last executing test programs: 1m3.038669345s ago: executing program 32 (id=591): r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) ioctl$CDROMVOLCTRL(r0, 0x5392, 0x0) 1m1.412627263s ago: executing program 1 (id=617): ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000440)={{0x0, 0x2, 0x0, 0x25}, 'syz0\x00', 0x53}) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x12) ioctl$UI_SET_SNDBIT(0xffffffffffffffff, 0x4004556a, 0x1) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) read$hiddev(0xffffffffffffffff, &(0x7f0000000040)=""/117, 0x75) 1m1.370645161s ago: executing program 1 (id=619): r0 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) connect$pppl2tp(r0, &(0x7f0000000300)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x1, 0x1, 0x4, 0x1, {0xa, 0x4e21, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x2}}}, 0x3a) 1m1.265880831s ago: executing program 1 (id=620): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000380), 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDCTL_SEQ_SYNC(r1, 0x5101) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[], 0x94}}, 0x0) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000040)=0x1, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000002c0)={'veth1_to_bridge\x00'}) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000480)=@urb_type_iso={0x0, {0x1, 0x1}, 0x449e, 0xc0, 0x0, 0x0, 0x3, 0x60000, 0x4, 0x4, 0x6, 0x0, [{0x0, 0xb5d1, 0x4}, {0x6, 0x8, 0x4}, {0x0, 0xf8000000, 0x4}, {0x3, 0xffffffff, 0x400}]}) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) socket$key(0xf, 0x3, 0x2) r6 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) ioctl$VIDIOC_S_INPUT(r6, 0xc0045627, &(0x7f0000000080)=0x2) ioctl$VIDIOC_S_SELECTION(r6, 0xc040565f, &(0x7f0000000040)={0x9, 0x100, 0x0, {0xa, 0x3, 0x7, 0xfffffffe}}) 1m1.210077203s ago: executing program 1 (id=621): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet_udp(0x2, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$SNDRV_PCM_IOCTL_UNLINK(0xffffffffffffffff, 0x40044160, 0x3) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) io_uring_register$IORING_REGISTER_FILES_UPDATE2(0xffffffffffffffff, 0xd, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x80042, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) write$binfmt_aout(r1, &(0x7f00000003c0)=ANY=[], 0xfce1) ioctl$TCFLSH(r0, 0x540b, 0x1) writev(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 1m1.130434947s ago: executing program 1 (id=623): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB]) r2 = creat(0x0, 0x59) quotactl_fd$Q_GETNEXTQUOTA(r2, 0xffffffff80000900, 0x0, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="010000000100000001000000010000000600") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff000000") r3 = syz_clone(0x82000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r3, &(0x7f0000000ac0)='syscall\x00') fcntl$getownex(r2, 0x10, &(0x7f00000001c0)={0x0, 0x0}) ioctl$CDROMRESUME(r2, 0x5302) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, 0x0) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r2, &(0x7f0000000280)={r2, 0xffffffffffffffff, 0x8344}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) close(r5) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) 1m1.0393829s ago: executing program 1 (id=624): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x82702) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000140)={0x0}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02864c3, &(0x7f00000002c0)={&(0x7f0000000280)=[r1], 0x200000000000000, 0x1, 0x2}) 1m0.371495107s ago: executing program 4 (id=632): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', 0x0, 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000002, 0xc3072, 0xffffffffffffffff, 0x200000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r0, 0x2, 0x0) getdents64(r0, 0x0, 0x22) 1m0.269501728s ago: executing program 4 (id=633): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000840)=@newtfilter={0x3c, 0x2c, 0x401, 0x0, 0x25dfdbf8, {0x0, 0x0, 0x0, r4, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x3, 0xd}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8855}, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) 1m0.129318923s ago: executing program 4 (id=634): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffffc}, 0x50) 1m0.050506157s ago: executing program 4 (id=635): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_mnt\x00', 0xfe) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/kcore\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) read$FUSE(r0, &(0x7f0000000140)={0x2020}, 0xeffd) 59.987802095s ago: executing program 4 (id=636): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB]) r2 = creat(0x0, 0x59) quotactl_fd$Q_GETNEXTQUOTA(r2, 0xffffffff80000900, 0x0, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="010000000100000001000000010000000600") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff000000") r3 = syz_clone(0x82000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r3, &(0x7f0000000ac0)='syscall\x00') fcntl$getownex(r2, 0x10, &(0x7f00000001c0)={0x0, 0x0}) ioctl$CDROMRESUME(r2, 0x5302) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, 0x0) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r2, &(0x7f0000000280)={r2, 0xffffffffffffffff, 0x8344}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) close(r5) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) 59.890281208s ago: executing program 4 (id=637): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r2, &(0x7f0000000380)='100000', 0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x3, 0xc1}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}}, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x34, r7, 0x1, 0x70bd2c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x34}}, 0x0) 45.809199917s ago: executing program 33 (id=624): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x82702) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000140)={0x0}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r2, 0xc02864c3, &(0x7f00000002c0)={&(0x7f0000000280)=[r1], 0x200000000000000, 0x1, 0x2}) 44.326605672s ago: executing program 34 (id=637): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r2, &(0x7f0000000380)='100000', 0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x3, 0xc1}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}}, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x34, r7, 0x1, 0x70bd2c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}]}, 0x34}}, 0x0) 30.754532059s ago: executing program 6 (id=845): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x80000001, @empty, 0x4}], 0x1c) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x22004001, 0x0, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x1000000, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x5, @loopback, 0x4}, 0x1c, &(0x7f0000001840)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x400c043) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) 30.751935252s ago: executing program 6 (id=848): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000000300)={{0xd, 0x7}, 'port1\x00', 0xa7, 0x0, 0x8, 0x6, 0x7, 0x2, 0x0, 0x0, 0x4, 0x6}) 30.695850569s ago: executing program 6 (id=849): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0xa82, 0x0) write$cgroup_int(r0, &(0x7f0000000040)=0x4000921, 0x12) 30.618558756s ago: executing program 6 (id=853): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000005c0)={0x1, 0x0, [{0xc0011022, 0x0, 0xc000004}]}) 30.55848667s ago: executing program 2 (id=857): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, r1, {0x7, 0x29, 0x80000009, 0xffffffff8888f9b5, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x4809ca8e114c6e67, 0x80000001}}, 0x50) r2 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x2c) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getdents64(r2, 0x0, 0x0) 30.489680155s ago: executing program 6 (id=859): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB]) r2 = creat(0x0, 0x59) quotactl_fd$Q_GETNEXTQUOTA(r2, 0xffffffff80000900, 0x0, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="010000000100000001000000010000000600") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff000000") r3 = syz_clone(0x82000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r3, &(0x7f0000000ac0)='syscall\x00') fcntl$getownex(r2, 0x10, &(0x7f00000001c0)={0x0, 0x0}) ioctl$CDROMRESUME(r2, 0x5302) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r2, &(0x7f0000000280)={r2, 0xffffffffffffffff, 0x8344}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) close(r5) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) listen(0xffffffffffffffff, 0x402) socket$nl_route(0x10, 0x3, 0x0) 30.398784412s ago: executing program 6 (id=861): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl(r2, 0x4048aecb, &(0x7f0000000100)) 29.639836698s ago: executing program 2 (id=869): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r0, &(0x7f0000001440)={0x2020}, 0x2020) 29.563917416s ago: executing program 2 (id=870): io_setup(0x3ff, &(0x7f0000000500)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='proc\x00', 0x8000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) io_destroy(r0) 29.466974145s ago: executing program 2 (id=874): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) mkdir(0x0, 0x0) chdir(0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000001400)={{0x7f, 0x45, 0x4c, 0x46, 0x7, 0x10, 0xf, 0x1, 0x3de1, 0x3, 0x3e, 0xfffffff7, 0x1d8, 0x40, 0x223, 0x8, 0x6, 0x38, 0x1, 0x74, 0x7, 0x104}, [{0x5, 0x10001, 0x3, 0x8, 0x9, 0x7c6, 0x7, 0xe96c}], "ec42b0de55023beef4735862f6db5bd6961b9c6a8e73d14e91bdd75a205438c746a8322519df8b5ff9fb1a0a"}, 0xa4) unlink(0x0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB, @ANYRES32=r2, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="90000000", @ANYRES16=r3, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="0600cd00000000006c003300802009000802110000010802110000005050505050505f00ff"], 0x90}, 0x1, 0x0, 0x0, 0xc0}, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) 29.349863331s ago: executing program 2 (id=876): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB]) r2 = creat(0x0, 0x59) quotactl_fd$Q_GETNEXTQUOTA(r2, 0xffffffff80000900, 0x0, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="010000000100000001000000010000000600") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff000000") r3 = syz_clone(0x82000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r3, &(0x7f0000000ac0)='syscall\x00') fcntl$getownex(r2, 0x10, &(0x7f00000001c0)={0x0, 0x0}) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, 0x0) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r2, &(0x7f0000000280)={r2, 0xffffffffffffffff, 0x8344}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) close(r5) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) listen(0xffffffffffffffff, 0x402) socket$nl_route(0x10, 0x3, 0x0) 29.269428821s ago: executing program 2 (id=877): syz_emit_ethernet(0x0, 0x0, 0x0) 24.459671438s ago: executing program 0 (id=929): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280), 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffffc}, 0x50) 24.359701102s ago: executing program 0 (id=930): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000001540), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, &(0x7f0000001580)={0xd, 0x1, 0x7}) r1 = syz_open_procfs(0x0, &(0x7f00000020c0)='net/wireless\x00') sysinfo(0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{}], 0x1}, 0x6) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000080)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=ANY=[@ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7009900000000009500010000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="18120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xa002, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r6, 0x1, 0x7, 0x0, 0x45) ioctl$KVM_RUN(r5, 0xae80, 0x0) preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000000)=""/216, 0xd8}, {&(0x7f0000000140)=""/142, 0x8e}, {&(0x7f0000000200)=""/87, 0x57}], 0x3, 0x1b, 0x400) socket$nl_rdma(0x10, 0x3, 0x14) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaa40ae4b2f8345f4b0aaa74996aaaaaaaaaaaaaaaaaa1c08060304600506040003ffffffffffffab7309fdaaaaaaaaaa41785321db2948865a88c301780d5c891c159883cb54f3ce4e842a075a98a33ac813f925a1abe0a3bf4590dbbb746d903183000e76167ba9455ca635c1c6d7946732059b155edbf2609dee30533e569c8aa0694a54b63865e827149bef7d2afc86c110f93f51"], 0x0) 24.219057274s ago: executing program 0 (id=931): syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB], 0x7) 24.218842898s ago: executing program 0 (id=932): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) 24.109988661s ago: executing program 0 (id=933): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB]) r2 = creat(0x0, 0x59) quotactl_fd$Q_GETNEXTQUOTA(r2, 0xffffffff80000900, 0x0, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="010000000100000001000000010000000600") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff000000") r3 = syz_clone(0x82000000, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$getownex(r2, 0x10, &(0x7f00000001c0)={0x0, 0x0}) ioctl$CDROMRESUME(r2, 0x5302) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, 0x0) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r2, &(0x7f0000000280)={r2, 0xffffffffffffffff, 0x8344}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) close(r5) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) listen(0xffffffffffffffff, 0x402) socket$nl_route(0x10, 0x3, 0x0) 24.006674424s ago: executing program 0 (id=935): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0xffff}, {0xffff, 0xffff}, {0x2, 0x10}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xd, [0xc, 0xe, 0x5, 0x1, 0xa, 0xd, 0x3, 0xa, 0x4, 0xf, 0xc, 0x5, 0xa, 0x10, 0xe, 0x4], 0x0, [0x1, 0x2, 0x4, 0x5, 0x9, 0x3, 0x1, 0x6, 0x0, 0x81, 0x2, 0x1000, 0x4, 0xc, 0x0, 0x7], [0xfffd, 0xd, 0xd96c, 0x0, 0x2, 0x2, 0x3ff, 0x2, 0x9, 0x7, 0xfff, 0x891d, 0x4, 0xd, 0x8, 0x5]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x4}, {0xffff}, {0xfff3, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0xd, 0x6, 0x8, 0x8, 0x2, 0x0, 0x1, 0x8, 0xff, 0x10, 0x4], 0x3, [0xc, 0x101, 0x4, 0x2002, 0x1, 0x4, 0x1853, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x27, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r9 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r11 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r11, 0x0, 0x0, 0x4, &(0x7f0000000140)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @multicast}, 0x14) r12 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r12, 0x0, 0x0, 0x48040, &(0x7f00000001c0)={0x11, 0x7, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) 22.872027437s ago: executing program 5 (id=939): r0 = syz_clone(0x82020000, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r1) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x80, 0x0) syz_open_procfs(r0, &(0x7f0000000040)='environ\x00') syz_usb_connect$cdc_ecm(0x5, 0x4d, &(0x7f00000002c0)=ANY=[@ANYBLOB="12011001020000202505"], 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 19.759826467s ago: executing program 5 (id=940): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xfffffffe}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0xd}]}}}]}]}], {0x14}}, 0xd8}, 0x1, 0x0, 0x0, 0x2000c045}, 0x24000004) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 19.759548978s ago: executing program 5 (id=941): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYBLOB, @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) 19.699634171s ago: executing program 5 (id=942): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) symlink(&(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x0) 19.64992879s ago: executing program 5 (id=943): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB]) r2 = creat(0x0, 0x59) quotactl_fd$Q_GETNEXTQUOTA(r2, 0xffffffff80000900, 0x0, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="010000000100000001000000010000000600") ioctl(r1, 0x400c0930, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff000000") r3 = syz_clone(0x82000000, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$getownex(r2, 0x10, &(0x7f00000001c0)={0x0, 0x0}) ioctl$CDROMRESUME(r2, 0x5302) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, 0x0) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r2, &(0x7f0000000280)={r2, 0xffffffffffffffff, 0x8344}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) close(r5) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) listen(0xffffffffffffffff, 0x402) socket$nl_route(0x10, 0x3, 0x0) 19.558977728s ago: executing program 5 (id=944): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x5, 0xfffa}, 0xa, [0x6, 0xc95a, 0xfffffff3, 0x9, 0x7f, 0x0, 0xfffffffd, 0x8, 0x6, 0xfffffff9, 0xfffffff2, 0x5f, 0xa, 0x3, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x69a4, 0x80000001, 0x4, 0x5, 0x100000, 0x3c5b, 0x1, 0x24, 0xffffffff, 0xfffffffe, 0x1f461e2c, 0x24000, 0xe661, 0x4, 0x9, 0x3, 0x7fff, 0x4, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x407, 0x7, 0x10103, 0x0, 0x5, 0x3c, 0x91, 0x2, 0xfffffffd, 0x3, 0x5, 0x0, 0x8, 0x4, 0x80, 0x0, 0x5, 0x2, 0x8, 0x4, 0xfffffffd, 0x514], [0x10000007, 0x8, 0x12f, 0x8000, 0x10, 0x4, 0x129432e2, 0xcb, 0xf9, 0xd, 0xffff, 0x6c9, 0x9, 0xfffffffe, 0x7, 0x0, 0x10007, 0x5, 0x2f, 0xb99, 0x312, 0x78, 0xea4, 0xa, 0x6, 0x4000, 0x8000, 0x9, 0x400, 0x1, 0x6, 0xff7ffffd, 0x8, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x4ecf, 0x7f, 0x9, 0x5, 0xd, 0x80004, 0x1, 0x7, 0xb, 0x9, 0x48c93690, 0x3, 0xff], [0x7, 0x800004, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x9, 0x1, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x4, 0x5, 0xcf, 0x1ef, 0x5, 0x8, 0x85, 0x6, 0x10000009, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x7, 0x7c, 0xffffffff, 0x4, 0x2, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d6, 0xbf, 0x200, 0x3, 0x400002, 0xfffffff9, 0x0, 0x0, 0x0, 0x0, 0x6, 0x6, 0x120000, 0x3, 0x6, 0x9, 0x4], [0x9, 0xbb30, 0x3, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x8ad, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x4, 0x5, 0xffffffff, 0x7ffffffe, 0x5, 0x2, 0x100c8, 0x3, 0x2, 0xffff, 0x3, 0x9, 0x100, 0x9602, 0xa, 0x2, 0x4, 0x493, 0x1, 0x10003, 0x5, 0x8, 0x2b91, 0xa1f, 0x108, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x100005, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x0) r0 = syz_open_dev$evdev(0x0, 0x3, 0x822b01) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) write$char_usb(r0, &(0x7f0000000040)="e2", 0x918) 15.296330764s ago: executing program 35 (id=861): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl(r2, 0x4048aecb, &(0x7f0000000100)) 13.293244665s ago: executing program 36 (id=877): syz_emit_ethernet(0x0, 0x0, 0x0) 9.957125529s ago: executing program 7 (id=948): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000d00)={0x0, 'syz_tun\x00', {0x4}, 0xa}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_usb_connect$printer(0x0, 0x2d, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xc) socket$inet_smc(0x2b, 0x1, 0x0) 9.699754582s ago: executing program 7 (id=949): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) 8.78193652s ago: executing program 37 (id=935): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0xffff}, {0xffff, 0xffff}, {0x2, 0x10}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xd, [0xc, 0xe, 0x5, 0x1, 0xa, 0xd, 0x3, 0xa, 0x4, 0xf, 0xc, 0x5, 0xa, 0x10, 0xe, 0x4], 0x0, [0x1, 0x2, 0x4, 0x5, 0x9, 0x3, 0x1, 0x6, 0x0, 0x81, 0x2, 0x1000, 0x4, 0xc, 0x0, 0x7], [0xfffd, 0xd, 0xd96c, 0x0, 0x2, 0x2, 0x3ff, 0x2, 0x9, 0x7, 0xfff, 0x891d, 0x4, 0xd, 0x8, 0x5]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x4}, {0xffff}, {0xfff3, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x9, 0x0, 0xf, 0x10, 0xd, 0x6, 0x8, 0x8, 0x2, 0x0, 0x1, 0x8, 0xff, 0x10, 0x4], 0x3, [0xc, 0x101, 0x4, 0x2002, 0x1, 0x4, 0x1853, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x27, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r9 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r11 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r11, 0x0, 0x0, 0x4, &(0x7f0000000140)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @multicast}, 0x14) r12 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r12, 0x0, 0x0, 0x48040, &(0x7f00000001c0)={0x11, 0x7, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) 8.543529381s ago: executing program 7 (id=954): r0 = socket(0x10, 0x80002, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'vlan0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="15e3000000000000140012800c0001006d616376746170000400028008000500", @ANYRES32=r2, @ANYBLOB="0a000100aaaa"], 0x48}}, 0x0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 8.360707866s ago: executing program 7 (id=955): r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='secret\x00', &(0x7f0000000200)='AQB1234567890123456789012345678901234567890=\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000300)='key\x00', 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000700)='fsid\x00', &(0x7f0000000800)='00000000-0000-0000-0000-000000000000\x00', 0x0) 8.318526922s ago: executing program 7 (id=956): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB]) r2 = creat(0x0, 0x59) quotactl_fd$Q_GETNEXTQUOTA(r2, 0xffffffff80000900, 0x0, 0x0) ioctl(r1, 0x40140921, &(0x7f0000000420)="010000000100000001000000010000000600") ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff000000") r3 = syz_clone(0x82000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r3, &(0x7f0000000ac0)='syscall\x00') fcntl$getownex(r2, 0x10, &(0x7f00000001c0)={0x0, 0x0}) ioctl$CDROMRESUME(r2, 0x5302) ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, 0x0) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r2, &(0x7f0000000280)={r2, 0xffffffffffffffff, 0x8344}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) close(r5) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) listen(0xffffffffffffffff, 0x402) socket$nl_route(0x10, 0x3, 0x0) 8.180049063s ago: executing program 7 (id=957): socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x4000004) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = gettid() timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write(r0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='md0', 0x3) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x2, 0x0) write(r3, &(0x7f0000000300)='raid1', 0x5) r4 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000380)='1:0', 0x3) r5 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/raid_disks\x00', 0x2, 0x0) write(r5, &(0x7f0000000400)='1', 0x1) write(0xffffffffffffffff, &(0x7f0000000480)='0', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/array_state\x00', 0x2, 0x0) write(r6, &(0x7f0000000500)='active', 0x6) write(r3, &(0x7f0000000540)='raid', 0x4) 4.553150907s ago: executing program 38 (id=944): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x5, 0xfffa}, 0xa, [0x6, 0xc95a, 0xfffffff3, 0x9, 0x7f, 0x0, 0xfffffffd, 0x8, 0x6, 0xfffffff9, 0xfffffff2, 0x5f, 0xa, 0x3, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x69a4, 0x80000001, 0x4, 0x5, 0x100000, 0x3c5b, 0x1, 0x24, 0xffffffff, 0xfffffffe, 0x1f461e2c, 0x24000, 0xe661, 0x4, 0x9, 0x3, 0x7fff, 0x4, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x407, 0x7, 0x10103, 0x0, 0x5, 0x3c, 0x91, 0x2, 0xfffffffd, 0x3, 0x5, 0x0, 0x8, 0x4, 0x80, 0x0, 0x5, 0x2, 0x8, 0x4, 0xfffffffd, 0x514], [0x10000007, 0x8, 0x12f, 0x8000, 0x10, 0x4, 0x129432e2, 0xcb, 0xf9, 0xd, 0xffff, 0x6c9, 0x9, 0xfffffffe, 0x7, 0x0, 0x10007, 0x5, 0x2f, 0xb99, 0x312, 0x78, 0xea4, 0xa, 0x6, 0x4000, 0x8000, 0x9, 0x400, 0x1, 0x6, 0xff7ffffd, 0x8, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x4ecf, 0x7f, 0x9, 0x5, 0xd, 0x80004, 0x1, 0x7, 0xb, 0x9, 0x48c93690, 0x3, 0xff], [0x7, 0x800004, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x9, 0x1, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x4, 0x5, 0xcf, 0x1ef, 0x5, 0x8, 0x85, 0x6, 0x10000009, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x7, 0x7c, 0xffffffff, 0x4, 0x2, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d6, 0xbf, 0x200, 0x3, 0x400002, 0xfffffff9, 0x0, 0x0, 0x0, 0x0, 0x6, 0x6, 0x120000, 0x3, 0x6, 0x9, 0x4], [0x9, 0xbb30, 0x3, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x8ad, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x4, 0x5, 0xffffffff, 0x7ffffffe, 0x5, 0x2, 0x100c8, 0x3, 0x2, 0xffff, 0x3, 0x9, 0x100, 0x9602, 0xa, 0x2, 0x4, 0x493, 0x1, 0x10003, 0x5, 0x8, 0x2b91, 0xa1f, 0x108, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x100005, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x0) r0 = syz_open_dev$evdev(0x0, 0x3, 0x822b01) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) write$char_usb(r0, &(0x7f0000000040)="e2", 0x918) 1.499461022s ago: executing program 9 (id=997): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x142, 0x80) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) 1.419450077s ago: executing program 9 (id=999): mkdirat(0xffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, 0x0, &(0x7f0000000040)='proc\x00', 0x0, 0x0) openat(0xffffff9c, &(0x7f00000001c0)='./proc/sys/net/ipv6/conf/all/force_mld_version\x00', 0x1, 0x5) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'geneve1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000300"/20, @ANYRES32=r1, @ANYRESHEX=r1], 0x3c}, 0x1, 0x2}, 0x0) 1.350030497s ago: executing program 9 (id=1001): r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_settime(0x0, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x6, 0x2, 0x80, 0x0, 0x1, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x24000000) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c49f8f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) 815.082427ms ago: executing program 8 (id=1006): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x142, 0x80) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) 742.290775ms ago: executing program 8 (id=1007): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000240)={0x1, 0x0, [{0x26a, 0x0, 0x2}]}) 574.063335ms ago: executing program 8 (id=1008): mkdirat(0xffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, 0x0, &(0x7f0000000040)='proc\x00', 0x0, 0x0) openat(0xffffff9c, &(0x7f00000001c0)='./proc/sys/net/ipv6/conf/all/force_mld_version\x00', 0x1, 0x5) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'geneve1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000300"/20, @ANYRES32=r1, @ANYRESHEX=r1], 0x3c}, 0x1, 0x2}, 0x0) 573.463666ms ago: executing program 8 (id=1009): socket$inet(0x2, 0x3, 0x6) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000000c0)=[{0x0}], 0x1) 573.327314ms ago: executing program 3 (id=1010): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r0, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x3, 0x400080, 0x14, "3eccd80000000000000000100000000401feff"}) 459.681047ms ago: executing program 3 (id=1011): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="1709000000000000000001000000050007000000000008000900feffffff1400200000000000000000000000ffffac1414bb08000a0004000000060002000100000014001f000000"], 0x5c}, 0x1, 0x620b}, 0x40000) 459.366062ms ago: executing program 8 (id=1012): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000001540), 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, &(0x7f0000001580)={0xd, 0x1, 0x7}) r1 = syz_open_procfs(0x0, &(0x7f00000020c0)='net/wireless\x00') sysinfo(0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{}], 0x1}, 0x6) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000080)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=ANY=[@ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7009900000000009500010000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xa002, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r6, 0x1, 0x7, 0x0, 0x45) ioctl$KVM_RUN(r5, 0xae80, 0x0) preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000000)=""/216, 0xd8}, {&(0x7f0000000140)=""/142, 0x8e}, {&(0x7f0000000200)=""/87, 0x57}], 0x3, 0x1b, 0x400) socket$nl_rdma(0x10, 0x3, 0x14) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaa40ae4b2f8345f4b0aaa74996aaaaaaaaaaaaaaaaaa1c08060304600506040003ffffffffffffab7309fdaaaaaaaaaa41785321db2948865a88c301780d5c891c159883cb54f3ce4e842a075a98a33ac813f925a1abe0a3bf4590dbbb746d903183000e76167ba9455ca635c1c6d7946732059b155edbf2609dee30533e569c8aa0694a54b63865e827149bef7d2afc86c110f93f51"], 0x0) 423.769706ms ago: executing program 3 (id=1013): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'team_slave_0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000040)) syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r1, 0x0, 0x0) 417.211183ms ago: executing program 9 (id=1014): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x142, 0x80) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) 327.248183ms ago: executing program 3 (id=1015): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000400)='cdg', 0x3) write$binfmt_script(r0, &(0x7f0000000200), 0xfffffd9d) 326.865672ms ago: executing program 8 (id=1016): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) 326.562873ms ago: executing program 3 (id=1017): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x2, 0x0) write(r1, &(0x7f0000000300)='raid1', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='1:0', 0x3) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/raid_disks\x00', 0x2, 0x0) write(r3, &(0x7f0000000400)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/block/md0/md/dev-ram0/slot\x00', 0x2, 0x0) write(r4, &(0x7f0000000480)='0', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/array_state\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)='active', 0x6) write(r1, &(0x7f0000000540)='raid0', 0x5) 314.318636ms ago: executing program 9 (id=1018): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_MEMORY_ENCRYPT_UNREG_REGION(r1, 0x8010aebc, &(0x7f0000000580)={0xa000, 0xb000}) 139.541927ms ago: executing program 9 (id=1019): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) syz_usb_connect$uac3(0x5, 0x80, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201010200000008733b230040000102030109026e00"], &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041) socket$nl_generic(0x10, 0x3, 0x10) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, r1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x4000) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}], 0x70}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x2, 0x91, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x800, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x8000, 0x3, 0x27e, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) write(r0, &(0x7f00000000c0)='7', 0x1) 0s ago: executing program 3 (id=1020): bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000027c0)={&(0x7f0000000600)="10a5e5f13b55f1fa97d030fcbe4e15b8bf91e385030937e510538e56961ef7b16a9e57b159dde5300b397c2f2116434526cffcabcb68e122bf3a08ca5ed9c9b6367fd7d37f09cad12b95823422bea0ff2f6b0843373587b28d766cc2c949ade901aa536f2017d97394f7a0c0ff120a5b12204a1a2e1dbe4ef9f93a5eaa4a178cacd30de86dbbac2106cbb495eacc32ae3d892dc3049b0d46b0e87ef40bc493bde5c69a7cc9e9004a40a14882d2dad996b2313d799412ee2cd0906209ed882eeaffb5754b2f17d2fb5a72f3ad9d2f8bca6a57d4ec7b5f5297ef2652ce23aa3a379b393a7b9cb6785604b0789c9c59d8bc465213c70dde3647c6042d2a91d001ccad6d22a083ce0accb6fcf4f6dae459029a3bdc1f1a5dc76b72507be68644776f1df94d9db67000d40ff526e087f51b52d2012a8582c54b204b80bb8b24c8cbbf6d9a987f06245d35e16cf44fd109bcedc927ab14dbbab3bf8a68bd9dfc219b58f17fc4284144b07a65bff98e7d4f3b5c1d449b0931170b2f652aeb83b673315c8b29b6f8ee79f051cf24264aa115267d868464eeab269630a80c81482119468c53611f0c058e64e1e4bc4b884b6e10b812273d049bf8c258329c37d1cf9b5b5eb4793e9e83118ff8a936606b07da88898e1b1d9a01e11cd76eb6f61061e1763a04ac414cea85d14a7f495352548d7c2460d057b788597f0491043dc4e128ab1938a49cc6486f365287484493ede30fd1c7b6d4cfde4154d602a2c878d62fecd82b1eddf6df8b3912148442924b8abb421916feac7f5d325ac4435b1f8ce86edf508dd8a7f0095005b25d8ff33c43efcca2fb1166f3735fb506c720c87603eecc92af18e669ccb44a90bb647ceb12da5bead504c831782ac0cdf4168fad7501a5fb74f5f5e617481669e15a0d9afab9572c87d58261cf9cb08cd7ef84246bcb5dfc5d58e4f776f8c2c62a40a307c21975f85ba556418d41f257507e15d1f957116366975e1c756c574fd35c36e4daf76e7ffe946cbc425f88f2e4950bb61f67345d9c048a56ae0222a3234ce0dc948fb3c4316f45e8f8cb8232fe3d5f17e74b62eafb4c21a189a4bfa6da860f9ebbbe5d4a761d30d8369c06e2ea51321c1bce0f873c0104e7b03caf48f64f65a761f95630000a5955322229386652663c85c1567c54919a62f8b3370a3de0f87864a4b4326354e58627511709df8720c43d0f9d39c49b9534fe4016b2fbbdfbadd00688076fce33443037279a0ba1ebc06281f8553872ba38314c39b5f4d59e84c8c7d3a726f978bb32389397246d7ed565b926f2c406dca6be057e1c8027c08ee0589484a871339eaa35832a83c73dc5a21a0af4bc83e69bf207a7b151dffc640d567455ff6fc97627a5d1813b5612aa1637829836f782e6ad942ead182f3620dc9cedb9c28ab0b1eddeaa2e246c6dfa2221e315e33d74d44cdaaf3f7e8689cd289f5e8a28ffe81963e1d65bddac56abfa1973d78814a141682f453d4355590ca4a55d2aa5d603e50388ab663e06b1471d9cfd02714df4de277ca2728bb9a6f4b9aa2227d30c19f4e1fd453b4701c220247ddd59cf299c55bc79d95f4e737504d40fd6540e937ad689d442b87a73932a9aa931a6e565aebf7d424cacdd9eed757ba59b0e53e4f2176b8c117d11146186f3a717607fceea810b37eaf12618aac1c5325c21032bf95006740b453c499ec37cadeb449d8fdaff52f5c53e8f00b34f9ffe05e0f984b55fc5b3d59cc8e18c7265b252e94bf456e1be3e0eb2db49f00d636e63096db85852825d20069d9d53a2eb39994a11a68226a9afa5d56fc8732f1398193eba397f01163e3200bd935783243903c521871b5e85bb31a9b8149130a36899726bf5d0e3a1f1212ad24e0b7874d903f92e302db2e7252bceb21fe245d7d1602e71b735eda9a9afa0b0ead18d401b941e73f4ada298a1a31fc257a07ddf81c85376ff01d3f2c35cc3b1809091d2e3971356127a2b13391c3907e01bf523f0d932b03ebae0e1a67ab3fe43da7337d221f09fee46ebcaa2974e5e0a8dc62aa8da7bb4655511d22341ca7947dde8d1626b20bd9860f7901c26060238f76eca04b55a12d0d30b377a90d1e07ac016d097533d52b3bde7acff69ca716665543a395a78e3c3b0891952d5331f5a1f56c78a6028104a5f17570079a12e5d2b34fa80bd41bc45442d5c2dda289dac8d164a1e8dd6c2a0d57208bdf084dfbaf864d9998f0235eafd4303573d6c00cbbfa7682501cf6aeddb7e78d09e3959096ee7156192c584dfe11a909254503a20190567bae6436ce68b81c758e82d263ab8f92d9ea6bd1e5c0e11846ffd81cc18039a97535850671841690237009f180a8d3437300e3cea59f87eb4be9f5b3fb827389121f34a7fa51ce15d8419066da538941d5afaf5fcb9e228e80fdddf4f202ab1430701a9a451bb118bab828f3eef4bb1f7a8b67ab4386fe9ccd3d4a07995629117fbab9abfc18f514d84266d6fcdf03cbb6ca6a62145cb2873bd7d7bded2ec59fc5199da47cd44bbc00343fc4cc91be48823ac64540a9a658b6345b6ebcc21a7e1e6c55bd096459722226b6a2950fb2d144ffe865b78009a25de59b8656b2c5d172c82daf78bccbb81120918b6f1d82315cb2f6f87c2405ddb98d73cd6acab5a21aeaca46b06058bca3568c318ae502c9d81f9a07debe7a1c0fa58a6c17dbddd333063c74439ba94ccb519b5965d49a60330c6c44538fce35a2462d3ed2483010e3a2a3c6c170be0a3e08d527a22fefe0af14f6502b493c68b0c24c9f13e3378b0b2786deaaa5b7ac98c2f9f37ef9e0a330b5b78a9a625add5e76f3310ce801e948fbb0c8d2f638323e80cdc80948a8682f02e5cd97aa171f7c83725b14a40270fdc5c4594673096cb0b0bdb856b981702d6cd4e3f9cdf17de01cebd432ab1ec46f4446afdb4022a81b16948efe23bebac9640d72ba4a27d11b2f34be5e966ccc5678c513a1960ac9a8ea8ca1fcbc0669771a5659ea714e50d57462972d5479fad75f43fb9e7d9985e553a059902e1a6dbdff068e9af3361b8a55e0570a6c49b4b2b57bc41525df05fb07e3861b9e29776c23298b2417dbeeb092219805504b1cc04ff30b221b774b4f95ebbdc5b0c9863a1ffae1c4e329c72f830c873942766b8f034bc4b8e365b1f743a4b04a9376017566f96c9f8bcdfe9c70efcb83a8a355e8b5cc391ea1027e5d686883e9d03b84ea2cba66685ad1742c3444c94a8cd1ba7753bad02f65cfef511cfa4caeade5d8109d159ff779019a5a8ea5bfcb01ddc1f037f71a0fbae6ac361910cac8edba995fc6ef8a26d9ecefe5652e3de527352e758300098bbf5f00138206318d52622386b0eae960541d46a1709879d0c24bcb8314cec33e262d5e9515493f38eb9d0c35ada4849534c65fba40c25d1bbaac28ca03ac0ff2e465683240f88566bd4d8eb49b1b33441ed83cfb869e3a38d17fac3f99d29247ffdffd1f522d80a5978197dfb7387f2f27f930d8b36356888b62d4710456ab521d9fdd2dabb4976c4c1c5e7b190b2a8332ff655781afbc9c1876a907b1eb4d0848d8995037da45901e18d66244fa2fb8dce6b4c47a974acc19f11f279df38", 0x0, 0x0, 0x0, 0xff, 0xffffffffffffffff, 0x4}, 0x38) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='8'], 0x38}}, 0x0) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000003c0)='sys_mnt/block/zram0/disksize\x00', 0x1, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x0) kernel console output (not intermixed with test programs): 68.133141][ T5815] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 68.133159][ T5815] usb 5-1: config 0 interface 0 has no altsetting 0 [ 68.135142][ T5815] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 68.135161][ T5815] usb 5-1: Product: syz [ 68.135172][ T5815] usb 5-1: Manufacturer: syz [ 68.135184][ T5815] usb 5-1: SerialNumber: syz [ 68.146036][ T5815] usb 5-1: config 0 descriptor?? [ 68.148817][ T5815] yurex 5-1:0.0: Could not find endpoints [ 68.159659][ T7238] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 68.203851][ T7242] syzkaller0: entered promiscuous mode [ 68.203868][ T7242] syzkaller0: entered allmulticast mode [ 68.370860][ T5815] usb 5-1: USB disconnect, device number 8 [ 68.594169][ T7265] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 68.594283][ T7265] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 68.597038][ T7265] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 68.598921][ T7265] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 68.603350][ T7265] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 68.639179][ T7265] siw: device registration error -23 [ 68.706621][ T5814] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.803246][ T5814] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.837892][ T7273] FAULT_INJECTION: forcing a failure. [ 68.837892][ T7273] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 68.837971][ T7273] CPU: 0 UID: 0 PID: 7273 Comm: syz.1.594 Not tainted syzkaller #0 PREEMPT(full) [ 68.837997][ T7273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 68.838007][ T7273] Call Trace: [ 68.838013][ T7273] [ 68.838022][ T7273] dump_stack_lvl+0x100/0x190 [ 68.838107][ T7273] should_fail_ex.cold+0x5/0xa [ 68.838129][ T7273] ? prepare_alloc_pages+0x16d/0x5b0 [ 68.838177][ T7273] should_fail_alloc_page+0xeb/0x140 [ 68.838202][ T7273] prepare_alloc_pages+0x1f0/0x5b0 [ 68.838234][ T7273] ? __memcg_kmem_charge_page+0x373/0x4d0 [ 68.838267][ T7273] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 68.838305][ T7273] ? __lock_acquire+0x4c5/0x1ec0 [ 68.838334][ T7273] ? __lock_acquire+0x4c5/0x1ec0 [ 68.838357][ T7273] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 68.838385][ T7273] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 68.838417][ T7273] ? unwind_next_frame+0xbd/0x2090 [ 68.838444][ T7273] ? lock_acquire+0x1d1/0x380 [ 68.838467][ T7273] ? is_bpf_text_address+0x25/0x1a0 [ 68.838491][ T7273] ? look_up_lock_class+0x55/0x120 [ 68.838543][ T7273] ? find_held_lock+0x2b/0x80 [ 68.838567][ T7273] ? __lock_acquire+0x4c5/0x1ec0 [ 68.838595][ T7273] ? __lock_acquire+0x4c5/0x1ec0 [ 68.838619][ T7273] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 68.838646][ T7273] ? policy_nodemask+0xed/0x4f0 [ 68.838673][ T7273] alloc_pages_mpol+0x201/0x550 [ 68.838699][ T7273] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 68.838724][ T7273] ? find_held_lock+0x2b/0x80 [ 68.838742][ T7273] ? __pud_alloc+0x4f6/0x690 [ 68.838765][ T7273] ? __pud_alloc+0x4f6/0x690 [ 68.838791][ T7273] alloc_pages_noprof+0x1a/0x160 [ 68.838819][ T7273] __pmd_alloc+0x3b/0x950 [ 68.838841][ T7273] ? __pud_alloc+0x4fb/0x690 [ 68.838866][ T7273] copy_page_range+0x3e98/0x57c0 [ 68.838895][ T7273] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 68.838937][ T7273] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 68.838967][ T7273] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 68.838995][ T7273] ? __pfx_copy_page_range+0x10/0x10 [ 68.839022][ T7273] ? mas_wr_store_entry+0xa4/0x1d50 [ 68.839052][ T7273] ? trace_ma_write+0x7d/0x200 [ 68.839077][ T7273] ? mas_store+0x745/0xe20 [ 68.839114][ T7273] ? __pfx___vma_start_write+0x10/0x10 [ 68.839146][ T7273] dup_mmap+0x1230/0x2370 [ 68.839180][ T7273] ? __pfx_dup_mmap+0x10/0x10 [ 68.839203][ T7273] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 68.839238][ T7273] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 68.839268][ T7273] ? __lock_acquire+0x4c5/0x1ec0 [ 68.839307][ T7273] ? lock_acquire+0x1d1/0x380 [ 68.839334][ T7273] ? copy_process+0x4806/0x8370 [ 68.839373][ T7273] copy_process+0x4811/0x8370 [ 68.839418][ T7273] ? __pfx_copy_process+0x10/0x10 [ 68.839447][ T7273] ? futex_wake+0x4ea/0x5e0 [ 68.839479][ T7273] kernel_clone+0x176/0x9d0 [ 68.839530][ T7273] ? __pfx_kernel_clone+0x10/0x10 [ 68.839576][ T7273] __do_compat_sys_ia32_clone+0xd4/0x120 [ 68.839608][ T7273] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 68.839659][ T7273] __do_fast_syscall_32+0x13a/0x8b0 [ 68.839687][ T7273] ? lockdep_hardirqs_on+0x7d/0x110 [ 68.839713][ T7273] do_fast_syscall_32+0x32/0x70 [ 68.839739][ T7273] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 68.839763][ T7273] RIP: 0023:0xf703efec [ 68.839783][ T7273] Code: Unable to access opcode bytes at 0xf703efc2. [ 68.839791][ T7273] RSP: 002b:00000000f542d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000078 [ 68.839811][ T7273] RAX: ffffffffffffffda RBX: 0000000041000000 RCX: 0000000000000000 [ 68.839824][ T7273] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 68.839836][ T7273] RBP: 00000000f542d5ec R08: 0000000000000000 R09: 0000000000000000 [ 68.839848][ T7273] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 68.839860][ T7273] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 68.839886][ T7273] [ 68.884756][ T5814] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 68.886576][ T64] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 68.893628][ T64] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 68.894342][ T64] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 68.897343][ T64] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 68.897916][ T64] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 69.072483][ T5814] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 69.264231][ T5814] bridge_slave_1: left allmulticast mode [ 69.264292][ T5814] bridge_slave_1: left promiscuous mode [ 69.272001][ T5814] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.282670][ T5814] bridge_slave_0: left allmulticast mode [ 69.282737][ T5814] bridge_slave_0: left promiscuous mode [ 69.283250][ T5814] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.432076][ T5814] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 69.441248][ T5814] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 69.446069][ T5814] bond0 (unregistering): Released all slaves [ 69.467492][ T1475] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 69.631208][ T1475] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 69.631286][ T1475] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 69.639620][ T1475] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 69.639713][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 69.639766][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 69.639804][ T1475] usb 5-1: config 0 interface 0 has no altsetting 0 [ 69.641031][ T1475] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 69.641069][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 69.641093][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 69.641114][ T1475] usb 5-1: config 0 interface 0 has no altsetting 0 [ 69.642024][ T1475] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 69.642060][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 69.642084][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 69.642104][ T1475] usb 5-1: config 0 interface 0 has no altsetting 0 [ 69.642997][ T1475] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 69.643032][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 69.643053][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 69.643071][ T1475] usb 5-1: config 0 interface 0 has no altsetting 0 [ 69.645345][ T1475] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 69.645382][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 69.645403][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 69.645421][ T1475] usb 5-1: config 0 interface 0 has no altsetting 0 [ 69.646328][ T1475] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 69.646361][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 69.646382][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 69.646401][ T1475] usb 5-1: config 0 interface 0 has no altsetting 0 [ 69.647243][ T5453] 8021q: adding VLAN 0 to HW filter on device eth2 [ 69.647714][ T872] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 69.648928][ T1475] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 69.648965][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 69.648987][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 69.649005][ T1475] usb 5-1: config 0 interface 0 has no altsetting 0 [ 69.651074][ T1475] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 69.651161][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 69.651182][ T1475] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 69.651201][ T1475] usb 5-1: config 0 interface 0 has no altsetting 0 [ 69.653966][ T1475] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 69.653989][ T1475] usb 5-1: Product: syz [ 69.654002][ T1475] usb 5-1: Manufacturer: syz [ 69.654016][ T1475] usb 5-1: SerialNumber: syz [ 69.657356][ T1475] usb 5-1: config 0 descriptor?? [ 69.663562][ T1475] yurex 5-1:0.0: Could not submitting URB [ 69.663704][ T1475] yurex 5-1:0.0: probe with driver yurex failed with error -5 [ 69.714090][ T7274] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.714200][ T7274] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.714338][ T7274] bridge_slave_0: entered allmulticast mode [ 69.715503][ T7274] bridge_slave_0: entered promiscuous mode [ 69.719943][ T7274] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.719991][ T7274] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.720061][ T7274] bridge_slave_1: entered allmulticast mode [ 69.720900][ T7274] bridge_slave_1: entered promiscuous mode [ 69.735100][ T7274] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.736415][ T7274] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.751425][ T7274] team0: Port device team_slave_0 added [ 69.752720][ T7274] team0: Port device team_slave_1 added [ 69.766171][ T7274] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.766181][ T7274] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.766194][ T7274] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.768822][ T7274] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.768830][ T7274] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.768843][ T7274] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.789273][ T7274] hsr_slave_0: entered promiscuous mode [ 69.789953][ T7274] hsr_slave_1: entered promiscuous mode [ 69.790252][ T7274] debugfs: 'hsr0' already exists in 'hsr' [ 69.790263][ T7274] Cannot create hsr debugfs directory [ 69.815946][ T872] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 69.816872][ T872] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 69.816886][ T872] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 69.816905][ T872] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 69.823155][ T872] usb 7-1: config 0 descriptor?? [ 69.835551][ T872] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 69.869839][ T872] usb 5-1: USB disconnect, device number 9 [ 69.884988][ T5814] hsr_slave_0: left promiscuous mode [ 69.888036][ T5814] hsr_slave_1: left promiscuous mode [ 69.889633][ T5814] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 69.889667][ T5814] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 69.891464][ T5814] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 69.891478][ T5814] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 69.905073][ T5814] veth1_macvtap: left promiscuous mode [ 69.905259][ T5814] veth0_macvtap: left promiscuous mode [ 69.905367][ T5814] veth1_vlan: left promiscuous mode [ 69.905460][ T5814] veth0_vlan: left promiscuous mode [ 69.961875][ T7333] openvswitch: netlink: Message has 13064 unknown bytes. [ 69.961950][ T7333] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 70.044572][ T7337] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 70.109467][ T5814] team0 (unregistering): Port device team_slave_1 removed [ 70.118600][ T5814] team0 (unregistering): Port device team_slave_0 removed [ 70.231755][ T5453] 8021q: adding VLAN 0 to HW filter on device eth3 [ 70.314248][ T7348] FAULT_INJECTION: forcing a failure. [ 70.314248][ T7348] name failslab, interval 1, probability 0, space 0, times 0 [ 70.314317][ T7348] CPU: 1 UID: 0 PID: 7348 Comm: syz.1.616 Not tainted syzkaller #0 PREEMPT(full) [ 70.314352][ T7348] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.314364][ T7348] Call Trace: [ 70.314370][ T7348] [ 70.314377][ T7348] dump_stack_lvl+0x100/0x190 [ 70.314408][ T7348] should_fail_ex.cold+0x5/0xa [ 70.314433][ T7348] should_failslab+0xc2/0x120 [ 70.314457][ T7348] kmem_cache_alloc_noprof+0x92/0x6a0 [ 70.314476][ T7348] ? d_instantiate+0x8a/0xb0 [ 70.314499][ T7348] ? alloc_empty_file+0x5b/0x1c0 [ 70.314527][ T7348] alloc_empty_file+0x5b/0x1c0 [ 70.314552][ T7348] alloc_file_pseudo+0x183/0x290 [ 70.314577][ T7348] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 70.314601][ T7348] ? alloc_fd+0x471/0x7a0 [ 70.314623][ T7348] sock_alloc_file+0x50/0x210 [ 70.314693][ T7348] __sys_socket+0x1c0/0x260 [ 70.314724][ T7348] ? xfd_validate_state+0x129/0x190 [ 70.314751][ T7348] ? __pfx___sys_socket+0x10/0x10 [ 70.314774][ T7348] __ia32_sys_socket+0x72/0xb0 [ 70.314789][ T7348] ? lockdep_hardirqs_on+0x7d/0x110 [ 70.314815][ T7348] __do_fast_syscall_32+0x13a/0x8b0 [ 70.314837][ T7348] ? lockdep_hardirqs_on+0x7d/0x110 [ 70.314853][ T7348] do_fast_syscall_32+0x32/0x70 [ 70.314869][ T7348] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 70.314884][ T7348] RIP: 0023:0xf703efec [ 70.314897][ T7348] Code: Unable to access opcode bytes at 0xf703efc2. [ 70.314902][ T7348] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 70.314913][ T7348] RAX: ffffffffffffffda RBX: 0000000000000018 RCX: 0000000000000001 [ 70.314920][ T7348] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 70.314926][ T7348] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 70.314932][ T7348] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 70.314938][ T7348] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 70.314951][ T7348] [ 70.370898][ T7274] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 70.387147][ T7274] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.388031][ T7274] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 70.410883][ T7274] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.411438][ T7274] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 70.425855][ T7274] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.431362][ T7274] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 70.443091][ T7274] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.475263][ T7274] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.475513][ T7274] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.475713][ T7274] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.475800][ T7274] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.485257][ T74] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.490169][ T74] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.505045][ T5453] 8021q: adding VLAN 0 to HW filter on device eth4 [ 70.529349][ T7366] overlayfs: upper fs does not support tmpfile. [ 70.566611][ T7274] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.584886][ T7274] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.593108][ T74] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.593384][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.607954][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.608137][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.643382][ T7274] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 70.671994][ T7380] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 70.740714][ T5453] 8021q: adding VLAN 0 to HW filter on device eth5 [ 70.842158][ T7397] openvswitch: netlink: Message has 13064 unknown bytes. [ 70.843324][ T7397] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 70.910676][ T7274] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.959781][ T64] Bluetooth: hci1: command tx timeout [ 70.966741][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.969634][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.979085][ T1354] cfg80211: failed to load regulatory.db [ 71.126705][ T7274] veth0_vlan: entered promiscuous mode [ 71.130855][ T7274] veth1_vlan: entered promiscuous mode [ 71.145908][ T7274] veth0_macvtap: entered promiscuous mode [ 71.149600][ T7274] veth1_macvtap: entered promiscuous mode [ 71.155945][ T7274] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.161247][ T7274] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.201622][ T69] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.201681][ T69] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.229361][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.229409][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.237527][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.247864][ T5814] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.248198][ T5814] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.248218][ T5814] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.313210][ T7417] FAULT_INJECTION: forcing a failure. [ 71.313210][ T7417] name failslab, interval 1, probability 0, space 0, times 0 [ 71.313256][ T7417] CPU: 2 UID: 0 PID: 7417 Comm: syz.0.629 Not tainted syzkaller #0 PREEMPT(full) [ 71.313281][ T7417] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 71.313290][ T7417] Call Trace: [ 71.313295][ T7417] [ 71.313300][ T7417] dump_stack_lvl+0x100/0x190 [ 71.313319][ T7417] should_fail_ex.cold+0x5/0xa [ 71.313334][ T7417] should_failslab+0xc2/0x120 [ 71.313351][ T7417] __kmalloc_cache_noprof+0x91/0x6d0 [ 71.313369][ T7417] ? call_usermodehelper_setup+0xaf/0x360 [ 71.313385][ T7417] ? __pfx_free_modprobe_argv+0x10/0x10 [ 71.313403][ T7417] call_usermodehelper_setup+0xaf/0x360 [ 71.313420][ T7417] __request_module+0x3c7/0x6a0 [ 71.313438][ T7417] ? __pfx___request_module+0x10/0x10 [ 71.313457][ T7417] ? rcu_is_watching+0x13/0xc0 [ 71.313470][ T7417] ? crypto_alg_lookup+0x10c/0x1e0 [ 71.313485][ T7417] ? crypto_alg_lookup+0x10c/0x1e0 [ 71.313506][ T7417] crypto_alg_mod_lookup+0x257/0x5d0 [ 71.313523][ T7417] crypto_type_has_alg+0x2c/0x80 [ 71.313536][ T7417] xfrm_probe_algs+0x85/0x400 [ 71.313550][ T7417] pfkey_register+0xf9/0x950 [ 71.313567][ T7417] ? pfkey_broadcast+0x28c/0x420 [ 71.313583][ T7417] ? __pfx_pfkey_register+0x10/0x10 [ 71.313599][ T7417] pfkey_process+0x5c3/0x810 [ 71.313614][ T7417] ? trace_contention_end+0x126/0x160 [ 71.313631][ T7417] ? __pfx_pfkey_process+0x10/0x10 [ 71.313645][ T7417] ? pfkey_sendmsg+0x41a/0x840 [ 71.313669][ T7417] ? __pfx___alloc_skb+0x10/0x10 [ 71.313687][ T7417] pfkey_sendmsg+0x428/0x840 [ 71.313704][ T7417] ____sys_sendmsg+0xa4d/0xbe0 [ 71.313720][ T7417] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 71.313736][ T7417] ? __pfx_____sys_sendmsg+0x10/0x10 [ 71.313759][ T7417] ___sys_sendmsg+0x190/0x1e0 [ 71.313777][ T7417] ? __pfx____sys_sendmsg+0x10/0x10 [ 71.313794][ T7417] ? futex_wait+0x11e/0x370 [ 71.313812][ T7417] ? find_held_lock+0x2b/0x80 [ 71.313832][ T7417] __sys_sendmsg+0x160/0x210 [ 71.313852][ T7417] ? __pfx___sys_sendmsg+0x10/0x10 [ 71.313876][ T7417] __do_fast_syscall_32+0x13a/0x8b0 [ 71.313895][ T7417] do_fast_syscall_32+0x32/0x70 [ 71.313913][ T7417] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 71.313929][ T7417] RIP: 0023:0xf6ffefec [ 71.313943][ T7417] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 71.313948][ T7417] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 71.313960][ T7417] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000800000c0 [ 71.313966][ T7417] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 71.313973][ T7417] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 71.313979][ T7417] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 71.313985][ T7417] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 71.313999][ T7417] [ 71.810437][ T7474] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 72.401424][ T50] usb 7-1: USB disconnect, device number 19 [ 72.507206][ T7488] syzkaller0: entered promiscuous mode [ 72.507269][ T7488] syzkaller0: entered allmulticast mode [ 73.038912][ T64] Bluetooth: hci1: command tx timeout [ 75.127477][ T64] Bluetooth: hci1: command tx timeout [ 75.337697][ T7512] syzkaller0: entered promiscuous mode [ 75.337753][ T7512] syzkaller0: entered allmulticast mode [ 76.406089][ T7520] netlink: 28 bytes leftover after parsing attributes in process `syz.2.653'. [ 76.450686][ T7520] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.451199][ T7520] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.492931][ T7520] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 76.496048][ T7520] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 76.629081][ T12] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.629186][ T12] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.629217][ T12] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.629245][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.786668][ T7536] input: syz0 as /devices/virtual/input/input25 [ 76.949592][ T7540] syzkaller0: entered promiscuous mode [ 76.949626][ T7540] syzkaller0: entered allmulticast mode [ 77.135949][ T7542] debugfs: out of free dentries, can not create directory '0:46' [ 77.197496][ T64] Bluetooth: hci1: command tx timeout [ 78.450556][ T7556] binder: 7555:7556 ioctl c0306201 0 returned -14 [ 78.977546][ T5850] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 79.148312][ T5850] usb 5-1: New USB device found, idVendor=104f, idProduct=0004, bcdDevice= 1.00 [ 79.149274][ T5850] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 79.149296][ T5850] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 79.150643][ T5850] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 79.150656][ T5850] usb 5-1: Product: syz [ 79.150664][ T5850] usb 5-1: Manufacturer: syz [ 79.158941][ T5850] iuu_phoenix 5-1:1.0: required endpoints missing [ 79.319405][ T7564] netlink: 4 bytes leftover after parsing attributes in process `syz.2.670'. [ 79.321623][ T7564] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 79.368108][ T5843] usb 5-1: USB disconnect, device number 10 [ 80.076673][ T7575] syzkaller0: entered promiscuous mode [ 80.078797][ T7575] syzkaller0: entered allmulticast mode [ 80.867483][ T5815] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 81.007493][ T25] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 81.038271][ T5815] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 81.039403][ T5815] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 81.039477][ T5815] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 81.039499][ T5815] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 81.039533][ T5815] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.050108][ T5815] usb 5-1: config 0 descriptor?? [ 81.177597][ T25] usb 7-1: Using ep0 maxpacket: 8 [ 81.180719][ T25] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 81.182091][ T25] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 81.182117][ T25] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 81.182137][ T25] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 81.182157][ T25] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 81.182187][ T25] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.395191][ T25] usb 7-1: usb_control_msg returned -32 [ 81.395289][ T25] usbtmc 7-1:16.0: can't read capabilities [ 81.431914][ T25] usb 7-1: USB disconnect, device number 20 [ 81.465694][ C0] raw-gadget.0 gadget.0: ignoring, device is not running [ 81.466632][ T5815] usbhid 5-1:0.0: can't add hid device: -71 [ 81.466715][ T5815] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 81.473368][ T5815] usb 5-1: USB disconnect, device number 11 [ 82.077506][ T7615] syzkaller0: entered promiscuous mode [ 82.078414][ T7615] syzkaller0: entered allmulticast mode [ 82.187582][ T872] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 82.338901][ T872] usb 7-1: New USB device found, idVendor=104f, idProduct=0004, bcdDevice= 1.00 [ 82.343600][ T872] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 82.347607][ T872] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 82.355807][ T872] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 82.359153][ T872] usb 7-1: Product: syz [ 82.360688][ T872] usb 7-1: Manufacturer: syz [ 82.374333][ T872] iuu_phoenix 7-1:1.0: required endpoints missing [ 82.487543][ T30] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 82.573610][ T25] usb 7-1: USB disconnect, device number 21 [ 82.619073][ T30] usb 5-1: device descriptor read/64, error -71 [ 82.857527][ T30] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 82.987631][ T30] usb 5-1: device descriptor read/64, error -71 [ 83.098693][ T30] usb usb5-port1: attempt power cycle [ 83.347622][ T5815] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 83.437651][ T30] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 83.458035][ T30] usb 5-1: device descriptor read/8, error -71 [ 83.497559][ T5815] usb 7-1: Using ep0 maxpacket: 32 [ 83.498515][ T5815] usb 7-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 83.500002][ T5815] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 83.500059][ T5815] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 83.500079][ T5815] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 83.500098][ T5815] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 83.502938][ T5815] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.502954][ T5815] usb 7-1: Product: syz [ 83.502962][ T5815] usb 7-1: Manufacturer: syz [ 83.502969][ T5815] usb 7-1: SerialNumber: syz [ 83.506786][ T5815] usb 7-1: config 0 descriptor?? [ 83.507562][ T7627] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 83.520317][ T5815] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/input/input26 [ 83.549289][ C0] xpad 7-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 83.707739][ T30] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 83.716884][ T25] usb 7-1: USB disconnect, device number 22 [ 83.716966][ C0] xpad 7-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 83.728173][ T30] usb 5-1: device descriptor read/8, error -71 [ 83.853505][ T30] usb usb5-port1: unable to enumerate USB device [ 84.262066][ T7629] syzkaller0: entered promiscuous mode [ 84.262154][ T7629] syzkaller0: entered allmulticast mode [ 84.927609][ T30] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 85.108174][ T30] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 85.109083][ T30] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 85.109099][ T30] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 85.109110][ T30] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 85.109133][ T30] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.112211][ T30] usb 7-1: config 0 descriptor?? [ 85.536707][ T30] usbhid 7-1:0.0: can't add hid device: -71 [ 85.536820][ T30] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 85.548797][ T30] usb 7-1: USB disconnect, device number 23 [ 85.601396][ T7649] netlink: 8 bytes leftover after parsing attributes in process `syz.0.695'. [ 86.017460][ T5843] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 86.076185][ T5743] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 86.079627][ T5743] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 86.081316][ T5743] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 86.084527][ T5743] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 86.085202][ T5743] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 86.113757][ T7657] netlink: 16 bytes leftover after parsing attributes in process `syz.2.698'. [ 86.115098][ T7657] netlink: 12 bytes leftover after parsing attributes in process `syz.2.698'. [ 86.174868][ T5843] usb 5-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 86.456693][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.497503][ T30] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 86.540155][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.638025][ T30] usb 7-1: device descriptor read/64, error -71 [ 86.673223][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.689556][ T7653] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.689736][ T7653] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.690007][ T7653] bridge_slave_0: entered allmulticast mode [ 86.691079][ T7653] bridge_slave_0: entered promiscuous mode [ 86.694703][ T7653] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.694824][ T7653] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.694883][ T7653] bridge_slave_1: entered allmulticast mode [ 86.696628][ T7653] bridge_slave_1: entered promiscuous mode [ 86.723101][ T7653] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.724641][ T7653] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.742715][ T7653] team0: Port device team_slave_0 added [ 86.758604][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.764692][ T7653] team0: Port device team_slave_1 added [ 86.790241][ T7653] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.792935][ T7653] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.797712][ T7653] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.799179][ T7653] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.799188][ T7653] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.799220][ T7653] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.837178][ T7653] hsr_slave_0: entered promiscuous mode [ 86.838980][ T7653] hsr_slave_1: entered promiscuous mode [ 86.839627][ T7653] debugfs: 'hsr0' already exists in 'hsr' [ 86.839645][ T7653] Cannot create hsr debugfs directory [ 86.887743][ T30] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 86.983142][ T12] bridge_slave_1: left allmulticast mode [ 86.983210][ T12] bridge_slave_1: left promiscuous mode [ 86.983520][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.994278][ T12] bridge_slave_0: left allmulticast mode [ 86.997093][ T12] bridge_slave_0: left promiscuous mode [ 86.997844][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.028893][ T30] usb 7-1: device descriptor read/64, error -71 [ 87.102749][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 87.109304][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 87.114709][ T12] bond0 (unregistering): Released all slaves [ 87.137721][ T30] usb usb7-port1: attempt power cycle [ 87.306073][ T7653] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 87.314888][ T7653] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.325085][ T7653] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 87.337984][ T7653] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.338778][ T7653] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 87.344939][ T7653] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.392290][ T7653] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 87.399040][ T7653] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.405813][ T5453] 8021q: adding VLAN 0 to HW filter on device eth6 [ 87.484430][ T12] hsr_slave_0: left promiscuous mode [ 87.487187][ T12] hsr_slave_1: left promiscuous mode [ 87.489944][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 87.490002][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 87.496823][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 87.497349][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 87.499079][ T30] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 87.514308][ T12] veth1_macvtap: left promiscuous mode [ 87.514395][ T12] veth0_macvtap: left promiscuous mode [ 87.514499][ T12] veth1_vlan: left promiscuous mode [ 87.514606][ T12] veth0_vlan: left promiscuous mode [ 87.518748][ T30] usb 7-1: device descriptor read/8, error -71 [ 87.623313][ T64] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.641964][ T64] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 87.653103][ T64] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 87.659405][ T64] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 87.662837][ T64] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 87.754780][ T12] team0 (unregistering): Port device team_slave_1 removed [ 87.764281][ T12] team0 (unregistering): Port device team_slave_0 removed [ 87.769592][ T30] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 87.788620][ T30] usb 7-1: device descriptor read/8, error -71 [ 87.844520][ T5453] 8021q: adding VLAN 0 to HW filter on device eth7 [ 87.893789][ T7653] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.897789][ T30] usb usb7-port1: unable to enumerate USB device [ 87.906921][ T7653] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.912694][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.912841][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.921161][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.921317][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.167525][ T5743] Bluetooth: hci4: command tx timeout [ 88.197189][ T5453] 8021q: adding VLAN 0 to HW filter on device eth8 [ 88.451698][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.515224][ T7653] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.517089][ T7695] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.517879][ T7695] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.517980][ T7695] bridge_slave_0: entered allmulticast mode [ 88.519313][ T7695] bridge_slave_0: entered promiscuous mode [ 88.522045][ T7695] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.522238][ T7695] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.522333][ T7695] bridge_slave_1: entered allmulticast mode [ 88.523787][ T7695] bridge_slave_1: entered promiscuous mode [ 88.555353][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.562226][ T5453] 8021q: adding VLAN 0 to HW filter on device eth9 [ 88.582121][ T7695] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.584928][ T7695] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.614396][ T7695] team0: Port device team_slave_0 added [ 88.616831][ T7695] team0: Port device team_slave_1 added [ 88.670770][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.679146][ T5843] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 88.679220][ T5843] usb 5-1: can't read configurations, error -71 [ 88.685861][ T7695] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.685876][ T7695] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.685894][ T7695] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.687514][ T7695] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.687526][ T7695] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.687545][ T7695] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.769817][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.780052][ T7695] hsr_slave_0: entered promiscuous mode [ 88.782087][ T7695] hsr_slave_1: entered promiscuous mode [ 88.782739][ T7695] debugfs: 'hsr0' already exists in 'hsr' [ 88.782757][ T7695] Cannot create hsr debugfs directory [ 88.971170][ T12] bridge_slave_1: left allmulticast mode [ 88.971240][ T12] bridge_slave_1: left promiscuous mode [ 88.971471][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.976848][ T12] bridge_slave_0: left allmulticast mode [ 88.976871][ T12] bridge_slave_0: left promiscuous mode [ 88.977049][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.037777][ T5843] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 89.105543][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 89.111034][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 89.115416][ T12] bond0 (unregistering): Released all slaves [ 89.130236][ T7653] veth0_vlan: entered promiscuous mode [ 89.140514][ T7653] veth1_vlan: entered promiscuous mode [ 89.188274][ T5843] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 89.188359][ T5843] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 89.190139][ T5843] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.190206][ T5843] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.190262][ T5843] usb 5-1: config 0 interface 0 has no altsetting 0 [ 89.191683][ T5843] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.191752][ T5843] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.191796][ T5843] usb 5-1: config 0 interface 0 has no altsetting 0 [ 89.197042][ T5843] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.197091][ T5843] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.197119][ T5843] usb 5-1: config 0 interface 0 has no altsetting 0 [ 89.200493][ T5843] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.200534][ T5843] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.200560][ T5843] usb 5-1: config 0 interface 0 has no altsetting 0 [ 89.201523][ T5843] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.201562][ T5843] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.201588][ T5843] usb 5-1: config 0 interface 0 has no altsetting 0 [ 89.202504][ T5843] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.202541][ T5843] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.202566][ T5843] usb 5-1: config 0 interface 0 has no altsetting 0 [ 89.204217][ T5843] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.204257][ T5843] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.204282][ T5843] usb 5-1: config 0 interface 0 has no altsetting 0 [ 89.205212][ T5843] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 89.205251][ T5843] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 89.205275][ T5843] usb 5-1: config 0 interface 0 has no altsetting 0 [ 89.209568][ T5843] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 89.209592][ T5843] usb 5-1: Product: syz [ 89.209605][ T5843] usb 5-1: Manufacturer: syz [ 89.209620][ T5843] usb 5-1: SerialNumber: syz [ 89.216537][ T5843] usb 5-1: config 0 descriptor?? [ 89.223714][ T7695] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 89.242318][ T5843] yurex 5-1:0.0: USB YUREX device now attached to Yurex #0 [ 89.244657][ T7695] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.245087][ T7695] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 89.260065][ T7695] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.268821][ T7695] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 89.282832][ T7695] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.288919][ T7653] veth0_macvtap: entered promiscuous mode [ 89.290226][ T7695] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 89.297292][ T7695] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.344768][ T7653] veth1_macvtap: entered promiscuous mode [ 89.395972][ T7653] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.404188][ T7653] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.466046][ T5453] 8021q: adding VLAN 0 to HW filter on device eth10 [ 89.498215][ T5814] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.498490][ T5814] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.498570][ T5814] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.498590][ T5814] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.522395][ T12] hsr_slave_0: left promiscuous mode [ 89.525153][ T12] hsr_slave_1: left promiscuous mode [ 89.525727][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 89.525743][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 89.532388][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 89.532403][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 89.549117][ T12] veth1_macvtap: left promiscuous mode [ 89.549221][ T12] veth0_macvtap: left promiscuous mode [ 89.549332][ T12] veth1_vlan: left promiscuous mode [ 89.550413][ T12] veth0_vlan: left promiscuous mode [ 89.677635][ T5743] Bluetooth: hci2: command tx timeout [ 89.780685][ T12] team0 (unregistering): Port device team_slave_1 removed [ 89.790814][ T12] team0 (unregistering): Port device team_slave_0 removed [ 89.941950][ T7695] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.990722][ T69] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.990847][ T69] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.032254][ T7695] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.050192][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.050290][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.060777][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.060863][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.061605][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.061622][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.151534][ T5453] 8021q: adding VLAN 0 to HW filter on device eth11 [ 90.247573][ T5743] Bluetooth: hci4: command tx timeout [ 90.479920][ T5453] 8021q: adding VLAN 0 to HW filter on device eth12 [ 90.553450][ T7695] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.799333][ T7695] veth0_vlan: entered promiscuous mode [ 90.803122][ T7695] veth1_vlan: entered promiscuous mode [ 90.825516][ T5453] 8021q: adding VLAN 0 to HW filter on device eth13 [ 90.826819][ T7695] veth0_macvtap: entered promiscuous mode [ 90.830060][ T7695] veth1_macvtap: entered promiscuous mode [ 90.837273][ T7695] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.849605][ T7695] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.970305][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.970535][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.015861][ T69] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.015936][ T69] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.062965][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.063037][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.067757][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.067806][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.440484][ C3] usb 5-1: yurex_control_callback - control failed: -2 [ 91.442288][ T5843] usb 5-1: USB disconnect, device number 17 [ 91.448045][ T5843] yurex 5-1:0.0: USB YUREX #0 now disconnected [ 91.467515][ T35] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 91.597972][ T35] usb 7-1: device descriptor read/64, error -71 [ 91.758248][ T5743] Bluetooth: hci2: command tx timeout [ 91.840206][ T35] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 91.967491][ T35] usb 7-1: device descriptor read/64, error -71 [ 92.078424][ T35] usb usb7-port1: attempt power cycle [ 92.199141][ T7838] netlink: 20 bytes leftover after parsing attributes in process `syz.0.712'. [ 92.200527][ T7786] Set syz1 is full, maxelem 65536 reached [ 92.318130][ T5743] Bluetooth: hci4: command tx timeout [ 92.417600][ T35] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 92.438284][ T35] usb 7-1: device descriptor read/8, error -71 [ 92.647602][ T50] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 92.677564][ T35] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 92.698165][ T35] usb 7-1: device descriptor read/8, error -71 [ 92.807868][ T35] usb usb7-port1: unable to enumerate USB device [ 92.810549][ T50] usb 10-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 92.814216][ T50] usb 10-1: too many configurations: 9, using maximum allowed: 8 [ 92.818231][ T50] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 92.818327][ T50] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 92.818735][ T50] usb 10-1: config 0 interface 0 has no altsetting 0 [ 92.820069][ T50] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 92.820119][ T50] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 92.820147][ T50] usb 10-1: config 0 interface 0 has no altsetting 0 [ 92.821193][ T50] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 92.821235][ T50] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 92.821262][ T50] usb 10-1: config 0 interface 0 has no altsetting 0 [ 92.822689][ T50] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 92.822740][ T50] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 92.822781][ T50] usb 10-1: config 0 interface 0 has no altsetting 0 [ 92.824126][ T50] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 92.824167][ T50] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 92.824191][ T50] usb 10-1: config 0 interface 0 has no altsetting 0 [ 92.825222][ T50] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 92.825262][ T50] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 92.825285][ T50] usb 10-1: config 0 interface 0 has no altsetting 0 [ 92.826467][ T50] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 92.826513][ T50] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 92.826534][ T50] usb 10-1: config 0 interface 0 has no altsetting 0 [ 92.830035][ T50] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 92.830074][ T50] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 92.830095][ T50] usb 10-1: config 0 interface 0 has no altsetting 0 [ 92.832723][ T50] usb 10-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 92.832745][ T50] usb 10-1: Product: syz [ 92.832757][ T50] usb 10-1: Manufacturer: syz [ 92.832769][ T50] usb 10-1: SerialNumber: syz [ 92.838740][ T50] usb 10-1: config 0 descriptor?? [ 92.852170][ T50] yurex 10-1:0.0: USB YUREX device now attached to Yurex #0 [ 93.837722][ T5743] Bluetooth: hci2: command tx timeout [ 94.119736][ T7882] net/sunrpc/rpc_pipe.c: rpc_populate failed to populate directory / [ 94.397619][ T5743] Bluetooth: hci4: command tx timeout [ 94.707535][ T855] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 94.837516][ T855] usb 5-1: device descriptor read/64, error -71 [ 95.021764][ T7938] FAULT_INJECTION: forcing a failure. [ 95.021764][ T7938] name fail_futex, interval 1, probability 0, space 0, times 1 [ 95.021837][ T7938] CPU: 1 UID: 0 PID: 7938 Comm: syz.6.756 Not tainted syzkaller #0 PREEMPT(full) [ 95.021873][ T7938] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.021885][ T7938] Call Trace: [ 95.021892][ T7938] [ 95.021899][ T7938] dump_stack_lvl+0x100/0x190 [ 95.021930][ T7938] should_fail_ex.cold+0x5/0xa [ 95.021956][ T7938] get_futex_key+0x1d0/0x14f0 [ 95.021992][ T7938] ? __pfx_get_futex_key+0x10/0x10 [ 95.022020][ T7938] ? __pfx___up_read+0x10/0x10 [ 95.022051][ T7938] ? kernelmode_fixup_or_oops.isra.0+0x80/0xf0 [ 95.022077][ T7938] futex_wake+0xf4/0x5e0 [ 95.022108][ T7938] ? __pfx_futex_wake+0x10/0x10 [ 95.022131][ T7938] ? lockdep_hardirqs_on+0x7d/0x110 [ 95.022168][ T7938] do_futex+0x2b2/0x440 [ 95.022189][ T7938] ? __pfx_do_futex+0x10/0x10 [ 95.022208][ T7938] ? __get_user_nocheck_8+0x20/0x20 [ 95.022236][ T7938] __ia32_sys_futex_time32+0x2f4/0x470 [ 95.022259][ T7938] ? xfd_validate_state+0x129/0x190 [ 95.022285][ T7938] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 95.022315][ T7938] __do_fast_syscall_32+0x13a/0x8b0 [ 95.022346][ T7938] do_fast_syscall_32+0x32/0x70 [ 95.022374][ T7938] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 95.022399][ T7938] RIP: 0023:0xf7f77fec [ 95.022417][ T7938] Code: Unable to access opcode bytes at 0xf7f77fc2. [ 95.022426][ T7938] RSP: 002b:00000000f54365cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 95.022445][ T7938] RAX: ffffffffffffffda RBX: 00000000f7434f8c RCX: 0000000000000081 [ 95.022458][ T7938] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 95.022471][ T7938] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 95.022483][ T7938] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 95.022495][ T7938] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 95.022518][ T7938] [ 95.128020][ C1] usb 10-1: yurex_control_callback - control failed: -2 [ 95.132037][ T1354] usb 10-1: USB disconnect, device number 2 [ 95.136935][ T1354] yurex 10-1:0.0: USB YUREX #0 now disconnected [ 95.139835][ T855] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 95.277847][ T855] usb 5-1: device descriptor read/64, error -71 [ 95.387915][ T855] usb usb5-port1: attempt power cycle [ 95.737621][ T855] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 95.749346][ T7960] netlink: 8 bytes leftover after parsing attributes in process `syz.5.765'. [ 95.758236][ T855] usb 5-1: device descriptor read/8, error -71 [ 96.027581][ T855] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 96.048334][ T855] usb 5-1: device descriptor read/8, error -71 [ 96.113457][ T7979] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.114715][ T7979] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.163232][ T7979] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 96.167704][ T855] usb usb5-port1: unable to enumerate USB device [ 96.167889][ T7979] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 96.207583][ T50] usb 11-1: new high-speed USB device number 2 using dummy_hcd [ 96.269230][ T12] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.269323][ T12] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.269397][ T12] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.269459][ T12] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.301829][ T7984] netlink: 8 bytes leftover after parsing attributes in process `syz.5.775'. [ 96.368401][ T50] usb 11-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 96.368482][ T50] usb 11-1: too many configurations: 9, using maximum allowed: 8 [ 96.369818][ T50] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 96.369858][ T50] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 96.369880][ T50] usb 11-1: config 0 interface 0 has no altsetting 0 [ 96.370971][ T50] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 96.371008][ T50] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 96.371029][ T50] usb 11-1: config 0 interface 0 has no altsetting 0 [ 96.372306][ T50] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 96.372345][ T50] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 96.372369][ T50] usb 11-1: config 0 interface 0 has no altsetting 0 [ 96.374056][ T50] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 96.374100][ T50] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 96.374126][ T50] usb 11-1: config 0 interface 0 has no altsetting 0 [ 96.375179][ T50] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 96.375222][ T50] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 96.375247][ T50] usb 11-1: config 0 interface 0 has no altsetting 0 [ 96.376259][ T50] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 96.376301][ T50] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 96.376327][ T50] usb 11-1: config 0 interface 0 has no altsetting 0 [ 96.377256][ T50] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 96.377294][ T50] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 96.377315][ T50] usb 11-1: config 0 interface 0 has no altsetting 0 [ 96.379790][ T50] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 96.379828][ T50] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 96.379849][ T50] usb 11-1: config 0 interface 0 has no altsetting 0 [ 96.381702][ T50] usb 11-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 96.381722][ T50] usb 11-1: Product: syz [ 96.381734][ T50] usb 11-1: Manufacturer: syz [ 96.381747][ T50] usb 11-1: SerialNumber: syz [ 96.384129][ T50] usb 11-1: config 0 descriptor?? [ 96.389406][ T50] yurex 11-1:0.0: USB YUREX device now attached to Yurex #0 [ 96.587557][ T1354] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 96.739665][ T1354] usb 10-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 96.741102][ T1354] usb 10-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 96.741139][ T1354] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 96.741161][ T1354] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 96.741180][ T1354] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 96.742328][ T1354] usb 10-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 96.742346][ T1354] usb 10-1: Manufacturer: syz [ 96.744251][ T1354] usb 10-1: config 0 descriptor?? [ 97.155824][ T1354] appleir 0003:05AC:8243.0002: unknown main item tag 0x0 [ 97.169380][ T1354] appleir 0003:05AC:8243.0002: hiddev1,hidraw1: USB HID v0.00 Device [syz] on usb-dummy_hcd.5-1/input0 [ 97.489935][ T8006] syzkaller0: entered promiscuous mode [ 97.490064][ T8006] syzkaller0: entered allmulticast mode [ 97.977597][ T35] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 98.134186][ T35] usb 5-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 98.151901][ T35] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 98.151982][ T35] usb 5-1: config 0 has no interfaces? [ 98.639241][ C1] usb 11-1: yurex_control_callback - control failed: -2 [ 98.640406][ T855] usb 11-1: USB disconnect, device number 2 [ 98.646621][ T855] yurex 11-1:0.0: USB YUREX #0 now disconnected [ 99.348278][ T8026] syzkaller0: entered promiscuous mode [ 99.348328][ T8026] syzkaller0: entered allmulticast mode [ 99.386171][ T1475] usb 10-1: USB disconnect, device number 3 [ 99.511422][ T69] IPVS: starting estimator thread 0... [ 99.522230][ T8037] FAULT_INJECTION: forcing a failure. [ 99.522230][ T8037] name fail_futex, interval 1, probability 0, space 0, times 0 [ 99.522283][ T8037] CPU: 0 UID: 0 PID: 8037 Comm: syz.5.797 Not tainted syzkaller #0 PREEMPT(full) [ 99.522311][ T8037] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 99.522320][ T8037] Call Trace: [ 99.522325][ T8037] [ 99.522330][ T8037] dump_stack_lvl+0x100/0x190 [ 99.522352][ T8037] should_fail_ex.cold+0x5/0xa [ 99.522369][ T8037] get_futex_key+0x1d0/0x14f0 [ 99.522392][ T8037] ? __pfx_get_futex_key+0x10/0x10 [ 99.522411][ T8037] ? __pfx___up_read+0x10/0x10 [ 99.522433][ T8037] ? kernelmode_fixup_or_oops.isra.0+0x80/0xf0 [ 99.522450][ T8037] futex_wake+0xf4/0x5e0 [ 99.522466][ T8037] ? __pfx_futex_wake+0x10/0x10 [ 99.522480][ T8037] ? lockdep_hardirqs_on+0x7d/0x110 [ 99.522510][ T8037] do_futex+0x2b2/0x440 [ 99.522523][ T8037] ? __pfx_do_futex+0x10/0x10 [ 99.522536][ T8037] ? __get_user_nocheck_8+0x20/0x20 [ 99.522556][ T8037] __ia32_sys_futex_time32+0x2f4/0x470 [ 99.522572][ T8037] ? xfd_validate_state+0x129/0x190 [ 99.522593][ T8037] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 99.522615][ T8037] __do_fast_syscall_32+0x13a/0x8b0 [ 99.522635][ T8037] do_fast_syscall_32+0x32/0x70 [ 99.522655][ T8037] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 99.522672][ T8037] RIP: 0023:0xf708efec [ 99.522686][ T8037] Code: Unable to access opcode bytes at 0xf708efc2. [ 99.522692][ T8037] RSP: 002b:00000000f547d5cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 99.522705][ T8037] RAX: ffffffffffffffda RBX: 00000000f7484f8c RCX: 0000000000000081 [ 99.522713][ T8037] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 99.522720][ T8037] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 99.522728][ T8037] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 99.522735][ T8037] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 99.522750][ T8037] [ 99.607922][ T8036] IPVS: using max 29 ests per chain, 69600 per kthread [ 99.654805][ T8045] netlink: 12 bytes leftover after parsing attributes in process `syz.6.801'. [ 99.676922][ T8047] netlink: 'syz.2.802': attribute type 3 has an invalid length. [ 99.677019][ T8047] netlink: 'syz.2.802': attribute type 3 has an invalid length. [ 99.786567][ T8054] syzkaller0: entered promiscuous mode [ 99.786625][ T8054] syzkaller0: entered allmulticast mode [ 100.192864][ T8081] syzkaller0: entered promiscuous mode [ 100.192914][ T8081] syzkaller0: entered allmulticast mode [ 100.352517][ T8089] netlink: 16 bytes leftover after parsing attributes in process `syz.6.820'. [ 100.584161][ T8107] netlink: 28 bytes leftover after parsing attributes in process `syz.6.825'. [ 100.644204][ T35] usb 5-1: unable to read config index 1 descriptor/start: -71 [ 100.644278][ T35] usb 5-1: can't read configurations, error -71 [ 100.816706][ T8132] netlink: 4 bytes leftover after parsing attributes in process `syz.6.835'. [ 100.965243][ T8147] netlink: 'syz.0.841': attribute type 9 has an invalid length. [ 101.147450][ T10] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 101.288608][ T8190] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 101.318934][ T10] usb 10-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 101.320254][ T10] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 101.320269][ T10] usb 10-1: config 0 has no interfaces? [ 101.322246][ T10] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 101.322260][ T10] usb 10-1: config 0 has no interfaces? [ 101.322995][ T10] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 101.323006][ T10] usb 10-1: config 0 has no interfaces? [ 101.324481][ T10] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 101.324494][ T10] usb 10-1: Product: syz [ 101.324501][ T10] usb 10-1: Manufacturer: syz [ 101.324508][ T10] usb 10-1: SerialNumber: syz [ 101.325794][ T10] usb 10-1: config 0 descriptor?? [ 101.533290][ T10] usb 10-1: USB disconnect, device number 4 [ 101.624073][ T8211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.864'. [ 102.273226][ T8236] netlink: 28 bytes leftover after parsing attributes in process `syz.5.871'. [ 102.446417][ T8246] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 102.692895][ T5850] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 102.817947][ T8257] netlink: 28 bytes leftover after parsing attributes in process `syz.0.880'. [ 102.838818][ T5850] usb 10-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 102.843624][ T5850] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 102.843689][ T5850] usb 10-1: config 0 has no interfaces? [ 102.852296][ T5850] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 102.852350][ T5850] usb 10-1: config 0 has no interfaces? [ 102.860855][ T5850] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 102.865610][ T5850] usb 10-1: config 0 has no interfaces? [ 102.869048][ T5850] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 102.873965][ T5850] usb 10-1: Product: syz [ 102.873983][ T5850] usb 10-1: Manufacturer: syz [ 102.873996][ T5850] usb 10-1: SerialNumber: syz [ 102.882368][ T8259] FAULT_INJECTION: forcing a failure. [ 102.882368][ T8259] name fail_futex, interval 1, probability 0, space 0, times 0 [ 102.882424][ T8259] CPU: 0 UID: 0 PID: 8259 Comm: syz.0.881 Not tainted syzkaller #0 PREEMPT(full) [ 102.882449][ T8259] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.882457][ T8259] Call Trace: [ 102.882462][ T8259] [ 102.882468][ T8259] dump_stack_lvl+0x100/0x190 [ 102.882488][ T8259] should_fail_ex.cold+0x5/0xa [ 102.882504][ T8259] get_futex_key+0x1d0/0x14f0 [ 102.882523][ T8259] ? __pfx_get_futex_key+0x10/0x10 [ 102.882545][ T8259] futex_wait_setup+0x91/0x540 [ 102.882563][ T8259] __futex_wait+0x19f/0x300 [ 102.882578][ T8259] ? __pfx___futex_wait+0x10/0x10 [ 102.882604][ T8259] ? __pfx_try_to_wake_up+0x10/0x10 [ 102.882621][ T8259] ? futex_hash+0x311/0x400 [ 102.882641][ T8259] ? __pfx_futex_wake_mark+0x10/0x10 [ 102.882656][ T8259] ? find_held_lock+0x2b/0x80 [ 102.882667][ T8259] ? futex_wake+0x4ea/0x5e0 [ 102.882682][ T8259] futex_wait+0xe6/0x370 [ 102.882696][ T8259] ? __pfx_futex_wait+0x10/0x10 [ 102.882716][ T8259] do_futex+0x265/0x440 [ 102.882727][ T8259] ? __pfx_do_futex+0x10/0x10 [ 102.882737][ T8259] ? kfree+0x22b/0x6d0 [ 102.882755][ T8259] __ia32_sys_futex_time32+0x2f4/0x470 [ 102.882769][ T8259] ? xfd_validate_state+0x129/0x190 [ 102.882785][ T8259] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 102.882803][ T8259] __do_fast_syscall_32+0x13a/0x8b0 [ 102.882819][ T8259] ? lockdep_hardirqs_on+0x7d/0x110 [ 102.882834][ T8259] do_fast_syscall_32+0x32/0x70 [ 102.882850][ T8259] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 102.882864][ T8259] RIP: 0023:0xf6ffefec [ 102.882878][ T8259] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 102.882884][ T8259] RSP: 002b:00000000f53ed5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 102.882896][ T8259] RAX: ffffffffffffffda RBX: 00000000f73f4f88 RCX: 0000000000000080 [ 102.882903][ T8259] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f73f4f8c [ 102.882910][ T8259] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 102.882916][ T8259] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.882923][ T8259] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 102.882936][ T8259] [ 102.953116][ T8261] overlayfs: failed to set uuid (261/file1, err=-12); falling back to uuid=null. [ 102.964498][ T8261] overlayfs: failed to verify upper root origin [ 102.985972][ T5850] usb 10-1: config 0 descriptor?? [ 103.047134][ T8267] net/sunrpc/rpc_pipe.c: rpc_populate failed to populate directory / [ 103.194934][ T10] usb 10-1: USB disconnect, device number 5 [ 103.363678][ T8281] syzkaller0: entered promiscuous mode [ 103.363736][ T8281] syzkaller0: entered allmulticast mode [ 103.796126][ T8297] can0: slcan on ttynull. [ 103.804522][ T8299] syzkaller0: entered promiscuous mode [ 103.804577][ T8299] syzkaller0: entered allmulticast mode [ 103.934916][ T8306] netlink: 620 bytes leftover after parsing attributes in process `syz.0.898'. [ 104.078841][ T10] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 104.259438][ T10] usb 10-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 104.261146][ T10] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 104.261175][ T10] usb 10-1: can't read configurations, error -61 [ 104.398420][ T10] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 104.400619][ T8326] netlink: 620 bytes leftover after parsing attributes in process `syz.0.907'. [ 104.559521][ T10] usb 10-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 104.563769][ T10] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 104.563791][ T10] usb 10-1: can't read configurations, error -61 [ 104.564047][ T10] usb usb10-port1: attempt power cycle [ 104.568858][ T8334] netlink: 8 bytes leftover after parsing attributes in process `syz.0.909'. [ 104.917687][ T10] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 104.948429][ T10] usb 10-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 104.949824][ T10] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 104.949850][ T10] usb 10-1: can't read configurations, error -61 [ 105.077557][ T10] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 105.110477][ T10] usb 10-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 105.112011][ T10] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 105.112046][ T10] usb 10-1: can't read configurations, error -61 [ 105.112295][ T10] usb usb10-port1: unable to enumerate USB device [ 105.916147][ T8356] syzkaller0: entered promiscuous mode [ 105.916233][ T8356] syzkaller0: entered allmulticast mode [ 106.859100][ T8296] can0 (unregistered): slcan off ttynull. [ 107.686079][ T8404] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 108.775999][ T8413] __nla_validate_parse: 1 callbacks suppressed [ 108.776121][ T8413] netlink: 28 bytes leftover after parsing attributes in process `syz.5.937'. [ 108.860937][ T8415] FAULT_INJECTION: forcing a failure. [ 108.860937][ T8415] name fail_futex, interval 1, probability 0, space 0, times 0 [ 108.861038][ T8415] CPU: 3 UID: 0 PID: 8415 Comm: syz.5.938 Not tainted syzkaller #0 PREEMPT(full) [ 108.861077][ T8415] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.861091][ T8415] Call Trace: [ 108.861100][ T8415] [ 108.861111][ T8415] dump_stack_lvl+0x100/0x190 [ 108.861153][ T8415] should_fail_ex.cold+0x5/0xa [ 108.861187][ T8415] get_futex_key+0x1d0/0x14f0 [ 108.861229][ T8415] ? __pfx_get_futex_key+0x10/0x10 [ 108.861279][ T8415] futex_wait_setup+0x91/0x540 [ 108.861319][ T8415] __futex_wait+0x19f/0x300 [ 108.861353][ T8415] ? __pfx___futex_wait+0x10/0x10 [ 108.861380][ T8415] ? __pfx_try_to_wake_up+0x10/0x10 [ 108.861417][ T8415] ? futex_hash+0x311/0x400 [ 108.861454][ T8415] ? __pfx_futex_wake_mark+0x10/0x10 [ 108.861489][ T8415] ? find_held_lock+0x2b/0x80 [ 108.861518][ T8415] ? futex_wake+0x4ea/0x5e0 [ 108.861557][ T8415] futex_wait+0xe6/0x370 [ 108.861586][ T8415] ? __pfx_futex_wait+0x10/0x10 [ 108.861691][ T8415] do_futex+0x265/0x440 [ 108.861736][ T8415] ? __pfx_do_futex+0x10/0x10 [ 108.861759][ T8415] ? kfree+0x22b/0x6d0 [ 108.861798][ T8415] __ia32_sys_futex_time32+0x2f4/0x470 [ 108.861829][ T8415] ? xfd_validate_state+0x129/0x190 [ 108.861867][ T8415] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 108.861903][ T8415] __do_fast_syscall_32+0x13a/0x8b0 [ 108.861934][ T8415] ? lockdep_hardirqs_on+0x7d/0x110 [ 108.861957][ T8415] do_fast_syscall_32+0x32/0x70 [ 108.861982][ T8415] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 108.862007][ T8415] RIP: 0023:0xf708efec [ 108.862033][ T8415] Code: Unable to access opcode bytes at 0xf708efc2. [ 108.862042][ T8415] RSP: 002b:00000000f547d5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 108.862064][ T8415] RAX: ffffffffffffffda RBX: 00000000f7484f88 RCX: 0000000000000080 [ 108.862079][ T8415] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f7484f8c [ 108.862091][ T8415] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 108.862102][ T8415] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 108.862114][ T8415] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 108.862139][ T8415] [ 109.237558][ T5841] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 109.387493][ T5841] usb 10-1: Using ep0 maxpacket: 32 [ 109.388263][ T5841] usb 10-1: New USB device found, idVendor=0525, idProduct=0000, bcdDevice= 0.00 [ 109.388295][ T5841] usb 10-1: no configurations [ 109.388306][ T5841] usb 10-1: can't read configurations, error -22 [ 109.517524][ T5841] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 109.667598][ T5841] usb 10-1: Using ep0 maxpacket: 32 [ 109.668314][ T5841] usb 10-1: New USB device found, idVendor=0525, idProduct=0000, bcdDevice= 0.00 [ 109.668344][ T5841] usb 10-1: no configurations [ 109.668354][ T5841] usb 10-1: can't read configurations, error -22 [ 109.670366][ T5841] usb usb10-port1: attempt power cycle [ 110.009464][ T5841] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 110.028251][ T5841] usb 10-1: Using ep0 maxpacket: 32 [ 110.028737][ T5841] usb 10-1: New USB device found, idVendor=0525, idProduct=0000, bcdDevice= 0.00 [ 110.028761][ T5841] usb 10-1: no configurations [ 110.028768][ T5841] usb 10-1: can't read configurations, error -22 [ 110.158284][ T5841] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 110.178251][ T5841] usb 10-1: Using ep0 maxpacket: 32 [ 110.178701][ T5841] usb 10-1: New USB device found, idVendor=0525, idProduct=0000, bcdDevice= 0.00 [ 110.178744][ T5841] usb 10-1: no configurations [ 110.178765][ T5841] usb 10-1: can't read configurations, error -22 [ 110.178981][ T5841] usb usb10-port1: unable to enumerate USB device [ 112.150623][ T8426] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 116.630357][ T64] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 116.635556][ T64] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 116.637122][ T64] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 116.640459][ T64] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 116.640933][ T64] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 117.060018][ T5606] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.270005][ T5606] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.398922][ T5606] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.529397][ T5606] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.604555][ T8430] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.609416][ T8430] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.613118][ T8430] bridge_slave_0: entered allmulticast mode [ 117.618023][ T8430] bridge_slave_0: entered promiscuous mode [ 117.623240][ T8430] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.626820][ T8430] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.631313][ T8430] bridge_slave_1: entered allmulticast mode [ 117.635908][ T8430] bridge_slave_1: entered promiscuous mode [ 117.684488][ T8430] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 117.692511][ T8430] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 117.734036][ T8430] team0: Port device team_slave_0 added [ 117.738892][ T8430] team0: Port device team_slave_1 added [ 117.871781][ T8430] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 117.871917][ T8430] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.871973][ T8430] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 117.890593][ T8430] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 117.890609][ T8430] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 117.890624][ T8430] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 117.939425][ T5606] bridge_slave_1: left allmulticast mode [ 117.939499][ T5606] bridge_slave_1: left promiscuous mode [ 117.939752][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.950113][ T5606] bridge_slave_0: left allmulticast mode [ 117.950162][ T5606] bridge_slave_0: left promiscuous mode [ 117.951288][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.214176][ T5606] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 118.222056][ T5606] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 118.227550][ T5606] bond0 (unregistering): Released all slaves [ 118.264100][ T8430] hsr_slave_0: entered promiscuous mode [ 118.265746][ T8430] hsr_slave_1: entered promiscuous mode [ 118.266136][ T8430] debugfs: 'hsr0' already exists in 'hsr' [ 118.266158][ T8430] Cannot create hsr debugfs directory [ 118.496581][ T5453] 8021q: adding VLAN 0 to HW filter on device eth14 [ 118.604108][ T64] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 118.607697][ T64] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 118.611029][ T64] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 118.616778][ T64] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 118.617735][ T64] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 118.689561][ T5606] hsr_slave_0: left promiscuous mode [ 118.692578][ T5606] hsr_slave_1: left promiscuous mode [ 118.693084][ T5606] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 118.693112][ T5606] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 118.697113][ T5606] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 118.697129][ T5606] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 118.716414][ T5606] veth1_macvtap: left promiscuous mode [ 118.716520][ T5606] veth0_macvtap: left promiscuous mode [ 118.716659][ T5606] veth1_vlan: left promiscuous mode [ 118.716691][ T5606] veth0_vlan: left promiscuous mode [ 118.718920][ T64] Bluetooth: hci1: command tx timeout [ 118.949591][ T5606] team0 (unregistering): Port device team_slave_1 removed [ 118.971319][ T5606] team0 (unregistering): Port device team_slave_0 removed [ 119.163336][ T5453] 8021q: adding VLAN 0 to HW filter on device eth15 [ 119.208357][ T8430] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 119.220497][ T8430] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 119.221014][ T8430] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 119.235203][ T8430] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 119.239666][ T8430] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 119.262200][ T8430] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 119.263093][ T8430] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 119.275693][ T8430] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 119.401753][ T8430] 8021q: adding VLAN 0 to HW filter on device bond0 [ 119.416367][ T8430] 8021q: adding VLAN 0 to HW filter on device team0 [ 119.427455][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 119.427593][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 119.436625][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 119.436759][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 119.500940][ T8430] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 119.578514][ T5453] 8021q: adding VLAN 0 to HW filter on device eth16 [ 119.870630][ T5453] 8021q: adding VLAN 0 to HW filter on device eth17 [ 119.990032][ T8456] bridge0: port 1(bridge_slave_0) entered blocking state [ 119.992914][ T8456] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.995582][ T8456] bridge_slave_0: entered allmulticast mode [ 119.999355][ T8456] bridge_slave_0: entered promiscuous mode [ 120.004369][ T8456] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.007350][ T8456] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.012914][ T8456] bridge_slave_1: entered allmulticast mode [ 120.016030][ T8456] bridge_slave_1: entered promiscuous mode [ 120.032603][ T8430] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 120.075293][ T8456] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 120.077086][ T8456] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 120.136152][ T8456] team0: Port device team_slave_0 added [ 120.175188][ T8456] team0: Port device team_slave_1 added [ 120.230422][ T8456] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 120.230471][ T8456] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 120.230514][ T8456] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 120.240775][ T8456] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 120.240789][ T8456] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 120.240810][ T8456] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 120.275346][ T5606] bridge_slave_1: left allmulticast mode [ 120.275409][ T5606] bridge_slave_1: left promiscuous mode [ 120.275557][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.283360][ T5606] bridge_slave_0: left allmulticast mode [ 120.283457][ T5606] bridge_slave_0: left promiscuous mode [ 120.285221][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.385597][ T5606] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 120.393104][ T5606] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 120.408110][ T5606] bond0 (unregistering): Released all slaves [ 120.465088][ T8456] hsr_slave_0: entered promiscuous mode [ 120.470412][ T8456] hsr_slave_1: entered promiscuous mode [ 120.470804][ T8456] debugfs: 'hsr0' already exists in 'hsr' [ 120.470817][ T8456] Cannot create hsr debugfs directory [ 120.534224][ T8430] veth0_vlan: entered promiscuous mode [ 120.582991][ T8430] veth1_vlan: entered promiscuous mode [ 120.648153][ T64] Bluetooth: hci2: command tx timeout [ 120.726507][ T8430] veth0_macvtap: entered promiscuous mode [ 120.733341][ T8430] veth1_macvtap: entered promiscuous mode [ 120.753936][ T8430] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 120.799275][ T64] Bluetooth: hci1: command tx timeout [ 120.830246][ T8430] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 120.858293][ T5453] 8021q: adding VLAN 0 to HW filter on device eth18 [ 120.869610][ T5606] hsr_slave_0: left promiscuous mode [ 120.872748][ T5606] hsr_slave_1: left promiscuous mode [ 120.873461][ T5606] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 120.876105][ T5606] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 121.096826][ T5606] team0 (unregistering): Port device team_slave_1 removed [ 121.119703][ T5606] team0 (unregistering): Port device team_slave_0 removed [ 121.156787][ T1172] smbdirect: ib_dev[syz1] removed [ 121.330446][ T5841] infiniband syz1: ib_query_port failed (-19) [ 121.339531][ T8456] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 121.345591][ T8456] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 121.346223][ T8456] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 121.354948][ T8456] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 121.368344][ T7683] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.368414][ T7683] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.368479][ T7683] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.368511][ T7683] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.383119][ T8456] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 121.392956][ T8456] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 121.404638][ T8456] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 121.419886][ T8456] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 121.535356][ T112] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.535430][ T112] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.584618][ T1172] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.584654][ T1172] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.612152][ T8456] 8021q: adding VLAN 0 to HW filter on device bond0 [ 121.626187][ T8456] 8021q: adding VLAN 0 to HW filter on device team0 [ 121.626951][ T5606] IPVS: stop unused estimator thread 0... [ 121.638424][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.638504][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 121.653359][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.653499][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 121.705147][ T5453] 8021q: adding VLAN 0 to HW filter on device eth19 [ 121.941493][ T8550] debugfs: out of free dentries, can not create directory '8550-8' [ 122.057084][ T5453] 8021q: adding VLAN 0 to HW filter on device eth20 [ 122.121152][ T8456] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 122.244894][ T5453] 8021q: adding VLAN 0 to HW filter on device eth21 [ 122.283706][ T8456] veth0_vlan: entered promiscuous mode [ 122.290235][ T8456] veth1_vlan: entered promiscuous mode [ 122.306405][ T8456] veth0_macvtap: entered promiscuous mode [ 122.309507][ T8456] veth1_macvtap: entered promiscuous mode [ 122.325665][ T8456] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 122.327467][ T8174] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 122.343681][ T8456] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 122.388841][ T5606] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.391128][ T5606] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.391153][ T5606] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.391172][ T5606] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.429458][ T1172] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.429525][ T1172] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.453590][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.453656][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.482242][ T8174] usb 12-1: Using ep0 maxpacket: 8 [ 122.482722][ T8174] usb 12-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 122.483507][ T8174] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 122.483521][ T8174] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 122.483533][ T8174] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 122.483545][ T8174] usb 12-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 122.483567][ T8174] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.519186][ T8584] netlink: 28 bytes leftover after parsing attributes in process `syz.8.946'. [ 122.615466][ T8588] syz.8.951 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 122.615549][ T8588] CPU: 1 UID: 0 PID: 8588 Comm: syz.8.951 Not tainted syzkaller #0 PREEMPT(full) [ 122.615576][ T8588] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.615585][ T8588] Call Trace: [ 122.615597][ T8588] [ 122.615602][ T8588] dump_stack_lvl+0x100/0x190 [ 122.615625][ T8588] dump_header+0xfb/0x606 [ 122.615641][ T8588] oom_kill_process.cold+0xd/0x380 [ 122.615657][ T8588] out_of_memory+0x340/0x14f0 [ 122.615677][ T8588] ? __pfx_out_of_memory+0x10/0x10 [ 122.615699][ T8588] mem_cgroup_out_of_memory+0xc6/0x130 [ 122.615714][ T8588] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 122.615728][ T8588] ? find_held_lock+0x2b/0x80 [ 122.615759][ T8588] ? do_raw_spin_unlock+0x145/0x1e0 [ 122.615778][ T8588] ? _raw_spin_unlock+0x28/0x50 [ 122.615793][ T8588] try_charge_memcg+0x783/0xf60 [ 122.615815][ T8588] ? __pfx_try_charge_memcg+0x10/0x10 [ 122.615832][ T8588] ? find_held_lock+0x2b/0x80 [ 122.615844][ T8588] ? rcu_read_unlock+0x17/0x60 [ 122.615883][ T8588] ? rcu_read_unlock+0x17/0x60 [ 122.615907][ T8588] __memcg_slab_post_alloc_hook+0x4a1/0x1270 [ 122.615932][ T8588] ? kasan_save_track+0x14/0x30 [ 122.615947][ T8588] kmem_cache_alloc_lru_noprof+0x4f6/0x6a0 [ 122.615963][ T8588] ? alloc_inode+0x68/0x250 [ 122.615982][ T8588] ? __pfx_rpc_alloc_inode+0x10/0x10 [ 122.615998][ T8588] alloc_inode+0x68/0x250 [ 122.616015][ T8588] new_inode+0x22/0x1c0 [ 122.616031][ T8588] ? lockdep_init_map_type+0x5c/0x250 [ 122.616049][ T8588] rpc_mkpipe_dentry+0x134/0x540 [ 122.616067][ T8588] ? __pfx_gss_pipe_match_pdo+0x10/0x10 [ 122.616086][ T8588] rpc_add_pipe_dir_object_locked.isra.0+0x8d/0x1e0 [ 122.616117][ T8588] ? __pfx_gss_pipe_match_pdo+0x10/0x10 [ 122.616135][ T8588] rpc_find_or_alloc_pipe_dir_object+0x104/0x150 [ 122.616152][ T8588] ? __pfx_gss_pipe_alloc_pdo+0x10/0x10 [ 122.616171][ T8588] gss_create+0xbda/0x1140 [ 122.616187][ T8588] ? __pfx_gss_create+0x10/0x10 [ 122.616199][ T8588] ? rpcauth_get_authops+0x13a/0x590 [ 122.616222][ T8588] rpcauth_create+0x9c/0x1b0 [ 122.616238][ T8588] rpc_client_register+0x3bc/0x6f0 [ 122.616254][ T8588] ? __pfx_rpc_client_register+0x10/0x10 [ 122.616272][ T8588] rpc_new_client+0x977/0x1300 [ 122.616289][ T8588] rpc_create_xprt+0xd9/0x440 [ 122.616304][ T8588] rpc_create+0x46e/0x7f0 [ 122.616320][ T8588] ? __pfx_rpc_create+0x10/0x10 [ 122.616352][ T8588] ? net_generic+0xea/0x2a0 [ 122.616364][ T8588] ? net_generic+0xea/0x2a0 [ 122.616380][ T8588] nfs_create_rpc_client+0x6a1/0x8f0 [ 122.616394][ T8588] ? __pfx_nfs_create_rpc_client+0x10/0x10 [ 122.616406][ T8588] ? __pfx___debug_object_init+0x10/0x10 [ 122.616431][ T8588] ? lockdep_init_map_type+0x5c/0x250 [ 122.616449][ T8588] ? lockdep_init_map_type+0x5c/0x250 [ 122.616470][ T8588] nfs4_alloc_client+0x8f0/0xd70 [ 122.616485][ T8588] ? __pfx_nfs4_alloc_client+0x10/0x10 [ 122.616501][ T8588] ? stack_trace_save+0x8e/0xc0 [ 122.616517][ T8588] ? __pfx_stack_trace_save+0x10/0x10 [ 122.616533][ T8588] ? lock_acquire+0x1d1/0x380 [ 122.616549][ T8588] ? net_generic+0x25/0x2a0 [ 122.616564][ T8588] ? nfs_get_client+0x849/0x1230 [ 122.616576][ T8588] ? nfs_get_client+0x849/0x1230 [ 122.616599][ T8588] nfs_get_client+0x87b/0x1230 [ 122.616612][ T8588] ? do_raw_spin_lock+0x128/0x260 [ 122.616637][ T8588] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 122.616657][ T8588] nfs4_set_client+0x3f6/0x640 [ 122.616672][ T8588] nfs4_init_server.isra.0+0x5ad/0xf60 [ 122.616688][ T8588] ? __pfx_nfs4_init_server.isra.0+0x10/0x10 [ 122.616713][ T8588] ? __rpc_init_priority_wait_queue+0x38a/0x500 [ 122.616739][ T8588] nfs4_create_server+0x185/0x2b0 [ 122.616756][ T8588] nfs4_try_get_tree+0x93/0x140 [ 122.616771][ T8588] nfs_get_tree+0xa61/0x1450 [ 122.616789][ T8588] vfs_get_tree+0x92/0x320 [ 122.616807][ T8588] vfs_cmd_create+0xd7/0x2a0 [ 122.616826][ T8588] __do_sys_fsconfig+0x55a/0xcb0 [ 122.616846][ T8588] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 122.616864][ T8588] ? xfd_validate_state+0x129/0x190 [ 122.616891][ T8588] __do_fast_syscall_32+0x13a/0x8b0 [ 122.616912][ T8588] do_fast_syscall_32+0x32/0x70 [ 122.616931][ T8588] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 122.616947][ T8588] RIP: 0023:0xf705efec [ 122.616964][ T8588] Code: Unable to access opcode bytes at 0xf705efc2. [ 122.616969][ T8588] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 00000000000001af [ 122.616983][ T8588] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000000000006 [ 122.616991][ T8588] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 122.616998][ T8588] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 122.617006][ T8588] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 122.617013][ T8588] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 122.617029][ T8588] [ 122.619750][ T8588] memory: usage 8kB, limit 8kB, failcnt 21 [ 122.619764][ T8588] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 122.619772][ T8588] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 122.619779][ T8588] Memory cgroup stats for /syz8/test: [ 122.620053][ T8588] cache 0 [ 122.620067][ T8588] rss 0 [ 122.620072][ T8588] rss_huge 0 [ 122.620077][ T8588] shmem 0 [ 122.620081][ T8588] mapped_file 0 [ 122.620121][ T8588] dirty 0 [ 122.620127][ T8588] writeback 0 [ 122.620132][ T8588] workingset_refault_anon 0 [ 122.620178][ T8588] workingset_refault_file 0 [ 122.620188][ T8588] swap 0 [ 122.620192][ T8588] swapcached 0 [ 122.620197][ T8588] pgpgin 0 [ 122.620202][ T8588] pgpgout 0 [ 122.620207][ T8588] pgfault 0 [ 122.620211][ T8588] pgmajfault 0 [ 122.620216][ T8588] inactive_anon 0 [ 122.620221][ T8588] active_anon 0 [ 122.620225][ T8588] inactive_file 0 [ 122.620230][ T8588] active_file 0 [ 122.620234][ T8588] unevictable 0 [ 122.620238][ T8588] hierarchical_memory_limit 8192 [ 122.620244][ T8588] hierarchical_memsw_limit 9223372036854771712 [ 122.620250][ T8588] total_cache 0 [ 122.620255][ T8588] total_rss 0 [ 122.620259][ T8588] total_rss_huge 0 [ 122.620264][ T8588] total_shmem 0 [ 122.620268][ T8588] total_mapped_file 0 [ 122.620273][ T8588] total_dirty 0 [ 122.620278][ T8588] total_writeback 0 [ 122.620282][ T8588] total_workingset_refault_anon 0 [ 122.620288][ T8588] total_workingset_refault_file 0 [ 122.620293][ T8588] total_swap 0 [ 122.620298][ T8588] total_swapcached 0 [ 122.620303][ T8588] total_pgpgin 0 [ 122.620308][ T8588] total_pgpgout 0 [ 122.620312][ T8588] total_pgfault 0 [ 122.620320][ T8588] total_pgmajfault 0 [ 122.620324][ T8588] total_inactive_anon 0 [ 122.620329][ T8588] total_active_anon 0 [ 122.620334][ T8588] total_inactive_file 0 [ 122.620338][ T8588] total_active_file 0 [ 122.620343][ T8588] total_unevictable 0 [ 122.620348][ T8588] anon_cost 0 [ 122.620353][ T8588] file_cost 0 [ 122.620358][ T8588] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz8/test,task_memcg=/syz8/test,task=syz.8.951,pid=8587,uid=0 [ 122.621222][ T8588] Memory cgroup out of memory: Killed process 8587 (syz.8.951) total-vm:102024kB, anon-rss:1292kB, file-rss:23336kB, shmem-rss:0kB, UID:0 pgtables:112kB oom_score_adj:1000 [ 122.628736][ T8588] rpc_mkpipe_dentry() failed to create pipe clnt4/gssd (errno = -12) [ 122.643894][ T8588] rpc_mkpipe_dentry() failed to create pipe clnt4/krb5 (errno = -12) [ 122.699324][ T8174] usb 12-1: usb_control_msg returned -32 [ 122.699347][ T8174] usbtmc 12-1:16.0: can't read capabilities [ 122.717657][ T64] Bluetooth: hci2: command tx timeout [ 122.741340][ T8174] usb 12-1: USB disconnect, device number 2 [ 122.877649][ T64] Bluetooth: hci1: command tx timeout [ 122.960174][ T872] usb 13-1: new high-speed USB device number 2 using dummy_hcd [ 123.109876][ T872] usb 13-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 123.109989][ T872] usb 13-1: too many configurations: 9, using maximum allowed: 8 [ 123.113611][ T872] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 123.113655][ T872] usb 13-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 123.113677][ T872] usb 13-1: config 0 interface 0 has no altsetting 0 [ 123.114685][ T872] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 123.114720][ T872] usb 13-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 123.114742][ T872] usb 13-1: config 0 interface 0 has no altsetting 0 [ 123.115753][ T872] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 123.115788][ T872] usb 13-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 123.115809][ T872] usb 13-1: config 0 interface 0 has no altsetting 0 [ 123.116746][ T872] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 123.116785][ T872] usb 13-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 123.116809][ T872] usb 13-1: config 0 interface 0 has no altsetting 0 [ 123.124996][ T5743] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 123.126572][ T5743] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 123.127959][ T5743] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 123.128388][ T872] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 123.128458][ T872] usb 13-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 123.128489][ T872] usb 13-1: config 0 interface 0 has no altsetting 0 [ 123.129392][ T5743] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 123.130295][ T5743] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 123.141818][ T872] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 123.141859][ T872] usb 13-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 123.141889][ T872] usb 13-1: config 0 interface 0 has no altsetting 0 [ 123.150002][ T872] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 123.150050][ T872] usb 13-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 123.150077][ T872] usb 13-1: config 0 interface 0 has no altsetting 0 [ 123.151279][ T872] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 123.151326][ T872] usb 13-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 123.151353][ T872] usb 13-1: config 0 interface 0 has no altsetting 0 [ 123.155533][ T872] usb 13-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 123.155554][ T872] usb 13-1: Product: syz [ 123.155566][ T872] usb 13-1: Manufacturer: syz [ 123.155577][ T872] usb 13-1: SerialNumber: syz [ 123.161203][ T872] usb 13-1: config 0 descriptor?? [ 123.179507][ T872] yurex 13-1:0.0: USB YUREX device now attached to Yurex #0 [ 123.300470][ T8597] macvtap1: entered promiscuous mode [ 123.300568][ T8597] vlan0: entered promiscuous mode [ 123.301080][ T8597] macvtap1: entered allmulticast mode [ 123.301099][ T8597] vlan0: entered allmulticast mode [ 123.301111][ T8597] veth0_vlan: entered allmulticast mode [ 123.327454][ T8597] macvtap2: entered promiscuous mode [ 123.327504][ T8597] macvtap2: entered allmulticast mode [ 123.415384][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.496806][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.521957][ T8609] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 123.606265][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.685688][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.924935][ T12] bridge_slave_1: left allmulticast mode [ 123.924986][ T12] bridge_slave_1: left promiscuous mode [ 123.925187][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.931026][ T12] bridge_slave_0: left allmulticast mode [ 123.931044][ T12] bridge_slave_0: left promiscuous mode [ 123.931187][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.130382][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 124.136426][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 124.143298][ T12] bond0 (unregistering): Released all slaves [ 124.158956][ T8592] bridge0: port 1(bridge_slave_0) entered blocking state [ 124.159045][ T8592] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.159136][ T8592] bridge_slave_0: entered allmulticast mode [ 124.160329][ T8592] bridge_slave_0: entered promiscuous mode [ 124.162143][ T8592] bridge0: port 2(bridge_slave_1) entered blocking state [ 124.162288][ T8592] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.162351][ T8592] bridge_slave_1: entered allmulticast mode [ 124.163470][ T8592] bridge_slave_1: entered promiscuous mode [ 124.211263][ T8592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 124.212759][ T8592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 124.230634][ T8592] team0: Port device team_slave_0 added [ 124.231870][ T8592] team0: Port device team_slave_1 added [ 124.250680][ T8592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 124.250733][ T8592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.250995][ T8592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 124.251924][ T8592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 124.251936][ T8592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 124.251951][ T8592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 124.365925][ T8592] hsr_slave_0: entered promiscuous mode [ 124.366753][ T8592] hsr_slave_1: entered promiscuous mode [ 124.367289][ T8592] debugfs: 'hsr0' already exists in 'hsr' [ 124.367307][ T8592] Cannot create hsr debugfs directory [ 124.441514][ T5453] 8021q: adding VLAN 0 to HW filter on device eth22 [ 124.530342][ T12] hsr_slave_0: left promiscuous mode [ 124.532652][ T12] hsr_slave_1: left promiscuous mode [ 124.533385][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 124.533436][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 124.540240][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 124.540329][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 124.554601][ T12] veth1_macvtap: left promiscuous mode [ 124.554684][ T12] veth0_macvtap: left promiscuous mode [ 124.554761][ T12] veth1_vlan: left promiscuous mode [ 124.555237][ T12] veth0_vlan: left promiscuous mode [ 124.811854][ T64] Bluetooth: hci2: command tx timeout [ 124.843553][ T12] team0 (unregistering): Port device team_slave_1 removed [ 124.875483][ T12] team0 (unregistering): Port device team_slave_0 removed [ 124.968594][ T64] Bluetooth: hci1: command tx timeout [ 125.207499][ T64] Bluetooth: hci3: command tx timeout [ 125.278766][ T8592] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 125.283274][ T8592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 125.285160][ T8592] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 125.288893][ T8592] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 125.289578][ T8592] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 125.293523][ T8592] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 125.294232][ T8592] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 125.299151][ T8592] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 125.310998][ T5453] 8021q: adding VLAN 0 to HW filter on device eth23 [ 125.360374][ T8592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 125.381819][ T8592] 8021q: adding VLAN 0 to HW filter on device team0 [ 125.390216][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.391091][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 125.397156][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.397277][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 125.438970][ T8592] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 125.439031][ T8592] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 125.452264][ C1] usb 13-1: yurex_control_callback - control failed: -2 [ 125.457974][ T7782] usb 13-1: USB disconnect, device number 2 [ 125.486327][ T7782] yurex 13-1:0.0: USB YUREX #0 now disconnected [ 125.560953][ T5453] 8021q: adding VLAN 0 to HW filter on device eth24 [ 125.721187][ T8592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 125.730347][ T5453] 8021q: adding VLAN 0 to HW filter on device eth25 [ 125.905016][ T8592] veth0_vlan: entered promiscuous mode [ 125.909357][ T8592] veth1_vlan: entered promiscuous mode [ 125.933363][ T8592] veth0_macvtap: entered promiscuous mode [ 125.938922][ T8592] veth1_macvtap: entered promiscuous mode [ 125.945849][ T8592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 125.951265][ T8592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 125.969480][ T12] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.020277][ T12] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.020570][ T12] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.020592][ T12] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 126.065459][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 126.065565][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 126.067733][ T8676] FAULT_INJECTION: forcing a failure. [ 126.067733][ T8676] name failslab, interval 1, probability 0, space 0, times 0 [ 126.067767][ T8676] CPU: 1 UID: 0 PID: 8676 Comm: syz.8.958 Not tainted syzkaller #0 PREEMPT(full) [ 126.067794][ T8676] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 126.067808][ T8676] Call Trace: [ 126.067816][ T8676] [ 126.067824][ T8676] dump_stack_lvl+0x100/0x190 [ 126.067910][ T8676] should_fail_ex.cold+0x5/0xa [ 126.067940][ T8676] should_failslab+0xc2/0x120 [ 126.067970][ T8676] __kmalloc_cache_node_noprof+0x94/0x720 [ 126.067999][ T8676] ? __alloc_workqueue+0x1211/0x1950 [ 126.068039][ T8676] __alloc_workqueue+0x1211/0x1950 [ 126.068083][ T8676] alloc_workqueue_noprof+0xc7/0x130 [ 126.068103][ T8676] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 126.068130][ T8676] ? __pfx___debug_object_init+0x10/0x10 [ 126.068165][ T8676] nci_register_device+0x21e/0xb80 [ 126.068189][ T8676] ? __pfx_nci_register_device+0x10/0x10 [ 126.068219][ T8676] ? lockdep_init_map_type+0x5c/0x250 [ 126.068257][ T8676] virtual_ncidev_open+0x141/0x220 [ 126.068290][ T8676] ? __pfx_virtual_ncidev_open+0x10/0x10 [ 126.068322][ T8676] misc_open+0x26d/0x450 [ 126.068344][ T8676] ? __pfx_misc_open+0x10/0x10 [ 126.068366][ T8676] chrdev_open+0x234/0x6a0 [ 126.068390][ T8676] ? __pfx_apparmor_file_open+0x10/0x10 [ 126.068424][ T8676] ? __pfx_chrdev_open+0x10/0x10 [ 126.068449][ T8676] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 126.068485][ T8676] do_dentry_open+0x6ab/0x14d0 [ 126.068506][ T8676] ? __pfx_chrdev_open+0x10/0x10 [ 126.068538][ T8676] vfs_open+0x82/0x3f0 [ 126.068570][ T8676] path_openat+0x19fa/0x2440 [ 126.068609][ T8676] ? __pfx_path_openat+0x10/0x10 [ 126.068646][ T8676] do_file_open+0x20e/0x430 [ 126.068676][ T8676] ? __pfx_do_file_open+0x10/0x10 [ 126.068724][ T8676] ? _raw_spin_unlock+0x28/0x50 [ 126.068751][ T8676] ? alloc_fd+0x471/0x7a0 [ 126.068783][ T8676] do_sys_openat2+0x10f/0x1e0 [ 126.068815][ T8676] ? __pfx_do_sys_openat2+0x10/0x10 [ 126.068848][ T8676] ? fdget+0x18b/0x210 [ 126.068876][ T8676] __ia32_compat_sys_openat+0x12d/0x210 [ 126.068909][ T8676] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 126.068953][ T8676] __do_fast_syscall_32+0x13a/0x8b0 [ 126.068990][ T8676] do_fast_syscall_32+0x32/0x70 [ 126.069022][ T8676] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 126.069051][ T8676] RIP: 0023:0xf705efec [ 126.069075][ T8676] Code: Unable to access opcode bytes at 0xf705efc2. [ 126.069084][ T8676] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 126.069106][ T8676] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 126.069122][ T8676] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 126.069136][ T8676] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 126.069150][ T8676] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 126.069164][ T8676] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 126.069193][ T8676] [ 126.124950][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 126.124969][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 126.200470][ T8678] process 'syz.8.959' launched './file0' with NULL argv: empty string added [ 126.596937][ T8689] netlink: 28 bytes leftover after parsing attributes in process `syz.8.963'. [ 126.877868][ T64] Bluetooth: hci2: command tx timeout [ 126.890585][ T8699] syzkaller0: entered promiscuous mode [ 126.890634][ T8699] syzkaller0: entered allmulticast mode [ 127.167325][ T8702] netlink: 20 bytes leftover after parsing attributes in process `syz.8.968'. [ 127.287595][ T64] Bluetooth: hci3: command tx timeout [ 127.352954][ T5743] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 127.353809][ T5743] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 127.356575][ T5743] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 127.359952][ T5743] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 127.365117][ T5743] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 127.381371][ T8712] netlink: 20 bytes leftover after parsing attributes in process `syz.8.968'. [ 127.381417][ T8712] nbd: nbd64 already in use [ 127.426070][ T8726] netlink: 28 bytes leftover after parsing attributes in process `syz.9.973'. [ 127.502270][ T8432] udevd[8432]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 128.149840][ T8718] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.149942][ T8718] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.150424][ T8718] bridge_slave_0: entered allmulticast mode [ 128.151688][ T8718] bridge_slave_0: entered promiscuous mode [ 128.156039][ T8718] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.156114][ T8718] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.156208][ T8718] bridge_slave_1: entered allmulticast mode [ 128.157468][ T8718] bridge_slave_1: entered promiscuous mode [ 128.198958][ T5743] Bluetooth: hci3: hardware error 0x00 [ 128.248722][ T8718] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 128.268211][ T8718] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 128.321693][ T8718] team0: Port device team_slave_0 added [ 128.325347][ T8718] team0: Port device team_slave_1 added [ 128.376296][ T12] bridge_slave_1: left allmulticast mode [ 128.376379][ T12] bridge_slave_1: left promiscuous mode [ 128.376963][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.384685][ T12] bridge_slave_0: left allmulticast mode [ 128.384708][ T12] bridge_slave_0: left promiscuous mode [ 128.386036][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.524093][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 128.537584][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 128.541633][ T12] bond0 (unregistering): Released all slaves [ 128.550432][ T8718] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 128.550483][ T8718] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 128.550509][ T8718] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 128.574734][ T8718] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 128.574792][ T8718] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 128.574816][ T8718] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 128.641554][ T8718] hsr_slave_0: entered promiscuous mode [ 128.642519][ T8718] hsr_slave_1: entered promiscuous mode [ 128.893738][ T12] hsr_slave_0: left promiscuous mode [ 128.898555][ T12] hsr_slave_1: left promiscuous mode [ 128.899387][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.911323][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.925680][ T8770] netlink: 28 bytes leftover after parsing attributes in process `syz.8.983'. [ 129.090978][ T12] team0 (unregistering): Port device team_slave_1 removed [ 129.108652][ T12] team0 (unregistering): Port device team_slave_0 removed [ 129.218024][ T5453] 8021q: adding VLAN 0 to HW filter on device eth26 [ 129.339619][ T8781] netlink: 20 bytes leftover after parsing attributes in process `syz.8.986'. [ 129.395501][ T8783] netlink: 'syz.8.987': attribute type 2 has an invalid length. [ 129.438855][ T64] Bluetooth: hci0: command tx timeout [ 129.702490][ T5453] 8021q: adding VLAN 0 to HW filter on device eth27 [ 129.749041][ T8798] syz.8.989 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 129.752214][ T8798] CPU: 3 UID: 0 PID: 8798 Comm: syz.8.989 Not tainted syzkaller #0 PREEMPT(full) [ 129.752243][ T8798] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 129.752254][ T8798] Call Trace: [ 129.752263][ T8798] [ 129.752273][ T8798] dump_stack_lvl+0x100/0x190 [ 129.752306][ T8798] dump_header+0xfb/0x606 [ 129.752325][ T8798] oom_kill_process.cold+0xd/0x380 [ 129.752348][ T8798] out_of_memory+0x340/0x14f0 [ 129.752376][ T8798] ? __pfx_out_of_memory+0x10/0x10 [ 129.752406][ T8798] mem_cgroup_out_of_memory+0xc6/0x130 [ 129.752428][ T8798] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 129.752444][ T8798] ? find_held_lock+0x2b/0x80 [ 129.752466][ T8798] ? do_raw_spin_unlock+0x145/0x1e0 [ 129.752490][ T8798] ? _raw_spin_unlock+0x28/0x50 [ 129.752512][ T8798] try_charge_memcg+0x783/0xf60 [ 129.752539][ T8798] ? __pfx_try_charge_memcg+0x10/0x10 [ 129.752562][ T8798] ? find_held_lock+0x2b/0x80 [ 129.752576][ T8798] ? rcu_read_unlock+0x17/0x60 [ 129.752599][ T8798] ? rcu_read_unlock+0x17/0x60 [ 129.752678][ T8798] __memcg_slab_post_alloc_hook+0x4a1/0x1270 [ 129.752717][ T8798] ? kasan_save_track+0x14/0x30 [ 129.752738][ T8798] kmem_cache_alloc_noprof+0x4fa/0x6a0 [ 129.752758][ T8798] ? d_instantiate+0x8a/0xb0 [ 129.752779][ T8798] ? alloc_empty_file+0x5b/0x1c0 [ 129.752805][ T8798] alloc_empty_file+0x5b/0x1c0 [ 129.752827][ T8798] alloc_file_pseudo+0x183/0x290 [ 129.752849][ T8798] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 129.752871][ T8798] ? pidfs_register_pid_gfp+0x72/0x1f0 [ 129.752892][ T8798] sock_alloc_file+0x50/0x210 [ 129.752914][ T8798] __sys_socketpair+0x321/0x5b0 [ 129.752931][ T8798] ? __pfx___sys_socketpair+0x10/0x10 [ 129.752954][ T8798] __ia32_sys_socketpair+0x95/0x100 [ 129.752970][ T8798] ? lockdep_hardirqs_on+0x7d/0x110 [ 129.752992][ T8798] __do_fast_syscall_32+0x13a/0x8b0 [ 129.753024][ T8798] do_fast_syscall_32+0x32/0x70 [ 129.753050][ T8798] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 129.753075][ T8798] RIP: 0023:0xf705efec [ 129.753093][ T8798] Code: Unable to access opcode bytes at 0xf705efc2. [ 129.753100][ T8798] RSP: 002b:00000000f544d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000168 [ 129.753116][ T8798] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000000005 [ 129.753126][ T8798] RDX: 0000000000000000 RSI: 0000000080000100 RDI: 0000000000000000 [ 129.753136][ T8798] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 129.753145][ T8798] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 129.753155][ T8798] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 129.753176][ T8798] [ 129.753182][ T8798] memory: usage 8kB, limit 8kB, failcnt 97 [ 129.753192][ T8798] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 129.753202][ T8798] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 129.753212][ T8798] Memory cgroup stats for /syz8/test: [ 129.766847][ T8798] cache 0 [ 129.766859][ T8798] rss 0 [ 129.766867][ T8798] rss_huge 0 [ 129.766874][ T8798] shmem 0 [ 129.766881][ T8798] mapped_file 0 [ 129.766888][ T8798] dirty 0 [ 129.766895][ T8798] writeback 0 [ 129.766902][ T8798] workingset_refault_anon 0 [ 129.766910][ T8798] workingset_refault_file 0 [ 129.766918][ T8798] swap 0 [ 129.766925][ T8798] swapcached 0 [ 129.766932][ T8798] pgpgin 0 [ 129.766937][ T8798] pgpgout 0 [ 129.766944][ T8798] pgfault 1 [ 129.766950][ T8798] pgmajfault 0 [ 129.766957][ T8798] inactive_anon 0 [ 129.766964][ T8798] active_anon 0 [ 129.766970][ T8798] inactive_file 0 [ 129.766977][ T8798] active_file 0 [ 129.766984][ T8798] unevictable 0 [ 129.766991][ T8798] hierarchical_memory_limit 8192 [ 129.766999][ T8798] hierarchical_memsw_limit 9223372036854771712 [ 129.767007][ T8798] total_cache 0 [ 129.767014][ T8798] total_rss 0 [ 129.767020][ T8798] total_rss_huge 0 [ 129.767027][ T8798] total_shmem 0 [ 129.767034][ T8798] total_mapped_file 0 [ 129.767041][ T8798] total_dirty 0 [ 129.767047][ T8798] total_writeback 0 [ 129.767055][ T8798] total_workingset_refault_anon 0 [ 129.767062][ T8798] total_workingset_refault_file 0 [ 129.767070][ T8798] total_swap 0 [ 129.767076][ T8798] total_swapcached 0 [ 129.767084][ T8798] total_pgpgin 0 [ 129.767090][ T8798] total_pgpgout 0 [ 129.767097][ T8798] total_pgfault 1 [ 129.767104][ T8798] total_pgmajfault 0 [ 129.767111][ T8798] total_inactive_anon 0 [ 129.767118][ T8798] total_active_anon 0 [ 129.767126][ T8798] total_inactive_file 0 [ 129.767133][ T8798] total_active_file 0 [ 129.767139][ T8798] total_unevictable 0 [ 129.767147][ T8798] anon_cost 0 [ 129.767153][ T8798] file_cost 0 [ 129.767160][ T8798] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz8/test,task_memcg=/syz8/test,task=syz.8.989,pid=8796,uid=0 [ 129.769112][ T8798] Memory cgroup out of memory: Killed process 8796 (syz.8.989) total-vm:102024kB, anon-rss:1276kB, file-rss:22952kB, shmem-rss:0kB, UID:0 pgtables:108kB oom_score_adj:1000 [ 129.948315][ T8806] netlink: 28 bytes leftover after parsing attributes in process `syz.8.991'. [ 130.025910][ T5453] 8021q: adding VLAN 0 to HW filter on device eth28 [ 130.245728][ T5453] 8021q: adding VLAN 0 to HW filter on device eth29 [ 130.266746][ T8718] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 130.273236][ T8718] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 130.273840][ T8718] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 130.283360][ T8718] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 130.283910][ T8718] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 130.291460][ T8718] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 130.292698][ T8718] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 130.298337][ T8718] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 130.319411][ T5743] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 130.389313][ T8841] netlink: 28 bytes leftover after parsing attributes in process `syz.9.999'. [ 130.399727][ T8718] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.420376][ T8718] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.436891][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.437025][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.444098][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.444225][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.490354][ T8718] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 130.920823][ T8718] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 130.984596][ T8718] veth0_vlan: entered promiscuous mode [ 130.988522][ T8718] veth1_vlan: entered promiscuous mode [ 131.003863][ T8718] veth0_macvtap: entered promiscuous mode [ 131.008005][ T8718] veth1_macvtap: entered promiscuous mode [ 131.014605][ T8718] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 131.019717][ T8718] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 131.039324][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.039393][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.039450][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.039495][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 131.074674][ T112] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.074742][ T112] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.099975][ T112] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.100047][ T112] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.202153][ T8895] netlink: 28 bytes leftover after parsing attributes in process `syz.8.1008'. [ 131.514401][ T8922] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 131.517514][ T5743] Bluetooth: hci0: command tx timeout [ 131.579226][ T8922] md: could not open device unknown-block(1,0). [ 131.649894][ T8922] md/raid1:md0: active with 1 out of 1 mirrors [ 131.650629][ T8922] md0: detected capacity change from 0 to 2048 [ 131.745658][ T8922] md/raid0:md0: multiple devices for 0 - aborting! [ 131.745723][ T8922] md: md0: raid0 would not accept array [ 131.868248][ T8946] [ 131.869477][ T8946] ====================================================== [ 131.872932][ T8946] WARNING: possible circular locking dependency detected [ 131.876102][ T8946] syzkaller #0 Not tainted [ 131.878053][ T8946] ------------------------------------------------------ [ 131.881067][ T8946] syz.3.1020/8946 is trying to acquire lock: [ 131.883785][ T8946] ffff888013ebbc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 131.887993][ T8946] [ 131.887993][ T8946] but task is already holding lock: [ 131.891281][ T8946] ffff88804bc79460 (&pipe->mutex){+.+.}-{4:4}, at: pipe_lock+0x69/0x80 [ 131.894822][ T8946] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 131.894822][ T8946] which lock already depends on the new lock. [ 131.894822][ T8946] [ 131.899474][ T8946] [ 131.899474][ T8946] the existing dependency chain (in reverse order) is: [ 131.903856][ T8946] [ 131.903856][ T8946] -> #2 (&pipe->mutex){+.+.}-{4:4}: [ 131.907224][ T8946] lock_acquire+0x1d1/0x380 [ 131.907442][ T855] usb 14-1: new high-speed USB device number 2 using dummy_hcd [ 131.912543][ T8946] __mutex_lock+0x1a4/0x1bd0 [ 131.914781][ T8946] anon_pipe_prefill_and_lock+0x16c/0x580 [ 131.917573][ T8946] anon_pipe_write+0x164/0x1b50 [ 131.920198][ T8946] __kernel_write_iter+0x6bb/0x930 [ 131.922967][ T8946] __kernel_write+0xf6/0x140 [ 131.925188][ T8946] autofs_notify_daemon+0x50d/0xd90 [ 131.927612][ T8946] autofs_wait+0x10fd/0x1b50 [ 131.929806][ T8946] autofs_mount_wait+0x132/0x3b0 [ 131.932258][ T8946] autofs_d_automount+0x490/0x950 [ 131.934944][ T8946] __traverse_mounts+0x1b9/0x8a0 [ 131.937359][ T8946] step_into_slowpath+0xb7e/0xf90 [ 131.939762][ T8946] path_lookupat+0x58b/0xc40 [ 131.941958][ T8946] filename_lookup+0x202/0x590 [ 131.944266][ T8946] kern_path+0x37/0x50 [ 131.946382][ T8946] lookup_bdev+0xd8/0x2a0 [ 131.948781][ T8946] resume_store+0x1d6/0x460 [ 131.951182][ T8946] kobj_attr_store+0x58/0x80 [ 131.953637][ T8946] sysfs_kf_write+0xf2/0x150 [ 131.955747][ T8946] kernfs_fop_write_iter+0x3e0/0x5f0 [ 131.957903][ T8946] vfs_write+0x6af/0x1050 [ 131.959980][ T8946] ksys_write+0x12a/0x250 [ 131.961948][ T8946] __do_fast_syscall_32+0x13a/0x8b0 [ 131.964382][ T8946] do_fast_syscall_32+0x32/0x70 [ 131.966856][ T8946] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 131.970187][ T8946] [ 131.970187][ T8946] -> #1 (&sbi->pipe_mutex){+.+.}-{4:4}: [ 131.973678][ T8946] lock_acquire+0x1d1/0x380 [ 131.976116][ T8946] __mutex_lock+0x1a4/0x1bd0 [ 131.978316][ T8946] autofs_notify_daemon+0x4f8/0xd90 [ 131.980581][ T8946] autofs_wait+0x10fd/0x1b50 [ 131.982752][ T8946] autofs_mount_wait+0x132/0x3b0 [ 131.984967][ T8946] autofs_d_automount+0x490/0x950 [ 131.987688][ T8946] __traverse_mounts+0x1b9/0x8a0 [ 131.990512][ T8946] step_into_slowpath+0xb7e/0xf90 [ 131.993002][ T8946] path_lookupat+0x58b/0xc40 [ 131.995108][ T8946] filename_lookup+0x202/0x590 [ 131.997676][ T8946] kern_path+0x37/0x50 [ 131.999789][ T8946] lookup_bdev+0xd8/0x2a0 [ 132.001989][ T8946] resume_store+0x1d6/0x460 [ 132.004421][ T8946] kobj_attr_store+0x58/0x80 [ 132.006810][ T8946] sysfs_kf_write+0xf2/0x150 [ 132.009156][ T8946] kernfs_fop_write_iter+0x3e0/0x5f0 [ 132.011731][ T8946] vfs_write+0x6af/0x1050 [ 132.013715][ T8946] ksys_write+0x12a/0x250 [ 132.015834][ T8946] __do_fast_syscall_32+0x13a/0x8b0 [ 132.018346][ T8946] do_fast_syscall_32+0x32/0x70 [ 132.020624][ T8946] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 132.023159][ T8946] [ 132.023159][ T8946] -> #0 (&of->mutex){+.+.}-{4:4}: [ 132.025574][ T8946] check_prev_add+0xeb/0xe60 [ 132.027235][ T8946] __lock_acquire+0x1492/0x1ec0 [ 132.029266][ T8946] lock_acquire+0x1d1/0x380 [ 132.030949][ T8946] __mutex_lock+0x1a4/0x1bd0 [ 132.032716][ T8946] kernfs_fop_write_iter+0x2c2/0x5f0 [ 132.034831][ T8946] iter_file_splice_write+0x830/0x10b0 [ 132.037337][ T8946] do_splice+0x109c/0x1fa0 [ 132.039303][ T8946] __do_splice+0x33b/0x370 [ 132.041359][ T8946] __ia32_sys_splice+0x189/0x250 [ 132.043779][ T8946] __do_fast_syscall_32+0x13a/0x8b0 [ 132.046403][ T8946] do_fast_syscall_32+0x32/0x70 [ 132.048961][ T8946] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 132.052154][ T8946] [ 132.052154][ T8946] other info that might help us debug this: [ 132.052154][ T8946] [ 132.057035][ T8946] Chain exists of: [ 132.057035][ T8946] &of->mutex --> &sbi->pipe_mutex --> &pipe->mutex [ 132.057035][ T8946] [ 132.062653][ T8946] Possible unsafe locking scenario: [ 132.062653][ T8946] [ 132.066033][ T8946] CPU0 CPU1 [ 132.067531][ T855] usb 14-1: Using ep0 maxpacket: 8 [ 132.069571][ T855] usb 14-1: unable to get BOS descriptor or descriptor too short [ 132.069633][ T855] usb 14-1: New USB device found, idVendor=3b73, idProduct=0023, bcdDevice= 0.40 [ 132.071490][ T855] usb 14-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 132.071531][ T855] usb 14-1: config 0 has no interfaces? [ 132.073410][ T855] usb 14-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.073450][ T855] usb 14-1: Product: syz [ 132.073479][ T855] usb 14-1: Manufacturer: syz [ 132.073508][ T855] usb 14-1: SerialNumber: syz [ 132.074784][ T855] usb 14-1: config 0 descriptor?? [ 132.093787][ T8946] ---- ---- [ 132.095539][ T8946] lock(&pipe->mutex); [ 132.097135][ T8946] lock(&sbi->pipe_mutex); [ 132.100079][ T8946] lock(&pipe->mutex); [ 132.102693][ T8946] lock(&of->mutex); [ 132.104153][ T8946] [ 132.104153][ T8946] *** DEADLOCK *** [ 132.104153][ T8946] [ 132.106741][ T8946] locks held by syz.3.1020/8946: 2, last CPU#1: [ 132.108921][ T8946] #0: ffff888023d22460 (sb_writers#7){.+.+}-{0:0}, at: __do_splice+0x33b/0x370 [ 132.111912][ T8946] #1: ffff88804bc79460 (&pipe->mutex){+.+.}-{4:4}, at: pipe_lock+0x69/0x80 [ 132.115012][ T8946] [ 132.115012][ T8946] stack backtrace: [ 132.117073][ T8946] CPU: 1 UID: 0 PID: 8946 Comm: syz.3.1020 Not tainted syzkaller #0 PREEMPT(full) [ 132.120218][ T8946] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 132.123670][ T8946] Call Trace: [ 132.124906][ T8946] [ 132.125839][ T8946] dump_stack_lvl+0x100/0x190 [ 132.127429][ T8946] print_circular_bug.cold+0x178/0x1be [ 132.129190][ T8946] check_noncircular+0x146/0x160 [ 132.130760][ T8946] ? find_held_lock+0x2b/0x80 [ 132.132405][ T8946] check_prev_add+0xeb/0xe60 [ 132.134334][ T8946] ? stack_depot_save_flags+0x49a/0x9f0 [ 132.136842][ T8946] __lock_acquire+0x1492/0x1ec0 [ 132.138805][ T8946] ? __ia32_sys_splice+0x189/0x250 [ 132.140485][ T8946] ? __do_fast_syscall_32+0x13a/0x8b0 [ 132.142487][ T8946] lock_acquire+0x1d1/0x380 [ 132.144061][ T8946] ? kernfs_fop_write_iter+0x2c2/0x5f0 [ 132.145990][ T8946] ? __pfx___might_resched+0x10/0x10 [ 132.147918][ T8946] __mutex_lock+0x1a4/0x1bd0 [ 132.149464][ T8946] ? kernfs_fop_write_iter+0x2c2/0x5f0 [ 132.151179][ T8946] ? kernfs_fop_write_iter+0x2c2/0x5f0 [ 132.153344][ T8946] ? __asan_memcpy+0x3c/0x60 [ 132.155223][ T8946] ? __pfx___mutex_lock+0x10/0x10 [ 132.157005][ T8946] ? __pfx__copy_from_iter+0x10/0x10 [ 132.159016][ T8946] ? __kmalloc_noprof+0x350/0x840 [ 132.160725][ T8946] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 132.162540][ T8946] ? kernfs_fop_write_iter+0x2c2/0x5f0 [ 132.164455][ T8946] kernfs_fop_write_iter+0x2c2/0x5f0 [ 132.166264][ T8946] iter_file_splice_write+0x830/0x10b0 [ 132.168342][ T8946] ? __pfx_iter_file_splice_write+0x10/0x10 [ 132.170643][ T8946] ? find_held_lock+0x2b/0x80 [ 132.172457][ T8946] ? tomoyo_path_number_perm+0x28f/0x580 [ 132.174355][ T8946] ? __pfx_iter_file_splice_write+0x10/0x10 [ 132.176252][ T8946] do_splice+0x109c/0x1fa0 [ 132.177715][ T8946] ? __lock_acquire+0x4c5/0x1ec0 [ 132.179295][ T8946] ? __lock_acquire+0x4c5/0x1ec0 [ 132.181074][ T8946] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 132.182760][ T8946] ? __pfx_do_splice+0x10/0x10 [ 132.184364][ T8946] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 132.186053][ T8946] ? __fget_files+0x34/0x3d0 [ 132.187674][ T8946] ? find_held_lock+0x2b/0x80 [ 132.189693][ T8946] __do_splice+0x33b/0x370 [ 132.191254][ T8946] ? __pfx___do_splice+0x10/0x10 [ 132.192882][ T8946] __ia32_sys_splice+0x189/0x250 [ 132.194833][ T8946] __do_fast_syscall_32+0x13a/0x8b0 [ 132.196654][ T8946] do_fast_syscall_32+0x32/0x70 [ 132.198706][ T8946] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 132.200851][ T8946] RIP: 0023:0xf708efec [ 132.202271][ T8946] Code: Unable to access opcode bytes at 0xf708efc2. [ 132.204737][ T8946] RSP: 002b:00000000f545c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000139 [ 132.207683][ T8946] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 132.210474][ T8946] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 000000000004ffe6 [ 132.213113][ T8946] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 132.215603][ T8946] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 132.218155][ T8946] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 132.220829][ T8946] [ 132.229625][ T8946] zram0: detected capacity change from 0 to 8 [ 132.232403][ T8946] zram: Cannot change disksize for initialized device [ 132.406008][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.406068][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.591867][ T12] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.620367][ T7782] usb 14-1: USB disconnect, device number 2 [ 132.672598][ T12] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.750460][ T12] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.861751][ T12] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.983065][ T12] bridge_slave_1: left allmulticast mode [ 132.983130][ T12] bridge_slave_1: left promiscuous mode [ 132.983287][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.989595][ T12] bridge_slave_0: left allmulticast mode [ 132.989620][ T12] bridge_slave_0: left promiscuous mode [ 132.989763][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.031386][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 133.036076][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 133.043270][ T12] bond0 (unregistering): Released all slaves [ 133.282052][ T12] hsr_slave_0: left promiscuous mode [ 133.284719][ T12] hsr_slave_1: left promiscuous mode [ 133.285222][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 133.285242][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 133.288205][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 133.288221][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 133.294507][ T12] veth1_macvtap: left promiscuous mode [ 133.294541][ T12] veth0_macvtap: left promiscuous mode [ 133.294593][ T12] veth1_vlan: left promiscuous mode [ 133.294631][ T12] veth0_vlan: left promiscuous mode [ 133.369004][ T12] team0 (unregistering): Port device team_slave_1 removed [ 133.371855][ T12] team0 (unregistering): Port device team_slave_0 removed [ 133.407576][ T5453] 8021q: adding VLAN 0 to HW filter on device eth2 [ 133.532080][ T5453] 8021q: adding VLAN 0 to HW filter on device eth3 [ 133.635545][ T5453] 8021q: adding VLAN 0 to HW filter on device eth4 [ 133.705002][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 133.760177][ T5453] 8021q: adding VLAN 0 to HW filter on device eth5 [ 134.010728][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.060537][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.100276][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.198429][ T12] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.250859][ T12] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.292472][ T12] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.298801][ T5453] 8021q: adding VLAN 0 to HW filter on device eth30 [ 134.332200][ T12] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.391980][ T12] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.405032][ T5453] 8021q: adding VLAN 0 to HW filter on device eth31 [ 134.441355][ T12] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.501290][ T12] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.540417][ T12] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.608498][ T12] bridge_slave_1: left allmulticast mode [ 134.608546][ T12] bridge_slave_1: left promiscuous mode [ 134.609308][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.614737][ T12] bridge_slave_0: left allmulticast mode [ 134.614750][ T12] bridge_slave_0: left promiscuous mode [ 134.614831][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.626378][ T12] bridge_slave_1: left allmulticast mode [ 134.626422][ T12] bridge_slave_1: left promiscuous mode [ 134.626606][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.633979][ T12] bridge_slave_0: left allmulticast mode [ 134.633992][ T12] bridge_slave_0: left promiscuous mode [ 134.634059][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.644459][ T12] bridge_slave_1: left allmulticast mode [ 134.644513][ T12] bridge_slave_1: left promiscuous mode [ 134.644650][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.650114][ T12] bridge_slave_0: left allmulticast mode [ 134.650131][ T12] bridge_slave_0: left promiscuous mode [ 134.650201][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.713893][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 134.718819][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 134.723214][ T12] bond0 (unregistering): Released all slaves [ 134.752184][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 134.756800][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 134.761704][ T12] bond0 (unregistering): Released all slaves [ 134.793831][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 134.799003][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 134.802463][ T12] bond0 (unregistering): Released all slaves [ 134.807570][ T5453] 8021q: adding VLAN 0 to HW filter on device eth33 [ 135.163265][ T5453] 8021q: adding VLAN 0 to HW filter on device eth32 [ 135.266661][ T12] hsr_slave_0: left promiscuous mode [ 135.270404][ T12] hsr_slave_1: left promiscuous mode [ 135.273401][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 135.276507][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 135.281067][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 135.281083][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 135.290774][ T12] hsr_slave_0: left promiscuous mode [ 135.293130][ T12] hsr_slave_1: left promiscuous mode [ 135.293656][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 135.293671][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 135.296076][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 135.296090][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 135.308488][ T12] hsr_slave_0: left promiscuous mode [ 135.310737][ T12] hsr_slave_1: left promiscuous mode [ 135.312707][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 135.314994][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 135.319029][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 135.319087][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 135.326073][ T12] veth1_macvtap: left promiscuous mode [ 135.326136][ T12] veth0_macvtap: left promiscuous mode [ 135.326205][ T12] veth1_vlan: left promiscuous mode [ 135.326232][ T12] veth0_vlan: left promiscuous mode [ 135.333999][ T12] vlan0: left allmulticast mode [ 135.334050][ T12] veth0_vlan: left allmulticast mode [ 135.334104][ T12] vlan0: left promiscuous mode [ 135.334283][ T12] veth1_macvtap: left promiscuous mode [ 135.334302][ T12] veth0_macvtap: left promiscuous mode [ 135.334352][ T12] veth1_vlan: left promiscuous mode [ 135.334381][ T12] veth0_vlan: left promiscuous mode [ 135.342008][ T12] veth1_macvtap: left promiscuous mode [ 135.342040][ T12] veth0_macvtap: left promiscuous mode [ 135.342090][ T12] veth1_vlan: left promiscuous mode [ 135.342126][ T12] veth0_vlan: left promiscuous mode [ 135.446412][ T12] team0 (unregistering): Port device team_slave_1 removed [ 135.450759][ T12] team0 (unregistering): Port device team_slave_0 removed [ 135.514095][ T12] team0 (unregistering): Port device team_slave_1 removed [ 135.520978][ T12] team0 (unregistering): Port device team_slave_0 removed [ 135.601938][ T12] team0 (unregistering): Port device team_slave_1 removed [ 135.609932][ T12] team0 (unregistering): Port device team_slave_0 removed [ 135.657319][ T5453] 8021q: adding VLAN 0 to HW filter on device eth34 [ 135.811056][ T5453] 8021q: adding VLAN 0 to HW filter on device eth35 [ 135.968066][ T5453] 8021q: adding VLAN 0 to HW filter on device eth36 [ 136.108831][ T5453] 8021q: adding VLAN 0 to HW filter on device eth37 [ 136.241056][ T5453] 8021q: adding VLAN 0 to HW filter on device eth38 [ 136.385811][ T5453] 8021q: adding VLAN 0 to HW filter on device eth39 [ 136.563129][ T5453] 8021q: adding VLAN 0 to HW filter on device eth40 [ 136.800132][ T5453] 8021q: adding VLAN 0 to HW filter on device eth41