177] vhci_hcd vhci_hcd.0: remove, state 4 [ 162.686146][ T8177] usb usb38: USB disconnect, device number 1 [ 162.727584][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.729224][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.731031][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.732907][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.734501][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.737517][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.741810][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.744073][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.747092][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.749292][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.751213][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.753064][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.758703][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.760538][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.762353][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.764301][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.766167][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.767966][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.771091][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.772821][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.774556][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.777596][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.779964][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.782453][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.785772][ T8177] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 162.797148][ T8177] vhci_hcd vhci_hcd.0: remove, state 4 [ 162.799091][ T8177] usb usb37: USB disconnect, device number 1 [ 162.823162][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.824976][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.827001][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.831646][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.836083][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.837870][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.840890][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.842691][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.844506][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.848037][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.849815][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.851622][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.853562][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.855225][ T34] kernel read not supported for file /vcs (pid: 34 comm: kworker/3:0) [ 162.857973][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.857996][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.858045][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.863599][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.865309][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.868400][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.870439][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.872217][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.874214][ T12] vhci_hcd vhci_hcd.0: stop threads [ 162.878185][ T12] vhci_hcd vhci_hcd.0: release socket [ 162.880152][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 162.882318][ T8177] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 162.928324][ T8178] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 162.941896][ T8178] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 37 [ 162.947845][ T8178] vhci_hcd vhci_hcd.0: created sysfs vhci_hcd.0 [ 162.954339][ T8178] usb usb37: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 162.957600][ T8178] usb usb37: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 162.960384][ T8178] usb usb37: Product: USB/IP Virtual Host Controller [ 162.962836][ T8178] usb usb37: Manufacturer: Linux syzkaller vhci_hcd [ 162.965161][ T8178] usb usb37: SerialNumber: vhci_hcd.0 [ 162.989637][ T8178] hub 37-0:1.0: USB hub found [ 162.997594][ T8178] hub 37-0:1.0: 8 ports detected [ 163.025660][ T8178] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 163.032582][ T8178] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 38 [ 163.038028][ T8178] usb usb38: We don't know the algorithms for LPM for this host, disabling LPM. [ 163.042777][ T8178] usb usb38: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 7.02 [ 163.046101][ T8178] usb usb38: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 163.048928][ T8178] usb usb38: Product: USB/IP Virtual Host Controller [ 163.051199][ T8178] usb usb38: Manufacturer: Linux syzkaller vhci_hcd [ 163.053371][ T8178] usb usb38: SerialNumber: vhci_hcd.0 [ 163.064889][ T8178] hub 38-0:1.0: USB hub found [ 163.068082][ T8178] hub 38-0:1.0: 8 ports detected [ 163.194208][ T8190] pim6reg1: entered promiscuous mode [ 163.198352][ T8190] pim6reg1: entered allmulticast mode [ 163.743787][ T24] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 164.347173][ T24] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 164.354271][ T24] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 164.359013][ T24] usb 6-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 164.362933][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.586596][ T34] usb 6-1: USB disconnect, device number 8 [ 165.900308][ T8253] netlink: 32 bytes leftover after parsing attributes in process `syz.0.735'. [ 166.848835][ T8279] netlink: 4 bytes leftover after parsing attributes in process `syz.2.745'. [ 166.858133][ T8279] netlink: 20 bytes leftover after parsing attributes in process `syz.2.745'. [ 166.891829][ T8281] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.036151][ T8281] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.119389][ T8291] loop5: detected capacity change from 0 to 7 [ 167.129203][ T8291] Dev loop5: unable to read RDB block 7 [ 167.131229][ T8291] loop5: unable to read partition table [ 167.133327][ T8291] loop5: partition table beyond EOD, truncated [ 167.136766][ T8291] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 167.154309][ T8281] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.246735][ T8281] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.455611][ T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 168.271079][ T8325] netlink: 44 bytes leftover after parsing attributes in process `syz.2.762'. [ 168.357975][ T8329] intel_xhci_usb_sw pcspkr: probe with driver intel_xhci_usb_sw failed with error -22 [ 168.937077][ T8343] input: syz0 as /devices/virtual/input/input14 [ 170.130827][ T8357] input: syz1 as /devices/virtual/input/input15 [ 170.228946][ T8361] loop5: detected capacity change from 0 to 7 [ 170.237140][ T8361] Dev loop5: unable to read RDB block 7 [ 170.239772][ T8361] loop5: unable to read partition table [ 170.242577][ T8361] loop5: partition table beyond EOD, truncated [ 170.244504][ T8361] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 172.128957][ T8417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 172.136172][ T8419] netlink: 4 bytes leftover after parsing attributes in process `syz.2.803'. [ 172.142599][ T8417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 172.241729][ T8422] input: syz1 as /devices/virtual/input/input16 [ 172.367012][ T8425] binder: 8423:8425 ioctl c0306201 80000480 returned -14 [ 172.856738][ T8428] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 172.859555][ T8428] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 172.862250][ T8428] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 173.198050][ T8436] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 174.897493][ T5754] Bluetooth: hci0: command 0x0c1a tx timeout [ 174.905622][ T5754] Bluetooth: hci3: command 0x0c1a tx timeout [ 174.906251][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 175.368826][ T8501] netlink: 27 bytes leftover after parsing attributes in process `syz.0.835'. [ 176.277572][ T8545] kvm: user requested TSC rate below hardware speed [ 176.285774][ T8545] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 178.342681][ T8607] fuse: fd is not a fuse device [ 178.658017][ T8625] netlink: 44 bytes leftover after parsing attributes in process `syz.2.877'. [ 179.529971][ T8636] evm: overlay not supported [ 180.240416][ T8663] loop2: detected capacity change from 0 to 7 [ 180.256937][ T8663] Dev loop2: unable to read RDB block 7 [ 180.258792][ T8663] loop2: unable to read partition table [ 180.264553][ T8663] loop2: partition table beyond EOD, truncated [ 180.267055][ T8663] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 180.880446][ T42] audit: type=1800 audit(1786065011.007:45): pid=8669 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.894" name="bmaControls" dev="configfs" ino=27824 res=0 errno=0 [ 182.004450][ T8702] netlink: 'syz.1.904': attribute type 1 has an invalid length. [ 182.042335][ T8702] 8021q: adding VLAN 0 to HW filter on device bond2 [ 182.078492][ T8702] bond2: (slave geneve2): making interface the new active one [ 182.082908][ T8702] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 182.521054][ T8715] syzkaller0: entered promiscuous mode [ 182.523162][ T8715] syzkaller0: entered allmulticast mode [ 183.171327][ T8731] overlayfs: failed to clone upperpath [ 183.224212][ T8733] input: syz0 as /devices/virtual/input/input17 [ 183.359723][ T8743] jffs2: notice: (8743) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 183.460552][ T8745] process '/newroot/268/file0' started with executable stack [ 183.482106][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.571677][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.632248][ T5754] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 183.644593][ T5754] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 183.653487][ T5754] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 183.657321][ T5754] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 183.666875][ T5754] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 183.725198][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.839687][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.093639][ T12] bridge_slave_1: left allmulticast mode [ 184.096726][ T12] bridge_slave_1: left promiscuous mode [ 184.100668][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 184.119383][ T12] bridge_slave_0: left allmulticast mode [ 184.121350][ T12] bridge_slave_0: left promiscuous mode [ 184.123378][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 184.372226][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 184.383866][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 184.389430][ T12] bond0 (unregistering): Released all slaves [ 184.410601][ T5456] 8021q: adding VLAN 0 to HW filter on device eth2 [ 184.815007][ T8820] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4234756656 (33878053248 ns) > initial count (25262286960 ns). Using initial count to start timer. [ 184.816201][ T5456] 8021q: adding VLAN 0 to HW filter on device eth3 [ 184.901207][ T8753] bridge0: port 1(bridge_slave_0) entered blocking state [ 184.916949][ T8753] bridge0: port 1(bridge_slave_0) entered disabled state [ 184.924583][ T8753] bridge_slave_0: entered allmulticast mode [ 184.970878][ T8753] bridge_slave_0: entered promiscuous mode [ 184.982493][ T8753] bridge0: port 2(bridge_slave_1) entered blocking state [ 184.994352][ T8753] bridge0: port 2(bridge_slave_1) entered disabled state [ 185.001301][ T8753] bridge_slave_1: entered allmulticast mode [ 185.006550][ T8753] bridge_slave_1: entered promiscuous mode [ 185.086924][ T8753] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 185.099095][ T8753] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 185.241758][ T12] hsr_slave_0: left promiscuous mode [ 185.248306][ T12] hsr_slave_1: left promiscuous mode [ 185.253478][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 185.268513][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 185.278126][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 185.280698][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 185.303572][ T12] veth1_macvtap: left promiscuous mode [ 185.306728][ T12] veth0_macvtap: left promiscuous mode [ 185.308641][ T12] veth1_vlan: left promiscuous mode [ 185.310500][ T12] veth0_vlan: left promiscuous mode [ 185.511737][ T12] team0 (unregistering): Port device team_slave_1 removed [ 185.519478][ T6089] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 185.529544][ T12] team0 (unregistering): Port device team_slave_0 removed [ 185.677561][ T6089] usb 6-1: unable to get BOS descriptor or descriptor too short [ 185.681553][ T6089] usb 6-1: not running at top speed; connect to a high speed hub [ 185.689862][ T6089] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 185.693284][ T6089] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 185.697144][ T6089] usb 6-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 185.701384][ T6089] usb 6-1: config 14 has no interface number 0 [ 185.703927][ T6089] usb 6-1: config 14 has no interface number 1 [ 185.709802][ T6089] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 185.714299][ T6089] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 185.719361][ T6089] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 185.727067][ T6089] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 185.737370][ T5456] 8021q: adding VLAN 0 to HW filter on device eth4 [ 185.742587][ T6089] usb 6-1: config 14 interface 57 has no altsetting 0 [ 185.752052][ T6089] usb 6-1: config 14 interface 228 has no altsetting 0 [ 185.760725][ T8753] team0: Port device team_slave_0 added [ 185.763310][ T6089] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 185.770113][ T8753] team0: Port device team_slave_1 added [ 185.770225][ T6089] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.773922][ T8841] fuse: fd is not a fuse device [ 185.788785][ T5754] Bluetooth: hci3: command tx timeout [ 185.793491][ T6089] usb 6-1: Product: syz [ 185.794939][ T6089] usb 6-1: Manufacturer: syz [ 185.799098][ T6089] usb 6-1: SerialNumber: syz [ 185.844233][ T8753] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 185.860556][ T8753] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 185.874485][ T8753] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 185.881376][ T8753] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 185.884387][ T8753] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 185.895818][ T8753] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 185.972624][ T8753] hsr_slave_0: entered promiscuous mode [ 185.976592][ T8753] hsr_slave_1: entered promiscuous mode [ 185.979711][ T8753] debugfs: 'hsr0' already exists in 'hsr' [ 185.983426][ T8753] Cannot create hsr debugfs directory [ 186.106653][ T12] IPVS: stop unused estimator thread 0... [ 186.237591][ T6089] legousbtower 6-1:14.57: interrupt endpoints not found [ 186.645091][ T6089] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 186.664610][ T6089] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 186.710065][ T8753] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 186.714757][ T8753] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 186.726204][ T8753] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 186.734454][ T8753] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 186.737937][ T8753] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 186.748636][ T8753] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 186.751979][ T8753] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 186.761617][ T8753] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 186.831954][ T8753] 8021q: adding VLAN 0 to HW filter on device bond0 [ 186.864962][ T8753] 8021q: adding VLAN 0 to HW filter on device team0 [ 186.874901][ T109] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.877220][ T109] bridge0: port 1(bridge_slave_0) entered forwarding state [ 186.890161][ T109] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.893276][ T109] bridge0: port 2(bridge_slave_1) entered forwarding state [ 187.199925][ T8917] usb 6-1: Couldn't submit interrupt_in_urb -90 [ 187.240697][ T8753] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 187.273115][ T8753] veth0_vlan: entered promiscuous mode [ 187.279594][ T8753] veth1_vlan: entered promiscuous mode [ 187.303580][ T8753] veth0_macvtap: entered promiscuous mode [ 187.310468][ T8753] veth1_macvtap: entered promiscuous mode [ 187.323515][ T8753] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 187.332379][ T8753] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 187.356684][ T5835] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.360459][ T5835] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.391154][ T1177] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.409203][ T34] usb 6-1: USB disconnect, device number 9 [ 187.411675][ T1177] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 187.436181][ T34] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 187.446542][ T109] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.449851][ T109] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 187.455615][ T5835] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.467050][ T5835] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.858596][ T5754] Bluetooth: hci3: command tx timeout [ 188.010739][ T8937] fuse: root generation should be zero [ 189.948357][ T5754] Bluetooth: hci3: command tx timeout [ 190.210469][ T9003] jffs2: notice: (9003) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 191.667069][ T9045] fuse: fd is not a fuse device [ 192.016242][ T5754] Bluetooth: hci3: command tx timeout [ 192.663096][ T9064] input: syz0 as /devices/virtual/input/input19 [ 192.695332][ T7930] udevd[7930]: setting owner of /dev/input/event3 to uid=0, gid=104 failed: No such file or directory [ 193.378970][ T9082] fuse: fd is not a fuse device [ 194.407237][ T9107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.411627][ T9107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 194.974077][ T9114] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1035'. [ 196.345038][ T9137] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1045'. [ 197.603550][ T9176] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1055'. [ 197.747792][ T9182] overlayfs: failed to clone upperpath [ 198.322725][ T9216] overlayfs: failed to clone upperpath [ 198.345751][ T9] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 198.497005][ T9] usb 6-1: config 0 has no interfaces? [ 198.503069][ T9] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 198.512685][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.522325][ T9] usb 6-1: config 0 descriptor?? [ 198.748983][ T9] usb 6-1: USB disconnect, device number 10 [ 199.054601][ T9231] pim6reg1: entered promiscuous mode [ 199.061901][ T9231] pim6reg1: entered allmulticast mode [ 199.404020][ T9237] vhci_hcd vhci_hcd.0: remove, state 4 [ 199.406723][ T9237] usb usb38: USB disconnect, device number 1 [ 199.438645][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.442592][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.448788][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.452025][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.458534][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.462999][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.470445][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.474458][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.477596][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.482081][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.486315][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.489233][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.493591][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.496463][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.505507][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.508829][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.510532][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.516244][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.518632][ T9242] overlayfs: failed to resolve './cgroup': -2 [ 199.519070][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.524987][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.527415][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.529894][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.532089][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.534409][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.541090][ T9237] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 199.551259][ T9237] vhci_hcd vhci_hcd.0: remove, state 4 [ 199.553641][ T9237] usb usb37: USB disconnect, device number 1 [ 199.587008][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.591736][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.603450][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.607377][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.609590][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.612030][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.614496][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.620239][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.622634][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.625135][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.627532][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.629893][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.632437][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.634696][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.637228][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.639710][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.642019][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.644442][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.647035][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.649380][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.651768][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.654171][ T5835] vhci_hcd vhci_hcd.0: stop threads [ 199.656819][ T5835] vhci_hcd vhci_hcd.0: release socket [ 199.659159][ T5835] vhci_hcd vhci_hcd.0: disconnect device [ 199.661558][ T9237] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 199.675439][ T9238] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 199.695285][ T9238] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 37 [ 199.707067][ T9238] vhci_hcd vhci_hcd.0: created sysfs vhci_hcd.0 [ 199.724796][ T9238] usb usb37: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 199.738727][ T9238] usb usb37: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 199.746236][ T9238] usb usb37: Product: USB/IP Virtual Host Controller [ 199.748614][ T9238] usb usb37: Manufacturer: Linux syzkaller vhci_hcd [ 199.755720][ T9238] usb usb37: SerialNumber: vhci_hcd.0 [ 199.774017][ T9238] hub 37-0:1.0: USB hub found [ 199.775959][ T9238] hub 37-0:1.0: 8 ports detected [ 199.790838][ T9238] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 199.797440][ T9238] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 38 [ 199.801013][ T9238] usb usb38: We don't know the algorithms for LPM for this host, disabling LPM. [ 199.804579][ T9238] usb usb38: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 7.02 [ 199.809044][ T9238] usb usb38: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 199.811948][ T9238] usb usb38: Product: USB/IP Virtual Host Controller [ 199.814824][ T9238] usb usb38: Manufacturer: Linux syzkaller vhci_hcd [ 199.818125][ T9238] usb usb38: SerialNumber: vhci_hcd.0 [ 199.829384][ T9238] hub 38-0:1.0: USB hub found [ 199.833093][ T9238] hub 38-0:1.0: 8 ports detected [ 200.213929][ T9254] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 200.239049][ T9254] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 200.242220][ T9254] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 200.245002][ T9254] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 200.251348][ T9254] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 200.278585][ T9254] pci 0000:00:01.0: Adding to iommu group 1 [ 200.284900][ T9254] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 200.287100][ T9254] pci 0000:00:01.0: vgaarb: bridge control possible [ 200.289169][ T9254] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 200.301978][ T9254] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 200.304920][ T9254] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 200.309046][ T9254] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 200.322314][ T9254] [drm] Found bochs VGA, ID 0xb0c5. [ 200.324089][ T9254] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 200.341298][ T9254] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 200.390674][ T9254] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 201.259782][ T24] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 201.419390][ T24] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 201.422559][ T24] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 201.425999][ T24] usb 6-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 201.429672][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.441297][ T24] spcp8x5 6-1:1.0: SPCP8x5 converter detected [ 201.452249][ T24] usb 6-1: SPCP8x5 converter now attached to ttyUSB0 [ 201.776272][ T9298] tipc: Started in network mode [ 201.778204][ T9298] tipc: Node identity 3e9714d151dc, cluster identity 4711 [ 201.783114][ T9298] tipc: Enabled bearer , priority 0 [ 202.895621][ T6128] tipc: Node number set to 1867191505 [ 203.047757][ T9320] fuse: fd is not a fuse device [ 203.175758][ T9321] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 203.389561][ T9285] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 203.395348][ T5433] usb 6-1: USB disconnect, device number 11 [ 203.406461][ T5433] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 203.409843][ T5433] spcp8x5 6-1:1.0: device disconnected [ 204.046783][ T109] Bluetooth: hci4: Frame reassembly failed (-84) [ 204.100876][ T64] Bluetooth: hci0: unexpected event for opcode 0x1004 [ 204.226521][ T9345] overlayfs: failed to clone upperpath [ 204.383108][ T9354] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 204.387510][ T9354] block device autoloading is deprecated and will be removed. [ 204.419370][ T9358] fuse: fd is not a fuse device [ 204.470804][ T9362] fuse: fd is not a fuse device [ 205.008049][ T9391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 205.012057][ T9391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 205.527924][ T9409] block nbd0: Receive control failed (result -32) [ 205.531317][ T7953] block nbd0: Receive control failed (result -32) [ 206.106929][ T5754] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 206.107445][ T64] Bluetooth: hci4: command 0x1003 tx timeout [ 206.130609][ T9420] tipc: Enabling of bearer rejected, already enabled [ 206.443540][ T9450] fuse: fd is not a fuse device [ 206.546037][ T9459] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 206.610233][ T9464] overlayfs: failed to clone upperpath [ 206.831020][ T9483] fuse: fd is not a fuse device [ 207.417742][ T9498] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 207.422528][ T9498] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 207.539452][ T9500] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 207.625784][ T9506] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 207.744784][ T9513] input: syz1 as /devices/virtual/input/input20 [ 207.820694][ T9517] input: syz0 as /devices/virtual/input/input21 [ 207.899431][ T5835] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 208.175518][ T5754] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 208.181402][ T5754] Bluetooth: hci0: Injecting HCI hardware error event [ 208.186979][ T64] Bluetooth: hci0: hardware error 0x00 [ 209.158451][ T9555] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 209.159056][ T9557] netlink: 'syz.1.1199': attribute type 2 has an invalid length. [ 210.256242][ T64] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 211.956026][ T9619] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1219'. [ 211.966221][ T9615] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 211.971525][ T9615] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 211.975295][ T9615] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 211.988489][ T9615] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 213.039537][ T9644] binder_alloc: 9643: pid 9643 spamming oneway? 1 buffers allocated for a total size of 4096 [ 213.242236][ T9650] binder: 9649:9650 unknown command 0 [ 213.244561][ T9650] binder: 9649:9650 ioctl c0306201 800001c0 returned -22 [ 214.015817][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 214.015839][ T5754] Bluetooth: hci2: command 0x0c1a tx timeout [ 214.999688][ T9680] fuse: fd is not a fuse device [ 215.036088][ T9682] mlx4_core: Mellanox ConnectX core driver v4.0-0 [ 215.039449][ T9682] mlx4_core: Initializing 0000:00:00.0 [ 215.043641][ T9682] mlx4_core 0000:00:00.0: Missing DCS, aborting (driver_data: 0x0, pci_resource_flags(pdev, 0):0x0) [ 215.052356][ T9686] netlink: 27 bytes leftover after parsing attributes in process `syz.2.1244'. [ 216.095562][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 218.106709][ T9744] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.109640][ T9744] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.176735][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 218.222919][ T9749] cgroup: Unknown subsys name 'euid' [ 219.330478][ T9781] netlink: 'syz.1.1277': attribute type 4 has an invalid length. [ 219.406633][ T9783] fuse: fd is not a fuse device [ 219.603940][ T9796] team0: No ports can be present during mode change [ 220.817186][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 220.830415][ T9831] fuse: fd is not a fuse device [ 222.343983][ T9859] syzkaller0: entered promiscuous mode [ 222.347166][ T9859] syzkaller0: entered allmulticast mode [ 222.552083][ T9864] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 222.700885][ T42] audit: type=1800 audit(1786065052.827:46): pid=9870 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1309" name="bmaControls" dev="configfs" ino=34703 res=0 errno=0 [ 222.852156][ T9878] smpboot: CPU 1 is now offline [ 224.289413][ T9928] e1000e 0000:00:02.0 eth1: removed PHC [ 224.388909][ T9935] overlayfs: failed to resolve './file2': -2 [ 224.689927][ T9928] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 224.771806][ T9937] vmxnet3 0000:00:03.0: Incompatible h/w version (0x0) for adapter [ 224.851485][ T9937] vmxnet3 0000:00:03.0: probe with driver vmxnet3 failed with error -16 [ 225.104932][ T9930] vmxnet3 0000:00:02.0: Incompatible h/w version (0x0) for adapter [ 225.137893][ T9930] vmxnet3 0000:00:02.0: probe with driver vmxnet3 failed with error -16 [ 226.181715][ T9998] syzkaller0: entered promiscuous mode [ 226.183630][ T9998] syzkaller0: entered allmulticast mode [ 226.396255][ T42] audit: type=1800 audit(1786065056.527:47): pid=10005 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1342" name="size" dev="configfs" ino=37931 res=0 errno=0 [ 226.408614][ T42] audit: type=1800 audit(1786065056.537:48): pid=10005 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1342" name="zoned" dev="configfs" ino=37932 res=0 errno=0 [ 226.431424][ T42] audit: type=1800 audit(1786065056.557:49): pid=10005 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1342" name="zone_size" dev="configfs" ino=37933 res=0 errno=0 [ 226.441365][ T42] audit: type=1800 audit(1786065056.557:50): pid=10005 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1342" name="power" dev="configfs" ino=37934 res=0 errno=0 [ 226.447398][T10005] null_blk: nullb1: using native zone append [ 226.460677][T10008] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 226.467639][T10008] IPv6: NLM_F_CREATE should be set when creating new route [ 226.499878][T10005] null_blk: disk nullb1 created [ 227.037511][T10024] nvmet: adding nsid 1 to subsystem testnqn [ 227.065513][ T42] audit: type=1800 audit(1786065057.167:51): pid=10024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1347" name="device_path" dev="configfs" ino=37776 res=0 errno=0 [ 227.075241][ T42] audit: type=1800 audit(1786065057.167:52): pid=10024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1347" name="buffered_io" dev="configfs" ino=37777 res=0 errno=0 [ 227.088703][ T42] audit: type=1800 audit(1786065057.177:53): pid=10024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1347" name="addr_trtype" dev="configfs" ino=37783 res=0 errno=0 [ 227.205501][T10029] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2761322500 (353449280000 ns) > initial count (313845741312 ns). Using initial count to start timer. [ 227.458629][T10032] usbip-vudc usbip-vudc.0: gadget not bound [ 227.764207][T10043] netlink: 'syz.0.1354': attribute type 1 has an invalid length. [ 227.801692][T10043] 8021q: adding VLAN 0 to HW filter on device bond1 [ 227.839722][T10043] bond1: (slave geneve3): making interface the new active one [ 227.844797][T10043] bond1: (slave geneve3): Enslaving as an active interface with an up link [ 228.243824][T10067] syzkaller0: entered promiscuous mode [ 228.252061][T10067] syzkaller0: entered allmulticast mode [ 229.252842][T10087] fuse: fd is not a fuse device [ 229.265647][T10089] jffs2: notice: (10089) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 230.074599][T10104] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 230.554361][T10121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.558853][T10121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.775851][T10121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.782376][T10121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 231.357606][T10133] netlink: 420 bytes leftover after parsing attributes in process `syz.0.1388'. [ 232.069522][T10148] syzkaller0: entered promiscuous mode [ 232.072690][T10148] syzkaller0: entered allmulticast mode [ 232.091592][T10148] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1393'. [ 232.095720][T10148] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1393'. [ 232.383994][T10159] loop6: detected capacity change from 0 to 2640 [ 232.387317][T10159] buffer_io_error: 61 callbacks suppressed [ 232.387327][T10159] Buffer I/O error on dev loop6, logical block 0, async page read [ 232.392666][T10159] Buffer I/O error on dev loop6, logical block 0, async page read [ 232.395337][T10159] Buffer I/O error on dev loop6, logical block 0, async page read [ 232.398387][T10159] Buffer I/O error on dev loop6, logical block 0, async page read [ 232.401689][T10159] Buffer I/O error on dev loop6, logical block 0, async page read [ 232.404478][T10159] Buffer I/O error on dev loop6, logical block 0, async page read [ 232.407926][T10159] Buffer I/O error on dev loop6, logical block 0, async page read [ 232.411265][T10159] Buffer I/O error on dev loop6, logical block 0, async page read [ 232.414697][T10159] ldm_validate_partition_table(): Disk read failed. [ 232.418294][T10159] Buffer I/O error on dev loop6, logical block 0, async page read [ 232.421669][T10159] Buffer I/O error on dev loop6, logical block 0, async page read [ 232.424334][T10159] Dev loop6: unable to read RDB block 0 [ 232.427573][T10159] loop6: unable to read partition table [ 232.429900][T10159] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 233.630803][T10183] socket: no more sockets [ 234.846024][T10196] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4234756656 (33878053248 ns) > initial count (25262286960 ns). Using initial count to start timer. [ 235.628921][T10225] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1413'. [ 237.173662][T10260] pim6reg: entered allmulticast mode [ 237.411970][T10268] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1427'. [ 237.466739][T10270] tc action pedit 'at' offset 1235 out of bounds [ 237.885514][ T12] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 237.896027][ T12] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 237.904114][ T12] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 237.914109][ T12] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 238.156261][T10282] fuse: fd is not a fuse device [ 238.311898][T10287] syzkaller0: entered promiscuous mode [ 238.314236][T10287] syzkaller0: entered allmulticast mode [ 238.325833][T10287] TC_ACT_REPEAT abuse ? [ 240.179187][T10327] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1447'. [ 240.189373][T10327] bridge0: port 2(bridge_slave_1) entered disabled state [ 240.197232][T10327] bridge0: port 1(bridge_slave_0) entered disabled state [ 240.321391][T10324] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 242.606021][T10368] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 243.218970][T10388] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 243.950000][T10408] openvswitch: netlink: Flow key attr not present in new flow. [ 244.912752][T10422] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 244.918388][T10422] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 245.889816][T10435] MTD: Couldn't look up './dev/mtdblock0': -2 [ 246.281554][T10441] binder: 10440:10441 ioctl c0306201 80000080 returned -14 [ 246.378743][T10445] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1480'. [ 246.874531][T10453] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1482'. [ 246.943911][T10454] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1482'. [ 246.998591][T10456] jffs2: notice: (10456) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 247.014615][T10458] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 247.027301][T10458] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 247.038877][T10458] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 247.044774][T10458] block nbd0: shutting down sockets [ 247.452914][T10474] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 247.499653][T10474] VFS: Can't find a romfs filesystem on dev nullb0. [ 247.499653][T10474] [ 249.053843][T10494] gadgetfs: bound to dummy_udc driver [ 249.307845][ T5858] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 249.314150][ C0] gadgetfs: connected [ 249.324834][ T5858] gadgetfs: disconnected [ 249.477801][ C0] gadgetfs: connected [ 249.483020][ T5858] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 249.492156][ T5858] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 249.503801][ T5858] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.516303][ C0] gadgetfs: configuration #1 [ 249.690253][T10493] gadgetfs: suspended from state 3 [ 249.693184][ T5858] usb 6-1: can't set config #1, error -71 [ 249.703898][ T5858] usb 6-1: USB disconnect, device number 12 [ 249.715102][T10493] gadgetfs: disconnected [ 251.183986][T10516] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 251.220592][ T5858] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 251.224583][ T5858] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 251.229627][ T36] wlan1: send auth to 08:02:11:00:00:00 (try 2/3) [ 251.233156][ T36] wlan1: send auth to 08:02:11:00:00:00 (try 3/3) [ 251.236483][ T36] wlan1: authentication with 08:02:11:00:00:00 timed out [ 251.241121][T10518] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 251.297223][T10516] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 251.353410][T10518] syz.3.1504 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 251.655229][T10523] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1505'. [ 253.600481][T10553] fuse: fd is not a fuse device [ 255.609658][T10587] tmpfs: Unknown parameter 'nr_inod' [ 255.620359][T10587] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1524'. [ 258.963322][ T5858] Process accounting resumed [ 259.268481][T10643] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1543'. [ 259.610795][T10650] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1552'. [ 260.083992][T10665] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1550'. [ 260.091278][T10664] ubi0: attaching mtd0 [ 260.094628][T10664] ubi0: scanning is finished [ 260.096664][T10664] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 260.154073][T10667] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 260.231815][T10664] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 260.302874][ T5014] libceph: connect (1)[c::]:6789 error -101 [ 260.305005][ T5014] libceph: mon0 (1)[c::]:6789 connect error [ 260.396733][T10669] ceph: No mds server is up or the cluster is laggy [ 260.553221][T10666] jffs2: notice: (10666) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 261.692891][T10683] [U]  [ 262.738601][T10710] bond0: (slave bond_slave_1): Releasing backup interface [ 263.217264][T10726] FAULT_FLAG_ALLOW_RETRY missing 801 [ 263.221828][T10726] CPU: 2 UID: 0 PID: 10726 Comm: syz.3.1569 Tainted: G L syzkaller #0 PREEMPT(full) [ 263.221858][T10726] Tainted: [L]=SOFTLOCKUP [ 263.221866][T10726] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 263.221878][T10726] Call Trace: [ 263.221909][T10726] [ 263.221918][T10726] dump_stack_lvl+0x100/0x190 [ 263.221982][T10726] handle_userfault.cold+0x54/0x65 [ 263.222019][T10726] ? do_raw_spin_unlock+0x145/0x1e0 [ 263.222075][T10726] ? _raw_spin_unlock+0x28/0x50 [ 263.222171][T10726] ? __free_frozen_pages+0x751/0x1090 [ 263.222218][T10726] ? __pfx_handle_userfault+0x10/0x10 [ 263.222259][T10726] ? rcu_read_unlock+0x2d/0xb0 [ 263.222290][T10726] ? rcu_read_unlock+0x2d/0xb0 [ 263.222316][T10726] do_anonymous_page+0x1a56/0x2080 [ 263.222344][T10726] __handle_mm_fault+0x1d2c/0x2a00 [ 263.222367][T10726] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 263.222390][T10726] ? __pfx___handle_mm_fault+0x10/0x10 [ 263.222411][T10726] ? pte_offset_map_lock+0x174/0x320 [ 263.222443][T10726] ? find_held_lock+0x2b/0x80 [ 263.222475][T10726] ? follow_page_pte+0x4d0/0x13f0 [ 263.222506][T10726] handle_mm_fault+0x37b/0xa30 [ 263.222530][T10726] __get_user_pages+0x1178/0x32a0 [ 263.222564][T10726] ? __pfx___get_user_pages+0x10/0x10 [ 263.222595][T10726] populate_vma_page_range+0x267/0x3f0 [ 263.222620][T10726] ? __pfx_populate_vma_page_range+0x10/0x10 [ 263.222647][T10726] ? vma_set_page_prot+0xb1/0x120 [ 263.222670][T10726] mprotect_fixup+0x955/0xe30 [ 263.222692][T10726] ? __pfx_mprotect_fixup+0x10/0x10 [ 263.222725][T10726] ? __pfx_mas_prev+0x10/0x10 [ 263.222771][T10726] do_mprotect_pkey+0xa4b/0xef0 [ 263.222797][T10726] ? __pfx_do_mprotect_pkey+0x10/0x10 [ 263.222825][T10726] ? find_held_lock+0x2b/0x80 [ 263.222848][T10726] ? __fget_files+0x215/0x3d0 [ 263.222893][T10726] __ia32_sys_mprotect+0x75/0xb0 [ 263.222912][T10726] ? lockdep_hardirqs_on+0x78/0x100 [ 263.222941][T10726] __do_fast_syscall_32+0xe7/0x970 [ 263.222970][T10726] do_fast_syscall_32+0x32/0x70 [ 263.222994][T10726] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 263.223014][T10726] RIP: 0023:0xf7ff3fec [ 263.223032][T10726] Code: Unable to access opcode bytes at 0xf7ff3fc2. [ 263.223059][T10726] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 000000000000007d [ 263.223077][T10726] RAX: ffffffffffffffda RBX: 0000000080ffc000 RCX: 0000000000004000 [ 263.223091][T10726] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 263.223103][T10726] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 263.223112][T10726] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 263.223121][T10726] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 263.223141][T10726] [ 263.784953][T10750] pim6reg1: entered promiscuous mode [ 263.787454][T10750] pim6reg1: entered allmulticast mode [ 264.674373][T10774] vhci_hcd vhci_hcd.0: remove, state 4 [ 264.678876][T10774] usb usb38: USB disconnect, device number 1 [ 264.882401][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 264.884129][ T5820] vhci_hcd vhci_hcd.0: release socket [ 264.886143][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 264.890659][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 264.893482][ T5820] vhci_hcd vhci_hcd.0: release socket [ 264.897688][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 264.902179][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 264.904864][ T5820] vhci_hcd vhci_hcd.0: release socket [ 264.911042][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 264.914062][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 264.918142][ T5820] vhci_hcd vhci_hcd.0: release socket [ 264.922335][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 264.928374][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 264.932182][ T5820] vhci_hcd vhci_hcd.0: release socket [ 264.935700][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 264.939903][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 264.944424][ T5820] vhci_hcd vhci_hcd.0: release socket [ 264.948426][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 264.951716][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 264.955070][ T5820] vhci_hcd vhci_hcd.0: release socket [ 264.957889][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 264.960927][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 264.962555][ T5820] vhci_hcd vhci_hcd.0: release socket [ 264.966119][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 264.968045][T10774] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 264.973350][T10774] vhci_hcd vhci_hcd.0: remove, state 4 [ 264.975199][T10774] usb usb37: USB disconnect, device number 1 [ 265.022520][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 265.024490][ T5820] vhci_hcd vhci_hcd.0: release socket [ 265.027558][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 265.030693][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 265.034072][ T5820] vhci_hcd vhci_hcd.0: release socket [ 265.038782][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 265.041886][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 265.044840][ T5820] vhci_hcd vhci_hcd.0: release socket [ 265.057424][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 265.061244][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 265.062970][ T5820] vhci_hcd vhci_hcd.0: release socket [ 265.065537][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 265.068607][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 265.071517][ T5820] vhci_hcd vhci_hcd.0: release socket [ 265.073877][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 265.075943][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 265.077760][ T5820] vhci_hcd vhci_hcd.0: release socket [ 265.080778][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 265.082757][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 265.084523][ T5820] vhci_hcd vhci_hcd.0: release socket [ 265.086484][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 265.088786][ T5820] vhci_hcd vhci_hcd.0: stop threads [ 265.090884][ T5820] vhci_hcd vhci_hcd.0: release socket [ 265.092784][ T5820] vhci_hcd vhci_hcd.0: disconnect device [ 265.094648][T10774] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 265.102049][T10775] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 265.113475][T10775] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 37 [ 265.122462][T10775] vhci_hcd vhci_hcd.0: created sysfs vhci_hcd.0 [ 265.127595][T10775] usb usb37: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 265.135108][T10775] usb usb37: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 265.140337][T10775] usb usb37: Product: USB/IP Virtual Host Controller [ 265.144060][T10775] usb usb37: Manufacturer: Linux syzkaller vhci_hcd [ 265.146699][T10775] usb usb37: SerialNumber: vhci_hcd.0 [ 265.172832][T10775] hub 37-0:1.0: USB hub found [ 265.175332][T10775] hub 37-0:1.0: 8 ports detected [ 265.205632][T10775] vhci_hcd vhci_hcd.0: USB/IP Virtual Host Controller [ 265.217534][T10775] vhci_hcd vhci_hcd.0: new USB bus registered, assigned bus number 38 [ 265.222851][T10775] usb usb38: We don't know the algorithms for LPM for this host, disabling LPM. [ 265.227198][T10786] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1587'. [ 265.230963][T10775] usb usb38: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 7.02 [ 265.234027][T10786] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1587'. [ 265.237007][T10775] usb usb38: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 265.239841][T10775] usb usb38: Product: USB/IP Virtual Host Controller [ 265.243278][T10775] usb usb38: Manufacturer: Linux syzkaller vhci_hcd [ 265.245992][T10775] usb usb38: SerialNumber: vhci_hcd.0 [ 265.266139][T10775] hub 38-0:1.0: USB hub found [ 265.276977][T10775] hub 38-0:1.0: 8 ports detected [ 268.418408][ T42] audit: type=1800 audit(1786065097.542:54): pid=10832 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1599" name="is_nonrot" dev="configfs" ino=43724 res=0 errno=0 [ 268.771436][T10835] batadv_slave_1: entered promiscuous mode [ 268.776962][T10835] macvlan2: entered allmulticast mode [ 268.779119][T10835] batadv_slave_1: entered allmulticast mode [ 268.782981][T10835] batman_adv: batadv0: Adding interface: macvlan2 [ 268.785071][T10835] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 268.792884][T10835] batman_adv: batadv0: Interface activated: macvlan2 [ 269.786146][T10859] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1607'. [ 271.305593][ T5433] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 271.456155][ T5433] usb 6-1: Using ep0 maxpacket: 8 [ 271.462490][ T5433] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 271.469146][ T5433] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 271.472659][ T5433] usb 6-1: config 0 interface 0 has no altsetting 0 [ 271.474875][ T5433] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 271.478258][ T5433] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.484449][ T5433] usb 6-1: config 0 descriptor?? [ 271.924436][ T5433] mcp2221 0003:04D8:00DD.0003: unknown main item tag 0x0 [ 271.924521][T10904] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1623'. [ 271.926835][ T5433] mcp2221 0003:04D8:00DD.0003: unknown main item tag 0x0 [ 271.933082][ T5433] mcp2221 0003:04D8:00DD.0003: unknown main item tag 0x0 [ 271.937747][ T5433] mcp2221 0003:04D8:00DD.0003: unknown main item tag 0x0 [ 271.941306][ T5433] mcp2221 0003:04D8:00DD.0003: unknown main item tag 0x0 [ 271.944918][ T5433] mcp2221 0003:04D8:00DD.0003: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 272.130194][ T5433] usb 6-1: USB disconnect, device number 13 [ 274.500272][ T64] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 274.501560][ T5754] Bluetooth: hci4: command 0x1003 tx timeout [ 275.462244][T10952] input: syz0 as /devices/virtual/input/input22 [ 276.220405][T10964] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 277.340983][T10988] x_tables: ip_tables: TCPMSS.0 target: invalid size 8 (kernel) != (user) 16 [ 277.959887][T10993] netlink: 'syz.1.1651': attribute type 4 has an invalid length. [ 278.302011][T10997] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 278.364060][T10997] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 278.368031][T10997] overlayfs: failed to look up (tracing) for ino (-66) [ 279.362117][T11016] [ 279.362952][T11016] ============================================ [ 279.365091][T11016] WARNING: possible recursive locking detected [ 279.367546][T11016] syzkaller #0 Tainted: G L [ 279.369570][T11016] -------------------------------------------- [ 279.371862][T11016] syz.1.1657/11016 is trying to acquire lock: [ 279.374218][T11016] ffff8880736fa160 (&rmidi->open_mutex){+.+.}-{4:4}, at: snd_rawmidi_kernel_open+0xa4/0x190 [ 279.377554][T11016] [ 279.377554][T11016] but task is already holding lock: [ 279.380418][T11016] ffff8880212e2560 (&rmidi->open_mutex){+.+.}-{4:4}, at: snd_rawmidi_open+0x296/0xba0 [ 279.383500][T11016] [ 279.383500][T11016] other info that might help us debug this: [ 279.386656][T11016] Possible unsafe locking scenario: [ 279.386656][T11016] [ 279.388989][T11016] CPU0 [ 279.390280][T11016] ---- [ 279.391639][T11016] lock(&rmidi->open_mutex); [ 279.393524][T11016] lock(&rmidi->open_mutex); [ 279.395111][T11016] [ 279.395111][T11016] *** DEADLOCK *** [ 279.395111][T11016] [ 279.397986][T11016] May be due to missing lock nesting notation [ 279.397986][T11016] [ 279.401059][T11016] 2 locks held by syz.1.1657/11016: [ 279.402732][T11016] #0: ffff8880212e2560 (&rmidi->open_mutex){+.+.}-{4:4}, at: snd_rawmidi_open+0x296/0xba0 [ 279.406592][T11016] #1: ffff8880736fa460 (&ump->open_mutex){+.+.}-{4:4}, at: snd_ump_legacy_open+0x120/0x4e0 [ 279.409958][T11016] [ 279.409958][T11016] stack backtrace: [ 279.412311][T11016] CPU: 0 UID: 0 PID: 11016 Comm: syz.1.1657 Tainted: G L syzkaller #0 PREEMPT(full) [ 279.412341][T11016] Tainted: [L]=SOFTLOCKUP [ 279.412347][T11016] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 279.412359][T11016] Call Trace: [ 279.412366][T11016] [ 279.412373][T11016] dump_stack_lvl+0x100/0x190 [ 279.412396][T11016] print_deadlock_bug.cold+0xbd/0xca [ 279.412426][T11016] __lock_acquire+0x1256/0x1a40 [ 279.412463][T11016] lock_acquire+0x1b9/0x370 [ 279.412484][T11016] ? snd_rawmidi_kernel_open+0xa4/0x190 [ 279.412499][T11016] ? __pfx___might_resched+0x10/0x10 [ 279.412533][T11016] __mutex_lock+0x1a4/0x1bd0 [ 279.412553][T11016] ? snd_rawmidi_kernel_open+0xa4/0x190 [ 279.412569][T11016] ? snd_rawmidi_kernel_open+0xa4/0x190 [ 279.412586][T11016] ? __mutex_lock+0x26d/0x1bd0 [ 279.412602][T11016] ? snd_ump_legacy_open+0x120/0x4e0 [ 279.412618][T11016] ? __pfx___mutex_lock+0x10/0x10 [ 279.412633][T11016] ? __pfx___mutex_lock+0x10/0x10 [ 279.412650][T11016] ? snd_rawmidi_kernel_open+0xa4/0x190 [ 279.412664][T11016] snd_rawmidi_kernel_open+0xa4/0x190 [ 279.412678][T11016] snd_ump_legacy_open+0x367/0x4e0 [ 279.412694][T11016] open_substream+0x480/0x970 [ 279.412707][T11016] rawmidi_open_priv+0x595/0x6f0 [ 279.412721][T11016] snd_rawmidi_open+0x4c9/0xba0 [ 279.412736][T11016] ? __pfx_snd_rawmidi_open+0x10/0x10 [ 279.412751][T11016] ? __pfx_default_wake_function+0x10/0x10 [ 279.412763][T11016] ? soundcore_open+0x231/0x5a0 [ 279.412773][T11016] ? soundcore_open+0x231/0x5a0 [ 279.412783][T11016] ? __pfx_snd_rawmidi_open+0x10/0x10 [ 279.412797][T11016] soundcore_open+0x2e3/0x5a0 [ 279.412807][T11016] ? __pfx_soundcore_open+0x10/0x10 [ 279.412816][T11016] chrdev_open+0x234/0x6a0 [ 279.412829][T11016] ? __pfx_chrdev_open+0x10/0x10 [ 279.412840][T11016] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 279.412855][T11016] do_dentry_open+0x6ab/0x14d0 [ 279.412866][T11016] ? __pfx_chrdev_open+0x10/0x10 [ 279.412878][T11016] vfs_open+0x82/0x3f0 [ 279.412892][T11016] path_openat+0x2873/0x4280 [ 279.412906][T11016] ? __pfx_path_openat+0x10/0x10 [ 279.412918][T11016] do_file_open+0x20e/0x430 [ 279.412929][T11016] ? __lock_acquire+0x49f/0x1a40 [ 279.412945][T11016] ? __pfx_do_file_open+0x10/0x10 [ 279.412960][T11016] ? _raw_spin_unlock+0x28/0x50 [ 279.412972][T11016] ? alloc_fd+0x471/0x7a0 [ 279.412984][T11016] do_sys_openat2+0x10f/0x1e0 [ 279.412998][T11016] ? __pfx_do_sys_openat2+0x10/0x10 [ 279.413012][T11016] ? kcov_ioctl+0x17a/0x750 [ 279.413035][T11016] ? rcu_is_watching+0x12/0xc0 [ 279.413056][T11016] ? kcov_ioctl+0x17a/0x750 [ 279.413073][T11016] __ia32_compat_sys_openat+0x12d/0x210 [ 279.413091][T11016] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 279.413111][T11016] do_int80_emulation+0x14b/0x720 [ 279.413128][T11016] asm_int80_emulation+0x1a/0x20 [ 279.413141][T11016] RIP: 0023:0xf71f74eb [ 279.413151][T11016] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 279.413162][T11016] RSP: 002b:00000000f547403c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 279.413174][T11016] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5474100 [ 279.413180][T11016] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 279.413187][T11016] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 279.413193][T11016] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 279.413199][T11016] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 279.413209][T11016]