last executing test programs: 8m39.161390555s ago: executing program 1 (id=1163): syz_emit_vhci(&(0x7f00000003c0)=ANY=[@ANYBLOB="040e04f34120", @ANYRESDEC], 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1df) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='myproc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='myproc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='myproc/iomem\x00', 0x0, 0x0) read(r0, &(0x7f0000000500), 0xfa0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='myproc\x00', 0x280, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi.usb0/id\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='Mid', 0x3) r2 = openat(r0, &(0x7f0000000240)='./config/usb_gadget/g1/functions/midi.usb0/in_ports\x00', 0x400084, 0xd9) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/midi.usb0/out_ports\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='2\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f00000003c0)='dummy_udc.0\n', 0xc) syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00') mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) userfaultfd(0x80001) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000180)={0x200005, 0x200027, 0x801, 0x0, 0x7}) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x8) 8m39.053118675s ago: executing program 1 (id=1165): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="340000001100010027bd7000fddbdf", @ANYRES32=0x0, @ANYBLOB="2010000000000400140003007621"], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000000104010100000000000000001ce2efb60a00000406000640"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x44010) socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8000000004) r4 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$packet(0x11, 0x2, 0x300) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000280)=ANY=[@ANYRES64=r3, @ANYRES8], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x31, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000180)=r8, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) ioctl$VIDIOC_QUERYMENU(r4, 0xc008561c, &(0x7f00000000c0)={0xf0f002, 0x2, @name="2a0bfa91762a67fc38beda01496988cd2bae0aa03dc5d7b06bef2d1e67d01e0c"}) writev(r3, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f00000001c0)="ee64", 0x2}], 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={0x0, 0x10}}, 0x0) syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r9, 0xffffffffffffffff, 0x0) 8m38.177092338s ago: executing program 1 (id=1167): openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x6b142, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000380), 0x8001, 0x0) socket(0x40000000015, 0x5, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x381, 0x0) openat$userfaultfd(0xffffff9c, &(0x7f0000000000), 0x800, 0x0) openat$sr(0xffffff9c, &(0x7f00000001c0), 0x140, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r0, 0x0, 0x10) 8m37.716518198s ago: executing program 1 (id=1169): r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x801) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, &(0x7f0000000580)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) chdir(&(0x7f0000000100)='./file0\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x58) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SSUBSCRIP(r1, 0x89e1, &(0x7f0000000380)={'ip_vti0\x00', 0x2, 0xfff}) keyctl$instantiate(0xc, 0x0, 0x0, 0x2e, 0xfffffffffffffffa) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00'}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r4, 0x5, &(0x7f0000000040)='fd', 0x0, r3) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) open(&(0x7f0000000000)='.\x00', 0x0, 0x244) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r5, r5) setpgid(r5, r5) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0x9362, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000300)) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="44000000180001002cbd700000000000", @ANYRES8=r6, @ANYBLOB, @ANYRESOCT=r0], 0x44}}, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) 8m37.61573245s ago: executing program 1 (id=1170): r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, &(0x7f0000000100)=""/178, 0xb2) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000300)=0x0) ptrace$ARCH_SHSTK_STATUS(0x1e, r3, &(0x7f00000002c0), 0x5005) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendto$inet6(r1, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000014c0)='\x00', 0x1}], 0x1}}], 0x1, 0x400c405) exit(0x0) sendmmsg$inet6(r1, &(0x7f0000003f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40) socket$kcm(0x2d, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r4, &(0x7f0000000780)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000740)={&(0x7f0000000240)=ANY=[@ANYBLOB="140600006dc6f305532146703e622a9175d5c708c5376ca710d957685149cd7ad42dc3bb123fee6f8a0e2159ce5af32580ab43df2bb13d141b15a058f8fff39cd0f9b2133a08558bf9c993c0101244a0522ac9f8d75ceb22d6cb"], 0x14}, 0x1, 0x0, 0x0, 0x24000040}, 0x10) syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000080)=ANY=[@ANYBLOB="12011003020000202505a1a440000102030109025c0002010c70090904000001020d000005240600010524006c0c0d240f0107000000010005000906241ab8f32009058103200000040d0904010000020d00000904010102020d0000090300000000000000090503020800072b99"], 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000fdffff8520000003000000950000000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x0, 0xe, 0x0, &(0x7f0000000900)="928e04b416cac951c35f7f4586e6", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 8m36.805573669s ago: executing program 1 (id=1177): setrlimit(0x7, &(0x7f00000001c0)={0x0, 0x1ef}) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x81901) openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080)) r0 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) rename(0x0, &(0x7f00000000c0)='./file0/../file0/file0\x00') ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f00000000c0)=@ethtool_gfeatures={0x33}}) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x0) fchdir(r2) mkdir(&(0x7f0000000100)='./file1\x00', 0x144) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x12, 0x3, 0x4, 0x8}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f00000001c0)=r6, 0x4) syz_emit_ethernet(0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa88a8df06e87ca6b6a1f1758d4bb54683f5b864014d0104ee6b503a7e4983e9e7eea1be704e6b55c0f6da3e36acc76bd237af82"], 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0xffff, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) sendmmsg$inet(r4, &(0x7f0000006e40)=[{{&(0x7f0000000380)={0x2, 0x6e20, @multicast1}, 0x10, 0x0}}], 0x1, 0x2000c044) writev(r4, &(0x7f0000002640)=[{&(0x7f0000000c40)="b4", 0x1}], 0x1) getdents64(r3, &(0x7f00000000c0)=""/55, 0x37) lseek(r3, 0x7, 0x1) r8 = getpid() r9 = syz_pidfd_open(r8, 0x0) process_madvise(r9, 0x0, 0x0, 0x65, 0x0) r10 = syz_open_dev$audion(&(0x7f0000000040), 0x2, 0x14500) ioctl$BTRFS_IOC_INO_LOOKUP(r10, 0xd0009412, &(0x7f0000000480)={0x0, 0x7}) 8m36.631361706s ago: executing program 32 (id=1177): setrlimit(0x7, &(0x7f00000001c0)={0x0, 0x1ef}) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x81901) openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080)) r0 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) rename(0x0, &(0x7f00000000c0)='./file0/../file0/file0\x00') ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f00000000c0)=@ethtool_gfeatures={0x33}}) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r0, 0x0, 0x0) fchdir(r2) mkdir(&(0x7f0000000100)='./file1\x00', 0x144) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x12, 0x3, 0x4, 0x8}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f00000001c0)=r6, 0x4) syz_emit_ethernet(0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa88a8df06e87ca6b6a1f1758d4bb54683f5b864014d0104ee6b503a7e4983e9e7eea1be704e6b55c0f6da3e36acc76bd237af82"], 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0xffff, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) sendmmsg$inet(r4, &(0x7f0000006e40)=[{{&(0x7f0000000380)={0x2, 0x6e20, @multicast1}, 0x10, 0x0}}], 0x1, 0x2000c044) writev(r4, &(0x7f0000002640)=[{&(0x7f0000000c40)="b4", 0x1}], 0x1) getdents64(r3, &(0x7f00000000c0)=""/55, 0x37) lseek(r3, 0x7, 0x1) r8 = getpid() r9 = syz_pidfd_open(r8, 0x0) process_madvise(r9, 0x0, 0x0, 0x65, 0x0) r10 = syz_open_dev$audion(&(0x7f0000000040), 0x2, 0x14500) ioctl$BTRFS_IOC_INO_LOOKUP(r10, 0xd0009412, &(0x7f0000000480)={0x0, 0x7}) 4.524416797s ago: executing program 4 (id=3330): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f0000000100), 0x0, 0x0, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) listen(0xffffffffffffffff, 0x0) syz_emit_ethernet(0xc3, &(0x7f0000000580)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0xb5, 0x64, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e23, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x40, 0x0, 0x0, 0x0, {[@nop, @window={0x3, 0x3, 0x1}, @window={0x3, 0x3, 0x9}, @window={0x3, 0x3, 0xe}]}}, {"29039e27fe115e6972548d03d6c44c519bce7c06eb0c290ed841d22da00300000051b35ac81607c6e43c13e284bc17ad16fcc52fba7ad42ded6f0a4c3e13e07f2cd56ce046387a0e89ee9e6d86a51e4b9a535c8174aa287e2cc40e0cab8acba2da0483d837be4650c5fffb36f0412be5d2ca63325ac4ebe0b10c951a95fca53e2d"}}}}}}, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x9c, 0x0, 0x0, 0x40000000}, {}, {0x3, 0x7}, {}, {0x0, 0x5a}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@delneigh={0x24, 0x1d, 0x1, 0x70bd25, 0x25dfdbff, {0xa, 0x0, 0x0, 0x0, 0x0, 0x1, 0xb}, [@NDA_DST_IPV4={0x8, 0x1, @private=0xa010102}]}, 0x24}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) 3.611394392s ago: executing program 4 (id=3332): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f0000000100), 0x0, 0x0, 0x0) close(r4) listen(0xffffffffffffffff, 0x0) syz_emit_ethernet(0xc3, &(0x7f0000000580)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0xb5, 0x64, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e23, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x40, 0x0, 0x0, 0x0, {[@nop, @window={0x3, 0x3, 0x1}, @window={0x3, 0x3, 0x9}, @window={0x3, 0x3, 0xe}]}}, {"29039e27fe115e6972548d03d6c44c519bce7c06eb0c290ed841d22da00300000051b35ac81607c6e43c13e284bc17ad16fcc52fba7ad42ded6f0a4c3e13e07f2cd56ce046387a0e89ee9e6d86a51e4b9a535c8174aa287e2cc40e0cab8acba2da0483d837be4650c5fffb36f0412be5d2ca63325ac4ebe0b10c951a95fca53e2d"}}}}}}, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x9c, 0x0, 0x0, 0x40000000}, {}, {0x3, 0x7}, {}, {0x0, 0x5a}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@delneigh={0x24, 0x1d, 0x1, 0x70bd25, 0x25dfdbff, {0xa, 0x0, 0x0, 0x0, 0x0, 0x1, 0xb}, [@NDA_DST_IPV4={0x8, 0x1, @private=0xa010102}]}, 0x24}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) 2.824369931s ago: executing program 0 (id=3338): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./work\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./lower/file\x00', 0x41, 0x1ff) mount(0x0, &(0x7f00000000c0)='./merge\x00', &(0x7f0000000140)='overlay\x00', 0x500, &(0x7f0000000180)='lowerdir=./lower,upperdir=./upper,workdir=./work,index=on,nfs_export=on\x00') r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000000200)='file\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="8000"/144], &(0x7f0000000300), 0x0) 2.823925921s ago: executing program 0 (id=3339): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$packet(0x11, 0x2, 0x300) keyctl$instantiate(0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYRES16=r1, @ANYRES32=r0], 0x0, 0xfffffffffffffff9) r3 = syz_io_uring_setup(0x3c63, &(0x7f0000000240)={0x0, 0x7b46, 0x27}, 0x0, 0x0, &(0x7f0000000000)=0x0) r5 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) keyctl$instantiate(0xc, r5, &(0x7f0000000740)=ANY=[@ANYRESDEC=r3, @ANYRES16=r0, @ANYRESHEX=r3, @ANYRESOCT=r0, @ANYRESOCT=r0, @ANYRES8=r4], 0x20, r5) add_key(&(0x7f00000005c0)='trusted\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) r6 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r6) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYRES16=r0], 0x58}, 0x1, 0x0, 0x0, 0x2404c050}, 0x0) eventfd(0xfb) r9 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x201, 0x402) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x11, r9, 0x1f) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_CONNECT(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYRESOCT=r10, @ANYRESOCT=r8, @ANYBLOB="05002cbd7000000000002e00000008000300", @ANYRESHEX=0x0, @ANYBLOB="0a00340002020202020d000008004b0004000000"], 0x30}}, 0x4104) read$usbfs(r9, &(0x7f00000002c0)=""/118, 0x76) r11 = syz_io_uring_setup(0xf00, &(0x7f0000000340)={0x0, 0x8006605, 0x1000, 0x1, 0x36}, &(0x7f0000000100), &(0x7f0000000140)=0x0, &(0x7f0000000180)) io_uring_enter(r11, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) getsockname$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r14 = syz_io_uring_setup(0xf00, &(0x7f0000001800)={0x0, 0x1e5a, 0x100, 0xfffffffe, 0x365}, &(0x7f0000000280), &(0x7f00000001c0)=0x0, &(0x7f0000000340)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) io_uring_register$IORING_REGISTER_EVENTFD(r14, 0x4, &(0x7f0000000040), 0x1) sendmsg$nl_route(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="908280001000370429bc40410000000000000000b14a9d4876fe3a732a77a43439ed01a4090181d4283095528c25a31d5cbad1129d2016dca96564ee0750f279a06dfe7bd2bc6bc71cd6f67d8820ffeacfff9c0106bdc1ca00a36bbb0166249072b87dbd55edfb167eba2583c5be6cdb64ab58156a2de571e92b416ee30189fe0b4e29ef7ea19576a3bcc2f5b151ad64dfb04bb88666b0ea0af4c091881a", @ANYRES32=r15, @ANYRES32=r12], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg(r2, &(0x7f0000000340)=[{{&(0x7f00000002c0)=@xdp={0x2c, 0xa888, r13, 0x7}, 0x14, 0x0}}], 0x1, 0x80) ioctl$XFS_IOC_SET_RESBLKS(r2, 0xc0105872, &(0x7f0000000080)={0x7, 0x2}) setsockopt$sock_attach_bpf(r10, 0x1, 0x25, &(0x7f0000000600)=r1, 0x4) 2.758205287s ago: executing program 3 (id=3340): creat(&(0x7f00000002c0)='./file0\x00', 0xbf) (async, rerun: 32) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) (rerun: 32) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) (async) r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix_mp={0x9, 0xfffffff7, 0x38416761, 0x2, 0x3, [{0x9, 0x10000}, {0x3, 0x4}, {0x9, 0x8}, {0x5f7, 0x9}, {0x3, 0xff}, {0x1, 0x400}, {0x59e6, 0x4}, {0x5, 0x483}], 0x8, 0xd, 0x4, 0x0, 0x3}}) (async) set_mempolicy(0x3, 0x0, 0x6) (async) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) (async) creat(&(0x7f00000002c0)='./file0\x00', 0x5d) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 64) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async, rerun: 64) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) (async) syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) (async, rerun: 32) socket$inet_mptcp(0x2, 0x1, 0x106) (rerun: 32) prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x7, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) (async, rerun: 64) sendmsg$nl_route(r2, 0x0, 0x0) (rerun: 64) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) (async, rerun: 32) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) (rerun: 32) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async, rerun: 32) r4 = socket$netlink(0x10, 0x3, 0x0) (rerun: 32) recvmmsg(r4, &(0x7f0000007700), 0x318, 0xfc0, 0x0) (async, rerun: 64) r5 = socket(0xa, 0x1, 0x0) (rerun: 64) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x11, @loopback, 0x0, 0x0, 'lblcr\x00', 0x32, 0x0, 0xfffffffc}, 0x2c) (async) setsockopt$IP_VS_SO_SET_FLUSH(r5, 0x0, 0x485, 0x0, 0x0) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) (rerun: 64) 2.703474168s ago: executing program 3 (id=3341): syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x161d02) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x0, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x7, &(0x7f0000000040)=0x8000001, 0x4) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) setgroups(0x0, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x4}) bpf$PROG_LOAD(0x5, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r4 = syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) ioctl$TIOCSERGETLSR(r3, 0x5459, &(0x7f00000001c0)) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000023c0)={&(0x7f0000000280)=ANY=[@ANYRES16, @ANYRESHEX, @ANYRES64=r3, @ANYRESHEX], 0x24}, 0x1, 0x0, 0x0, 0x24048454}, 0x0) ptrace$peekuser(0x3, r4, 0x7) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000000314230c2dbd7000ffdbdf250900020073797a32000f00000800410072786500140033007767320000000000000000000000000066129cbdaaf92ea305126427a766b1c085924cd6ad57b03cfe9655f622d77d2aeea86454e08d702ca2d6392ca31ef21b722d78da5d90886bb0db32b0e33c89a5e901bb4e0379f25665d395238e6730ad37288567b268fe7f1586d588e526e7d727ec73b81279a75e879dd960e5107507609756ec582a8032a0ae41beb16ed972c66cc59029b79ace6666660cde28316ee23ff7ea64e39ae6d39b5f45f5ccf2adaffee80cc44776710ba5c2a2e806dcb0a1fd133d11902dea4f"], 0x38}, 0x1, 0x0, 0x0, 0x400c080}, 0x0) ioctl$USBDEVFS_RELEASE_PORT(0xffffffffffffffff, 0x5514, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, &(0x7f0000000040)={'\x00', 0xd, 0x1, 0x102, 0x401, 0x1}) 2.643628465s ago: executing program 0 (id=3342): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$l2tp6(0xa, 0x2, 0x73) getpgid(0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)) r2 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='ntfs3\x00', 0x1000080, 0x0) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) connect$can_bcm(r6, &(0x7f00000000c0)={0x1d, r7}, 0x10) sendmsg$can_bcm(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r5, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x1) sendmsg$can_bcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0x230}, 0x2}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x12, 0x4, 0x8, 0x8002}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r8, 0x0, 0x0}, 0x20) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x4000002) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) connect$l2tp6(r1, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r1, 0x0, 0x0, 0xff00) prctl$PR_PAC_RESET_KEYS(0x36, 0x0) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="14030000300001000001000004000000010300800c0001"], 0x314}], 0x1}, 0x800) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r9, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x20007, 0x30}, 0xc) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r10, &(0x7f00000002c0)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) 2.636039129s ago: executing program 4 (id=3343): r0 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f0000000540)="900000001c001f4d154a817393278bff0a80a57802000000e503740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e00a2c5fed0759cb068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0c80cef7cff81d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0xfffffdce) sendto$inet6(r0, &(0x7f0000000180)="900000001d001f4d154a817393278bff0a80a578020000000404840014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000766436c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) 2.548325127s ago: executing program 4 (id=3344): r0 = syz_open_dev$mouse(&(0x7f0000000040), 0x0, 0x511741) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_procfs$pagemap(0x0, &(0x7f0000000140)) write$FUSE_LK(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, {{0x0, 0x122a000000}}}, 0x28) ioctl$FS_IOC_SETFLAGS(r1, 0xc0606610, &(0x7f0000000040)=0x60) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xd, &(0x7f00000002c0)=ANY=[], &(0x7f0000000440)='GPL\x00', 0x60, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r2}, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000cc0)={0x6, 0x2b, &(0x7f0000000d80)=ANY=[@ANYBLOB="18460000fdffffff000000000000000018640000060000000000000009000000185a0000060000000000000000000000b7080000000000007b8af8ff00000000b708000000f0ffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b70500000800000085000000a500000018", @ANYRES32=r0, @ANYBLOB, @ANYRES32, @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000008500"], &(0x7f0000000b80)='GPL\x00', 0x80000001, 0x13, &(0x7f0000000bc0)=""/19, 0x41100, 0x10, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000c40)={0x3, 0x4, 0x7, 0x7}, 0x10, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000c80)=[{0x2, 0x3, 0x5, 0xb}, {0x1, 0x5, 0xd, 0x4}, {0x0, 0x1, 0x7, 0xf}, {0x1, 0x4, 0xc, 0xa}], 0x10, 0x2566}, 0x94) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="080000000000000004000000018000006d000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80200, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r6, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/llc/socket\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) landlock_create_ruleset(&(0x7f0000000040)={0x4000, 0x3}, 0x18, 0x0) 2.298189948s ago: executing program 4 (id=3345): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) keyctl$KEYCTL_MOVE(0x1e, r0, r0, r0, 0x1) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1200000, 0xffffffff}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x3, 0x0, [{0x1b, 0x0, 0xfee00c00}, {0x832, 0x0, 0x40000}, {0x6e0, 0x0, 0x87a9}]}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/file0\x00', 0x121045, 0x0) write(r3, &(0x7f0000000280)='dummy_udc.0\n', 0xc) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='0.0.0.0:0:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f00000000c0)='ms_mode\x00', &(0x7f0000000100)='crc\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000140)='mount_timeout\x00', &(0x7f0000000180)='1\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r4, 0x84, 0x16, &(0x7f0000000040)=ANY=[@ANYBLOB="05000000"], 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000840)={&(0x7f0000000a40)=ANY=[@ANYBLOB="700000000906010200000000000000000a0000083400078005001a00000000000900130073797a31000000000800064000000003080006408000000131ff1940000000000000007a0c00078006001d40000600000800094000006b6d08000940000000050900020073797a320000000069efdfb52c0648193044ce31ead2baee416e0693b34f1293ab3189e6bbbff8b90c5a396ed0eb2d114610076afd3b97aad25c5237c750b0b9e2b15f2178c6f04006a2a0364a9b05c3b5776aae9be95dda4e07c61c06158193eee5b97e1d155af4fc24123f399019848305d0908ea5497391b7a86cbd0fe4e5d2299c5761c368eeac76c6096848aecf3ab947eee3f5312a1b3794de52761351680080571f8dc0a96f0672b791d7e6285a650a1343151e52ede10abf9dd095cd1a27ee59fc926780dd48ca917427ca5ed1"], 0x70}, 0x1, 0x0, 0x0, 0x4}, 0x1) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCADDRT(r7, 0x890b, &(0x7f0000000540)={@mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8240022a}) r8 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet_sctp(r8, &(0x7f0000002a00)=[{&(0x7f0000000100)=@in={0x2, 0x100, @private=0xa010100}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000080)="14850c", 0x3}], 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="2c2ef744f47123ffd8c06c5b010bdd5c9fe002006996c27a", @ANYRES32=0x0], 0x2c}], 0x1, 0x40) inotify_add_watch(r3, &(0x7f00000006c0)='.\x00', 0x400000ea) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r9, 0x84, 0x9, &(0x7f0000000940)={0x0, @in6={{0xa, 0x4e20, 0x10001, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3}}, 0x5, 0x5, 0x8, 0x0, 0xbc, 0x7, 0x5}, &(0x7f0000000a00)=0x9c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000140)=""/48, 0x30}, {&(0x7f0000000580)=""/42, 0x2a}], 0x2) 2.014476726s ago: executing program 2 (id=3347): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./work\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./lower/file\x00', 0x41, 0x1ff) mount(0x0, &(0x7f00000000c0)='./merge\x00', &(0x7f0000000140)='overlay\x00', 0x500, &(0x7f0000000180)='lowerdir=./lower,upperdir=./upper,workdir=./work,index=on,nfs_export=on\x00') r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000000200)='file\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="8000"/144], &(0x7f0000000300), 0x0) 1.934324304s ago: executing program 2 (id=3348): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x24, r1, 0x5, 0x0, 0x1000000, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x24}}, 0xc0c4) 1.874574708s ago: executing program 2 (id=3349): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi5\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) close(0x3) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'aio_iiro_16\x00', [0x100, 0x80000000, 0x2, 0xc, 0xe, 0x5, 0x79, 0x3, 0x80008, 0x0, 0x2, 0x1, 0x7, 0x1, 0x1000, 0xfd, 0x0, 0x8, 0x40003, 0x80000000, 0x8, 0x2, 0x0, 0x20001e58, 0x1, 0x0, 0x7, 0xffffffff, 0xa6b5, 0x24a05ffd, 0xffffffff]}) 1.874221859s ago: executing program 2 (id=3350): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0x48, &(0x7f0000000300)={0x0, 0xf20f, 0x0, 0x2, 0x1b}, &(0x7f0000000200), &(0x7f00000000c0), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0xd1, 0x5, 0x0, 0x1, @dev, @dev={0xfe, 0x80, '\x00', 0x37}, 0x10, 0x8000, 0x9, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x0, 0x0, 0x0, 0x4007}}) unshare(0x26020480) r3 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x1c) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r3, 0x0, 0x0) r6 = openat$cgroup_int(r5, &(0x7f0000000180)='cgroup.max.depth\x00', 0x2, 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x123f41, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000040)=0xd) write$binfmt_aout(r5, &(0x7f0000000400)=ANY=[@ANYRESHEX=0x0, @ANYRES64, @ANYRES32=0x0, @ANYRES8, @ANYRESDEC=r0], 0xff2e) ioctl$TCFLSH(r7, 0x540b, 0x1) write$cgroup_int(r6, &(0x7f0000000000), 0x12) 1.720994917s ago: executing program 0 (id=3351): socket$packet(0x11, 0x3, 0x300) (async) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r1 = socket(0x0, 0x0, 0x0) connect$inet(r1, &(0x7f0000000140)={0x2, 0x4e20, @loopback}, 0xffffffffffffffd8) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001580)=ANY=[@ANYBLOB], 0x124}, 0x1, 0x0, 0x0, 0x15}, 0x4) (async) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) (async) recvmmsg(r1, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001440)=""/145, 0x91}, {&(0x7f0000001500)=""/13, 0xd}, {&(0x7f0000001540)=""/120, 0x78}], 0x4}}], 0x1, 0x2, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) (async) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143902) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x929a03) ioctl$EVIOCSMASK(r3, 0x40104593, &(0x7f0000001740)={0x0, 0x4, &(0x7f0000000740)="8af7a39a"}) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x57, 0x7, 0x2008, {0x1000, 0x1}, {0x74, 0x2}, @const={0x6, {0xa, 0x7, 0x77c8, 0x8c}}}) (async) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) write$char_usb(0xffffffffffffffff, 0x0, 0x0) write$char_usb(r4, &(0x7f0000000040)="e2", 0xff0f) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)='\b', 0x1}, {0x0}], 0x2) (async) r5 = shmget$private(0x0, 0x2000, 0x0, &(0x7f00000eb000/0x2000)=nil) socketpair$unix(0x1, 0x5, 0x0, 0x0) (async) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) (async) shmat(r5, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) r6 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000100)=0x3) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r6, 0x0) ioctl$KVM_INTERRUPT(r6, 0x4004ae86, &(0x7f0000000240)=0x4) (async) ioctl$KVM_SET_REGS(r6, 0x4090ae82, 0x0) 1.612256502s ago: executing program 0 (id=3352): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f0000000100), 0x0, 0x0, 0x0) close(r4) listen(0xffffffffffffffff, 0x0) syz_emit_ethernet(0xc3, &(0x7f0000000580)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0xb5, 0x64, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e23, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x40, 0x0, 0x0, 0x0, {[@nop, @window={0x3, 0x3, 0x1}, @window={0x3, 0x3, 0x9}, @window={0x3, 0x3, 0xe}]}}, {"29039e27fe115e6972548d03d6c44c519bce7c06eb0c290ed841d22da00300000051b35ac81607c6e43c13e284bc17ad16fcc52fba7ad42ded6f0a4c3e13e07f2cd56ce046387a0e89ee9e6d86a51e4b9a535c8174aa287e2cc40e0cab8acba2da0483d837be4650c5fffb36f0412be5d2ca63325ac4ebe0b10c951a95fca53e2d"}}}}}}, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x9c, 0x0, 0x0, 0x40000000}, {}, {0x3, 0x7}, {}, {0x0, 0x5a}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@delneigh={0x24, 0x1d, 0x1, 0x70bd25, 0x25dfdbff, {0xa, 0x0, 0x0, 0x0, 0x0, 0x1, 0xb}, [@NDA_DST_IPV4={0x8, 0x1, @private=0xa010102}]}, 0x24}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) 910.093666ms ago: executing program 2 (id=3353): r0 = syz_open_dev$loop(&(0x7f0000000040), 0xfff, 0x100) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, 0x27, 0x301, 0x270bd1d, 0x25dfdbf4, {0x20}, [@typed={0x8, 0x167, 0x0, 0x0, @pid}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000140)={0x0, {}, 0x0, {}, 0x200, 0x4, 0x10, 0x10, "f3daea722932eba910bc02fe2e9d27b8248ed767925231c35f01e27f77ab44c62b370cb7ad0668ed43f76811c7599d6996f40ef10f595f89d667f6c567c239a6", "c94fd841be0eb29701ec161f6e4801969544afada19a47796d94fa4a7a5157ad", [0x1, 0x3]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, &(0x7f00000000c0)="420f38f0ae213b0000c4017e7fb3cd650000f30f009a00500000b9360800000f3266ba400066b8f80066ef66400f3830720dc461cdc649330566b81f018ed00f014e003e3e650fe58d00000000", 0x4d}], 0x1, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x3, 0x7, 0x1, 0x41, 0x10000000c3d, 0xfffffffffffffffd, 0x2004cb, 0xffffffdfffffffff, 0xa1d, 0x5, 0x3, 0x79, 0x3, 0x1de4bd98], 0x3b384000, 0x14a82}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x1ff, 0x4, 0x1, 0x5, 0x7, 0x7, 0x7f, 0x200, 0x8, 0x2, 0xb, 0x8001, 0x7ff, 0x2, 0xfff, 0x7fffffffffffffff], 0x40000, 0x2000}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 893.713016ms ago: executing program 3 (id=3354): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f00000000c0)={'pcl711\x00', [0x100, 0x80000000, 0x2, 0x10, 0xe, 0x5, 0x79, 0xfffffff8, 0x80008, 0x0, 0x7, 0x1, 0x7, 0x2, 0x0, 0xfd, 0xfffffffb, 0x9, 0x3, 0x7fffffff, 0x489, 0x4, 0x0, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0x6, 0xffffffff, 0xfffffff8]}) pread64(r2, 0x0, 0x0, 0x2f6) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), r0) r3 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b\xba\xdf//\xdc/\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x20, r5, 0xb496be12fe179219, 0x70bd29, 0x25dfdbfd, {}, [{{0x8, 0x1, r7}, {0x4}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="cf042bbd7000fedbdf251200000008000300", @ANYRES32=r8, @ANYBLOB="0a000600ffffffffffff000008001400", @ANYRES32=r10, @ANYBLOB="a811463f66d1f822a07b7220561cc4be66cbecbd65a1812e67d34d9d8b9c4f5e89158eb38b3300000000000000d4011259ed09e5fcafaf120ee18eecdf7f01a3587004b9f217c69caf0b53056e0e17d30bde6f84fc90d85b2374"], 0x30}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r2, 0xc01c5868, &(0x7f00000005c0)={r9, &(0x7f0000000300)='//\xf2/\x06\b\xba\xdf//\xdc/\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0xfffffffffffffeef, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000002c0), 0x2000400, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000140)='./file0\x00') chdir(&(0x7f0000000240)='./file0\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x4, 0x16, &(0x7f0000000800)=ANY=[@ANYBLOB="611234000000000061134c0000000000bf2000000000000015000200000001103d030100000000009500000000000000bc26000000000000bf67000000000000070300000fff070067020000030000001606000000000078bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f909ad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305865050df26469f"], &(0x7f0000000100)='GPL\x00'}, 0x94) mount$binder(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x1000810, 0x0) 741.846536ms ago: executing program 3 (id=3357): r0 = syz_open_dev$mouse(&(0x7f0000000040), 0x0, 0x511741) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_procfs$pagemap(0x0, &(0x7f0000000140)) write$FUSE_LK(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, {{0x0, 0x122a000000}}}, 0x28) ioctl$FS_IOC_SETFLAGS(r1, 0xc0606610, &(0x7f0000000040)=0x60) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xd, &(0x7f00000002c0)=ANY=[], &(0x7f0000000440)='GPL\x00', 0x60, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r2}, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000cc0)={0x6, 0x2b, &(0x7f0000000d80)=ANY=[@ANYBLOB="18460000fdffffff000000000000000018640000060000000000000009000000185a0000060000000000000000000000b7080000000000007b8af8ff00000000b708000000f0ffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b70500000800000085000000a5", @ANYRES32=r0, @ANYBLOB, @ANYRES32, @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000008500"], &(0x7f0000000b80)='GPL\x00', 0x80000001, 0x13, &(0x7f0000000bc0)=""/19, 0x41100, 0x10, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000c40)={0x3, 0x4, 0x7, 0x7}, 0x10, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000c80)=[{0x2, 0x3, 0x5, 0xb}, {0x1, 0x5, 0xd, 0x4}, {0x0, 0x1, 0x7, 0xf}, {0x1, 0x4, 0xc, 0xa}], 0x10, 0x2566}, 0x94) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="080000000000000004000000018000006d000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80200, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r6, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/llc/socket\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) landlock_create_ruleset(&(0x7f0000000040)={0x4000, 0x3}, 0x18, 0x0) 683.74907ms ago: executing program 0 (id=3358): socket$nl_route(0x10, 0x3, 0x0) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, 0x0, 0x18015) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="3c3f47f4f66f2b7d35d82c21a9b06cda8eee6128c85bba9b8b3e1b5939f8a3001ad3794dea6d466515544e00aefe19ca8f", 0x31}], 0x1, 0x0, 0x0, 0x4040055}], 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000500)={'syz_tun\x00', &(0x7f0000000180)=@ethtool_link_settings={0x4d, 0x400, 0xf, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, [0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1]}}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000000000000000005000200fc0000000800050064000000050006"], 0x44}, 0x1, 0x0, 0x0, 0x4044851}, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000fef000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r2}, 0x64) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) r4 = memfd_create(&(0x7f0000000c40)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xb1\xea_\x8cZ7\xe7a\xdenJ\xeb\xa7\x9b\x11x\x0e\xa1\xef\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xcc\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97\x11\xac\x9e\xce\x84\xae\xb3\xe5\x87\a\b\xb0\xc2<\x80I\xe7\x10\x8f\x00\xa0\xbbP\x19\xe8I\xda=\xcam\xfdE\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`j*H\xa5\xd7i{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\xe0\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf0\xce\xb0j\x9d\'\x93\xeflI\xe2r\xe6\xa7n\xad>U\x14\xe4\xee{C\f\x94\x16\x89\x06vM\xa4\x17\x04qQ\xd0\x83\x92a^\xed\t)2\x84Z\x8f*\xe8z\x81h\xc0\xf1\xa0\x92\xc2>\x97t\xe4\xa4\xc3\xc0p\xab\xa4d\x93\xd2\xd4\x86\xd9\xe2Sm4;fc\x14\x91\"\xb9r\xedZ\xf3\x8cQ\xba\xb3nN\r\xbd\xe5\x04\xa8\xce\x99h\xf1\xa6\x18\xf1\xf7\x8cd\xee>\x16\b\xc4\xbc\xc4\x065$\x1fh\x03\x90\xaf\xfe\xf2d\xbe\x99\xd7L=\xd4^=l\xf8\x85\xdaI\x9fZ\x91\xbb\xbf4\x06\x17U\xfc\xa9\x9a\xba\x82)\x930\x9b j\x16\xb5\x18J\x9c~K~HV\xdc2\xec{\x17\xfc\x96n\x15\xe2\xae\xa8PE\xae\x98iOBO\t\xd0\x92\x1d\x17\xa7\xae\xfb\x1aK\xb5\xc3\xfb\xff\xff\xff\"d\xac\x9c=d\xdc\xe3\x92\x98Q\xca\xd8\xa3}\xc7\x16\x8ae\x1fX\xfa\b\r\xae\xb7\xba\rw\xec\x9c\xe1\x92\xc6|\xe7\xed\xe5\x04\xd2\xe3S\xc7\xb1\xc7\x8dE\x1a]\xa6\xfdW\xb73ms:\xac\x9cn\x87\x19\xe6\xbd\xdc\xcb\x85i\x9a,\xe1\xb3\x81@\x0e>\xd1]O\xec\xf9y\xe7\xd6\xee\xc2\xf6\xd8\xfa\x8ck\x83;\xeb\"\x02\xf3\xe5\xcbB\x89\xf1B\xa4\x04\xf5\xc6%\xd4\xea\xb3\x93\\\xdcM\xa1\a\x00\x00\x00\xb0Z\x84(\xec\xf2\x91\xf3\rG&\a\x18Y\xaf\xb9\f\xd6|\xea\xe0\xbdw\xed\xa7\xbd\xa9\xe2\x8a\x16\x1e\x1f\xf5rj\x8aK\xdc@\xedV\x86\x18Z(\n\x99_\xa8\xf5Z\xce\xae9\xc6\x92\x8a]!]\x89\xc7\xb6\xb8\xdc\x10#r>\x90N~\xddd\x93\x0f\x89\xde\x80\xee\xd0\xf3\xff\x83\xde\x8e\xf0\xcb1\x1b\xb6r#\x8f\xd0\x948\xe8\x19~\x13b\xd4\xa7\xd7\tv--\xec\x8c\xcb\xcd\xc1d\xe9o:\xf0\xf1W\xbd\xcb<\x90\x10t:\x97.jw\x8fm\xbd\xbc@?\xa8\xa5\xaa\xae2\xfb\x91\xa0\x19-}\xc2V\xbb\xd3K\x9b0\x03\xecU~\xcfA\xdcK \xedPX\x02L\"M2=\n\xa6\x9c*I-\xa1\xad\xd0\xa3\x0f\x04T\x84\xe5nj\xdbh\x99\xbak\x17\xcb\xbc/\xd4\xcfZ\x96\xb8\x00\xd6\x91\xa0@\xaac\xecUP\xd5\xd3\x00\x00', 0xb) fcntl$addseals(r4, 0x409, 0x7) ftruncate(r4, 0x600000) write(r3, &(0x7f0000000300)='rt1719 0x49\x00', 0xc) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/graphics/fbcon/rotate_all\x00', 0x1, 0x0) write(r5, &(0x7f00000000c0)='1\x00', 0x2) 490.623957ms ago: executing program 4 (id=3359): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) keyctl$KEYCTL_MOVE(0x1e, r0, r0, r0, 0x1) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1200000, 0xffffffff}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x3, 0x0, [{0x1b, 0x0, 0xfee00c00}, {0x832, 0x0, 0x40000}, {0x6e0, 0x0, 0x87a9}]}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000280)='dummy_udc.0\n', 0xc) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r4, 0x84, 0x16, &(0x7f0000000040)=ANY=[@ANYBLOB="05000000"], 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, 0x9, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x8}, [@IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_COMMENT={0x5, 0x1a, '\x00'}, @IPSET_ATTR_NAMEREF={0x9, 0x13, 'syz1\x00'}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x3}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x80000001}, @IPSET_ATTR_PACKETS={0xffffffffffffff31, 0x19, 0x1, 0x0, 0x7a}]}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_SKBQUEUE={0x6, 0x1d, 0x1, 0x0, 0x6}]}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x6b6d}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x70}, 0x1, 0x0, 0x0, 0x4}, 0x1) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCADDRT(r6, 0x890b, &(0x7f0000000540)={@mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8240022a}) r7 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet_sctp(r7, &(0x7f0000002a00)=[{&(0x7f0000000100)=@in={0x2, 0x100, @private=0xa0101e0}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000080)="14850c", 0x3}], 0x1, &(0x7f0000000000)=[@sndrcv={0x2c, 0x84, 0x1, {0x0, 0x0, 0x9, 0x0, 0x0, 0x4}}], 0x2c}], 0x1, 0x40) inotify_add_watch(r3, &(0x7f00000006c0)='.\x00', 0x400000ea) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r8, 0x84, 0x9, &(0x7f0000000940)={0x0, @in6={{0xa, 0x4e20, 0x10001, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3}}, 0x5, 0x5, 0x8, 0x0, 0xbc, 0x7, 0x5}, &(0x7f0000000a00)=0x9c) readv(r1, &(0x7f0000000700)=[{&(0x7f0000000140)=""/48, 0x30}, {&(0x7f0000000580)=""/42, 0x2a}], 0x2) 0s ago: executing program 3 (id=3360): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000700), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)={0x2c, r1, 0x1, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x1}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1374}]}, 0x2c}}, 0x880) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r4, &(0x7f0000000000)={0x13, 0x10, 0x10f, {0xffffffffffffffff, r5, 0x1}}, 0x18) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)={{0x14}, [], {0x14}}, 0x28}}, 0x0) kernel console output (not intermixed with test programs): mily 0 port 6081 - 0 [ 686.739962][T16081] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2879'. [ 686.817109][ T5896] usb 8-1: new high-speed USB device number 104 using dummy_hcd [ 686.822648][T16082] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2879'. [ 686.873629][ T9] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 686.930782][ T9846] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.939478][ T9846] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.960738][ T9846] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.981080][ T5896] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 686.984766][ T5896] usb 8-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 686.989539][ T5896] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 687.032182][T16076] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 687.041683][ T5896] opticon 8-1:1.0: opticon converter detected [ 687.042737][ T9846] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 687.115407][ T5896] usb 8-1: opticon converter now attached to ttyUSB0 [ 687.471564][T16085] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2880'. [ 687.508963][ T9] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 687.744853][T16086] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2880'. [ 688.187221][ T9] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 688.223790][T16089] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2881'. [ 688.391893][T16091] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2881'. [ 688.482046][ T9] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 688.486311][ T9] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 688.494017][ T9] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 688.498201][ T9] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 688.501458][ T9] usb 9-1: Manufacturer: syz [ 688.505262][ T9] usb 9-1: config 0 descriptor?? [ 688.809825][T16093] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 688.811917][T16093] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 688.814798][T16093] vhci_hcd vhci_hcd.0: Device attached [ 688.838526][T16093] rdma_rxe: rxe_newlink: failed to add wg2 [ 688.844370][T16096] vhci_hcd: connection closed [ 688.845319][ T9846] vhci_hcd vhci_hcd.0: stop threads [ 688.858474][ T9846] vhci_hcd vhci_hcd.0: release socket [ 688.861155][ T9846] vhci_hcd vhci_hcd.0: disconnect device [ 688.877009][ T9] rc_core: IR keymap rc-hauppauge not found [ 688.879444][ T9] Registered IR keymap rc-empty [ 688.881145][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 688.907005][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 688.927622][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 688.933220][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input53 [ 688.939363][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 688.967463][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 688.987079][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 689.017018][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 689.047257][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 689.077044][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 689.107320][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 689.127384][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 689.157984][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 689.187931][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 689.234139][ T9] mceusb 9-1:0.0: Registered with mce emulator interface version 1 [ 689.242027][ T9] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 689.261013][ T9] usb 9-1: USB disconnect, device number 65 [ 689.645876][T16103] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(7) [ 689.647977][T16103] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 689.653538][T16103] vhci_hcd vhci_hcd.0: Device attached [ 689.937264][ T5896] usb 42-1: SetAddress Request (22) to port 0 [ 689.939367][ T5896] usb 42-1: new SuperSpeed USB device number 22 using vhci_hcd [ 689.997615][T16103] rdma_rxe: rxe_newlink: failed to add wg2 [ 690.210469][T16108] vhci_hcd: connection reset by peer [ 690.216459][ T9846] vhci_hcd vhci_hcd.2: stop threads [ 690.220403][ T9846] vhci_hcd vhci_hcd.2: release socket [ 690.225340][ T9846] vhci_hcd vhci_hcd.2: disconnect device [ 690.558984][T16115] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2887'. [ 690.658794][T16116] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2887'. [ 690.774384][T16119] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2888'. [ 690.812708][T16119] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 690.960248][T16119] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.017660][T16119] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.157073][ T55] usb 9-1: new high-speed USB device number 66 using dummy_hcd [ 691.313157][ T55] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 691.325153][ T55] usb 9-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 691.329791][ T55] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 691.366631][T16121] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 691.399750][ T55] opticon 9-1:1.0: opticon converter detected [ 691.489032][T16119] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.521066][ T55] usb 9-1: opticon converter now attached to ttyUSB1 [ 691.639593][T16123] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2889'. [ 691.702504][T16125] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2889'. [ 691.806869][ T9846] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.967536][ T9846] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.007191][ T9846] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.017269][ T9846] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.777168][ T7142] usb 8-1: USB disconnect, device number 104 [ 692.827212][ T7142] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 692.834807][ T7142] opticon 8-1:1.0: device disconnected [ 693.193540][ T24] libceph: connect (1)[c::]:6789 error -101 [ 693.195714][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 693.197237][T16139] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 693.199675][T16139] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 693.202274][T16139] vhci_hcd vhci_hcd.0: Device attached [ 693.210390][T16139] rdma_rxe: rxe_newlink: failed to add wg2 [ 693.214395][T16147] vhci_hcd: connection closed [ 693.214638][ T9846] vhci_hcd vhci_hcd.3: stop threads [ 693.219016][ T9846] vhci_hcd vhci_hcd.3: release socket [ 693.240455][T16142] ceph: No mds server is up or the cluster is laggy [ 693.250191][ T9846] vhci_hcd vhci_hcd.3: disconnect device [ 693.819134][ T24] usb 9-1: USB disconnect, device number 66 [ 693.832944][ T24] opticon ttyUSB1: opticon converter now disconnected from ttyUSB1 [ 693.849124][ T24] opticon 9-1:1.0: device disconnected [ 693.870466][T16154] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2897'. [ 693.894751][T16154] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 694.066300][T16158] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 694.070780][T16158] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 694.663347][T16166] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 694.769473][T16154] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 695.002679][ T5896] usb 42-1: device descriptor read/8, error -110 [ 695.110963][T16154] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 695.387047][ T9] usb 9-1: new high-speed USB device number 67 using dummy_hcd [ 695.387911][ T5896] usb usb42-port1: attempt power cycle [ 695.415054][T16154] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 695.686993][ T9] usb 9-1: Using ep0 maxpacket: 16 [ 695.687138][T15650] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 695.691481][ T9] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 695.691523][T15650] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 695.694728][ T9] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 695.697426][T15650] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 695.700783][ T9] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 695.703799][T15650] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 695.706401][ T9] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 695.706417][ T9] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 695.707622][ T9] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 695.724730][ T9] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 695.727400][ T9] usb 9-1: Manufacturer: syz [ 695.730593][ T9] usb 9-1: config 0 descriptor?? [ 695.958190][ T5896] usb usb42-port1: unable to enumerate USB device [ 695.987007][ T9] rc_core: IR keymap rc-hauppauge not found [ 695.989936][ T9] Registered IR keymap rc-empty [ 695.992477][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.007173][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.028257][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 696.034849][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input54 [ 696.042814][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.057088][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.077044][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.097088][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.117730][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.137237][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.157085][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.177133][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.200228][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.288705][ T9] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 696.318061][ T9] mceusb 9-1:0.0: Registered with mce emulator interface version 1 [ 696.330312][ T9] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 696.341448][ T9] usb 9-1: USB disconnect, device number 67 [ 696.526304][T16188] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 696.654971][T16192] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 696.657091][T16192] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 696.660133][T16192] vhci_hcd vhci_hcd.0: Device attached [ 696.701534][T16192] syz2: rxe_newlink: already configured on wg2 [ 696.872699][ T9] libceph: connect (1)[c::]:6789 error -101 [ 696.875520][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 696.916298][T16199] ceph: No mds server is up or the cluster is laggy [ 696.960932][ T5896] usb 46-1: SetAddress Request (34) to port 0 [ 696.963092][ T5896] usb 46-1: new SuperSpeed USB device number 34 using vhci_hcd [ 697.404578][T16193] vhci_hcd: connection reset by peer [ 697.406846][T15650] vhci_hcd vhci_hcd.4: stop threads [ 697.408667][T15650] vhci_hcd vhci_hcd.4: release socket [ 697.410521][T15650] vhci_hcd vhci_hcd.4: disconnect device [ 697.667985][T16204] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2910'. [ 697.742612][T16207] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2910'. [ 698.731425][T16214] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2913'. [ 698.735708][T16210] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 698.752643][T16214] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.813178][T16214] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.976224][T16214] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.021620][T16224] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2916'. [ 699.134783][T16214] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.158871][ T24] usb 9-1: new high-speed USB device number 68 using dummy_hcd [ 699.290615][T16225] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2916'. [ 699.449294][ T5753] usb 7-1: new high-speed USB device number 97 using dummy_hcd [ 699.647365][T15650] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.678532][ T5753] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 699.690759][ T5753] usb 7-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 699.706392][ T5753] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 699.727152][T15650] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.765401][T16222] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 699.788935][ T5753] opticon 7-1:1.0: opticon converter detected [ 699.895270][ T5753] usb 7-1: opticon converter now attached to ttyUSB0 [ 699.907748][T15650] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.914807][T15650] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 700.307567][ T24] usb 9-1: Using ep0 maxpacket: 16 [ 700.688078][ T24] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 700.974956][T16232] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2919'. [ 701.163288][T16234] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 701.171352][T16234] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 701.312193][ T24] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 701.320763][ T24] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 701.324077][ T24] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 701.327616][ T24] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 701.333732][ T24] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 701.337565][ T24] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 701.340814][T16232] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 701.342681][ T24] usb 9-1: Manufacturer: syz [ 701.361770][ T24] usb 9-1: config 0 descriptor?? [ 701.489503][T16232] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 701.687717][ T24] rc_core: IR keymap rc-hauppauge not found [ 701.694475][ T24] Registered IR keymap rc-empty [ 701.700994][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.727122][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.748061][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 701.758027][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input55 [ 701.764402][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.767434][T16232] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 701.776991][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.797057][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.817701][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.832875][T16232] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 701.846982][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.867073][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.887097][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.907055][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.946996][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.947051][ T9846] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.957238][ T9846] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.967005][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 701.967019][ T9846] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.972375][ T9846] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.988104][ T24] mceusb 9-1:0.0: Registered with mce emulator interface version 1 [ 701.990735][ T24] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 701.995424][ T24] usb 9-1: USB disconnect, device number 68 [ 701.997083][T11753] usb 8-1: new high-speed USB device number 105 using dummy_hcd [ 702.047729][ T5896] usb 46-1: device descriptor read/8, error -110 [ 702.156999][T11753] usb 8-1: Using ep0 maxpacket: 16 [ 702.161280][T11753] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 702.166853][T11753] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 702.170816][T11753] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 702.177303][T11753] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 702.181242][T11753] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 702.184443][T11753] usb 8-1: Manufacturer: syz [ 702.191484][T11753] usb 8-1: config 0 descriptor?? [ 702.245436][T16243] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 702.447839][ T5896] usb usb46-port1: attempt power cycle [ 702.471580][T16246] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2923'. [ 702.477873][T16246] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 702.590942][T16246] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 702.689694][T16246] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 702.745570][T16246] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 702.847239][ T1482] usb 9-1: new high-speed USB device number 69 using dummy_hcd [ 702.857030][ T9846] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 702.859807][ T9846] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 702.862941][ T9846] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 702.867617][ T9846] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 702.999572][ T1482] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 703.002798][ T1482] usb 9-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 703.005656][ T1482] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 703.012645][T16248] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 703.016873][ T1482] opticon 9-1:1.0: opticon converter detected [ 703.021586][ T1482] usb 9-1: opticon converter now attached to ttyUSB1 [ 703.157977][ T5896] usb usb46-port1: unable to enumerate USB device [ 704.759895][ T9] usb 8-1: USB disconnect, device number 105 [ 704.832884][T16254] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 704.906173][T16257] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2926'. [ 704.994951][T16258] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2926'. [ 705.198001][T16261] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2927'. [ 705.261965][T16262] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2927'. [ 705.363186][ T1482] usb 7-1: USB disconnect, device number 97 [ 705.488795][ T1482] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 705.508928][ T1482] opticon 7-1:1.0: device disconnected [ 706.358217][ T9] usb 7-1: new high-speed USB device number 98 using dummy_hcd [ 706.394168][T11753] usb 9-1: USB disconnect, device number 69 [ 706.418081][T11753] opticon ttyUSB1: opticon converter now disconnected from ttyUSB1 [ 706.423698][T11753] opticon 9-1:1.0: device disconnected [ 706.517310][ T9] usb 7-1: Using ep0 maxpacket: 16 [ 706.520910][ T9] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 706.524192][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 706.528134][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 706.532400][ T9] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 706.535454][ T9] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 706.540652][ T9] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 706.544038][ T9] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 706.546561][ T9] usb 7-1: Manufacturer: syz [ 706.551294][ T9] usb 7-1: config 0 descriptor?? [ 706.807156][ T9] rc_core: IR keymap rc-hauppauge not found [ 706.809114][ T9] Registered IR keymap rc-empty [ 706.810787][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 706.827194][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 706.857597][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0 [ 706.862823][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0/input56 [ 706.868610][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 706.887076][ T1482] usb 9-1: new high-speed USB device number 70 using dummy_hcd [ 706.897049][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 706.917137][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 706.937117][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 706.957322][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 706.979279][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 707.007176][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 707.027080][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 707.037002][ T1482] usb 9-1: Using ep0 maxpacket: 16 [ 707.047160][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 707.051377][ T1482] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 707.067010][ T1482] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 707.067115][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 707.070429][ T1482] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 707.071488][ T1482] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 707.081207][ T1482] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 707.083979][ T1482] usb 9-1: Manufacturer: syz [ 707.089343][ T1482] usb 9-1: config 0 descriptor?? [ 707.090967][ T9] mceusb 7-1:0.0: Registered with mce emulator interface version 1 [ 707.100897][ T9] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 707.122679][T16286] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2935'. [ 707.133498][ T9] usb 7-1: USB disconnect, device number 98 [ 707.210030][T16287] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2935'. [ 707.331854][T16290] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 707.777396][T16298] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2939'. [ 707.789650][T16300] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2938'. [ 707.850862][T16301] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2939'. [ 707.858561][T16302] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2938'. [ 709.823485][ T9387] usb 9-1: USB disconnect, device number 70 [ 709.932769][T16320] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 709.981421][T16325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 709.984672][T16325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 710.185081][T16320] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 710.237007][ T9387] usb 9-1: new high-speed USB device number 71 using dummy_hcd [ 710.444887][T16320] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 710.481331][T16329] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 710.513765][T16320] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 710.578836][ T9387] usb 9-1: Using ep0 maxpacket: 16 [ 710.582206][ T9387] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 710.585405][ T9387] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 710.588899][ T9387] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 710.591934][ T9387] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 710.594957][ T9387] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 710.600332][ T9387] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 710.603221][ T9387] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 710.605707][ T9387] usb 9-1: Manufacturer: syz [ 710.607030][ T9846] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.608586][ T9387] usb 9-1: config 0 descriptor?? [ 710.610994][ T9846] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.627161][ T9846] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.637300][ T9846] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.877015][ T9387] rc_core: IR keymap rc-hauppauge not found [ 710.878926][ T9387] Registered IR keymap rc-empty [ 710.880666][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 710.907118][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 710.928097][ T9387] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 710.934286][ T9387] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input57 [ 710.939603][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 710.967031][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 710.987155][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 711.017083][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 711.037064][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 711.057168][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 711.077067][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 711.097153][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 711.117118][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 711.137115][ T9387] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 711.159073][ T9387] mceusb 9-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 711.162801][ T9387] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 711.168312][ T9387] usb 9-1: USB disconnect, device number 71 [ 711.224751][T16334] __nla_validate_parse: 5 callbacks suppressed [ 711.224771][T16334] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2949'. [ 711.249508][T16334] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.323861][T16334] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.412730][T16334] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.563230][T16334] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.601736][T16344] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2952'. [ 711.606712][T16344] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.704276][ T7142] usb 8-1: new high-speed USB device number 106 using dummy_hcd [ 711.759256][T16344] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.947347][T15650] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 711.951592][ T7142] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 711.988389][ T7142] usb 8-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 711.989136][T16344] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 712.056613][ T7142] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 712.077416][T10898] usb 9-1: new high-speed USB device number 72 using dummy_hcd [ 712.182935][T16340] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 712.184747][T16344] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 712.229761][ T7142] opticon 8-1:1.0: opticon converter detected [ 712.302018][T10898] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 712.324571][ T7142] usb 8-1: opticon converter now attached to ttyUSB0 [ 712.336191][T10898] usb 9-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 712.340361][T15650] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.382905][T10898] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 712.491488][T15650] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.530915][T15650] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.534129][T16347] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 712.631984][T10898] opticon 9-1:1.0: opticon converter detected [ 712.682013][T10898] usb 9-1: opticon converter now attached to ttyUSB1 [ 712.969863][T15650] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.984560][T15650] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 713.055394][T15650] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 713.085893][T15650] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 714.497716][T16357] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2954'. [ 714.600152][T16358] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2954'. [ 715.370034][T11753] usb 9-1: USB disconnect, device number 72 [ 715.376546][T11753] opticon ttyUSB1: opticon converter now disconnected from ttyUSB1 [ 715.380073][T11753] opticon 9-1:1.0: device disconnected [ 715.808044][T16368] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 715.810184][T16368] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 715.812925][T16368] vhci_hcd vhci_hcd.0: Device attached [ 715.848012][T16368] syz2: rxe_newlink: already configured on wg2 [ 715.853251][T16372] vhci_hcd: connection closed [ 715.860324][T15650] vhci_hcd vhci_hcd.4: stop threads [ 715.866416][T15650] vhci_hcd vhci_hcd.4: release socket [ 715.870553][T15650] vhci_hcd vhci_hcd.4: disconnect device [ 716.031472][T16375] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2958'. [ 716.138716][T16376] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2958'. [ 716.648916][T16379] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 716.667249][T16379] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 717.235895][T16389] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2963'. [ 717.244062][T16389] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.369597][T16389] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.523359][T16394] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 717.528185][T16394] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 717.610283][T16389] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.713377][T16389] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.887120][T15650] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 717.890645][T15650] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 717.897324][T15650] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.071791][ T5896] usb 8-1: USB disconnect, device number 106 [ 718.084471][ T5896] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 718.091296][ T5896] opticon 8-1:1.0: device disconnected [ 718.097296][T15650] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.183192][T16402] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2967'. [ 718.680899][T16416] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2973'. [ 718.688399][T16416] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 718.744727][T16416] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 718.818781][T16416] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 718.880046][T11753] usb 8-1: new high-speed USB device number 107 using dummy_hcd [ 718.935307][T16416] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 719.037018][T11753] usb 8-1: Using ep0 maxpacket: 16 [ 719.042838][T11753] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 719.047519][T11753] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 719.052846][T11753] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 719.056802][T11753] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 719.061967][T11753] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 719.069787][T11753] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 719.073667][T11753] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 719.077618][T11753] usb 8-1: Manufacturer: syz [ 719.082130][T11753] usb 8-1: config 0 descriptor?? [ 719.466210][T15650] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 719.517277][ T9846] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 719.520880][ T9846] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 719.524431][ T9846] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 719.527033][ T9387] usb 9-1: new high-speed USB device number 73 using dummy_hcd [ 719.597039][T11753] rc_core: IR keymap rc-hauppauge not found [ 719.598954][T11753] Registered IR keymap rc-empty [ 719.600651][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 719.627153][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 719.647935][T11753] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0 [ 719.652668][T11753] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0/input58 [ 719.659137][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 719.677051][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 719.693328][ T9387] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 719.696830][ T9387] usb 9-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 719.697421][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 719.702881][ T9387] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 719.713197][T16433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2976'. [ 719.717066][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 719.736405][T16433] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 719.738581][T16420] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 719.740611][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 719.755957][ T9387] opticon 9-1:1.0: opticon converter detected [ 719.775039][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 719.798764][ T9387] usb 9-1: opticon converter now attached to ttyUSB0 [ 719.844995][T16433] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 719.858746][T16435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 719.863516][T16435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 720.082328][T16433] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 720.251891][T16433] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 720.385663][T16438] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2977'. [ 720.409730][T16438] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 720.453061][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 720.538590][T16438] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.023105][T16438] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.067058][ T1482] usb 7-1: new high-speed USB device number 99 using dummy_hcd [ 721.230167][ T1482] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 721.317214][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 721.327212][T16438] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.436120][ T1482] usb 7-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 721.443831][ T1482] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 721.456289][T16440] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 721.472897][ T1482] opticon 7-1:1.0: opticon converter detected [ 721.486282][ T1482] usb 7-1: opticon converter now attached to ttyUSB1 [ 721.789372][T15650] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.928397][ T9846] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.978202][ T9846] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.989996][ T9846] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 722.047063][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 722.137927][T10898] usb 9-1: USB disconnect, device number 73 [ 722.213923][T10898] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 722.235603][T10898] opticon 9-1:1.0: device disconnected [ 722.457054][T11753] mceusb 8-1:0.0: Error: mce write submit urb error = -90 [ 722.608175][T11753] mceusb 8-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 722.616549][T11753] mceusb 8-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 722.622858][T11753] usb 8-1: USB disconnect, device number 107 [ 722.830345][T16449] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2979'. [ 723.316993][T13043] Bluetooth: hci2: command 0x0406 tx timeout [ 723.637761][ T9846] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.645996][ T9846] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.652031][ T9846] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.657828][ T9846] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.852403][ T5753] usb 7-1: USB disconnect, device number 99 [ 723.884379][ T5753] opticon ttyUSB1: opticon converter now disconnected from ttyUSB1 [ 723.893468][ T5753] opticon 7-1:1.0: device disconnected [ 723.993159][T16465] ehci-pci 0000:00:1d.7: remove, state 1 [ 724.000745][T16465] usb usb2: USB disconnect, device number 1 [ 724.003549][T16465] usb 2-1: USB disconnect, device number 2 [ 724.163258][T16465] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 724.237021][ T7142] usb 9-1: new high-speed USB device number 74 using dummy_hcd [ 724.406995][ T7142] usb 9-1: Using ep0 maxpacket: 16 [ 724.410669][ T7142] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 724.414005][ T7142] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 724.418670][ T7142] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 724.421755][ T7142] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 724.424811][ T7142] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 724.430528][ T7142] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 724.433435][ T7142] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 724.436046][ T7142] usb 9-1: Manufacturer: syz [ 724.439084][T16468] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 724.440538][ T7142] usb 9-1: config 0 descriptor?? [ 724.448657][T16468] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 724.454361][T16468] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 724.467131][T16468] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 724.475694][T16468] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 724.478829][T16468] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 724.482636][T16468] usb usb2: Product: EHCI Host Controller [ 724.484467][T16468] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 724.486726][T16468] usb usb2: SerialNumber: 0000:00:1d.7 [ 724.498641][T16468] hub 2-0:1.0: USB hub found [ 724.504937][T16468] hub 2-0:1.0: 6 ports detected [ 724.549926][T16468] hub 1-0:1.0: USB hub found [ 724.554845][T16468] hub 1-0:1.0: 2 ports detected [ 724.604097][T16468] hub 3-0:1.0: USB hub found [ 724.619738][T16468] hub 3-0:1.0: 2 ports detected [ 724.664107][T16468] hub 4-0:1.0: USB hub found [ 724.666671][T16468] hub 4-0:1.0: 2 ports detected [ 724.717483][T16477] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2988'. [ 724.726625][T16477] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 724.787019][ T846] usb 2-1: new high-speed USB device number 2 using ehci-pci [ 724.858225][ T7142] rc_core: IR keymap rc-hauppauge not found [ 724.860776][ T7142] Registered IR keymap rc-empty [ 724.862466][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 724.886982][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 724.890398][T16477] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 724.922569][ T7142] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 725.169863][ T7142] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input59 [ 725.196822][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 725.204550][T16487] netlink: 'syz.0.2990': attribute type 49 has an invalid length. [ 725.217519][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 725.247691][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 725.267020][ T24] usb 8-1: new high-speed USB device number 108 using dummy_hcd [ 725.277452][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 725.307670][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 725.337314][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 725.357358][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 725.387385][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 725.409196][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 725.422881][ T24] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 725.427855][ T7142] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 725.430450][ T24] usb 8-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 725.433389][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 725.440690][T16481] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 725.445808][ T24] opticon 8-1:1.0: opticon converter detected [ 725.454517][ T24] usb 8-1: opticon converter now attached to ttyUSB0 [ 725.472439][ T7142] mceusb 9-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 725.475585][ T7142] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 725.503486][ T7142] usb 9-1: USB disconnect, device number 74 [ 725.506810][T16493] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2991'. [ 725.764351][ T846] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 725.768152][ T846] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 725.771450][ T846] usb 2-1: Product: QEMU USB Tablet [ 725.773716][ T846] usb 2-1: Manufacturer: QEMU [ 725.774341][T16487] ip6gretap0: entered promiscuous mode [ 725.775612][ T846] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 725.787636][T16487] ip6gretap0: entered allmulticast mode [ 725.804673][ T846] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb2/2-1/2-1:1.0/0003:0627:0001.0002/input/input60 [ 725.831496][T16488] netlink: 'syz.0.2990': attribute type 2 has an invalid length. [ 725.921316][ T846] hid-generic 0003:0627:0001.0002: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 726.141268][T16477] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 726.149996][ T7142] usb 9-1: new high-speed USB device number 75 using dummy_hcd [ 726.194570][T16493] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 726.255971][T16477] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 726.342078][ T7142] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 726.351865][ T7142] usb 9-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 726.367197][ T7142] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 726.413239][T16501] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 726.441978][ T7142] opticon 9-1:1.0: opticon converter detected [ 726.490499][ T7142] usb 9-1: opticon converter now attached to ttyUSB1 [ 726.840834][T16510] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2994'. [ 726.888856][T16493] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.320306][ T55] usb 7-1: new high-speed USB device number 100 using dummy_hcd [ 727.499508][ T55] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 727.503312][ T55] usb 7-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 727.509186][ T55] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 727.537923][T16512] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 727.571523][ T55] opticon 7-1:1.0: opticon converter detected [ 727.582735][T16510] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.629169][ T55] usb 7-1: opticon converter now attached to ttyUSB2 [ 727.732182][T16493] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.948949][T16518] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2995'. [ 728.113676][T16510] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.139555][T16493] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.169932][T16518] syzkaller1: entered promiscuous mode [ 728.173240][T16518] syzkaller1: entered allmulticast mode [ 728.194659][T16510] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.257114][T15650] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.262470][T15650] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.269775][T15650] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.297369][T15650] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.303620][T16510] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.668257][T15650] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.681573][T15650] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.686356][T15650] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.689009][ T9] usb 9-1: USB disconnect, device number 75 [ 728.710128][ T9] opticon ttyUSB1: opticon converter now disconnected from ttyUSB1 [ 728.713906][ T9] opticon 9-1:1.0: device disconnected [ 728.747362][T15650] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.751071][T15650] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.838216][ T9846] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.841782][ T9846] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.845553][ T9846] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.954793][T16534] 9p: Bad value for 'rfdno' [ 729.810590][T16546] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 729.813128][T16546] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 729.816434][T16546] vhci_hcd vhci_hcd.0: Device attached [ 729.831803][T16546] rdma_rxe: rxe_newlink: failed to add wg2 [ 729.913573][ T9387] usb 7-1: USB disconnect, device number 100 [ 729.919255][ T9387] opticon ttyUSB2: opticon converter now disconnected from ttyUSB2 [ 729.927480][ T9387] opticon 7-1:1.0: device disconnected [ 729.960964][T16551] kAFS: No cell specified [ 730.067011][ T42] audit: type=1804 audit(1785954041.986:145): pid=16554 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.3001" name="/newroot/59/merge/file" dev="overlay" ino=348 res=1 errno=0 [ 730.087094][ T24] usb 38-1: SetAddress Request (50) to port 0 [ 730.089065][ T24] usb 38-1: new SuperSpeed USB device number 50 using vhci_hcd [ 730.274834][T16559] siw: device registration error -23 [ 730.278651][ T42] audit: type=1800 audit(1785954042.246:146): pid=16559 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3003" name="attr_allow_any_host" dev="configfs" ino=100174 res=0 errno=0 [ 730.292579][ T42] audit: type=1800 audit(1785954042.246:147): pid=16559 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3003" name="device_path" dev="configfs" ino=100175 res=0 errno=0 [ 730.314474][T16559] wg2 speed is unknown, defaulting to 1000 [ 730.445140][T16547] vhci_hcd: connection reset by peer [ 730.457002][T15650] vhci_hcd vhci_hcd.0: stop threads [ 730.459026][T15650] vhci_hcd vhci_hcd.0: release socket [ 730.462463][T15650] vhci_hcd vhci_hcd.0: disconnect device [ 730.658599][T16564] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 730.847910][ T5896] usb 8-1: USB disconnect, device number 108 [ 730.893613][ T5896] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 731.164194][ T5896] opticon 8-1:1.0: device disconnected [ 731.418833][T16582] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 731.422339][T16582] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 731.739534][T16587] vxcan0: tx address claim with dest, not broadcast [ 731.789754][ T42] audit: type=1804 audit(1785954043.756:148): pid=16589 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.3011" name="/newroot/447/merge/file" dev="overlay" ino=2582 res=1 errno=0 [ 732.043324][T16598] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 732.437451][ T42] audit: type=1804 audit(1785954044.396:149): pid=16609 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.3016" name="/newroot/290/merge/file" dev="overlay" ino=1623 res=1 errno=0 [ 732.656816][T16616] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3027'. [ 732.840171][ T42] audit: type=1804 audit(1785954044.806:150): pid=16620 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.3020" name="/newroot/104/merge/file" dev="overlay" ino=577 res=1 errno=0 [ 733.187004][ T55] usb 8-1: new full-speed USB device number 109 using dummy_hcd [ 733.348963][ T55] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 733.352211][ T55] usb 8-1: config 0 interface 0 has no altsetting 0 [ 733.356210][ T55] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 733.363480][ T55] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 733.369541][ T55] usb 8-1: Product: syz [ 733.370948][ T55] usb 8-1: Manufacturer: syz [ 733.375026][ T55] usb 8-1: SerialNumber: syz [ 733.431547][ T55] usb 8-1: config 0 descriptor?? [ 733.448977][ T55] usb 8-1: selecting invalid altsetting 0 [ 733.563734][T16639] netlink: 'syz.2.3035': attribute type 49 has an invalid length. [ 733.568072][T16639] netlink: 'syz.2.3035': attribute type 2 has an invalid length. [ 733.639334][ T1482] usb 8-1: USB disconnect, device number 109 [ 733.904616][T16643] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3029'. [ 733.980773][T16646] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3029'. [ 734.327915][T16652] overlayfs: failed to resolve './lower': -2 [ 734.421050][T16654] overlayfs: failed to resolve './lower': -2 [ 734.802128][T16660] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 734.804152][T16660] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 734.806787][T16660] vhci_hcd vhci_hcd.0: Device attached [ 734.913943][T16660] rdma_rxe: rxe_newlink: failed to add wg2 [ 734.944705][T16669] netlink: 'syz.4.3037': attribute type 49 has an invalid length. [ 734.952540][T16669] netlink: 'syz.4.3037': attribute type 2 has an invalid length. [ 735.246881][T16674] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 735.249181][T16674] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 735.251929][T16674] vhci_hcd vhci_hcd.0: Device attached [ 735.262672][T16674] rdma_rxe: rxe_newlink: failed to add wg2 [ 735.365163][T16663] vhci_hcd: connection reset by peer [ 735.368734][ T9846] vhci_hcd vhci_hcd.0: stop threads [ 735.370471][ T9846] vhci_hcd vhci_hcd.0: release socket [ 735.373550][ T24] usb 38-1: device descriptor read/8, error -110 [ 735.373803][ T9846] vhci_hcd vhci_hcd.0: disconnect device [ 735.418614][T16676] usb usb1: usbfs: interface 0 claimed by hub while 'syz.4.3039' sets config #24 [ 735.549473][ T55] usb 42-1: SetAddress Request (26) to port 0 [ 735.551533][ T55] usb 42-1: new SuperSpeed USB device number 26 using vhci_hcd [ 735.717476][T16694] overlayfs: failed to resolve './lower': -2 [ 735.799361][T16697] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3044'. [ 735.898229][T16698] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3044'. [ 735.914755][ T24] usb usb38-port1: attempt power cycle [ 736.007678][T16678] vhci_hcd: connection reset by peer [ 736.009778][ T9846] vhci_hcd vhci_hcd.2: stop threads [ 736.011678][ T9846] vhci_hcd vhci_hcd.2: release socket [ 736.013450][ T9846] vhci_hcd vhci_hcd.2: disconnect device [ 736.258989][T16701] overlayfs: failed to resolve './lower': -2 [ 736.511296][ T24] usb usb38-port1: unable to enumerate USB device [ 736.642138][ T42] audit: type=1804 audit(1785954048.606:151): pid=16712 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.3048" name="/newroot/112/merge/file" dev="overlay" ino=630 res=1 errno=0 [ 736.787724][T16713] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 736.789833][T16713] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 736.798583][T16713] vhci_hcd vhci_hcd.0: Device attached [ 736.830317][T16723] overlayfs: failed to resolve './lower': -2 [ 736.836582][T16721] syzkaller0: entered promiscuous mode [ 736.840109][T16721] syzkaller0: entered allmulticast mode [ 736.842217][T16713] syz2: rxe_newlink: already configured on wg2 [ 736.874138][T16725] overlayfs: failed to resolve './lower': -2 [ 736.880715][T16727] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3053'. [ 736.886515][T16727] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 736.910731][T16729] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3055'. [ 736.980564][T16727] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 737.069143][T16727] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 737.097027][T14471] usb 8-1: new high-speed USB device number 110 using dummy_hcd [ 737.100794][T16731] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3055'. [ 737.149845][T16727] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 737.207098][ T1482] usb 46-1: SetAddress Request (38) to port 0 [ 737.209042][ T1482] usb 46-1: new SuperSpeed USB device number 38 using vhci_hcd [ 737.261049][T14471] usb 8-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 737.264954][T14471] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 737.268671][T14471] usb 8-1: Product: syz [ 737.270383][T14471] usb 8-1: Manufacturer: syz [ 737.275867][T14471] opticon 8-1:1.0: opticon converter detected [ 737.283782][T14471] usb 8-1: opticon converter now attached to ttyUSB0 [ 737.355546][T16716] vhci_hcd: connection reset by peer [ 737.359124][T15650] vhci_hcd vhci_hcd.4: stop threads [ 737.360787][T15650] vhci_hcd vhci_hcd.4: release socket [ 737.362606][T15650] vhci_hcd vhci_hcd.4: disconnect device [ 737.482527][T15650] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.527041][ T9846] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.537033][ T9846] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.539679][ T9846] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.686579][ T40] usb 8-1: USB disconnect, device number 110 [ 737.690817][ T40] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 737.693621][ T40] opticon 8-1:1.0: device disconnected [ 737.844756][T16738] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3056'. [ 737.904253][T16739] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3056'. [ 737.968916][ T7142] usb 7-1: new high-speed USB device number 101 using dummy_hcd [ 738.217143][ T7142] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 738.220490][ T7142] usb 7-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 738.223767][ T7142] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 738.288651][T16732] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 738.333244][ T7142] opticon 7-1:1.0: opticon converter detected [ 738.390939][T16747] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 738.410557][ T7142] usb 7-1: opticon converter now attached to ttyUSB0 [ 738.476986][ T24] usb 9-1: new high-speed USB device number 76 using dummy_hcd [ 738.560355][T16755] overlayfs: failed to decode file handle (len=9, type=248, flags=0, err=-22) [ 738.643680][ T24] usb 9-1: Using ep0 maxpacket: 16 [ 739.374417][ T24] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 739.456841][ T24] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 739.460822][ T24] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 739.463946][ T24] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 739.467264][ T24] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 739.473058][ T24] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 739.475984][ T24] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 739.480044][ T24] usb 9-1: Manufacturer: syz [ 739.484170][ T24] usb 9-1: config 0 descriptor?? [ 739.521437][T16762] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3073'. [ 739.572509][T16762] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.686454][T16764] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 739.688531][T16764] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 739.691919][T16764] vhci_hcd vhci_hcd.0: Device attached [ 739.707191][T16764] rdma_rxe: rxe_newlink: failed to add wg2 [ 739.740801][T16765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 739.743895][T16762] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.749017][T16765] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 739.824458][ T24] rc_core: IR keymap rc-hauppauge not found [ 739.826745][ T24] Registered IR keymap rc-empty [ 739.831080][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 739.835603][T16762] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.858332][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 739.912182][T16762] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.944189][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0 [ 739.987802][ T7142] usb 44-1: SetAddress Request (31) to port 0 [ 739.989820][ T7142] usb 44-1: new SuperSpeed USB device number 31 using vhci_hcd [ 740.090627][ T9846] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 740.097082][ T9846] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 740.099604][ T9846] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 740.102056][ T9846] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 740.110124][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/rc/rc0/input61 [ 740.149353][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 740.168807][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 740.199476][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 740.245728][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 740.268791][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 740.287747][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 740.309372][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 740.315047][T16766] vhci_hcd: connection reset by peer [ 740.317638][ T9846] vhci_hcd vhci_hcd.3: stop threads [ 740.319847][ T9846] vhci_hcd vhci_hcd.3: release socket [ 740.322110][ T9846] vhci_hcd vhci_hcd.3: disconnect device [ 740.329719][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 740.348404][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 740.367167][ T24] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 740.402596][ T24] mceusb 9-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 740.405870][ T24] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 740.430471][ T24] usb 9-1: USB disconnect, device number 76 [ 740.599212][ T55] usb 42-1: device descriptor read/8, error -110 [ 741.031269][ T55] usb usb42-port1: attempt power cycle [ 741.250113][T16800] netlink: 212 bytes leftover after parsing attributes in process `syz.3.3070'. [ 741.598086][ T55] usb usb42-port1: unable to enumerate USB device [ 741.943167][T16803] kAFS: No cell specified [ 741.995522][T16805] overlayfs: failed to decode file handle (len=9, type=248, flags=0, err=-22) [ 742.277920][ T1482] usb 46-1: device descriptor read/8, error -110 [ 742.567174][T16816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 742.570856][T16816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 742.677649][ T1482] usb usb46-port1: attempt power cycle [ 742.969390][T16818] vxcan0: tx address claim with dest, not broadcast [ 742.997019][ T5756] Bluetooth: hci1: command 0x0405 tx timeout [ 742.997204][T16789] Bluetooth: hci1: Opcode 0x0401 failed: -110 [ 743.028881][T16820] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3077'. [ 743.039584][T16820] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 743.044865][T16820] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 743.049449][T16820] bond0 (unregistering): Released all slaves [ 743.129741][T16823] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3078'. [ 743.209866][T16824] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3078'. [ 743.257560][ T1482] usb usb46-port1: unable to enumerate USB device [ 743.731024][ T55] usb 7-1: USB disconnect, device number 101 [ 743.736476][ T55] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 743.739361][ T55] opticon 7-1:1.0: device disconnected [ 743.942306][T16835] overlayfs: failed to decode file handle (len=9, type=248, flags=0, err=-22) [ 744.216188][T16845] vxcan0: tx address claim with dest, not broadcast [ 744.218510][T16847] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3086'. [ 744.246212][T16844] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 744.285320][T16849] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3086'. [ 744.662967][T16858] bond1: entered promiscuous mode [ 744.672300][T16858] 8021q: adding VLAN 0 to HW filter on device bond1 [ 744.774962][ T42] audit: type=1800 audit(1785954056.736:152): pid=16866 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3090" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 745.068389][ T40] usb 8-1: new high-speed USB device number 111 using dummy_hcd [ 745.112135][ T7142] usb 44-1: device descriptor read/8, error -110 [ 745.290627][ T40] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 745.294924][ T40] usb 8-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 745.297925][ T40] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 745.318685][T16869] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 745.335732][ T40] opticon 8-1:1.0: opticon converter detected [ 745.355424][ T40] usb 8-1: opticon converter now attached to ttyUSB0 [ 745.558528][ T7142] usb usb44-port1: attempt power cycle [ 746.565823][ T7142] usb usb44-port1: unable to enumerate USB device [ 746.760688][ T1442] ieee802154 phy0 wpan0: encryption failed: -22 [ 746.762805][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 746.829850][T16884] vxcan0: tx address claim with dest, not broadcast [ 747.156603][T16897] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 747.184757][T16898] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 747.187543][T16898] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 747.197523][T16898] vhci_hcd vhci_hcd.0: Device attached [ 747.212037][T16898] rdma_rxe: rxe_newlink: failed to add wg2 [ 747.457065][ T9] usb 38-1: SetAddress Request (54) to port 0 [ 747.459177][ T9] usb 38-1: new SuperSpeed USB device number 54 using vhci_hcd [ 747.508216][T16905] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 747.510337][T16905] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 747.513061][T16905] vhci_hcd vhci_hcd.0: Device attached [ 747.574647][T16905] syz2: rxe_newlink: already configured on wg2 [ 747.699230][T16901] vhci_hcd: connection reset by peer [ 747.707266][T15650] vhci_hcd vhci_hcd.0: stop threads [ 747.709488][T15650] vhci_hcd vhci_hcd.0: release socket [ 747.711765][T15650] vhci_hcd vhci_hcd.0: disconnect device [ 747.807297][ T55] usb 46-1: SetAddress Request (42) to port 0 [ 747.810309][ T55] usb 46-1: new SuperSpeed USB device number 42 using vhci_hcd [ 748.066279][T16911] vhci_hcd: connection reset by peer [ 748.068526][T15650] vhci_hcd vhci_hcd.4: stop threads [ 748.070145][T15650] vhci_hcd vhci_hcd.4: release socket [ 748.072051][T15650] vhci_hcd vhci_hcd.4: disconnect device [ 748.800555][T16926] bond1 (unregistering): Released all slaves [ 748.878610][T16930] jffs2: notice: (16930) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 749.309292][T16945] netlink: 212 bytes leftover after parsing attributes in process `syz.4.3108'. [ 749.820695][T16953] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 749.822795][T16953] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 749.825720][T16953] vhci_hcd vhci_hcd.0: Device attached [ 749.835276][T16953] rdma_rxe: rxe_newlink: failed to add wg2 [ 750.298166][T16954] vhci_hcd: connection closed [ 750.299293][T15650] vhci_hcd vhci_hcd.0: stop threads [ 750.302980][T15650] vhci_hcd vhci_hcd.0: release socket [ 750.305009][T15650] vhci_hcd vhci_hcd.0: disconnect device [ 750.695150][ T40] usb 8-1: USB disconnect, device number 111 [ 750.730748][ T40] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 750.742743][ T40] opticon 8-1:1.0: device disconnected [ 751.107518][ T846] usb 7-1: new high-speed USB device number 102 using dummy_hcd [ 751.267038][ T846] usb 7-1: Using ep0 maxpacket: 16 [ 751.271806][ T846] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 751.279217][ T846] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 751.288241][ T846] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 751.294623][ T846] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 751.302321][ T846] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 751.303846][ T846] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 751.307787][T16981] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 751.318543][ T846] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 751.318633][ T846] usb 7-1: Manufacturer: syz [ 751.333585][ T846] usb 7-1: config 0 descriptor?? [ 751.588363][T16984] bond0 (unregistering): Released all slaves [ 751.707286][ T846] rc_core: IR keymap rc-hauppauge not found [ 751.709747][ T846] Registered IR keymap rc-empty [ 751.711461][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.727069][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.747936][ T846] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0 [ 751.756070][ T846] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0/input62 [ 751.764181][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.787126][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.809410][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.830397][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.857021][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.877530][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.897372][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.918133][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.937045][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.957075][ T846] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 751.978035][ T846] mceusb 7-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 751.981124][ T846] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 751.987899][ T846] usb 7-1: USB disconnect, device number 102 [ 752.517587][ T9] usb 38-1: device descriptor read/8, error -110 [ 752.606976][T14471] usb 8-1: new high-speed USB device number 112 using dummy_hcd [ 752.758710][T14471] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 752.761951][T14471] usb 8-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 752.765052][T14471] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 752.772964][T17004] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 752.777621][T14471] opticon 8-1:1.0: opticon converter detected [ 752.785996][T14471] usb 8-1: opticon converter now attached to ttyUSB0 [ 752.793262][T17014] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3130'. [ 752.838404][ T55] usb 46-1: device descriptor read/8, error -110 [ 752.879437][T17015] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3130'. [ 753.274548][ T55] usb usb46-port1: attempt power cycle [ 753.567302][T17021] jffs2: notice: (17021) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 753.598246][T17024] FAULT_INJECTION: forcing a failure. [ 753.598246][T17024] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 753.611129][T17024] CPU: 3 UID: 0 PID: 17024 Comm: syz.2.3133 Tainted: G L syzkaller #0 PREEMPT(full) [ 753.611164][T17024] Tainted: [L]=SOFTLOCKUP [ 753.611171][T17024] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 753.611191][T17024] Call Trace: [ 753.611218][T17024] [ 753.611225][T17024] dump_stack_lvl+0x100/0x190 [ 753.611318][T17024] should_fail_ex.cold+0x5/0xa [ 753.611346][T17024] ? prepare_alloc_pages+0x16d/0x5f0 [ 753.611392][T17024] should_fail_alloc_page+0xeb/0x140 [ 753.611428][T17024] prepare_alloc_pages+0x1f0/0x5f0 [ 753.611463][T17024] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 753.611489][T17024] ? do_raw_spin_lock+0x128/0x260 [ 753.611527][T17024] ? find_held_lock+0x2b/0x80 [ 753.611549][T17024] ? stack_depot_save_flags+0x479/0x9d0 [ 753.611601][T17024] ? rcu_is_watching+0x12/0xc0 [ 753.611632][T17024] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 753.611687][T17024] ? lockdep_hardirqs_on+0x78/0x100 [ 753.611711][T17024] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 753.611738][T17024] ? kasan_save_stack+0x3f/0x50 [ 753.611759][T17024] ? kasan_save_stack+0x30/0x50 [ 753.611780][T17024] ? kasan_save_track+0x14/0x30 [ 753.611800][T17024] ? __kasan_kmalloc+0xaa/0xb0 [ 753.611820][T17024] ? __kmalloc_noprof+0x322/0x820 [ 753.611843][T17024] ? copy_splice_read+0x1a3/0xbb0 [ 753.611876][T17024] ? do_splice_read+0x285/0x370 [ 753.611893][T17024] ? splice_direct_to_actor+0x2a1/0xa30 [ 753.611910][T17024] ? do_splice_direct+0x174/0x240 [ 753.611928][T17024] ? vfs_copy_file_range+0xc1b/0x1840 [ 753.611957][T17024] ? __do_sys_copy_file_range+0x1a1/0x460 [ 753.612008][T17024] alloc_pages_bulk_noprof+0x5de/0x13c0 [ 753.612038][T17024] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 753.612060][T17024] ? rcu_is_watching+0x12/0xc0 [ 753.612079][T17024] ? trace_kmalloc+0xeb/0x110 [ 753.612103][T17024] ? __kasan_kmalloc+0xaa/0xb0 [ 753.612128][T17024] ? copy_splice_read+0x1a3/0xbb0 [ 753.612151][T17024] copy_splice_read+0x1e1/0xbb0 [ 753.612176][T17024] ? __pfx_copy_splice_read+0x10/0x10 [ 753.612197][T17024] ? look_up_lock_class+0x64/0x120 [ 753.612224][T17024] ? lockdep_init_map_type+0x5c/0x250 [ 753.612242][T17024] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 753.612270][T17024] ? __pfx_copy_splice_read+0x10/0x10 [ 753.612289][T17024] do_splice_read+0x285/0x370 [ 753.612312][T17024] splice_direct_to_actor+0x2a1/0xa30 [ 753.612334][T17024] ? __pfx_direct_splice_actor+0x10/0x10 [ 753.612358][T17024] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 753.612379][T17024] ? __lock_acquire+0x49f/0x1a40 [ 753.612409][T17024] do_splice_direct+0x174/0x240 [ 753.612431][T17024] ? __pfx_do_splice_direct+0x10/0x10 [ 753.612449][T17024] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 753.612482][T17024] vfs_copy_file_range+0xc1b/0x1840 [ 753.612509][T17024] ? __pfx_vfs_copy_file_range+0x10/0x10 [ 753.612530][T17024] ? __might_fault+0xc5/0x140 [ 753.612557][T17024] ? __might_fault+0xc5/0x140 [ 753.612585][T17024] __do_sys_copy_file_range+0x1a1/0x460 [ 753.612609][T17024] ? __pfx___do_sys_copy_file_range+0x10/0x10 [ 753.612629][T17024] ? find_held_lock+0x2b/0x80 [ 753.612650][T17024] ? trace_syscall_enter+0xd9/0x110 [ 753.612670][T17024] ? trace_syscall_enter+0xd9/0x110 [ 753.612695][T17024] __do_fast_syscall_32+0xe7/0x970 [ 753.612729][T17024] ? lockdep_hardirqs_on+0x78/0x100 [ 753.612753][T17024] do_fast_syscall_32+0x32/0x70 [ 753.612778][T17024] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 753.612802][T17024] RIP: 0023:0xf7f08fec [ 753.612823][T17024] Code: Unable to access opcode bytes at 0xf7f08fc2. [ 753.612848][T17024] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000179 [ 753.612866][T17024] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 753.612878][T17024] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000004 [ 753.612888][T17024] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 753.612900][T17024] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 753.612909][T17024] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 753.612931][T17024] [ 753.848651][ T9] usb usb38-port1: attempt power cycle [ 753.870275][ T55] usb usb46-port1: unable to enumerate USB device [ 754.618447][T17042] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 754.620630][T17042] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 754.623515][T17042] vhci_hcd vhci_hcd.0: Device attached [ 754.643369][T17042] syz2: rxe_newlink: already configured on wg2 [ 754.721834][T17046] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 754.753306][T17043] vhci_hcd: connection closed [ 754.753649][ T9846] vhci_hcd vhci_hcd.4: stop threads [ 754.757347][ T9846] vhci_hcd vhci_hcd.4: release socket [ 754.759138][ T9846] vhci_hcd vhci_hcd.4: disconnect device [ 755.068649][ T9] usb usb38-port1: unable to enumerate USB device [ 755.289976][T17054] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 755.292765][T17054] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 755.295441][T17054] vhci_hcd vhci_hcd.0: Device attached [ 755.331783][T17054] rdma_rxe: rxe_newlink: failed to add wg2 [ 755.567119][ T5753] usb 38-1: SetAddress Request (58) to port 0 [ 755.571429][ T5753] usb 38-1: new SuperSpeed USB device number 58 using vhci_hcd [ 755.730762][T17055] vhci_hcd: connection reset by peer [ 755.733377][ T9846] vhci_hcd vhci_hcd.0: stop threads [ 755.735255][ T9846] vhci_hcd vhci_hcd.0: release socket [ 755.737857][ T9846] vhci_hcd vhci_hcd.0: disconnect device [ 757.412902][T17080] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 757.577858][T17086] wg2 speed is unknown, defaulting to 1000 [ 757.841725][T17095] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3155'. [ 757.902624][T17096] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3155'. [ 758.186793][ T5857] usb 8-1: USB disconnect, device number 112 [ 758.191447][ T5857] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 758.220698][ T5857] opticon 8-1:1.0: device disconnected [ 758.465023][T17099] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 758.467185][T17099] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 758.470121][T17099] vhci_hcd vhci_hcd.0: Device attached [ 758.480925][T17099] syz2: rxe_newlink: already configured on wg2 [ 758.638133][T17100] vhci_hcd: connection closed [ 758.638364][T15650] vhci_hcd vhci_hcd.4: stop threads [ 758.641767][T15650] vhci_hcd vhci_hcd.4: release socket [ 758.643539][T15650] vhci_hcd vhci_hcd.4: disconnect device [ 759.217617][T17123] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3161'. [ 759.550810][T17127] can0: slcan on ttyS3. [ 759.637766][T17127] can0 (unregistered): slcan off ttyS3. [ 759.779492][T17131] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3163'. [ 759.793063][T17131] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3163'. [ 760.422417][ T55] usb 9-1: new high-speed USB device number 77 using dummy_hcd [ 760.677083][ T5753] usb 38-1: device descriptor read/8, error -110 [ 760.679781][ T55] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 760.682762][ T55] usb 9-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 760.685490][ T55] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 760.696624][T17139] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 760.700906][ T55] opticon 9-1:1.0: opticon converter detected [ 760.706420][ T55] usb 9-1: opticon converter now attached to ttyUSB0 [ 760.856716][T17149] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3168'. [ 760.864067][T17150] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3176'. [ 760.936822][T17151] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3168'. [ 760.959411][T17152] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3176'. [ 761.092498][ T5753] usb usb38-port1: attempt power cycle [ 761.692418][ T5753] usb usb38-port1: unable to enumerate USB device [ 761.849181][T17167] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3173'. [ 761.924070][T17167] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.581232][T17167] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.640189][T17167] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.720938][T17167] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 762.837786][ T24] usb 8-1: new high-speed USB device number 113 using dummy_hcd [ 762.857289][ T9846] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 762.864827][ T9846] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 762.869179][ T9846] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 762.872526][ T9846] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 762.942917][T17172] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 762.944936][T17172] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 762.947736][T17172] vhci_hcd vhci_hcd.0: Device attached [ 762.959398][T17172] rdma_rxe: rxe_newlink: failed to add wg2 [ 763.008781][ T24] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 763.012731][ T24] usb 8-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 763.016483][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 763.024946][T17168] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 763.035678][ T24] opticon 8-1:1.0: opticon converter detected [ 763.047453][ T24] usb 8-1: opticon converter now attached to ttyUSB1 [ 763.063183][T17173] vhci_hcd: connection closed [ 763.064917][ T9846] vhci_hcd vhci_hcd.2: stop threads [ 763.070892][ T9846] vhci_hcd vhci_hcd.2: release socket [ 763.072989][ T9846] vhci_hcd vhci_hcd.2: disconnect device [ 763.105222][T17178] jffs2: notice: (17178) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 764.345441][T17191] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3180'. [ 764.406742][T17192] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3180'. [ 765.235380][T14471] usb 8-1: USB disconnect, device number 113 [ 765.241856][T14471] opticon ttyUSB1: opticon converter now disconnected from ttyUSB1 [ 765.244700][T14471] opticon 8-1:1.0: device disconnected [ 765.326805][T17202] wg2 speed is unknown, defaulting to 1000 [ 765.509577][T17206] jffs2: notice: (17206) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 766.231273][ T5753] usb 9-1: USB disconnect, device number 77 [ 766.239254][ T5753] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 766.252428][ T5753] opticon 9-1:1.0: device disconnected [ 766.334712][T17218] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3187'. [ 767.407057][ T9] usb 8-1: new high-speed USB device number 114 using dummy_hcd [ 767.509305][T17237] overlayfs: failed to resolve './file0': -2 [ 767.554842][T17239] jffs2: notice: (17239) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 767.669396][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 767.676432][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 767.683497][ T9] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 767.693023][ T9] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 767.704391][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 767.717661][ T9] usb 8-1: config 0 descriptor?? [ 768.144955][ T9] plantronics 0003:047F:FFFF.0003: reserved main item tag 0xd [ 768.175198][ T9] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 768.787064][T14471] usb 9-1: new high-speed USB device number 78 using dummy_hcd [ 768.923787][ T40] usb 8-1: USB disconnect, device number 114 [ 768.950275][T14471] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 768.953515][T14471] usb 9-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 768.956340][T14471] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 768.992219][T17248] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 768.997543][T14471] opticon 9-1:1.0: opticon converter detected [ 769.010192][T14471] usb 9-1: opticon converter now attached to ttyUSB0 [ 769.317057][ T5756] Bluetooth: hci1: command 0x0405 tx timeout [ 769.979882][T17269] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3203'. [ 770.082906][T17271] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3203'. [ 770.935226][T17279] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 770.952546][T17282] FAULT_INJECTION: forcing a failure. [ 770.952546][T17282] name failslab, interval 1, probability 0, space 0, times 0 [ 770.957192][T17282] CPU: 2 UID: 0 PID: 17282 Comm: syz.3.3206 Tainted: G L syzkaller #0 PREEMPT(full) [ 770.957212][T17282] Tainted: [L]=SOFTLOCKUP [ 770.957216][T17282] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 770.957223][T17282] Call Trace: [ 770.957228][T17282] [ 770.957234][T17282] dump_stack_lvl+0x100/0x190 [ 770.957254][T17282] should_fail_ex.cold+0x5/0xa [ 770.957268][T17282] should_failslab+0xc2/0x120 [ 770.957291][T17282] kmem_cache_alloc_noprof+0x91/0x6a0 [ 770.957305][T17282] ? __pfx_map_id_range_down+0x10/0x10 [ 770.957334][T17282] ? rcu_is_watching+0x12/0xc0 [ 770.957348][T17282] ? security_inode_alloc+0x3b/0x2c0 [ 770.957379][T17282] security_inode_alloc+0x3b/0x2c0 [ 770.957393][T17282] inode_init_always_gfp+0xc77/0xfb0 [ 770.957408][T17282] alloc_inode+0x8e/0x250 [ 770.957424][T17282] new_inode+0x22/0x1c0 [ 770.957440][T17282] proc_pid_make_inode+0x22/0x160 [ 770.957465][T17282] proc_pident_instantiate+0x85/0x310 [ 770.957484][T17282] proc_pident_lookup+0x1e3/0x270 [ 770.957502][T17282] ? __pfx_down_read+0x10/0x10 [ 770.957522][T17282] __lookup_slow+0x155/0x320 [ 770.957539][T17282] lookup_slow+0x50/0x70 [ 770.957554][T17282] link_path_walk+0x1712/0x1cc0 [ 770.957577][T17282] path_openat+0x1c9/0x4280 [ 770.957588][T17282] ? kasan_save_track+0x14/0x30 [ 770.957602][T17282] ? __kasan_slab_alloc+0x89/0x90 [ 770.957616][T17282] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 770.957630][T17282] ? do_sys_openat2+0xc7/0x1e0 [ 770.957650][T17282] ? __pfx_path_openat+0x10/0x10 [ 770.957666][T17282] do_file_open+0x20e/0x430 [ 770.957677][T17282] ? __lock_acquire+0x49f/0x1a40 [ 770.957696][T17282] ? __pfx_do_file_open+0x10/0x10 [ 770.957712][T17282] ? __pfx_proc_put_link+0x10/0x10 [ 770.957727][T17282] ? __pfx_kfree_link+0x10/0x10 [ 770.957753][T17282] ? _raw_spin_unlock+0x28/0x50 [ 770.957770][T17282] ? alloc_fd+0x471/0x7a0 [ 770.957794][T17282] do_sys_openat2+0x10f/0x1e0 [ 770.957817][T17282] ? __pfx_do_sys_openat2+0x10/0x10 [ 770.957846][T17282] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 770.957872][T17282] __ia32_compat_sys_openat+0x12d/0x210 [ 770.957889][T17282] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 770.957905][T17282] ? fput+0x79/0x100 [ 770.957918][T17282] ? ksys_write+0x1ac/0x250 [ 770.957928][T17282] ? __pfx_ksys_write+0x10/0x10 [ 770.957942][T17282] __do_fast_syscall_32+0xe7/0x970 [ 770.957958][T17282] ? lockdep_hardirqs_on+0x78/0x100 [ 770.957974][T17282] do_fast_syscall_32+0x32/0x70 [ 770.958012][T17282] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 770.958029][T17282] RIP: 0023:0xf70befec [ 770.958042][T17282] Code: Unable to access opcode bytes at 0xf70befc2. [ 770.958048][T17282] RSP: 002b:00000000f54ad50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 770.958059][T17282] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000240 [ 770.958067][T17282] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 770.958073][T17282] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 770.958079][T17282] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 770.958086][T17282] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 770.958100][T17282] [ 771.169702][T17289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 771.177412][T17289] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 771.428144][T17296] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3212'. [ 771.478855][T17290] wg2 speed is unknown, defaulting to 1000 [ 772.114391][T17305] overlayfs: failed to resolve './lower': -2 [ 772.261646][T17309] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 772.324589][T17312] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 772.341441][T17312] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.345543][T17312] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.350390][T17312] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 772.402935][T15650] bridge_slave_1: left allmulticast mode [ 772.405055][T15650] bridge_slave_1: left promiscuous mode [ 772.406981][T15650] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.419293][T15650] bridge_slave_0: left allmulticast mode [ 772.422726][T15650] bridge_slave_0: left promiscuous mode [ 772.425275][T15650] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.436679][T15650] pim6reg: left allmulticast mode [ 772.609101][T17321] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 772.687097][T17321] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 772.692643][T15650] bond1 (unregistering): (slave .`): Releasing backup interface [ 772.698645][T15650] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 772.703955][T15650] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 772.708466][T15650] .` (unregistering): Released all slaves [ 772.714090][T15650] bond1 (unregistering): Released all slaves [ 772.797115][ T40] usb 7-1: new high-speed USB device number 103 using dummy_hcd [ 772.800211][T17324] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 772.802204][T17324] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 772.804912][T17324] vhci_hcd vhci_hcd.0: Device attached [ 772.862807][T17324] rdma_rxe: rxe_newlink: failed to add wg2 [ 772.978469][ T40] usb 7-1: config 0 has no interfaces? [ 772.980257][ T40] usb 7-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 772.983217][ T40] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 772.990751][ T40] usb 7-1: config 0 descriptor?? [ 773.077437][ T9] usb 44-1: SetAddress Request (35) to port 0 [ 773.079546][ T9] usb 44-1: new SuperSpeed USB device number 35 using vhci_hcd [ 773.282092][ T846] usb 7-1: USB disconnect, device number 103 [ 773.335612][T15650] hsr_slave_0: left promiscuous mode [ 773.338623][T17319] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3219'. [ 773.345750][T15650] hsr_slave_1: left promiscuous mode [ 773.354611][T15650] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 773.357821][T15650] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 773.368919][T15650] veth1_macvtap: left promiscuous mode [ 773.371328][T15650] veth0_macvtap: left promiscuous mode [ 773.373718][T15650] veth1_vlan: left promiscuous mode [ 773.375997][T15650] veth0_vlan: left promiscuous mode [ 773.445264][T17326] vhci_hcd: connection reset by peer [ 773.460495][ T12] vhci_hcd vhci_hcd.3: stop threads [ 773.462575][ T12] vhci_hcd vhci_hcd.3: release socket [ 773.465221][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 774.295304][ T5857] usb 9-1: USB disconnect, device number 78 [ 774.300741][ T5857] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 774.303348][ T5857] opticon 9-1:1.0: device disconnected [ 774.319128][T17335] overlayfs: failed to resolve './lower': -2 [ 774.615655][T17342] netlink: zone id is out of range [ 774.620557][T17342] netlink: zone id is out of range [ 774.622577][T17342] netlink: zone id is out of range [ 774.624442][T17342] netlink: zone id is out of range [ 774.626541][T17342] netlink: zone id is out of range [ 774.630525][T17342] netlink: zone id is out of range [ 774.632343][T17342] netlink: zone id is out of range [ 774.634631][T17342] netlink: zone id is out of range [ 775.025223][T17349] netlink: 'syz.0.3228': attribute type 21 has an invalid length. [ 775.028605][T17349] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3228'. [ 775.512254][T17358] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 775.606386][T17363] overlayfs: failed to resolve './lower': -2 [ 775.754068][T17366] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 775.756674][T17366] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 775.760153][T17366] vhci_hcd vhci_hcd.0: Device attached [ 775.775121][T17366] rdma_rxe: rxe_newlink: failed to add wg2 [ 775.883060][T17374] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 775.884902][T17374] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 775.889129][T17374] vhci_hcd vhci_hcd.0: Device attached [ 775.907051][T14471] usb 9-1: new full-speed USB device number 79 using dummy_hcd [ 776.027108][ T40] usb 42-1: SetAddress Request (30) to port 0 [ 776.029215][ T40] usb 42-1: new SuperSpeed USB device number 30 using vhci_hcd [ 776.059236][T14471] usb 9-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 776.063447][T14471] usb 9-1: config 0 interface 0 has no altsetting 0 [ 776.070872][T14471] usb 9-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 776.073919][T14471] usb 9-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 776.076878][T14471] usb 9-1: Product: syz [ 776.078297][T14471] usb 9-1: Manufacturer: syz [ 776.079969][T14471] usb 9-1: SerialNumber: syz [ 776.083890][T14471] usb 9-1: config 0 descriptor?? [ 776.089089][T14471] usb 9-1: selecting invalid altsetting 0 [ 776.197119][ T29] usb 38-1: SetAddress Request (62) to port 0 [ 776.199142][ T29] usb 38-1: new SuperSpeed USB device number 62 using vhci_hcd [ 776.288900][T14471] usb 9-1: USB disconnect, device number 79 [ 776.399745][T17367] vhci_hcd: connection reset by peer [ 776.402226][ T12] vhci_hcd vhci_hcd.2: stop threads [ 776.403940][ T12] vhci_hcd vhci_hcd.2: release socket [ 776.415966][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 776.591986][T17375] vhci_hcd: connection reset by peer [ 776.593935][ T12] vhci_hcd vhci_hcd.0: stop threads [ 776.595497][ T12] vhci_hcd vhci_hcd.0: release socket [ 776.597373][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 776.780022][T17385] bridge0: port 1(bridge_slave_0) entered disabled state [ 776.791126][T17385] bridge0: port 2(bridge_slave_1) entered disabled state [ 776.970828][T17392] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3238'. [ 776.982987][T17391] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3240'. [ 777.048172][T17395] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3238'. [ 777.166606][T17398] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3242'. [ 777.257026][ T5896] usb 7-1: new high-speed USB device number 104 using dummy_hcd [ 777.409638][ T5896] usb 7-1: Using ep0 maxpacket: 16 [ 777.415889][ T5896] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 777.424395][ T5896] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 777.434009][ T5896] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 777.447878][ T5896] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 777.456289][ T5896] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 777.471005][ T5896] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 777.482336][ T5896] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 777.490449][ T5896] usb 7-1: Manufacturer: syz [ 777.496700][T17400] overlayfs: failed to resolve './lower': -2 [ 777.496843][ T5896] usb 7-1: config 0 descriptor?? [ 777.591250][T17402] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 777.767210][ T5896] rc_core: IR keymap rc-hauppauge not found [ 777.769247][ T5896] Registered IR keymap rc-empty [ 777.770942][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 777.782522][T17406] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 777.788521][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 777.808329][ T5896] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0 [ 777.815317][ T5896] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0/input64 [ 777.823497][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 777.838913][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 777.880236][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 777.909824][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 777.927045][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 777.949038][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 777.968709][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 777.987042][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 778.007034][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 778.026476][T17412] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 778.027035][ T5896] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 778.117111][ T9] usb 44-1: device descriptor read/8, error -110 [ 778.171248][ T5896] mceusb 7-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 778.177525][ T5896] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 778.193311][ T5896] usb 7-1: USB disconnect, device number 104 [ 778.261922][T17420] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 778.264506][T17420] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 778.269793][T17420] vhci_hcd vhci_hcd.0: Device attached [ 778.286809][T17420] syz2: rxe_newlink: already configured on wg2 [ 778.460664][T17432] overlayfs: failed to resolve './lower': -2 [ 778.537117][ T7142] usb 46-1: SetAddress Request (46) to port 0 [ 778.540943][T17435] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 778.542939][ T7142] usb 46-1: new SuperSpeed USB device number 46 using vhci_hcd [ 778.558445][ T9] usb usb44-port1: attempt power cycle [ 778.863284][T17423] vhci_hcd: connection reset by peer [ 778.865898][T15650] vhci_hcd vhci_hcd.4: stop threads [ 778.868318][T15650] vhci_hcd vhci_hcd.4: release socket [ 778.870613][T15650] vhci_hcd vhci_hcd.4: disconnect device [ 778.875029][T17440] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3255'. [ 778.915864][T17438] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 778.947653][T17442] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3255'. [ 779.015066][T17438] net_ratelimit: 11 callbacks suppressed [ 779.015090][T17438] socket: no more sockets [ 779.118197][ T9] usb usb44-port1: unable to enumerate USB device [ 779.297444][T17438] isofs_fill_super: bread failed, dev=sr0, iso_blknum=32, block=32 [ 779.499724][T17446] FAULT_INJECTION: forcing a failure. [ 779.499724][T17446] name failslab, interval 1, probability 0, space 0, times 0 [ 779.505119][T17446] CPU: 0 UID: 0 PID: 17446 Comm: syz.4.3257 Tainted: G L syzkaller #0 PREEMPT(full) [ 779.505149][T17446] Tainted: [L]=SOFTLOCKUP [ 779.505155][T17446] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 779.505167][T17446] Call Trace: [ 779.505175][T17446] [ 779.505183][T17446] dump_stack_lvl+0x100/0x190 [ 779.505227][T17446] should_fail_ex.cold+0x5/0xa [ 779.505249][T17446] should_failslab+0xc2/0x120 [ 779.505277][T17446] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 779.505302][T17446] ? __alloc_skb+0x5b7/0x710 [ 779.505362][T17446] ? __alloc_skb+0x140/0x710 [ 779.505389][T17446] __alloc_skb+0x140/0x710 [ 779.505413][T17446] ? __alloc_skb+0x5b7/0x710 [ 779.505435][T17446] ? __pfx___alloc_skb+0x10/0x10 [ 779.505466][T17446] netlink_alloc_large_skb+0x69/0x150 [ 779.505503][T17446] netlink_sendmsg+0x680/0xda0 [ 779.505529][T17446] ? __pfx_netlink_sendmsg+0x10/0x10 [ 779.505553][T17446] ? apparmor_socket_sendmsg+0x15b/0x270 [ 779.505581][T17446] ____sys_sendmsg+0xa4d/0xbe0 [ 779.505610][T17446] ? __pfx_netlink_sendmsg+0x10/0x10 [ 779.505633][T17446] ? __pfx_____sys_sendmsg+0x10/0x10 [ 779.505664][T17446] ___sys_sendmsg+0x190/0x1e0 [ 779.505688][T17446] ? __pfx____sys_sendmsg+0x10/0x10 [ 779.505720][T17446] ? find_held_lock+0x2b/0x80 [ 779.505758][T17446] __sys_sendmsg+0x160/0x210 [ 779.505788][T17446] ? __pfx___sys_sendmsg+0x10/0x10 [ 779.505826][T17446] ? __pfx_ksys_write+0x10/0x10 [ 779.505851][T17446] __do_fast_syscall_32+0xe7/0x970 [ 779.505878][T17446] ? lockdep_hardirqs_on+0x78/0x100 [ 779.505903][T17446] do_fast_syscall_32+0x32/0x70 [ 779.505929][T17446] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 779.505974][T17446] RIP: 0023:0xf6feefec [ 779.505998][T17446] Code: Unable to access opcode bytes at 0xf6feefc2. [ 779.506007][T17446] RSP: 002b:00000000f53dd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 779.506027][T17446] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001900 [ 779.506040][T17446] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 779.506051][T17446] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 779.506061][T17446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 779.506073][T17446] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 779.506095][T17446] [ 779.670806][T17451] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3259'. [ 779.675092][ T42] audit: type=1326 audit(1785954091.636:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17448 comm="syz.3.3258" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x0 [ 779.718650][T17451] vlan2: entered allmulticast mode [ 779.721604][T17451] bridge4: entered allmulticast mode [ 779.736538][T17451] bridge4: port 1(erspan0) entered blocking state [ 779.740484][T17444] netlink: 'syz.2.3256': attribute type 1 has an invalid length. [ 779.743702][T17451] bridge4: port 1(erspan0) entered disabled state [ 779.746397][T17444] netlink: 756 bytes leftover after parsing attributes in process `syz.2.3256'. [ 779.750222][T17451] erspan0: entered allmulticast mode [ 779.754465][T17454] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 779.756362][T17451] erspan0: entered promiscuous mode [ 779.758640][T17454] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 779.765065][T17451] bridge4: port 1(erspan0) entered blocking state [ 779.767770][T17451] bridge4: port 1(erspan0) entered forwarding state [ 779.819771][T17459] overlayfs: failed to resolve './lower': -2 [ 779.970116][T17463] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 780.099424][T17469] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3264'. [ 780.173590][T17472] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3264'. [ 780.346763][T17477] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3268'. [ 780.564235][T17491] overlayfs: failed to resolve './upper': -2 [ 780.682150][T17496] FAULT_INJECTION: forcing a failure. [ 780.682150][T17496] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 780.686660][T17496] CPU: 3 UID: 0 PID: 17496 Comm: syz.0.3273 Tainted: G L syzkaller #0 PREEMPT(full) [ 780.686690][T17496] Tainted: [L]=SOFTLOCKUP [ 780.686697][T17496] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 780.686707][T17496] Call Trace: [ 780.686713][T17496] [ 780.686719][T17496] dump_stack_lvl+0x100/0x190 [ 780.686745][T17496] should_fail_ex.cold+0x5/0xa [ 780.686759][T17496] ? prepare_alloc_pages+0x16d/0x5f0 [ 780.686783][T17496] should_fail_alloc_page+0xeb/0x140 [ 780.686805][T17496] prepare_alloc_pages+0x1f0/0x5f0 [ 780.686827][T17496] ? is_bpf_text_address+0x8a/0x1a0 [ 780.686870][T17496] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 780.686906][T17496] ? is_bpf_text_address+0x94/0x1a0 [ 780.686928][T17496] ? kernel_text_address+0x8d/0x100 [ 780.686959][T17496] ? find_held_lock+0x2b/0x80 [ 780.686977][T17496] ? __kernel_text_address+0xd/0x30 [ 780.686997][T17496] ? unwind_get_return_address+0x59/0xa0 [ 780.687028][T17496] ? arch_stack_walk+0xa6/0xf0 [ 780.687063][T17496] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 780.687082][T17496] ? __pfx_stack_trace_save+0x10/0x10 [ 780.687102][T17496] ? __pfx___might_resched+0x10/0x10 [ 780.687133][T17496] ? stack_depot_save_flags+0x27/0x9d0 [ 780.687162][T17496] ? find_held_lock+0x2b/0x80 [ 780.687179][T17496] ? process_measurement+0x4c8/0x2350 [ 780.687208][T17496] ? kasan_save_stack+0x3f/0x50 [ 780.687226][T17496] ? kasan_save_stack+0x30/0x50 [ 780.687245][T17496] ? handle_mm_fault+0x37b/0xa30 [ 780.687259][T17496] ? do_user_addr_fault+0x74c/0x12f0 [ 780.687278][T17496] ? exc_page_fault+0x6f/0xd0 [ 780.687297][T17496] ? asm_exc_page_fault+0x26/0x30 [ 780.687311][T17496] ? _copy_to_user+0x9f/0xd0 [ 780.687339][T17496] ? do_timer_create+0x6d9/0x1460 [ 780.687357][T17496] ? __ia32_compat_sys_timer_create+0x193/0x1c0 [ 780.687374][T17496] ? __do_fast_syscall_32+0xe7/0x970 [ 780.687395][T17496] ? do_fast_syscall_32+0x32/0x70 [ 780.687414][T17496] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 780.687433][T17496] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 780.687463][T17496] ? policy_nodemask+0xed/0x4f0 [ 780.687487][T17496] alloc_pages_mpol+0x1fb/0x540 [ 780.687508][T17496] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 780.687534][T17496] alloc_pages_noprof+0x1a/0x160 [ 780.687549][T17496] pte_alloc_one+0x1c/0x3d0 [ 780.687571][T17496] __pte_alloc+0x6d/0x3e0 [ 780.687591][T17496] ? __pfx___pte_alloc+0x10/0x10 [ 780.687610][T17496] ? do_raw_spin_lock+0x128/0x260 [ 780.687625][T17496] ? find_held_lock+0x2b/0x80 [ 780.687644][T17496] do_anonymous_page+0x13ae/0x2080 [ 780.687663][T17496] ? __pmd_alloc+0x3fb/0x950 [ 780.687686][T17496] __handle_mm_fault+0x1d2c/0x2a00 [ 780.687704][T17496] ? mt_find+0x45e/0x8e0 [ 780.687727][T17496] ? __pfx___handle_mm_fault+0x10/0x10 [ 780.687741][T17496] ? __pfx_mt_find+0x10/0x10 [ 780.687772][T17496] ? find_vma+0xbf/0x140 [ 780.687789][T17496] ? __pfx_find_vma+0x10/0x10 [ 780.687810][T17496] handle_mm_fault+0x37b/0xa30 [ 780.687828][T17496] do_user_addr_fault+0x74c/0x12f0 [ 780.687853][T17496] exc_page_fault+0x6f/0xd0 [ 780.687871][T17496] asm_exc_page_fault+0x26/0x30 [ 780.687885][T17496] RIP: 0010:_copy_to_user+0x9f/0xd0 [ 780.687907][T17496] Code: 89 ee 48 89 ef e8 71 63 ee fc 4d 85 ff 75 26 e8 87 69 ee fc 89 de 4c 89 e7 e8 2d ff 5d fd 0f 01 cb 48 89 d9 48 89 ef 4c 89 e6 a4 0f 1f 00 0f 01 ca 48 89 cb e8 61 69 ee fc 48 89 d8 5b 5d 41 [ 780.687922][T17496] RSP: 0018:ffffc90002dc7ce8 EFLAGS: 00050297 [ 780.687935][T17496] RAX: 0000000000000001 RBX: 0000000000000004 RCX: 0000000000000004 [ 780.687944][T17496] RDX: 0000000000000001 RSI: ffffc90002dc7da0 RDI: 0000000080000100 [ 780.687953][T17496] RBP: 0000000080000100 R08: 0000000000000000 R09: fffff520005b8fb4 [ 780.687962][T17496] R10: 0000000000000003 R11: 0000000000000000 R12: ffffc90002dc7da0 [ 780.687971][T17496] R13: 0000000080000104 R14: 00007ffffffff000 R15: 0000000000000000 [ 780.687989][T17496] ? _copy_to_user+0x93/0xd0 [ 780.688012][T17496] do_timer_create+0x6d9/0x1460 [ 780.688033][T17496] ? __pfx_do_timer_create+0x10/0x10 [ 780.688050][T17496] ? __mutex_unlock_slowpath+0x35d/0x930 [ 780.688072][T17496] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 780.688094][T17496] __ia32_compat_sys_timer_create+0x193/0x1c0 [ 780.688114][T17496] ? __pfx___ia32_compat_sys_timer_create+0x10/0x10 [ 780.688133][T17496] ? fput+0x79/0x100 [ 780.688151][T17496] ? ksys_write+0x1ac/0x250 [ 780.688168][T17496] ? __pfx_ksys_write+0x10/0x10 [ 780.688185][T17496] __do_fast_syscall_32+0xe7/0x970 [ 780.688205][T17496] ? lockdep_hardirqs_on+0x78/0x100 [ 780.688225][T17496] do_fast_syscall_32+0x32/0x70 [ 780.688245][T17496] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 780.688262][T17496] RIP: 0023:0xf7ff6fec [ 780.688279][T17496] Code: Unable to access opcode bytes at 0xf7ff6fc2. [ 780.688286][T17496] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000103 [ 780.688298][T17496] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 780.688307][T17496] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 780.688316][T17496] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 780.688324][T17496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 780.688332][T17496] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 780.688351][T17496] [ 781.079261][ T40] usb 42-1: device descriptor read/8, error -110 [ 781.095189][T17506] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 781.098177][T17506] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 781.127244][T17506] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3275'. [ 781.194477][T17507] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3275'. [ 781.259561][ T29] usb 38-1: device descriptor read/8, error -110 [ 781.489143][ T40] usb usb42-port1: attempt power cycle [ 781.585796][T17514] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3285'. [ 781.749033][T17518] overlayfs: failed to resolve './file0': -2 [ 781.772386][ T29] usb usb38-port1: attempt power cycle [ 782.052249][ T40] usb usb42-port1: unable to enumerate USB device [ 782.346706][T17523] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 782.367962][ T29] usb usb38-port1: unable to enumerate USB device [ 782.628187][T17528] overlayfs: failed to resolve './upper': -2 [ 782.869027][T17536] sysfs: Unknown parameter '' [ 782.881473][T17536] Invalid option length (1047276) for dns_resolver key [ 783.406238][T17546] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3287'. [ 783.520488][T17548] netlink: 'syz.2.3288': attribute type 21 has an invalid length. [ 783.523782][T17548] netlink: 156 bytes leftover after parsing attributes in process `syz.2.3288'. [ 783.638812][ T7142] usb 46-1: device descriptor read/8, error -110 [ 783.747809][T17557] overlayfs: failed to resolve './upper': -2 [ 783.793854][ T42] audit: type=1326 audit(1785954095.756:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17558 comm="syz.2.3292" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f08fec code=0x0 [ 784.060143][ T7142] usb usb46-port1: attempt power cycle [ 784.179676][T17566] netlink: 'syz.3.3294': attribute type 1 has an invalid length. [ 784.185176][T17566] netlink: 756 bytes leftover after parsing attributes in process `syz.3.3294'. [ 784.310294][T17578] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3296'. [ 784.582046][T17587] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 784.584281][T17587] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 784.587678][T17587] vhci_hcd vhci_hcd.0: Device attached [ 784.601408][T17587] rdma_rxe: rxe_newlink: failed to add wg2 [ 784.673445][T17593] overlayfs: failed to resolve './work': -2 [ 784.707821][ T7142] usb usb46-port1: unable to enumerate USB device [ 784.857688][T16532] usb 44-1: SetAddress Request (39) to port 0 [ 784.862018][T16532] usb 44-1: new SuperSpeed USB device number 39 using vhci_hcd [ 784.903086][T17597] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 785.021513][T17606] netlink: 'syz.4.3304': attribute type 1 has an invalid length. [ 785.262627][T17590] vhci_hcd: connection reset by peer [ 785.276350][ T12] vhci_hcd vhci_hcd.3: stop threads [ 785.285423][ T12] vhci_hcd vhci_hcd.3: release socket [ 785.292936][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 785.357397][T17616] overlayfs: failed to resolve './work': -2 [ 785.549494][T17623] overlayfs: failed to decode file handle (len=8, type=251, flags=0, err=-22) [ 785.586149][T17621] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 785.597062][ T9] usb 9-1: new high-speed USB device number 80 using dummy_hcd [ 785.727007][ T9] usb 9-1: device descriptor read/64, error -71 [ 785.932700][T17636] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 785.967036][ T9] usb 9-1: new high-speed USB device number 81 using dummy_hcd [ 786.097342][ T9] usb 9-1: device descriptor read/64, error -71 [ 786.208153][ T9] usb usb9-port1: attempt power cycle [ 786.557278][ T9] usb 9-1: new high-speed USB device number 82 using dummy_hcd [ 786.579594][ T9] usb 9-1: device descriptor read/8, error -71 [ 786.794735][T17642] overlayfs: failed to resolve './work': -2 [ 786.817036][ T9] usb 9-1: new high-speed USB device number 83 using dummy_hcd [ 786.837864][ T9] usb 9-1: device descriptor read/8, error -71 [ 786.948112][ T9] usb usb9-port1: unable to enumerate USB device [ 787.045134][T17651] FAULT_INJECTION: forcing a failure. [ 787.045134][T17651] name failslab, interval 1, probability 0, space 0, times 0 [ 787.049149][T17651] CPU: 0 UID: 0 PID: 17651 Comm: syz.2.3317 Tainted: G L syzkaller #0 PREEMPT(full) [ 787.049169][T17651] Tainted: [L]=SOFTLOCKUP [ 787.049173][T17651] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 787.049180][T17651] Call Trace: [ 787.049185][T17651] [ 787.049190][T17651] dump_stack_lvl+0x100/0x190 [ 787.049208][T17651] should_fail_ex.cold+0x5/0xa [ 787.049222][T17651] should_failslab+0xc2/0x120 [ 787.049239][T17651] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 787.049255][T17651] ? __alloc_skb+0x5b7/0x710 [ 787.049271][T17651] ? __alloc_skb+0x140/0x710 [ 787.049288][T17651] __alloc_skb+0x140/0x710 [ 787.049302][T17651] ? __alloc_skb+0x5b7/0x710 [ 787.049316][T17651] ? __pfx___alloc_skb+0x10/0x10 [ 787.049335][T17651] netlink_alloc_large_skb+0x69/0x150 [ 787.049351][T17651] netlink_sendmsg+0x680/0xda0 [ 787.049367][T17651] ? __pfx_netlink_sendmsg+0x10/0x10 [ 787.049382][T17651] ? apparmor_socket_sendmsg+0x15b/0x270 [ 787.049397][T17651] ____sys_sendmsg+0xa4d/0xbe0 [ 787.049409][T17651] ? __pfx_netlink_sendmsg+0x10/0x10 [ 787.049423][T17651] ? __pfx_____sys_sendmsg+0x10/0x10 [ 787.049441][T17651] ___sys_sendmsg+0x190/0x1e0 [ 787.049455][T17651] ? __pfx____sys_sendmsg+0x10/0x10 [ 787.049474][T17651] ? find_held_lock+0x2b/0x80 [ 787.049498][T17651] __sys_sendmsg+0x160/0x210 [ 787.049515][T17651] ? __pfx___sys_sendmsg+0x10/0x10 [ 787.049535][T17651] ? __pfx_ksys_write+0x10/0x10 [ 787.049550][T17651] __do_fast_syscall_32+0xe7/0x970 [ 787.049567][T17651] ? lockdep_hardirqs_on+0x78/0x100 [ 787.049583][T17651] do_fast_syscall_32+0x32/0x70 [ 787.049600][T17651] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 787.049615][T17651] RIP: 0023:0xf7f08fec [ 787.049631][T17651] Code: Unable to access opcode bytes at 0xf7f08fc2. [ 787.049636][T17651] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 787.049648][T17651] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800002c0 [ 787.049656][T17651] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 787.049662][T17651] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 787.049669][T17651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 787.049676][T17651] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 787.049689][T17651] [ 787.065867][T17653] __nla_validate_parse: 3 callbacks suppressed [ 787.065879][T17653] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3321'. [ 787.172798][T17653] dlm: no local IP address has been set [ 787.175091][T17653] dlm: cannot start dlm midcomms -107 [ 787.181617][T17653] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 787.520607][T17660] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 787.804233][T17667] overlayfs: failed to resolve './file0': -2 [ 787.871192][T17668] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 787.873303][T17668] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 787.876053][T17668] vhci_hcd vhci_hcd.0: Device attached [ 788.177052][ T5857] usb 38-1: SetAddress Request (66) to port 0 [ 788.179427][ T5857] usb 38-1: new SuperSpeed USB device number 66 using vhci_hcd [ 788.655051][T17669] vhci_hcd: connection reset by peer [ 788.658299][T15650] vhci_hcd vhci_hcd.0: stop threads [ 788.662757][T15650] vhci_hcd vhci_hcd.0: release socket [ 788.669532][T15650] vhci_hcd vhci_hcd.0: disconnect device [ 788.782780][T13043] Bluetooth: hci1: connection err: -111 [ 789.882967][T17699] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2147484032 (4294968064 ns) > initial count (6 ns). Using initial count to start timer. [ 789.957242][T16532] usb 44-1: device descriptor read/8, error -110 [ 790.230454][T17715] trusted_key: encrypted_key: insufficient parameters specified [ 790.374529][T17724] ntfs3(nullb0): Primary boot signature is not NTFS. [ 790.382106][T17724] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 790.386457][T16532] usb usb44-port1: attempt power cycle [ 790.458695][T17727] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3343'. [ 790.568777][T17731] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 790.570871][T17731] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 790.573670][T17731] vhci_hcd vhci_hcd.0: Device attached [ 790.702822][T17729] netlink: 'syz.0.3342': attribute type 1 has an invalid length. [ 790.706115][T17729] netlink: 756 bytes leftover after parsing attributes in process `syz.0.3342'. [ 790.777287][T16532] usb 44-1: SetAddress Request (41) to port 0 [ 790.781179][T16532] usb 44-1: new SuperSpeed USB device number 41 using vhci_hcd [ 790.806705][ T846] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 790.998527][T17742] overlayfs: failed to resolve './lower': -2 [ 791.067563][ T846] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 791.169237][T17732] vhci_hcd: connection reset by peer [ 791.171332][ T12] vhci_hcd vhci_hcd.3: stop threads [ 791.172879][ T12] vhci_hcd vhci_hcd.3: release socket [ 791.174842][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 791.346646][ T42] audit: type=1800 audit(1785954103.306:155): pid=17755 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.3351" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 791.639412][ T846] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 791.887087][T17737] ceph: No mds server is up or the cluster is laggy [ 792.269147][T17770] overlayfs: failed to resolve './lower': -2 [ 792.360854][ T9874] wlan1: Trigger new scan to find an IBSS to join [ 792.584830][T17780] i2c i2c-0: Failed to register i2c client rt1719 at 0x49 (-16) [ 792.892829][ T9] usb 5-1: USB disconnect, device number 10 [ 793.060625][ T9] ================================================================== [ 793.063237][ T9] BUG: KASAN: slab-use-after-free in snd_usb_midi_v2_free+0x52d/0x670 [ 793.065827][ T9] Write of size 8 at addr ffff88804cf38350 by task kworker/0:0/9 [ 793.068989][ T9] [ 793.070163][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 793.070190][ T9] Tainted: [L]=SOFTLOCKUP [ 793.070195][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 793.070214][ T9] Workqueue: usb_hub_wq hub_event [ 793.070258][ T9] Call Trace: [ 793.070264][ T9] [ 793.070271][ T9] dump_stack_lvl+0x100/0x190 [ 793.070292][ T9] print_report+0x13d/0x4b0 [ 793.070312][ T9] ? __virt_addr_valid+0x239/0x430 [ 793.070334][ T9] ? snd_usb_midi_v2_free+0x52d/0x670 [ 793.070352][ T9] kasan_report+0xdf/0x1c0 [ 793.070374][ T9] ? snd_usb_midi_v2_free+0x52d/0x670 [ 793.070397][ T9] snd_usb_midi_v2_free+0x52d/0x670 [ 793.070416][ T9] ? __pfx_snd_ctl_dev_free+0x10/0x10 [ 793.070448][ T9] snd_usb_midi_v2_free_all+0x85/0xe0 [ 793.070465][ T9] snd_usb_audio_free+0x4e/0x120 [ 793.070491][ T9] ? __pfx_snd_usb_audio_free+0x10/0x10 [ 793.070514][ T9] release_card_device+0xb2/0x1a0 [ 793.070529][ T9] ? __pfx_release_card_device+0x10/0x10 [ 793.070548][ T9] device_release+0xd2/0x270 [ 793.070576][ T9] kobject_put+0x1f7/0x640 [ 793.070594][ T9] ? snd_card_disconnect.part.0+0x443/0x5b0 [ 793.070609][ T9] put_device+0x1f/0x30 [ 793.070628][ T9] snd_card_free_when_closed+0x2b/0x40 [ 793.070643][ T9] usb_audio_disconnect+0x210/0x680 [ 793.070668][ T9] usb_unbind_interface+0x1dd/0x9e0 [ 793.070692][ T9] ? __pfx_usb_unbind_interface+0x10/0x10 [ 793.070711][ T9] device_remove+0x12a/0x180 [ 793.070732][ T9] device_release_driver_internal+0x44e/0x620 [ 793.070792][ T9] bus_remove_device+0x2bc/0x560 [ 793.070809][ T9] ? __pfx_bus_remove_device+0x10/0x10 [ 793.070831][ T9] ? __pfx_device_remove_attrs+0x10/0x10 [ 793.070850][ T9] device_del+0x376/0x9b0 [ 793.070872][ T9] ? __pfx_device_del+0x10/0x10 [ 793.070891][ T9] ? kobject_put+0xb9/0x640 [ 793.070904][ T9] usb_disable_device+0x367/0x810 [ 793.070927][ T9] usb_disconnect+0x2e2/0x9a0 [ 793.070945][ T9] hub_event+0x1c4f/0x4a60 [ 793.070970][ T9] ? __lock_acquire+0x49f/0x1a40 [ 793.070994][ T9] ? do_raw_spin_unlock+0x145/0x1e0 [ 793.071007][ T9] ? __pfx_hub_event+0x10/0x10 [ 793.071030][ T9] ? debug_object_deactivate+0x2e4/0x3b0 [ 793.071062][ T9] ? rcu_is_watching+0x12/0xc0 [ 793.071082][ T9] process_one_work+0xa23/0x1940 [ 793.071111][ T9] ? __pfx_process_one_work+0x10/0x10 [ 793.071137][ T9] ? __pfx_hub_event+0x10/0x10 [ 793.071155][ T9] worker_thread+0x5ef/0xe50 [ 793.071178][ T9] ? kthread+0x13a/0x450 [ 793.071199][ T9] ? __pfx_worker_thread+0x10/0x10 [ 793.071214][ T9] kthread+0x370/0x450 [ 793.071234][ T9] ? __pfx_kthread+0x10/0x10 [ 793.071251][ T9] ret_from_fork+0x72b/0xd50 [ 793.071275][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 793.071289][ T9] ? __switch_to+0x800/0x10f0 [ 793.071317][ T9] ? __pfx_kthread+0x10/0x10 [ 793.071337][ T9] ret_from_fork_asm+0x1a/0x30 [ 793.071361][ T9] [ 793.071371][ T9] [ 793.163067][ T9] Allocated by task 60: [ 793.164414][ T9] kasan_save_stack+0x30/0x50 [ 793.165949][ T9] kasan_save_track+0x14/0x30 [ 793.167425][ T9] __kasan_kmalloc+0xaa/0xb0 [ 793.168904][ T9] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 793.170580][ T9] snd_ump_endpoint_new+0x93/0x470 [ 793.172160][ T9] create_midi2_ump+0x2dd/0x920 [ 793.173625][ T9] snd_usb_midi_v2_create+0x11fa/0x4070 [ 793.175377][ T9] snd_usb_create_stream.isra.0+0x386/0x4d0 [ 793.177387][ T9] usb_audio_probe+0xf05/0x3b10 [ 793.178968][ T9] usb_probe_interface+0x303/0x8f0 [ 793.180591][ T9] really_probe+0x241/0xa60 [ 793.182043][ T9] __driver_probe_device+0x20e/0x450 [ 793.183717][ T9] driver_probe_device+0x4a/0x140 [ 793.185333][ T9] __device_attach_driver+0x1df/0x320 [ 793.187053][ T9] bus_for_each_drv+0x159/0x1e0 [ 793.188550][ T9] __device_attach+0x1e4/0x4d0 [ 793.190085][ T9] device_initial_probe+0xaf/0xd0 [ 793.191688][ T9] bus_probe_device+0x64/0x160 [ 793.193255][ T9] device_add+0x121d/0x1970 [ 793.194705][ T9] usb_set_configuration+0xd97/0x1c60 [ 793.196423][ T9] usb_generic_driver_probe+0xa1/0xe0 [ 793.198124][ T9] usb_probe_device+0xef/0x400 [ 793.199611][ T9] really_probe+0x241/0xa60 [ 793.200965][ T9] __driver_probe_device+0x20e/0x450 [ 793.202678][ T9] driver_probe_device+0x4a/0x140 [ 793.204282][ T9] __device_attach_driver+0x1df/0x320 [ 793.206021][ T9] bus_for_each_drv+0x159/0x1e0 [ 793.207569][ T9] __device_attach+0x1e4/0x4d0 [ 793.209098][ T9] device_initial_probe+0xaf/0xd0 [ 793.210708][ T9] bus_probe_device+0x64/0x160 [ 793.212275][ T9] device_add+0x121d/0x1970 [ 793.213718][ T9] usb_new_device.cold+0x685/0x115c [ 793.215428][ T9] hub_event+0x30a3/0x4a60 [ 793.216872][ T9] process_one_work+0xa23/0x1940 [ 793.218458][ T9] worker_thread+0x5ef/0xe50 [ 793.219936][ T9] kthread+0x370/0x450 [ 793.221239][ T9] ret_from_fork+0x72b/0xd50 [ 793.222746][ T9] ret_from_fork_asm+0x1a/0x30 [ 793.224288][ T9] [ 793.225079][ T9] Freed by task 9: [ 793.226297][ T9] kasan_save_stack+0x30/0x50 [ 793.227826][ T9] kasan_save_track+0x14/0x30 [ 793.229319][ T9] kasan_save_free_info+0x3b/0x70 [ 793.230917][ T9] __kasan_slab_free+0x5f/0x80 [ 793.232473][ T9] kfree+0x22b/0x6c0 [ 793.233721][ T9] snd_rawmidi_dev_free+0x3e/0x60 [ 793.235333][ T9] __snd_device_free+0x1a3/0x300 [ 793.236899][ T9] snd_device_free_all+0xf3/0x220 [ 793.238425][ T9] release_card_device+0x77/0x1a0 [ 793.239954][ T9] device_release+0xd2/0x270 [ 793.241371][ T9] kobject_put+0x1f7/0x640 [ 793.242786][ T9] put_device+0x1f/0x30 [ 793.244101][ T9] snd_card_free_when_closed+0x2b/0x40 [ 793.245836][ T9] usb_audio_disconnect+0x210/0x680 [ 793.247534][ T9] usb_unbind_interface+0x1dd/0x9e0 [ 793.249179][ T9] device_remove+0x12a/0x180 [ 793.250667][ T9] device_release_driver_internal+0x44e/0x620 [ 793.252563][ T9] bus_remove_device+0x2bc/0x560 [ 793.254132][ T9] device_del+0x376/0x9b0 [ 793.255533][ T9] usb_disable_device+0x367/0x810 [ 793.257101][ T9] usb_disconnect+0x2e2/0x9a0 [ 793.258543][ T9] hub_event+0x1c4f/0x4a60 [ 793.259908][ T9] process_one_work+0xa23/0x1940 [ 793.261400][ T9] worker_thread+0x5ef/0xe50 [ 793.262917][ T9] kthread+0x370/0x450 [ 793.264220][ T9] ret_from_fork+0x72b/0xd50 [ 793.265716][ T9] ret_from_fork_asm+0x1a/0x30 [ 793.267248][ T9] [ 793.268024][ T9] The buggy address belongs to the object at ffff88804cf38000 [ 793.268024][ T9] which belongs to the cache kmalloc-4k of size 4096 [ 793.272332][ T9] The buggy address is located 848 bytes inside of [ 793.272332][ T9] freed 4096-byte region [ffff88804cf38000, ffff88804cf39000) [ 793.276561][ T9] [ 793.277336][ T9] The buggy address belongs to the physical page: [ 793.279333][ T9] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4cf38 [ 793.282050][ T9] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 793.284663][ T9] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 793.287054][ T9] page_type: f5(slab) [ 793.288327][ T9] raw: 04fff00000000040 ffff88801bc43040 dead000000000100 dead000000000122 [ 793.290972][ T9] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 793.293671][ T9] head: 04fff00000000040 ffff88801bc43040 dead000000000100 dead000000000122 [ 793.296380][ T9] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 793.299065][ T9] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 793.301737][ T9] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 793.304441][ T9] page dumped because: kasan: bad access detected [ 793.306468][ T9] page_owner tracks the page as allocated [ 793.308233][ T9] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 60, tgid 60 (kworker/1:1), ts 104441419620, free_ts 104418780159 [ 793.314672][ T9] post_alloc_hook+0xfd/0x120 [ 793.316195][ T9] get_page_from_freelist+0xf48/0x3530 [ 793.317911][ T9] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 793.319754][ T9] new_slab+0xa2/0x640 [ 793.321045][ T9] refill_objects+0xe3/0x410 [ 793.322542][ T9] __pcs_replace_empty_main+0x376/0x680 [ 793.324268][ T9] __kmalloc_cache_noprof+0x479/0x6c0 [ 793.325983][ T9] kobject_uevent_env+0x263/0x18b0 [ 793.327597][ T9] device_add+0x1173/0x1970 [ 793.329010][ T9] usb_set_configuration+0xd97/0x1c60 [ 793.330677][ T9] usb_generic_driver_probe+0xa1/0xe0 [ 793.332386][ T9] usb_probe_device+0xef/0x400 [ 793.333909][ T9] really_probe+0x241/0xa60 [ 793.335371][ T9] __driver_probe_device+0x20e/0x450 [ 793.337056][ T9] driver_probe_device+0x4a/0x140 [ 793.338660][ T9] __device_attach_driver+0x1df/0x320 [ 793.340355][ T9] page last free pid 5896 tgid 5896 stack trace: [ 793.342334][ T9] free_pages_prepare+0x586/0xd80 [ 793.343921][ T9] __free_contig_range_common+0x14f/0x250 [ 793.345724][ T9] free_pages_bulk+0x12a/0x200 [ 793.347290][ T9] vm_area_free_pages+0xad/0x2b0 [ 793.348850][ T9] vfree+0x107/0x750 [ 793.350113][ T9] delayed_vfree_work+0x56/0x80 [ 793.351661][ T9] process_one_work+0xa23/0x1940 [ 793.353255][ T9] worker_thread+0x5ef/0xe50 [ 793.354730][ T9] kthread+0x370/0x450 [ 793.356067][ T9] ret_from_fork+0x72b/0xd50 [ 793.357539][ T9] ret_from_fork_asm+0x1a/0x30 [ 793.359066][ T9] [ 793.359835][ T9] Memory state around the buggy address: [ 793.361594][ T9] ffff88804cf38200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 793.364088][ T9] ffff88804cf38280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 793.366609][ T9] >ffff88804cf38300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 793.369089][ T9] ^ [ 793.371168][ T9] ffff88804cf38380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 793.373673][ T9] ffff88804cf38400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 793.376181][ T9] ================================================================== [ 793.401833][ T5857] usb 38-1: device descriptor read/8, error -110 [ 793.482808][ T9] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 793.485152][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 793.488478][ T9] Tainted: [L]=SOFTLOCKUP [ 793.489846][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 793.493033][ T9] Workqueue: usb_hub_wq hub_event [ 793.494727][ T9] Call Trace: [ 793.495827][ T9] [ 793.496772][ T9] dump_stack_lvl+0x100/0x190 [ 793.498309][ T9] vpanic+0x552/0x970 [ 793.499577][ T9] ? __pfx_vpanic+0x10/0x10 [ 793.501011][ T9] ? snd_usb_midi_v2_free+0x52d/0x670 [ 793.502731][ T9] panic+0xd1/0xe0 [ 793.503920][ T9] ? __pfx_panic+0x10/0x10 [ 793.505341][ T9] ? snd_usb_midi_v2_free+0x52d/0x670 [ 793.507047][ T9] ? preempt_schedule_common+0x42/0xc0 [ 793.508754][ T9] check_panic_on_warn.cold+0x19/0x34 [ 793.510453][ T9] end_report.part.0+0x3a/0x90 [ 793.511977][ T9] kasan_report.cold+0xe/0x18 [ 793.513474][ T9] ? snd_usb_midi_v2_free+0x52d/0x670 [ 793.515184][ T9] snd_usb_midi_v2_free+0x52d/0x670 [ 793.516828][ T9] ? __pfx_snd_ctl_dev_free+0x10/0x10 [ 793.518521][ T9] snd_usb_midi_v2_free_all+0x85/0xe0 [ 793.520204][ T9] snd_usb_audio_free+0x4e/0x120 [ 793.521767][ T9] ? __pfx_snd_usb_audio_free+0x10/0x10 [ 793.523538][ T9] release_card_device+0xb2/0x1a0 [ 793.525140][ T9] ? __pfx_release_card_device+0x10/0x10 [ 793.526931][ T9] device_release+0xd2/0x270 [ 793.528397][ T9] kobject_put+0x1f7/0x640 [ 793.529820][ T9] ? snd_card_disconnect.part.0+0x443/0x5b0 [ 793.531685][ T9] put_device+0x1f/0x30 [ 793.533046][ T9] snd_card_free_when_closed+0x2b/0x40 [ 793.534774][ T9] usb_audio_disconnect+0x210/0x680 [ 793.536446][ T9] usb_unbind_interface+0x1dd/0x9e0 [ 793.538101][ T9] ? __pfx_usb_unbind_interface+0x10/0x10 [ 793.539893][ T9] device_remove+0x12a/0x180 [ 793.541364][ T9] device_release_driver_internal+0x44e/0x620 [ 793.543330][ T9] bus_remove_device+0x2bc/0x560 [ 793.544907][ T9] ? __pfx_bus_remove_device+0x10/0x10 [ 793.546659][ T9] ? __pfx_device_remove_attrs+0x10/0x10 [ 793.548432][ T9] device_del+0x376/0x9b0 [ 793.549804][ T9] ? __pfx_device_del+0x10/0x10 [ 793.551357][ T9] ? kobject_put+0xb9/0x640 [ 793.552826][ T9] usb_disable_device+0x367/0x810 [ 793.554407][ T9] usb_disconnect+0x2e2/0x9a0 [ 793.555878][ T9] hub_event+0x1c4f/0x4a60 [ 793.557297][ T9] ? __lock_acquire+0x49f/0x1a40 [ 793.558770][ T9] ? do_raw_spin_unlock+0x145/0x1e0 [ 793.560385][ T9] ? __pfx_hub_event+0x10/0x10 [ 793.561910][ T9] ? debug_object_deactivate+0x2e4/0x3b0 [ 793.563711][ T9] ? rcu_is_watching+0x12/0xc0 [ 793.565244][ T9] process_one_work+0xa23/0x1940 [ 793.566837][ T9] ? __pfx_process_one_work+0x10/0x10 [ 793.568534][ T9] ? __pfx_hub_event+0x10/0x10 [ 793.570062][ T9] worker_thread+0x5ef/0xe50 [ 793.571535][ T9] ? kthread+0x13a/0x450 [ 793.572912][ T9] ? __pfx_worker_thread+0x10/0x10 [ 793.574538][ T9] kthread+0x370/0x450 [ 793.575862][ T9] ? __pfx_kthread+0x10/0x10 [ 793.577329][ T9] ret_from_fork+0x72b/0xd50 [ 793.578803][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 793.580417][ T9] ? __switch_to+0x800/0x10f0 [ 793.581920][ T9] ? __pfx_kthread+0x10/0x10 [ 793.583411][ T9] ret_from_fork_asm+0x1a/0x30 [ 793.584943][ T9] [ 793.586575][ T9] Kernel Offset: disabled [ 793.587940][ T9] Rebooting in 86400 seconds.. VM DIAGNOSIS: 18:21:45 Registers: info registers vcpu 0 CPU#0 RAX=dffffc0000000060 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=ffffffff85a0a5f0 RDI=ffffffff9b9f74e0 RBP=ffffffff9b9f74a0 RSP=ffffc900001b6ed0 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=666f206574697257 R12=0000000000000000 R13=0000000000000020 R14=fffffbfff373eeee R15=dffffc0000000000 RIP=ffffffff85a0a617 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096bdf000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f53bbff4 CR3=000000004f653000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000fefee000 Opmask01=0000000000000000 Opmask02=00000000ffff7fdf Opmask03=0000000000004104 Opmask04=00000000ffdfffff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 44455a494c414954 494e495f43455355 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000557e25ad5170 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fea3bdf1b20 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00ff000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 7373260d56dec4f3 7373737373735e34 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 7373737373737373 7373737373737373 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 30306e6930307069 3130637369313063 6930307064303063 7364303063643230 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 005600051f40494c 43055c5155484005 424b4c55554c4e53 004057005b1a0f00 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 d806f84eff3d1db0 0000557b724e9132 00000000000000d1 000000000000302e ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 d806f84eff3d1db0 0000000557e25ad9 00000000000002a1 0000003177610030 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3139312c3039312c 4638312c4538312c 4238312c3938312c 3838312c3538312c ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3438312c3138312c 3937312c3737312c 3437312c4436312c 4336312c3636312c ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 3336312c3136312c 3036312c30462c46 442c30442c46432c 38412c37412c4639 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000454d10 00004c4c254b1d52 0000000000000021 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00004c4c254b1710 0000000000000021 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000002baca81 RBX=ffff88801c742540 RCX=ffffffff8bb892d5 RDX=0000000000000000 RSI=ffffffff8e1a9b0a RDI=ffffffff8c400a80 RBP=ffffed10038e84a8 RSP=ffffc9000046fe00 R8 =0000000000000001 R9 =ffffed100566678d R10=ffff88802b333c6b R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff9200008dfc4 R15=dffffc0000000000 RIP=ffffffff8bb8789f RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096cdf000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f7fea190 CR3=000000004f653000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000f000000000 0000000300000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000001 RBX=0000000000000000 RCX=0000000000000002 RDX=0000000000000000 RSI=ffffffff81b803d1 RDI=ffffffff8ebe8000 RBP=ffffffff8ebe8000 RSP=ffffc90002d370c8 R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000200 R11=000000000000b931 R12=ffffffff81b803d1 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff82791d7a RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007ff80e74e300 ffffffff 00c00000 GS =0000 ffff888096ddf000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000055e772790000 CR3=0000000051739000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000005000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=00000004000008fd RBX=ffff88801c2d8488 RCX=0000000000000830 RDX=0000000000000004 RSI=00000000000000fd RDI=0000000000000002 RBP=0000000000000002 RSP=ffffc90005f477d0 R8 =0000000000000000 R9 =fffffbfff22455fa R10=ffffffff9122afd7 R11=0000000000000000 R12=0000000000000004 R13=1ffff92000be8efe R14=ffffc90005f47810 R15=0000000000000010 RIP=ffffffff81b69c1a RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096edf000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080004000 CR3=0000000050785000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000005000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000