last executing test programs: 30.0413421s ago: executing program 2 (id=2860): sendto(0xffffffffffffffff, &(0x7f0000000040)="120000001200e7ef007b00000000000000a1", 0x12, 0x4044084, 0x0, 0x0) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000300)={@val={0x0, 0x805}, @void, @x25={0x0, 0x0, 0x1, '\v'}}, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e24, 0x8}, 0x1c) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f00000000c0)=0x4, 0x4) listen(r4, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r4, 0xc01c586a, &(0x7f0000000280)={r0, &(0x7f0000000100)='syzkaller1\x00', 0x280, &(0x7f0000000140)={@align=0x3, {0x5, 0xc, 0x3, 0x100000000000001}}, 0x0, &(0x7f0000000180), &(0x7f0000000240)=0x7}) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r5, 0xc008551b, &(0x7f00000002c0)={0x2, 0x20, [0x7, 0x30c64e1, 0x0, 0xd0, 0x0, 0x2, 0x2, 0xffff]}) sendto$inet(r3, 0x0, 0x0, 0x0, &(0x7f0000e68000)={0x2, 0x4e22, @empty}, 0x10) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000000)=[0x0, 0x0, 0x0], 0x3}, 0x58) munmap(&(0x7f0000bde000/0x3000)=nil, 0x3000) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000600)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@typedef={0x4, 0x0, 0x0, 0x8, 0x4}]}, {0x0, [0x61, 0x61, 0x3e]}}, 0x0, 0x29, 0x0, 0x1, 0x800}, 0x28) r7 = socket$inet_udp(0x2, 0x2, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x1b, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xaf1}, {}, {}, [@call={0x85, 0x0, 0x0, 0x22}, @cb_func={0x18, 0x3, 0x4, 0x0, 0x1}, @ldst={0x0, 0x1, 0x2, 0x2, 0x2, 0x100, 0x8}, @map_val={0x18, 0x8, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x101}, @generic={0x40, 0x2, 0x8, 0x7, 0x9}, @tail_call={{0x18, 0x2, 0x1, 0x0, r5}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xa687}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f00000004c0)=ANY=[], 0x76) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f00000000c0)) 29.57878621s ago: executing program 2 (id=2863): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000007c0)=@newtfilter={0xf0, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0x7, 0xffff}, {0x3}}, [@filter_kind_options=@f_flower={{0xb}, {0xc0, 0x2, [@TCA_FLOWER_ACT={0xbc, 0x3, [@m_tunnel_key={0x60, 0x1, 0x0, 0x0, {{0xf}, {0x30, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x1}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x2, @rand_addr=0x64010100}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x3, @rand_addr=0x64010101}]}, {0x4}, {0xc}, {0xc}}}, @m_sample={0x58, 0x2, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x1, {0x5, 0x0, 0x1}}, @TCA_SAMPLE_RATE={0x8, 0x2, 0x1}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2a}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0xf0}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x108}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x867, &(0x7f0000000140)={0x0, 0x9164, 0x1000, 0x1, 0x359}, &(0x7f00000002c0), &(0x7f0000ff4000), &(0x7f0000000000)) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) r2 = openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r5, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}]}, 0x1c}}, 0x0) read$nci(r2, &(0x7f0000000200)=""/100, 0x64) write$nci(r2, &(0x7f0000000280)=@NCI_OP_CORE_RESET_RSP={0x0, 0x0, 0x2, 0x0, 0x0, {0x1}}, 0x6) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(0xffffffffffffffff, 0x40505331, &(0x7f0000000740)={{0x70, 0x5}, {0xf, 0x5}, 0xd181, 0x1, 0x1}) read$nci(r2, &(0x7f00000002c0)=""/100, 0x64) write$nci(r2, &(0x7f0000000340)=@NCI_OP_CORE_INIT_RSP, 0x14) read$nci(r2, &(0x7f0000000380)=""/100, 0x64) write$nci(r2, &(0x7f0000000400)=@NCI_OP_RF_DISCOVER_MAP_RSP, 0x4) sendmsg$NFC_CMD_START_POLL(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000008c0)=ANY=[@ANYBLOB="24160000", @ANYRES16=r5, @ANYBLOB="010023010000340200000600000008000100", @ANYRES32=r3, @ANYBLOB="0800cb0e9b60e986034004000000"], 0x24}}, 0x0) read$nci(r2, &(0x7f0000000500)=""/100, 0x64) write$nci(r2, &(0x7f0000000580)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r2, &(0x7f00000005c0)=""/100, 0x64) write$nci(r2, &(0x7f0000000640)=@NCI_OP_CORE_SET_CONFIG_RSP, 0x5) read$nci(r2, &(0x7f0000000680)=""/100, 0x64) write$nci(r2, &(0x7f0000000700)=@NCI_OP_RF_DISCOVER_RSP, 0x4) 28.263128454s ago: executing program 2 (id=2869): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x900800}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="00048542b5af6fdbb727bd7000fe"], 0x14}, 0x1, 0x0, 0x0, 0x40001}, 0x40000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r2, 0xffffffff80000800, 0x0, &(0x7f0000000f80)={0x8000000000000000, 0x4, 0x100000001, 0x3, 0x24, 0xffffffffffffffff, 0x3, 0x4, 0x100fff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x8000600, 0x0, 0x1, 0x9, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000180)={@mcast1, 0x8000600, 0x0, 0xff, 0x1, 0x400, 0xfffc}, 0x20) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000021c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) mkdir(&(0x7f0000000100)='./debugfs\x00', 0x1ff) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, 0x0, 0x0}, 0x94) r4 = io_uring_setup(0x3eae, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x11a1}) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) syz_clone(0xb44040, 0x0, 0x0, 0x0, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) r5 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=@newqdisc={0x38, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfb, {0x60, 0x0, 0x0, r7, {0x0, 0xc}, {0x8, 0xa}, {0xffe0, 0xe}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x28, 0x2, [@TCA_PIE_LIMIT={0x8, 0x2, 0x1}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x55}, 0x8010) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) 27.920770359s ago: executing program 2 (id=2872): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mbind(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4005, &(0x7f0000000c00)=0xc, 0x6, 0x2) futex_waitv(&(0x7f0000001b00)=[{0xffb, &(0x7f0000000240)=0x200000006, 0xa}], 0x1, 0x0, 0x0, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x5032}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) writev(r1, &(0x7f0000000400)=[{&(0x7f0000000500)="010000000000220010000000000002010000000000020800450000740002400040063c807f0000017f00000104d204d2008be45a1bd519d77d10000000000000", 0x40}, {&(0x7f0000000880)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8}], 0x2) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0/file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x185093, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) umount2(&(0x7f00000001c0)='./file0/file0\x00', 0x8) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/usb/devices/usb2/power/autosuspend_delay_ms\x00', 0x1, 0x0) write$binfmt_format(r3, &(0x7f00000000c0)='-1\x00', 0x3) write$binfmt_format(r3, &(0x7f0000000180)='1\x00', 0x2) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) socket$netlink(0x10, 0x3, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x22, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) 27.6919753s ago: executing program 2 (id=2874): openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/uprobe_events\x00', 0x2, 0x0) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @loopback=0x7f00fffd}, 0x10, 0x0}, 0x8050) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000200), 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c040, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000003c0)='nfs4\x00', 0x0, &(0x7f00000001c0)='\x01') (fail_nth: 14) 27.403668149s ago: executing program 2 (id=2875): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x86, 0xbffffffd, &(0x7f0000006680)) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x86, 0xbffffffd, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) eventfd(0x9) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x10, 0x2, 0x0) (async) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)="5c00000012006bcd9e3fe3dc6e48aa310b6b87033c00a6001f03000000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4) 27.19291946s ago: executing program 32 (id=2875): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x86, 0xbffffffd, &(0x7f0000006680)) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x86, 0xbffffffd, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) eventfd(0x9) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x10, 0x2, 0x0) (async) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)="5c00000012006bcd9e3fe3dc6e48aa310b6b87033c00a6001f03000000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4) 12.942679902s ago: executing program 4 (id=2914): syz_emit_ethernet(0x2a, &(0x7f00000001c0)={@broadcast, @remote, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @multicast, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @dev}}}}, 0x0) (async) r0 = socket(0x10, 0x3, 0x0) (async) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r1, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x35, 0x5, 0x57e, 0x330, 0x0, 0x0, "0600ff0901a101150026ff007508951f852009018102852109018102852209018102851609019102851709019102851509019102c0"}}, 0x14d) (async) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) (async) write$UHID_INPUT2(r1, &(0x7f0000000200)={0xc, {0x7, "20000003000000"}}, 0xd) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x1000000, {0x60, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0xfff}, @TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x1}]}}]}, 0x48}}, 0x0) 11.547238806s ago: executing program 0 (id=2926): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000240)={{r0}}) r1 = socket$kcm(0x2, 0xa, 0x2) syz_open_dev$loop(&(0x7f0000000280), 0x9, 0x10000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "399421fe8a4c9563", "00b147fbbfc100", '\x00', "f2ffffff07ffffff"}, 0x28) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r3, &(0x7f0000000040)='\x00', 0x1) ioctl$SOUND_MIXER_READ_VOLUME(r3, 0x80044d08, &(0x7f0000000180)) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e23, 0x8, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}, 0x1c) pselect6(0x40, &(0x7f00000001c0)={0x3f, 0x0, 0x3, 0xfffffffffffffffd, 0x4}, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000001c0)={&(0x7f0000000040)=[0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0], &(0x7f0000000140)=[0x0], 0x2, 0x5c, 0x2, 0x1}) ioctl$DRM_IOCTL_MODE_GETENCODER(0xffffffffffffffff, 0xc01464a6, &(0x7f0000000200)={r4}) write$tun(r0, &(0x7f0000000440)={@val, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0x8}}}}}}}, 0x3e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) 10.497349896s ago: executing program 0 (id=2920): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x301000, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x31) mount(0x0, 0x0, &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000007000000000000000000000095"], &(0x7f0000000440)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/netdevsim/new_device\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='10 1 1\x00', 0x7) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='1\x00', 0x2) close(r4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="740000001000ffff25bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="17200000212000004c0012800c0001006d6163766c616e003c00028008000300030000000800010010000000280005800a00040096aaaaaaaaaa00000a"], 0x74}, 0x1, 0x0, 0x0, 0x1}, 0xc000) r5 = socket(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000000240)=@generic={&(0x7f0000001280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r2}, 0x14) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/mycluster/heartbeat/dead_threshold\x00', 0x1, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0a00000004000000040000007f00000000100000df0846feb508771820202e6e8e7d9502aa03d4b4a2c1b321a2e3a99902615bea78db5acd72981cd753b3b70fd24008d00bf728d340d9dada578c5001802c7861c06bd30dac17ca8b37cb56a3b39281faac41bc6a544a4c1da4e372206699d242ad3adf276ddb7089a9d4100af5091351c32db8f23c9f75d27262ef075ed3ac3d55a6a8217b83a8eae76ec19a02c8722ce3281f3318d910c344186cc0254e9b2077f926d004a0a5d371cf", @ANYRESDEC=r7, @ANYBLOB='\x00'/20, @ANYBLOB="e44e1ed91047a422e06167f59f951fb56e35717d6585abab044d8912dde44b4f6f8a2eea80d518ceaf83f07315cdc777c828784d289f80a26927b1e1a62194c70d2034e87b347eee4b41dc345ace1b78a0306133438fa3741ec303b57e80de01124c498ec9f05674cb1efed6116772a427a9eb411f96d068d605eedceb358415cc71a40817c95845e1f5dc38808de328af3ce9b79d88103a55fde5d583e741149a9f3550afe21cf7573ba5ff3670881cf5489294c04b9c7a704d26ec4816b459", @ANYRES32=r0, @ANYRES16=r3], 0x50) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1fa18436f4aa27650000001004000005000000050000000000d54e0cd8dfe40200", @ANYRES32, @ANYBLOB='\t\x00'/20, @ANYRES32=0x0, @ANYRES32=r6, @ANYBLOB="0200000004000000020000000d00"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0x10, &(0x7f0000000640)=ANY=[@ANYRES8=r1, @ANYRES32=r9, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x48, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 9.532749948s ago: executing program 0 (id=2921): syz_io_uring_setup(0xf06, &(0x7f0000000400)={0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000003c0)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)) sendto(0xffffffffffffffff, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000000080), 0x4a) sendmmsg$inet(r3, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(r4) openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x42, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x418000) syz_io_uring_modify_offsets$generic(r0, r1, 0x54, 0x10000) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo/3\x00') read$FUSE(r5, &(0x7f00000040c0)={0x2020}, 0x2020) 7.617509962s ago: executing program 0 (id=2922): syz_io_uring_setup(0xf06, &(0x7f0000000400)={0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000003c0)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)) sendto(0xffffffffffffffff, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000000080), 0x4a) sendmmsg$inet(r3, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(r4) openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x42, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x418000) syz_io_uring_modify_offsets$generic(r0, r1, 0x54, 0x10000) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo/3\x00') read$FUSE(r5, &(0x7f00000040c0)={0x2020}, 0x2020) 6.137922964s ago: executing program 0 (id=2927): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x69ee, 0xc00, 0x5, 0x50}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, 0x0) syz_ublk_setup_queues(r0, 0x0, &(0x7f0000019080)={0x0, 0x597f, 0x1, 0x2, 0x10d, 0x0, r0}, &(0x7f0000019180)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2067, 0x8000, 0x3, 0x17, 0x0, r0}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xce5e, 0x10, 0x2, 0x2c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xecae, 0x200, 0x3, 0x11a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88d9, 0x800, 0x0, 0x3bd, 0x0, r0}}], 0x4, 0x0, &(0x7f000001a480)) r7 = socket$pptp(0x18, 0x1, 0x2) accept4(r7, 0x0, 0x0, 0x800) r8 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bind$inet(r8, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3000004, 0x10, r6, 0x24b2000) connect$inet(r8, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r10, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) close_range(r9, 0xffffffffffffffff, 0x3f00000000000000) syz_pidfd_open(0x0, 0x0) sendmmsg(r8, &(0x7f0000007fc0), 0x800001d, 0x1c) 5.181645394s ago: executing program 3 (id=2928): r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./trace/uprobe_events\x00', 0x0, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0000001200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000000)=@in={0x2, 0x4e24, @loopback=0x7f00fffd}, 0x10, 0x0}, 0x8050) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000200), 0x8) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000002480)={'wlan0\x00'}) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000100000040000180060001000a00000008000500000000000c000700000000000000000008000900710000000700060072720000080008000000000008000b"], 0x54}}, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) open_tree(0xffffffffffffffff, 0x0, 0x89901) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r0, r3, 0x25, 0x14, @void}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c040, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000003c0)='nfs4\x00', 0x0, &(0x7f00000001c0)='\x01') r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r6, 0x4008ae90, &(0x7f00000002c0)={0x4, 0x0, [{0x1, 0xff, 0x0, 0x6, 0x0, 0x20}, {0x40000001, 0x0, 0x2, 0xef, 0x0, 0x2}, {0x1, 0x1000, 0x6, 0x7ff, 0x0, 0x1, 0xb}, {0x0, 0x4, 0x4, 0x6, 0xb, 0x4, 0x7}]}) ioctl$KVM_SET_NESTED_STATE(r6, 0x4080aebf, &(0x7f0000000400)=@vmx={0x0, 0x0, 0x2080, {0x25000, 0xffffffffffffffff, {0x2}, 0x1}, {'\x00', "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100"}}) lremovexattr(&(0x7f0000000080)='./trace/uprobe_events\x00', &(0x7f0000000100)=@known='trusted.overlay.nlink\x00') 5.138224119s ago: executing program 3 (id=2930): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x11, 0x4, 0x4, 0x8}, 0x50) (async) r1 = syz_open_dev$vcsn(&(0x7f00000001c0), 0x2, 0x80) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r1, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r2, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@ETHTOOL_A_RINGS_RX_MINI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x41}, 0x4800) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c0001800600"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="500000000001010400000000141a000002000010240001801400018008000100e000000108000200e00000010c00028005000100000000001800028014000180080001"], 0x50}}, 0x0) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a1b000000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) (async) sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000000840)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000680)={0x154, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0xb8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x5}, @TIPC_NLA_NODE_ID={0x1b, 0x3, "bedff09e01b9fa44cf07a416e20ff4b93f26b21984bd45"}, @TIPC_NLA_NODE_KEY={0x47, 0x4, {'gcm(aes)\x00', 0x1f, "c3ce8afdfdad15f778b0589a4dd49b0ff24e6df529782fa3f59ce9907cb1d7"}}, @TIPC_NLA_NODE_KEY={0x45, 0x4, {'gcm(aes)\x00', 0x1d, "d90fb5b717781adac54792367dddccf467825d28fca5742e41c46288be"}}]}, @TIPC_NLA_SOCK={0x40, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7f}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_PUBL={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x101}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80000001}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xa}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER={0x4}]}, 0x154}, 0x1, 0x0, 0x0, 0x4000}, 0x8048) r4 = gettid() tkill(r4, 0x7) (async) syz_open_procfs(r4, &(0x7f0000000480)='net/unix\x00') (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./trace\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000300)='./trace/error_log\x00', 0x24903, 0x4) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0x3100, 0x3100, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.023133927s ago: executing program 3 (id=2933): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) setresuid(0x0, 0xee00, 0x0) write(r1, &(0x7f0000000100)='select \n', 0x10) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000000c0)={0x32b, @time={0x200, 0x216}, 0x0, {}, 0x0, 0x1}) 4.385553415s ago: executing program 3 (id=2935): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x143542, 0x88) write$P9_RREADDIR(r0, 0x0, 0x0) (async) write$P9_RREADDIR(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) setns(0xc9, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x6, &(0x7f0000000300)=@raw=[@generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xffffffc0}, @call={0x85, 0x0, 0x0, 0xd1}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x45}, @generic={0x95}], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x5, @void}, 0x10) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) (async) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) (async) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) keyctl$clear(0x3, 0xfffffffffffffffd) request_key(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0xfffffffffffffffe) (async) request_key(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0xfffffffffffffffe) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) (async) r4 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b00000005000000020000000400000005"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xe, 0x4, 0x8, 0x7, 0x0, 0xffffffffffffffff, 0x7ff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x11, 0x15, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000100850000000100000018110000", @ANYRES32, @ANYBLOB="00005130bd18475ab100000000dcdc000000b7080000000000007bf4289c9402c600f8b703002008000000b7040000000100be971a1732efd65a51b93800"/73, @ANYBLOB="d67f16b81011c22919a5bc8a2b5b79ca410b81e8e380dec05a9329cf53527d09d6275a8c2b27cf7e0721dfd679366990cf89c13ac425e94fa2cd41d0867fd8c71a6a6a6a321f15e6c32e1d38954854bf0eb7a8975d98e940c37988f4101e74ae0b72fe8b480a400c62c3c427c428e3de83ddbb836af15af4f52ff7f9304a00d9768dcf109e91dc04ba6ea683d2c559092f14653f7ebd0bfb2f27891e023701dd9775cb7290b54d943c8bf0", @ANYRESHEX=r2], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) (async) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) (async) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_FD(r4, 0x5, &(0x7f00000000c0)='source', 0x0, r4) (async) fsconfig$FSCONFIG_SET_FD(r4, 0x5, &(0x7f00000000c0)='source', 0x0, r4) socket$netlink(0x10, 0x3, 0xb) socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x1, 0x70bd29, 0x259fdbfd, {0x0, 0x0, 0x0, 0x0, 0x21120, 0x68591}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4000804) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) 4.340903511s ago: executing program 0 (id=2936): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x69ee, 0xc00, 0x5, 0x50}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, 0x0) syz_ublk_setup_queues(r0, 0x0, &(0x7f0000019080)={0x0, 0x597f, 0x1, 0x2, 0x10d, 0x0, r0}, &(0x7f0000019180)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2067, 0x8000, 0x3, 0x17, 0x0, r0}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xce5e, 0x10, 0x2, 0x2c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xecae, 0x200, 0x3, 0x11a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88d9, 0x800, 0x0, 0x3bd, 0x0, r0}}], 0x4, 0x0, &(0x7f000001a480)) r7 = socket$pptp(0x18, 0x1, 0x2) accept4(r7, 0x0, 0x0, 0x800) r8 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bind$inet(r8, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3000004, 0x10, r6, 0x24b2000) connect$inet(r8, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r9 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0) syz_usb_control_io$printer(r9, 0x0, &(0x7f0000000100)={0x98, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r10, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) syz_pidfd_open(0x0, 0x0) sendmmsg(r8, &(0x7f0000007fc0), 0x800001d, 0x1c) 3.933237934s ago: executing program 4 (id=2937): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) socket$kcm(0x10, 0x2, 0x0) r0 = socket$kcm(0x11, 0x200000000000002, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000002c0)=r2, 0x4) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r3, &(0x7f0000000300)='r:test/event1 ./file0:0x0 arg2=\\', 0x20) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x30000, &(0x7f00000004c0)={&(0x7f0000000140)={0x1c, 0x15, 0x1, 0xfffffffc, 0x30000, {0x5, 0x7c}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x3b5e04dbece314b7}, 0xc000) 3.840575606s ago: executing program 4 (id=2938): r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xbf31, 0x2, 0xfffffffd, 0x1c9}, &(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000240)=0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000040)=[{0x0}, {&(0x7f00000000c0)=""/250, 0xfa}], 0x2}}], 0x1, 0x34000, 0x0) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000040)={0x30, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) setxattr(&(0x7f00000000c0)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000240)=@known='trusted.overlay.redirect\x00', 0x0, 0x0, 0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x49, 0x0, r0}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x100000c, 0x4031, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, 0x0, 0x1, 0x70bd2a, 0x0, {{}, {}, {0x14, 0x19, {0x0, 0x1}}}}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x4080) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x0, &(0x7f0000000100)=0xffffffff, 0x4) connect$inet6(r5, &(0x7f0000002000)={0xa, 0x4e1e, 0x7579cf98, @loopback, 0x103}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000003c0), 0x3) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) getsockopt$bt_hci(r5, 0x11a, 0x5, 0x0, &(0x7f0000000040)=0xfffffffffffffdaf) r6 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r6, &(0x7f0000000700)=[{&(0x7f00000002c0)='\x00', 0x1}, {0x0}, {&(0x7f0000000400)="c24c84660b627142da5f185c34aa9697c8519c1571c3f20993517fd6db8b0114a642c50107d9fe3f07445be28000ba767b6757ac95c1dec09f90bd532babdfc2e5d1c99d06c23d459c195eb0ab626b30daa082de340fe5b7d7e00bd95a027a68ad97cff74e", 0x65}, {&(0x7f00000005c0)="fe69e4d9c628ebd54f4643de2f7aa1108c4f33e606e3c33e90f2fe580bd439865a7604738f09479b00545e9b375695605b63f90ac6d36faae1ee2087c6ee74d86882a9fb937394772163d6864291703aeb5963d3f4f761b11ab5f83ffa2baba761a9473632edc09edc8cd5bcea239f48beedf5e0155b9b2c747859544246e75fb1f67792349b1f440f4efc67e7494e517eb53593bace917b0fb350f64c1cdb9753920f1c0bc3e550d070270f1414d39e245bce3af6bbba1b5d334ea447aea849ade569fbdcc90ea49afb80db7f8d296b0578c4d2f9aadfb1dde350b433265749f8c9d43b72b295dc08ef8773a81fbd606256dcb4d02ed0196f7c053808", 0xfd}, {&(0x7f00000006c0)="377068f14bd204987aa0ae881cfdb9eaf58bf2cd822138e327bacc3c67f83ef0d60a3c0490046762e4ab97933efdc564bab0", 0x32}], 0x5) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x4844c1) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mount(&(0x7f0000000200)=@nullb, &(0x7f00000001c0)='./file0\x00', 0x0, 0x1000, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) io_uring_enter(r0, 0xfffffffd, 0x1, 0x0, 0x0, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r7, 0x0, 0x48a, &(0x7f0000000140)={0x6, 0x7}, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 3.669136492s ago: executing program 4 (id=2941): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x30, r1, 0x5, 0x0, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x14, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0xb8}, @NL80211_MESHCONF_PLINK_TIMEOUT={0x8, 0x1c, 0x1}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) write$binfmt_aout(r3, &(0x7f00000001c0)=ANY=[], 0xff2e) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xe, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0xc, &(0x7f0000000400)=ANY=[@ANYBLOB="61100c0000000000150003000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000050002000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000000000000b7030000000000008500000033000000b70000000200000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x0, 0xe, 0x0, &(0x7f0000000700)="00112233445566778899aabb0800", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000dc0)={0x0, 0xfffffff5, 0x5, 0xd000, 0xe, "0062ba7d8200000016001b001e00f705096604"}) r7 = syz_open_pts(r3, 0xa0200) r8 = dup3(r7, r3, 0x0) r9 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x400, 0x0, 0x40055, 0x0, r8}, &(0x7f0000000100)=0x0, &(0x7f0000000180)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r10, r11, r12, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r9, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_setup(0x7, &(0x7f00000000c0)=0x0) io_submit(r13, 0x1, &(0x7f0000000b00)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x3}]) openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/uprobe_events\x00', 0x2, 0x0) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @loopback=0x7f00fffd}, 0x10, 0x0}, 0x8050) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000200), 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c040, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000003c0)='nfs4\x00', 0x0, &(0x7f00000001c0)='\x01') 3.621004612s ago: executing program 1 (id=2942): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0xc05, 0x0, 0x0, {0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x7}, @NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}, {0x18, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x94}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r3) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r4, 0x1, 0x70bd2a, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4000040) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000c80), r5) sendmsg$NFC_CMD_DEACTIVATE_TARGET(r5, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000d00)={0x1c, r6, 0x5a5, 0x4070bd29, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000140)=0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='\t'], 0x24}}, 0x0) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRESDEC=r9, @ANYRES16=r9, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x20008000) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x44, r9, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0x18, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x8, 0x4, '\x00\x00\x00\x00'}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x41}, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000180)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000001c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000200)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000240)=0x0) sendmsg$NFC_CMD_DEV_DOWN(r3, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x3c, r6, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r10}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r12}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r13}]}, 0x3c}}, 0x24008081) setns(r1, 0x24020000) ptrace$setregset(0x4205, 0x0, 0x201, &(0x7f00000000c0)={&(0x7f0000000000)="4f44e51e14523eca876824804756977f845dfbd5bc1eec3c50168539ea315e81cd968418fe6686415d8e47dff763970abbe4138b36f460df8a6458a89c333e8a8faa6c9e1085adf9c4e2706ba0b206c7c03d7e4f6607dd945378d89f52125f8f2b9efedbe54c7e4836d2087189225b746ccb1f2d73d676d044e125484d9a26e7a04f84eaa1e782", 0x87}) syz_clone(0xb60e111f, 0x0, 0x14, 0x0, 0x0, 0x0) 3.265898648s ago: executing program 4 (id=2943): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x69ee, 0xc00, 0x5, 0x50}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, 0x0) syz_ublk_setup_queues(r0, 0x0, &(0x7f0000019080)={0x0, 0x597f, 0x1, 0x2, 0x10d, 0x0, r0}, &(0x7f0000019180)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2067, 0x8000, 0x3, 0x17, 0x0, r0}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xce5e, 0x10, 0x2, 0x2c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xecae, 0x200, 0x3, 0x11a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88d9, 0x800, 0x0, 0x3bd, 0x0, r0}}], 0x4, 0x0, &(0x7f000001a480)) r7 = socket$pptp(0x18, 0x1, 0x2) accept4(r7, 0x0, 0x0, 0x800) r8 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bind$inet(r8, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3000004, 0x10, r6, 0x24b2000) connect$inet(r8, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r9 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0) syz_usb_control_io$printer(r9, 0x0, &(0x7f0000000100)={0x98, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r10, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) syz_pidfd_open(0x0, 0x0) sendmmsg(r8, &(0x7f0000007fc0), 0x800001d, 0x1c) 3.265659911s ago: executing program 3 (id=2944): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x69ee, 0xc00, 0x5, 0x50}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, 0x0) syz_ublk_setup_queues(r0, 0x0, &(0x7f0000019080)={0x0, 0x597f, 0x1, 0x2, 0x10d, 0x0, r0}, &(0x7f0000019180)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2067, 0x8000, 0x3, 0x17, 0x0, r0}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xce5e, 0x10, 0x2, 0x2c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xecae, 0x200, 0x3, 0x11a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88d9, 0x800, 0x0, 0x3bd, 0x0, r0}}], 0x4, 0x0, &(0x7f000001a480)) r7 = socket$pptp(0x18, 0x1, 0x2) accept4(r7, 0x0, 0x0, 0x800) r8 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bind$inet(r8, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3000004, 0x10, r6, 0x24b2000) connect$inet(r8, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r10, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) close_range(r9, 0xffffffffffffffff, 0x3f00000000000000) syz_pidfd_open(0x0, 0x0) sendmmsg(r8, &(0x7f0000007fc0), 0x800001d, 0x1c) 3.263472636s ago: executing program 1 (id=2951): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x40811}, 0x20) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000400)='cdg', 0x3) write$binfmt_script(r0, &(0x7f0000000200), 0xfffffd9d) openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/uprobe_events\x00', 0x2, 0x0) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @loopback}, 0x10, 0x0}, 0x8050) r4 = syz_open_dev$loop(&(0x7f0000000100), 0x7, 0x103482) r5 = syz_io_uring_setup(0x5f38, &(0x7f00000005c0)={0x0, 0xf6ea, 0x40000, 0x3, 0x3}, &(0x7f0000000080)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f00000006c0)=@IORING_OP_TIMEOUT={0xb, 0x50, 0x0, 0x0, 0x800000000000002, &(0x7f00000001c0)={0x0, 0x989680}, 0x1, 0x0, 0x1}) io_uring_enter(r5, 0x6516, 0x6d93, 0x8, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r5, 0x18, &(0x7f0000000200)={0x1, 0xffffffffffffffff, 0x19, {0x3, 0xc82}, 0xb}, 0x1) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='freezer.state\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000002c0)={r9, 0x0, {0x2a00, 0x80010000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0xd, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00000014000800000000000000007f"}}) ioctl$LOOP_SET_DIRECT_IO(r4, 0x4c08, 0x591) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000200), 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c040, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000003c0)='nfs4\x00', 0x0, &(0x7f00000001c0)='\x01') 998.401273ms ago: executing program 1 (id=2945): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$IP_SET_OP_GET_FNAME(r1, 0x1, 0x53, &(0x7f0000000040)={0x8, 0x7, 0x0, 'syz2\x00'}, &(0x7f0000000080)=0x2c) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x84, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x58, 0x3, 0x0, 0x1, [{0x54, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x48, 0xb, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_LIMIT_UNIT={0xc}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x3}]}}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x108}}, 0x0) 882.645291ms ago: executing program 1 (id=2946): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) r0 = socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)='\\', 0x1}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4008000) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r2, &(0x7f0000000300)='r:test/event1 ./file0:0x0 arg2=\\', 0x20) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x30000, &(0x7f00000004c0)={&(0x7f0000000140)={0x1c, 0x15, 0x1, 0xfffffffc, 0x30000, {0x5, 0x7c}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x3b5e04dbece314b7}, 0xc000) 742.555353ms ago: executing program 1 (id=2947): r0 = socket$inet_sctp(0x2, 0xb, 0x84) (async, rerun: 64) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x10001, 0x867f, 0x1, 0x0, 0x8, 0x80, 0x2}, &(0x7f00000000c0)=0x9c) (rerun: 64) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000100)={r1, 0x3}, &(0x7f0000000140)=0x8) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async) r2 = openat$ubi_ctrl(0xffffff9c, &(0x7f0000000180), 0x40, 0x0) (async) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00000001c0)={r1, 0x3}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000240)={r3, 0x2}, &(0x7f0000000280)=0x8) (async) write$cgroup_subtree(r2, &(0x7f00000002c0)={[{0x2b, 'cpuacct'}, {0x2b, 'net'}, {0x2b, 'perf_event'}, {0x2b, 'rdma'}, {0x2b, 'io'}, {0x2b, 'rdma'}, {0x2d, 'rdma'}]}, 0x30) (async, rerun: 32) syz_open_dev$evdev(&(0x7f0000000300), 0x7fff, 0x0) (async, rerun: 32) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000340)={@remote, @multicast1, 0x1, "96d77c856fd9adb79b45548fc62569033fd2b5d6ae05667dd49758bb4fa2c97f", 0x7, 0x9, 0x4, 0x1}, 0x3c) (async) getsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f0000000380)=0xfff, &(0x7f00000003c0)=0x2) (async) ioctl$HIDIOCSUSAGES(r2, 0x501c4814, &(0x7f0000000400)={{0x2, 0x0, 0x2, 0x19b, 0x96}, 0x1bb, [0x8, 0x10001000, 0x6, 0x8, 0x4, 0x1, 0x306, 0x1, 0x1097, 0xffffff80, 0x80, 0x10, 0x10000, 0xb0, 0x1, 0x3, 0x9, 0x5, 0x81, 0x3, 0xfffffffb, 0x0, 0x59, 0xfffffffb, 0x6, 0x0, 0x4b9, 0xb, 0x2, 0xe00, 0x9, 0x858, 0x2, 0x9, 0x0, 0x1, 0x2, 0xb, 0x8, 0x6, 0x10, 0x5, 0x0, 0x9, 0x3, 0x506, 0x5, 0x1, 0x5, 0xfffffff9, 0xc18c, 0xdf99, 0x5, 0x3, 0x80000001, 0x1, 0xe5, 0xc204, 0x695, 0x9, 0x8, 0x2d4c8b18, 0x1, 0x3, 0x6, 0x0, 0x2, 0xffff, 0xffffff01, 0x7ff, 0x9, 0x3ff, 0xb, 0xfffffffe, 0x40000000, 0x3ff, 0x3, 0x3f8, 0x7, 0x3, 0x5, 0x3, 0x9, 0x9, 0x543, 0x5, 0x8, 0xa000000, 0xffff, 0x3, 0x80000000, 0x10000, 0x80000001, 0x7, 0x3ff, 0xe, 0x9, 0xe568, 0x2, 0x3ff, 0x8e, 0x5, 0x1ff, 0xd, 0x3ff, 0x5, 0x1, 0x800, 0x2, 0x6202f9a7, 0x0, 0x4, 0x2, 0x8, 0x2, 0x7fff, 0xff, 0x0, 0x9, 0x8, 0x101, 0x877, 0x1, 0x1bd, 0xb, 0x1, 0xe, 0x4, 0x1, 0xffffffff, 0x3, 0x6, 0x8e1, 0x5, 0x9, 0x6, 0x4, 0x33, 0x6, 0xfffffff9, 0x336, 0x3, 0x8, 0x7, 0x1, 0x131e, 0x81, 0x5, 0x2, 0x40, 0x5, 0x8001, 0x4, 0x4ac, 0x5, 0x4, 0x3, 0x8, 0x8, 0x1f, 0x8, 0x50e536d1, 0xfa, 0x8, 0x3, 0x9, 0x4, 0x3, 0x1, 0x1, 0x49965a30, 0xfffffff8, 0x80aa, 0x8, 0x8, 0x3, 0x4, 0x200, 0xc, 0x9, 0x2ac, 0x8e, 0x5, 0xa8, 0xffffffff, 0x7, 0x2, 0x6, 0x9, 0x4, 0x4, 0x1d75, 0x7ff, 0x9, 0x7, 0x7fff, 0x7, 0x6, 0x7, 0x7ff, 0x6, 0x4, 0x1, 0x5, 0xa3, 0x2, 0x5, 0x800, 0x2b, 0xfff, 0x2, 0x2, 0x10001, 0xc191, 0x7, 0xfff, 0x8, 0x6, 0x9, 0x9, 0x6, 0x9, 0x9, 0x6, 0x1, 0x0, 0x3, 0x10, 0x8, 0x9, 0x100, 0x1, 0xd, 0x3646, 0x8, 0x200, 0x6, 0xfffffff8, 0x6, 0xfffffffa, 0x7, 0x8, 0xf72f, 0x4, 0x4, 0x6, 0xc0000000, 0x0, 0x2, 0x5, 0x1, 0xfa1, 0x7, 0x6, 0x0, 0x63, 0xf6f, 0x2, 0x6, 0xfffffffc, 0xc8, 0x6, 0x5, 0x7fffffff, 0x1, 0x6, 0x2, 0x7, 0x9, 0x7fff, 0x2, 0x8, 0xffffffff, 0xff, 0x3, 0x4, 0x0, 0x5, 0x4, 0x8, 0x9, 0x1, 0x5, 0xa, 0x663b, 0x2, 0x7fff, 0x1ff, 0x10001, 0x6, 0x5, 0x2, 0x6, 0x1ff, 0x1000, 0x53, 0x9, 0x401, 0x50000000, 0x4, 0x101, 0x57700000, 0x80000001, 0x10000, 0x101, 0xa, 0x477, 0x8, 0x80000000, 0x80000001, 0x5, 0xcb, 0x1, 0x962, 0x233f, 0x8, 0x7ff, 0x1, 0x5, 0x200, 0x80000000, 0x0, 0x1ff, 0x7, 0x3, 0x1, 0x4, 0x8, 0x7, 0x7, 0x0, 0xe907, 0x1, 0x2000000, 0x10, 0xda62, 0x9, 0xfffff1a8, 0x2, 0x10000, 0x8, 0x89, 0x9, 0x3, 0x3, 0x0, 0xfffffff9, 0x6, 0x0, 0xf8000000, 0x7, 0x81, 0x3, 0x6, 0x2, 0x3ff80, 0xf3, 0x2, 0x1, 0x80, 0x6, 0x8e93, 0xffffff13, 0x44, 0x200, 0x5, 0x3, 0x401, 0x5, 0xb9c0, 0x1, 0x815, 0x80, 0x7, 0x9, 0x6, 0xa, 0x8175, 0xfff, 0x1, 0x1, 0x800, 0x80000001, 0x4, 0xf, 0x5, 0x2, 0xfffff89d, 0x3, 0x8, 0x1515, 0x64, 0x0, 0x6, 0xc1b, 0x81, 0xe9f8, 0x9, 0x5, 0xfffffff4, 0xd350, 0x1, 0xa4, 0x60000, 0xb7, 0x7, 0xcfd, 0x4, 0x0, 0xfffffffa, 0x9, 0xff, 0x80000001, 0x5, 0x8000, 0x0, 0xffffffff, 0xff, 0x6, 0x800, 0x6, 0x80000000, 0x9db, 0x1, 0x1, 0x7305, 0x1, 0x7, 0x1, 0x2, 0x9, 0xa, 0x3, 0x101, 0x2, 0x7ff, 0x1, 0x0, 0x3, 0xa, 0x3ff, 0x5, 0x3, 0x3, 0x6, 0x3, 0x2, 0x7, 0x7, 0x9, 0xfffffff7, 0x2, 0x3, 0x6, 0x9, 0x2, 0x7, 0x25670e8b, 0x0, 0x1, 0xfffffbff, 0x100, 0xe6, 0x9, 0x4, 0xf23, 0x8, 0xfffffffd, 0x1, 0x7, 0x10, 0x4, 0x2019496, 0x9, 0x9, 0x9, 0x1, 0x100, 0x10001, 0x3, 0x5, 0x4, 0x0, 0x8, 0x7, 0x1, 0xcfa, 0x2, 0x5, 0x3ff, 0x8, 0x200, 0x8, 0x3bd8, 0x400, 0x9, 0x8, 0x9, 0x6, 0x6, 0x400, 0x7, 0xf29, 0x4, 0xd4, 0xa6c, 0x4, 0x3, 0xfffff3f8, 0x8, 0x401, 0x9, 0x4, 0x9, 0x9, 0x9, 0x6, 0x51, 0x1, 0x4, 0x9, 0x9, 0x2, 0x1ff, 0x3, 0x400000, 0x400, 0x8, 0x1, 0x2, 0xfe4, 0xb, 0x7, 0x2, 0x2, 0x0, 0x1, 0xc, 0x7, 0x4b5, 0x7, 0x8, 0x4, 0x8001, 0x8, 0x3, 0x1, 0x94, 0x8, 0x2dc, 0x1, 0x4, 0x9, 0x100, 0x0, 0x101, 0x2, 0x100, 0x7, 0x5, 0x7f, 0x100, 0x2, 0x8000, 0x3, 0x8, 0x200, 0x6, 0x8001, 0xf, 0x8, 0x4, 0x5, 0xf, 0x7, 0x6, 0x4, 0xfffffc01, 0x0, 0x401, 0x8, 0x3ff, 0x3, 0x2, 0x7fff, 0x0, 0xfff, 0x6617, 0x3, 0x8, 0x35308956, 0x4, 0x7f, 0xcc, 0x9, 0xb3ef, 0xdeb0, 0x7f, 0x7, 0x8000, 0x9, 0x8, 0x2, 0x9, 0x5, 0x7, 0x0, 0x7, 0x8, 0x4, 0x5, 0x44, 0x5, 0x24f, 0xc8, 0x3, 0x2, 0x4, 0x4, 0x3, 0x8, 0x10000, 0x2, 0xa3, 0x7, 0x0, 0xffff, 0x7, 0x6, 0x1, 0x401, 0x101, 0xb, 0x8, 0x3, 0xb, 0x0, 0x81, 0x9, 0x8, 0xffffff01, 0xff, 0x8, 0x3, 0xd6f, 0x5, 0x39d, 0x81, 0x401, 0x4785f14f, 0x16c0a00, 0x7fffffff, 0xe64, 0x10001, 0x8, 0x0, 0x1, 0x2, 0x6, 0x8000, 0xff, 0x1, 0x7, 0x10001, 0x3, 0x8, 0x2, 0x8, 0x3, 0x7, 0x0, 0x3, 0x5, 0x3, 0x3, 0x7f, 0x22, 0x5, 0x10001, 0xffffee69, 0x1, 0x81, 0x6, 0x2, 0x1, 0xfffffffb, 0xfffffffd, 0xff, 0x200, 0x9, 0x1, 0xd, 0x8000, 0x3, 0xc10, 0x5, 0x27, 0x100, 0x3, 0x9, 0xf1a7, 0x8, 0x400040, 0x8, 0x3, 0x7, 0xffff7f29, 0x2, 0x3, 0x3ff, 0x10, 0x7, 0xa7, 0x30, 0x7, 0x4, 0x0, 0xff, 0x9, 0x401, 0xac, 0x5, 0x9d90, 0x6, 0x0, 0xae, 0x2, 0x850, 0x3ff, 0x4, 0x8, 0x8, 0x42fa, 0xa, 0x6, 0x0, 0xd, 0x0, 0x3, 0x8, 0x10, 0x200, 0x9, 0x9, 0x6, 0xf, 0x10, 0x4198, 0x4, 0x1, 0x1, 0x4, 0xfffffff8, 0x0, 0x9, 0x5, 0x1, 0x200, 0x6, 0x8, 0x2, 0x12, 0xb3a, 0x0, 0x40, 0xb8, 0x4, 0x7ff, 0x4, 0xfffffffa, 0x8, 0x7d1d, 0x0, 0x2, 0x6, 0x29a6edc0, 0x0, 0x7, 0x81, 0x2, 0x182e, 0x9, 0x3, 0x0, 0xe0000, 0x101, 0x3, 0x4, 0x0, 0x2, 0x1, 0xfffffffd, 0x39, 0x80000000, 0x2, 0x0, 0xfff, 0xb, 0x1, 0x3, 0x0, 0xa000, 0x438, 0x4, 0x2, 0x2, 0xa, 0x0, 0xfffffffc, 0x9, 0x0, 0x1, 0x7, 0x80000001, 0x1, 0x7, 0xf4, 0x1, 0x1ff, 0x7, 0x59ee, 0x200000, 0x7ff, 0x8, 0x3, 0x7ff, 0xa, 0x0, 0x1a9b, 0x2, 0x100, 0x8001, 0x8, 0x3ff, 0x400, 0x3, 0x2, 0x5, 0x0, 0xe, 0x61fa, 0x101, 0x241, 0xfffffff3, 0x2, 0x0, 0xfff, 0x9, 0x8001, 0x0, 0x7, 0x3, 0x2, 0x401, 0xe10, 0xfffffd55, 0x1, 0x7, 0xfffffff8, 0x4, 0x235, 0x1000, 0x4, 0x8000, 0x9, 0x1, 0x3, 0x400, 0x89fe, 0x6, 0x3, 0x4, 0x2, 0x40, 0x7fff, 0x0, 0x4, 0x5, 0x8000, 0xe780e447, 0x195, 0xffff, 0xfffffe00, 0xd4, 0x8ba5, 0x810, 0x2, 0x4, 0x3, 0x8, 0x0, 0x8, 0x1ff, 0xdfa, 0x5, 0x5, 0x3, 0x1, 0x8, 0xa, 0x1, 0x1, 0x800, 0x0, 0xf3, 0xfffffff9, 0x0, 0x7fcc, 0x481, 0xe, 0xdd, 0x3, 0x0, 0x1, 0x7, 0xfffffffc, 0xdd4, 0x2, 0xffffffff, 0x0, 0x0, 0xffffffff, 0xa, 0x3, 0x1, 0x2, 0xc4, 0xfffffff9, 0x9, 0x54, 0x7fff, 0x2, 0x9, 0x9c70, 0x800, 0x10001, 0x8, 0x6b, 0x7a2a, 0x1, 0x4, 0x7f, 0x2, 0x1, 0x7, 0x9, 0x6, 0x7f, 0x10, 0x57, 0x10c, 0x6, 0x0, 0x0, 0x7, 0x4, 0x9, 0x5, 0x6, 0x1, 0xada2, 0x400, 0x80000001, 0xe, 0xb03, 0xfffffffb, 0x0, 0x8, 0x7, 0x0, 0x40, 0xc9e, 0x2, 0x7, 0x800, 0x2a, 0x0, 0x400, 0x7d, 0x9, 0x8, 0x1, 0x6, 0x0, 0x1, 0x1, 0x271, 0x20, 0x5, 0xe4, 0x5, 0x9, 0xef55, 0x5, 0x4, 0x5dfb, 0xfffffffc, 0x2b45f2f2, 0x9, 0xfa3, 0x8, 0x80, 0x58, 0x1800000, 0x4, 0x1ff, 0x4da, 0x80, 0x401, 0x4, 0x1, 0x6, 0xb, 0x3, 0x7, 0x101, 0x6, 0xffff, 0x40, 0x4, 0x2, 0x2, 0x73a, 0x9]}) (async) ioctl$DRM_IOCTL_MODE_SETGAMMA(r2, 0xc02064a5, &(0x7f0000001500)={0x0, 0x5, &(0x7f0000001440)=[0x6, 0x9, 0xffe, 0x8000, 0x8], &(0x7f0000001480)=[0x5, 0x0, 0x8, 0x5], &(0x7f00000014c0)=[0x4e74, 0x4, 0x0, 0xffff]}) ioctl$FICLONE(r2, 0x40049409, r2) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001580)={'wlan1\x00', 0x0}) (rerun: 32) sendmsg$NL80211_CMD_START_P2P_DEVICE(r2, &(0x7f0000001640)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001600)={&(0x7f00000015c0)={0x1c, 0x0, 0x400, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4) (async, rerun: 64) getpid() (async, rerun: 64) ioctl$LOOP_SET_CAPACITY(r2, 0x4c07) (async, rerun: 32) r5 = openat(r2, &(0x7f0000001680)='./file0\x00', 0x101100, 0x40) (rerun: 32) mount(&(0x7f00000016c0)=@md0, &(0x7f0000001700)='./file0\x00', &(0x7f0000001740)='ntfs3\x00', 0x109000, &(0x7f0000001780)='/dev/input/event#\x00') (async) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000001800), r5) sendmsg$GTP_CMD_DELPDP(r2, &(0x7f00000018c0)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001880)={&(0x7f0000001840)={0x34, r6, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_FLOW={0x6, 0x6, 0x4}, @GTPA_I_TEI={0x8}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_VERSION={0x8}]}, 0x34}}, 0x4000) (async) sendmsg$sock(r5, &(0x7f0000001b00)={&(0x7f0000001900)=@ethernet={0x306, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x42}}, 0x80, &(0x7f0000001a80)=[{&(0x7f0000001980)="0aabfed0a0ab328d7a7938ca5b219f909d7d57c4f1d8b6", 0x17}, {&(0x7f00000019c0)="5b74a6e16f34c349418f0fee7740edd81784ddd1450c5d8396430e5d60f3ad344df61ed388e68fb9751756ef3e72c7b0bcc9e6b357b1ad2d5aaf655f906a0d6e0a1cae16da633f7111450c5ca19c9a54ce98de457bbee68a6eab5607ebc5cc8a5e96727d670c5222a212adc466cc4839084f1d9dec3dfc41472c39572215d799032c5a703c8cef573376a0b46c5dbebf0d27b1826aa8aca7edf8cc7c1f", 0x9d}], 0x2, &(0x7f0000001ac0)=[@mark={{0x10, 0x1, 0x24, 0x8}}], 0x10}, 0x1) (async) umount2(&(0x7f0000001b40)='./file0\x00', 0x4) (async) openat$sequencer2(0xffffff9c, &(0x7f0000001b80), 0x400000, 0x0) (async) sendmsg$AUDIT_USER_AVC(r5, &(0x7f0000001cc0)={&(0x7f0000001bc0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001c80)={&(0x7f0000001c00)={0x78, 0x453, 0x1, 0x70bd2a, 0x25dfdbfb, "aeb8a924c1e6eab71b8f7e4c848e995f5c72b410248aaa809ea363f66aa3c74815b03ae17697c9132d83a0ac3c71500679fff3e6b36170c654c5b4997ed27715fe49a8cd7099bc86887cdd3867696f51267e5d8b3ed1e4b5cf3d957ebc6f7b865f2e33e0f4bf", ["", "", ""]}, 0x78}}, 0x8000) (async, rerun: 64) openat$zero(0xffffff9c, &(0x7f0000001d00), 0x420a83, 0x0) (async, rerun: 64) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r7, 0x4014f50b, &(0x7f0000001d40)={0x1, 0x0, 0x4}) (async) socket$nl_route(0x10, 0x3, 0x0) 3.413741ms ago: executing program 4 (id=2948): move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x20800, 0x0) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000100)=[0x1, 0x2]) ptrace(0x10, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/smt/control\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/smt/control\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)='off', 0x3) write(r1, &(0x7f0000000180)='on', 0x2) socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x0, 0x0, 0x0, 0x0, {[@md5sig={0x1d, 0x12, "adf059fd789278e2fb03dc15d356998a"}]}}}}}}}, 0x0) 2.885632ms ago: executing program 3 (id=2949): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f000000850000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) (async) socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x6, 0x18, &(0x7f00000062c0)=""/4099, &(0x7f0000000380)=0x1003) (async) getsockopt$sock_buf(0xffffffffffffffff, 0x6, 0x18, &(0x7f00000062c0)=""/4099, &(0x7f0000000380)=0x1003) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f0000000580)="c37256eda04e7cd2774dbc24dca7ba45811e0c2a6ceccebbb9733477799d8a7ce81a80fe659a39f298e637d48d39169a827d5857516a78c10912da557516b194c7a9e4369eda47ba0d9d822b2c8cae5eb41a484b865c642be547a79ac402d70a473e528d553a659aaf7c805b93808e619098e5f9d5cbb3dfb3a973f3ece8e89eda632b7be899e4f86cd11618fa04cc666fc81a1cb9cd3e8e1fcfe9e1e4219e3ebca6ce21cea03dec11c01f6354bbbbdbf19288369bd913c3c7167b55442df8f13f1d9f4e74d5b4cc8868c8f79325aa9880eafe4184f157e1a03a765e88217d7fd40f4d15522e29843eead1aa59a5997e746c4cf42f8adc402be267e240f48997dbdcff5e9f57a6acaf5e9f994bcf921345b6078739bb722d8ad4293e9e6eb2f743e6f6b01213912ccb1b5363dae6a445e63659aa8890a53ca5e742113eb61db6f4cabde86d442ceaa3a52b89652c90354bb44a770e10cbcb906c8495648bd9abacbbae9ac5cb111e420770d4fca3d44af061247bead70dcfd5694aa7", 0x17c}, {0x0}], 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) io_uring_setup(0x4126, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x64}}, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async) r2 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x50, 0x0, 0xfff, {0x7, 0x29, 0xcf940281, 0xa00010, 0x1, 0x3a76, 0x10, 0x1801, 0x0, 0x0, 0x2, 0x2000009e}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x50, 0x0, 0xfff, {0x7, 0x29, 0xcf940281, 0xa00010, 0x1, 0x3a76, 0x10, 0x1801, 0x0, 0x0, 0x2, 0x2000009e}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r2, &(0x7f00000042c0)="0d9ec529eb18ec94a35378619cb10ff8c913f67139447b7ee0cca809e36c363ba1d3975a7446b70c6bdd99e2cff540eda7589ea89efeb498df568916036f0848ede5f089bf502b483c67c0432c34b98b1bc085a99e2981103397e0b0eed2ec64c1075798b56a42ea532091f5326c97622a47c53fbf42e71c3ed4b954c559424b49a13598c6c63ef65b62384b038b3e6e98ebecd178289831eaecd986a01c751e8cca7a57c009f2b5310fe9dd8a63b91c4b5b13d1c44d2b874b32ae3e961b9e96a511ffaa3ed20248dfb470460d305e44ffcd287b355380319fd31f7538c6d00de06ddb8f72b3a59c4699c94d7379e1e190c6dd7786e12096f9e963a038b6b4375535047135ecc07b16035ceeb27ed09d77f52b6eae27a03071e060b05bf347b9ba44a984e5db346d230ae9c5324ecfd4e7725bc5019a9f4d20237c820359d73b82f9c668ae71f6b85d5350140a16f988bb2b8010effb52636e0b728be1b1ed37c1b8868ec67edd52951dbf65b479aa25e92667a98c755d88995e6303a48a64317bd4b201fc6dea59381abfb5e0fb1035bbd32a97a6324b08f404fe3991879a0c6362032864031737941d9cc534697da61a43c8723ecd1062906b65c504d86383cdf9631f228372b13aee64f8ea8db00dffc37fa092ab5daeb7431dab37091c44f91c9202df60876a6e06ceee3e6a095406fe5cc1f83de1a4adf36fbef5a94a622132cc85e56fb53a9cff67bc69a24d8c259ccfe19b1925061f0cad95d6b4158c1394b8acfa9a8f52a566c6cb4e0b14dd30c85b309289a5f395e01d981735f6fce6ab30994643d70b2f322b7a233a339e621ea2eb00a0082a175c231b330a58062680546c28db8ff5b7e66c0e3df0a9b74ab72abfd241fcbe1e3d27a2d1eab44cf88180dcef4482c866324133f9e4780b891a7c5000b005cab0c131c225e944fd1aab5de9e8d17b8770b4472b6e4a13b6cce90ba152e5144acf74cd8a9821ce3eae72dc7ddc81b76482226098329c3a8ecb923822610aa0b086f44329522dd8f9ae355b4666d1a10911ef8e21377578b42fe6ee0b2a77917157488d6e0bb388951f80551dcaebf212b396d1f922aec595bd340390d310f6006c4b3efdd80838f39d25470db39d6205ba8f52bac634f8145a3c10ed007acc2f25c5dbfe911f18f44a0c57cee33725eb8c5f2d9112f91787c2c323b67b67d9d1f593f16430d77189d4678fd8d7c11c1f2d744ad59a03a8cffc52ee0293c90b00d61897c80184aa63fcf43c109b06af20c808035af0a0bf9cbe544681768f92a2ebe3b4458dd020fb0550822bc2f769631e00d63bd91e7100299bbc4ce53a35e993e24028dc5c81d46f5377d21f2f38a9688ed981044346b865161b68f3390a50c2e625052396cdb6637e9434904c63d8ca45aa2325626293cdd9cd0179b1d995be10281fa8d281db16320f520e42af268ff30dc2d8885aa3d9e7f294eadb4d827d195cd5d18632928f2153261345c231efd143288b881638b61dc5dab8114c1948d83b8ac4e278f131ec3eef4e87e43a36f4b41a699a741ef3a7cd4f0bc5dbd2dffb1d223a5c5b38b98e49092631a176d15c4f3c077d639726a3482bf2fdc73c2bdb09208aaf90bc64b5fee89d231bb1679de3e5d31662db2c5824ce9941f94500e5a11b8fe79da548efed8cc44e9bc1d5175dd77fc16f8219a83b83ccce2181bf411b0945312598817e08e5277530eccffff17d198613cc8c991349141ced56e79031ab6cb98f3f39e5f20bac76017083041a1ee99ca257d0e0cf95e59617139afb08cf0c6a607d3f2ac2b5d3f4394a4a063c9769bb884ec522d46138228c7e9b5c7ea5e3a6c70815b565ce15a13fd0a5deb28e710c15fe25c744b430b4f6482532fb96566381c56e12632cab5acb5e08d6f973003c96a7d81ff76966e0f93c83c462bfcef230939e48c4983bfed78f68b0f540d1fff2196cbd1f1c1a1c310ec10f5a2745407000bc6db1fcc8540282cc7e96cf5582c4eaf874a2fe6369534176429b7505eb0aade883260806be2d86a42e76b315a76e5f686ca669f49e1f9054a77b8eaff14a43e9a9801244e8e94ff50a17b60dee0122ea70819bae3375070466c7f202c4ea0fc0c9aaae50c43cb65febea224c2b554e937f67689b3e18ed543749a7ef0997a7a7530b918c4ef935137137e1ee7e6a8919fb76a8f008ddcc2d8b2e18f3eb90f7a13cf4f49170ccf50c75de82e92a5e2d1f311e59071ff202b6cae4d6243fc3787cb9fbd401938cc18dcf5620f8b8f74e9e3b13dcde85ef896f31f5a2458118addae77206ab1506882f91873b4828950a7b91ddae74888155a9c486c7c60492813ac0e33362dc4e21e00538e5b05b78271d82486a0d156d4a5a07085bb1cd74f5d63763f18648a489352b5d05107909fe54b5d332cde2900c82c150b11071e028eeb275cc9a9614f1eda4e4830b128870e732d473100c24152aff2aa1659daa65d7e9591ebfcae5dca4e84c9a0965a01668e59843ef4a093d9b01067a0ae9d09e3d810c2cb63600ee05b10fc8685e8cb150e2d6d75baecfb8762f7a7d131417eb0721e19e1d21f5adcc1e09489f06b81d91b48608107fc7b3853e214a3c786a9812113ccbcf09907506d0e9cd72c79793584b4fe06a18a627bd969f628a5936367961f1e7d117d03a8fabc85f5ecdd0ddcfae49aa293893a2e5ae376be11031abc0e05ff250b35926345b52f8d3dc02b7497f7513e759247353db9b8e493120e73981aef4c4d9747621537a089848754c14cda1cad18084274e98ea2bf7400ca846184e0e31a571f9bd770222b1038a4ce60dcf8fe9cca4d60048cc29c37c1345de992e9dc7128ef093c1ce80232a88a3da7ae8bc87120c5b1f405d5186141288998fed9e021cd0ad6b12b51c217849390be3ea00cbd6c755958140bfb9b2a2765ad1f51ac045fdc5c28ee5886b1436015b88bd90d19328f91394110b0d891678e63b63d6cc4d35279f6f616d7692c6fe177a79d80ae8f7e4ad5078d8d7096f3ee664dcdb2f634eba98f4788de1f5e34f32ef09e2f0aee4fdc5bec4bc4aeec5721ac3a2da1bf52da017c3312095403d50dcde39671242b610f13132773796557f71455376a7741ab242a9fc94464180bf224d5e8c79b462e3a816f6c08ab0f5503386d34ddfd808b4b8d5d333548d4b873923c6c297b2fa1abe433ec9264385c50dca40316c37ed85db382e7c853ba331c727043cb3345de9f89b1c804e98205eda3d6b6e042c9c41877d456dcb8f12663e6dc1ba809229536fbcc4c58d01a137eb80af8596dfc7b5fa7a044cd141238aa82e440526e55a28c4ed2f4b26157a0eebb4a77c5ab66fcce2602e1a70aea07e5e7e7e5321d58ad128a5ea6b574730037f24a7300e0ad6fc96bd18e03763bbbf21bd3c388aff1cc5ea13728ba2f8e1eb70148d2603e55bb01cce0763c2020b5627a0ccb35ae3a9b3df380e6d9800d9506219a90971a3b8bde1dae6a43fce2aaecbc026be8f4e9bd749e10c87ed7d78f92014342fa449eef28e7175548e5a8ec4fe7d31fc86737aee63ef40b54485380b6898161676f0d82f76113b12a529fbce4482dd278a90aa416077c677aea623ddb3761bc81527ab7e3d73a3b4c8c3e4352c7c083cee8953ebd972a83caed837587e8d7cf360f28ce6ca71de75c9174e8744ba1098513bb6c7fdc6a3c7c8e5870223d6cc0b18b5d6edea926d5376aeb85488d3712e8f67128f0d3fb2b42f82363a0d4c1c806ff283f6e4ddc10ce4a0803be66a247207d6606c7dd67cd293dada159016d7fd7e88c4df53d09bdd9fd9fa3c732da45fb92bdf6f442eda15edd97bf1928a7699008f0b482240a684ff5efef0cadbf1b4f16888650d59b2bdaeae0d1112a79c5522dd0933ccc16fed7cd0ccabe929f625de8947b3b1532dc04253cca988a1584df2b31492b19410d6f681d614eaa20029592c00c948a98973a9fba87f1397f8859ba543edeb5c0b0db92f65462a1103947d780b539433332d65bd1418bc00c9e815f73e0cc0aca5fcc9f95f707c455013a55a0c4a29093b05b94edc5b5284ec7ccf3ec091002b4229036c174e2927127f40769ece890612bbeb960d9392f442765a2ca8990c52ad7d4441e975a7cf079d139945f2b2a8a34f0e85d76cbc96efbb52cf8b5ae681234e14b6648244d41cfee2d9b189cd831cc2f31ae7e5f11aaaff1629f8c2cf73494ac38e58da7010dd986f8b6134ee0dabfdcb30617d15720cffbec7651f22253aea21696d2ece4fe026543ea2f3473e4c12e65dbb3cbf764ffa0b3a396382b9b7f0c24eaaf3495554b2319b66f3cabf01a8d6cfd1382d94ab71cd11eae2a42e4dc841d4a9732c395688d3377c8ccff7e3f88a3129855a5f41a7de6b6a9ac40a87c288f4821295edfc4f5b8fe5a1fc0162e9820205c809935cc6047e8a835c651be02fb41c21de30ac770d7a7f2108c6a3f1cf2649cac444f028a6ebf4db422cbbdb7fd0cb39109a3130ffae17810bb58f5c557c99670224c2678fa07f1064911e6c665c0d1c26cd2f40f7089789208a48eb339bb8885910e035b4b8c69b1c3ad79270ac6e70b963493a6628b90501822878cdfac866268d914d8af2814612b0198f9e4c6b48e739e414d61f34e2f69ff7cdc4fc7ffe45a64c5faf191ef6c4e31cecebe09a2f6a63d60926ebaa7e925ccea5c93e403c7ec0ee55423ce4893471440006d4c09c141e489dda5577f73b57ecfc764ee5bc1bc88f7866dc6a494e3ee560c956dc12ae51842030251f1cedf2caca15549d0bb4ee3bef03702197350cd7586b5916ef6a0abcb5f30548d22ce5d8c4dbd82030b8d7b5481c51676b7d14d35c20346c74dcc7d96ea0b13f890f755a219993e88739da8246283ebbd82eb1b15956b5ec16ad523768c19ceba9199f97d7bb43b85fa11349ff7fb89a97b463b34c584ae9e2af6c8f20ab528750a22ff6c2297e400065fbd9a4660ec2c658afff6db9b67070352d2aa5e6cfe534eeb5ff271575b828dfd7f537e3627a1a6419ed0c84297fc3d362a52f3860a2eb7ae0a50f06d3c68c4a1463ec331ead7af2dba792332218b04d5b585de1a471d296df6e10316852d50f211e07643f749a1d75410e66e47db40bfcefe4b708d0b2879a50ccbd85939b89fe4b905a6a89a2d5a4e28d18c048e66108a06d8b6a64ec5737b5ae283d914484167c8ac7dde7ec007aad1999854c4d6a0e5f887f99de3662610d5e8d49bac7d41d6fb7d90b4b04939638e2151ba67e75362aded50edfb7d9919b345b5b7df6a909193ce64b20470e3480c68bd764968f4d8a5779ffd9a35e58558272a214ae26a094360b9f2ec97c5e0a7693f4b7509b962cd8537e90ce7be70b54e9531e7295f894b94566df49c50c2265842392dff50e17ed3f7beb9ba4ad0520a73db1d8d3b39759e7fffcbf26517316bc74437fef944fc915ec24affc1a53748cfc883e3ddea9e25063ea8383b06f0d5c9db13a0ff335f52699226b391543060ae5e2c25b585b9efdd5ff9495a4873cac58b5feff5f08717b04e81bfea349accc58fcc6a6505de3aa6ff4985d9c38bb83e8daa663ccb356df3ed52343ed7723687e416816f987c565eae22c7548c1d6b56a5b6819583da0ddf92739f65e604e37b3275a6cb1252d4ef7a515c4b1e9068d714be80066bf0d422f1e4d2ce6f95c9eac081d6e4596a6a8e16a57b732b575b7de16f176ff0e34e84b293d3fd77fa30a7b7cf12a1edd54170e56bf7f2d40620ad56acbc5cc615556300ff9e95ce3dda93c8333f23f0d97a5da12a0fe58f95d6b911f614563d343ac6e4f9fee1d149c94fc75a97ac839b6d8d7b27c5efb870d2bfc6dbe6b688490b23597d83982d7858215c59011042b1957a0b386842621c72f89a9b524008794ffa0c179753ab48d0f73e5ff13624b3b90287edaf6a5367dcfe4094a21ffad3e881b428b77ccac6924d5bde9c781d4189654d8f29885fbde070a004c6406dd3ece359c6ac7c6147f5c4906e56764e9980a669bfdddd9eb780e7f9988630d1eb098b3e4fd4c795f11441fb6d0ff7cf086eb291b1ec8d90092e1eaf9722ccdcd15408617cdb8c49043bf71a6ea0ee6b7e840344fbcd377b995bfb1faf22754fcb363f6c630501b619bbd87cc13d5df0948a176771d2d69236eb50dd313817d9687967e7d71f854db6bff803f4501d999dfe3da37ccfdf894a7914c4c113fa7a18c3468a52d646a5070614a6f02b7ff21c9f6927f5de55be85ba815f4bb9e29f26a94423c58338947c804e0627d69bc5a6e93fc5fe8cae851700253f2d494622c6127b4d77bf54a1ac27957234628cbe2fea1729ec53be7d90806d510ccddfd76fab1b9bf1207db8b05c3eaa88fa4c0a5db13cec9310f4e02c1d8114705446fd6649df3829aa12786b8d10b4540d8c1f1c8208c4b41998435e3fa1ec5199cb2d3d0c5c04c5e0b3ffd69112252106bb39333ff23b38d167a9b45ad1bdabf434c8695e2676d461b34c5f048e70b67a44d824baa090c8be13a22ef0d0970cc7a94ed4b77bfc3a40427c6c11abd2b415817243f6801d535a3adc9924a1671b645100e822a0c1876a37d9c9e230e3d762f1cfbb89a8b28255ba4cc5b46cb1635cf185578fa068b68bac93991982b48e7faacc09745a7e33bb12de6b25a2342a7e03cff06dde29b4d05de84e56c78fc6d9dcd180438da3136767d5846bfe7168faeac5b9434394bd747126c5c1ecc6621d10817ce9b6540433828a3bb8f6da0cd8f2b54a47cd5473f6bc3dc1234bd115a6890aa678d1bce7840d7a4559cda556740860079e46217c20e45ee59b8b7078d9b70cb6a249eb2e5e4071d044f456fb61649f261689b8d7a532afaf88eb30041242ce491fb7e654a1f06add370e2706f75c2fe1afe8e065804414c660ec4d96f496b1ad87592de8b7d04baa7ab142f580f262c64c57fce8ef933f18904f001809cfdf94eb679c9eced5d125b4f1d0064ca2ccf5eaf61bb7841bd408ae213deeb15d860f7ee7224b9d2dd38ee9f6c3fca6590335715c218db8f8c98e6339a6944817a1ce2e115ae984699861631b9893c143f594d6dde0895a0c7edb9912f3fcd8fd0765227b3963033306d15711387044bc373ac10d7be73cd80f1a79cf1ea0989ea9ae8a0dbbd1227bc33df652792a6bd95f1d21c6497c4c35b9a1eadc0217e322285a2eb832753aae74ef42fc983e58a126b7c23e4b0bac16f0de1eff7d41477bb25052f32cc9cc956ebd209d6b945b1fa9182857e180672a6be7edeb5234830668b1ea749d0a0dd3a244684d4dd76221c3bdf98c2f1eacb7a6dcccafd249b0ba2592c88790de40895799ea4dfb045cc2392dbb623bfe420b24e5a425b84a4b24d787a68bbec9db363ac4e9453df597f0224d8b7b21629e1989e53accbae97e189cf9b59ebf8bb89591fe3fda450af548ffc46eff98b5216e238a9246e2fb95810f8f4d89504633a6d223484a765b9e6e5497159b31c51fa6cc10641bafa81b10c5ab853f3136fa1b4334bcbde99cb4689f077ca3c29c2f1aca2a05762943073d5992aac4d9b0d411ba25905c34fd02b8eb7b9db375a6f6516446cc195eb55eda1e007e26328e9e2642a9c4e90c56440cc60a1db77713860a56820901b3022d55c621e9d54f759dd17fc5b59331c63cf30e07081bf0cdee6cc94ddfe8c6179e7ed86607d4ba7d5f1e97fbc1139b43ae5fd04c1c715f4600f028d0852a421d472b1b48e591b6edfebcd86be3db2caf967b06776096e14f0deffc9bb126ec329c49ada996b963e942d9c404967dc23bdbd0eee951b2879f2ef7ae224d4ff25edac4ddeb2c0b8e579af283e87c625d3fae5286fa855930e45207af7054763937a9247dc38e37e6dee2e325b617280846012e463707b6ccfa2fc399a66e534221a45626cd18c79d46f5c77c2d359e19ea870cd230709b5e33cd52fd43388ef91dea0a1e0df6c72688d9fd32bb67f489a3618604ef1dfa0d7f569d40cc68e39994e4edab4007c988998f59485ce4723c1eeb7c72f7e833418bab47735a91c7ab24e8555d2ccf3a812b6c634c0c3a68271ec8b536aaa442e056945feca6fb4e54d2cf60a0334f494b2bdb6fbd597de0ce9d2cf03333a0c7121e086aa4c657360fbfb60f3ce0fc0d90ff12b03464e8ff0e5e546ff79735c5c800a0f9b680a478c772f60173a760e280d8287681986038444f2103e2894d5809d062cfe8380e34bca86475da3d7634131c2a8cdc98c5927bc137db61f94eaf9a74f87cc85072c201766eae17fbd5b732859fb1b1c980b36e377aa41a95bca18ccea529420e742899af7b968c1fb9c0d181da9f86358dbeea877c3e9123a9289c362fa61d96c707ac94b427318a1e5f21078aa9d1fd7a52704e0d73e527f3ca65b7b459734dd30db5335c450f1dbcc1e4259d657d13b6d6b4adddc3d0eae034d1878cd0aa1825991d75f8e6b5b4c0d6d17e8ce709b19ff794a8ef856abdfac65cd13631f1b66b20f2ebf2f3122d18e03cbfff88206a5998fc3cb2b40634fcecdb8f5bdbfe044dbf169ccd2cd60f7bf033272f38f587943fcc75d2d65d9028c02891c8415706c2b2459b7a3c5cc82b0446088d3b3bcc033ad453136afd4ac4678320fc17288dbfa1c5180ad57508a2a298ed4ebc716ede34fded574d9779be5d56517d4dd40f197312390c488f46914b0927b13901ce70c1684801f2811168fab533998a1fdabbb6e683abfa021f6b80077f19455c34cecf5dbdb2fa6e3930eb5940cb14504050cc74249424310dff81116b8f2076b8ebece84c302e758fa90af5a1888aa8a5a2bff4aeb7ebd1c7a216bdbb84bf9c021caf3c8efbfdc5d3aede46381bcda372a5398c89868ad57287736fec2a7e8ed638974fde5875eafa506a6bd7f772d2b221f4bde4920fe0c56f8e0847e2a7e8387c64ddef4203d77a526c46d7871befe0c5f9128bd67319acd963fc040185aac4e7815f728bbd7ffd8f3d125e63320182f202fa9a52505be9585556a5d1308c118ccdf01978027cbace7ab339d6f53d15e795b7f3fedae4f86c3f257ed80ee634375dc2333ceed1ccaeab1b6be7a9611ff33d79dccdec2007558c06dfc06612d56d37882e5f1de340cf05f4fffbe1a5def6d045bc5bdaf633f07360f9028cedd103bf03fec8beb9fdbf8c5fc684d12efae1859c53e2cc3e2f508a9cd0410ec036648d3760dd591f7ae04e4cdd61a2566319c943f0b63d87e422dfe5c0d1edcb2dc515778a0d7bb2c93ced3b1435adbc51d3fdca9c13679397bc4490093d64869998d6a28bb862ead0fa411585289cc00dc199eac6c607b8a84123dad3be80dd8fd86aa202113131046336352235f34c05f5ea6d5265adda98edbbfd11d6839c5b1bfe4fad4e688558d633d4a281df44d9c0a35abd464e01f8ab01a1e272cc8cd155a40b8aca4c6b1dc894c0fdc02f15a8f67ce94c7f99b6fcc0e4a3a8a71365645ad7809d47bb26f46ed8bd02f6e8f3d277224f82f3d41695f367e343ac6d507413f4bdacf9e344a49156c4de36d68c075415f8004748055b38b8a4110f869fafcc59cdae5663eda72a05be365a50e98bfd4b00e35aef687afae7bd6622cdd725326776f6fb1476c8cf8c20a0e5223e2bea494a1bbe4e79b25a5e48ba34bc66a84ecc4a0aba98e74ca2b1f61893e61a29498d855a778a2a9ce7b7fcaa44b4aedcbd0e28d6c49bdb6776975bf69161f372b964e4288ce6a3b877c3126f90c4c9749d45b8c5c840983b035993e484a945be5fc9d2d1bd3f3de4e6de7bc74a7a07b13e9e82acc11db85454f1d928fe52ad42ca783fd20dd3e94471b498c2736af40d2a45ff74f9ef874639e33306daa8a667674571e2ed93a48f49b57e9e3382fa8090774bc795609ee510b6a1ca48d9833819cbe8ac77eeebb0e3b6c59ced2d1ab355264934ff1914a3f654249bba60a692dd36368b8a866b333320e57e9c7d3646c375696ff14e303780ffd7b957d89ccdf57823d2d1e158773c2075233dd2f331eafe3802da683c293eaa24cd8b63a7582ddb202cd6f8c837c74f823727641c7eb680fe51ce7f250adb34956e4cab17b8a5f10edf144c700e376c682dd46c8fc89830fee1a44fafe0a5a2e7581d5d16ad6267d1dc2d5be8547f9352d1591b42de94f2559b44a80038360c6394541a77d95b196558a479b609882fc597b9cbe285ad7c7a41133ed85c8ab6e6dec5bf70f9e787985512d48865022705098a6703b255a6f2b05b62fc7ab32e67f06d785ccb33fb348205a76939e6c2991486c5aae8ec1556b2f8e30ca445a4a495cbf2c6013042b8cea615e58899fccbbf1fc4f17a6dc37e46b17ada0be033dc67904fbd7903086d3417e423af64338426a84ca0c2a3252db62695f9cdf10ebc09b9da5747d30e7f4adfb374e1d2bb24542b0373b1fb897690b49fe24d8575ec9800f019c9c76459421c11f002989ac82c13c04a202cf7f9f38b053f9a680d4d5012887a11d25cad201df20a4eee6d2c0474055579ac729c7514a88b1675bbf6b773448c6c1a5ccd157f44f7e032a6b848f2e734d773f029e48fd13c90d41666f9bd4e9bea91950737b6e7502f9d2677938f240e3f905d6095bb0f8bbe961b99b2d025538c3888bfff8957e3592ee5326a75399b59c697f59fcdfbbe3bcffb8777340875611bf75486d2378e68de771800bfffe0572fb36ca855ec5fc8cb90c76455773c36ec40b101fb30c48f8a8e775f5220e024b4da9dddc2fcf4da413e7c5db9e0567cbb5fad0c91d779a0939debd9247d3f7d8107fd986f73a9c9067e6594fabde0b9e887040cfbe7d31332f41259de57b38f33275597725392efea51f290b8e1b5c243ffd9eb4c0231600f9b4b204344736849d527156c4720a463bbe88fbbdc333099d949853d5c6fda98bcd35ad3f1fb1d5a7d00541a8a202c8590e35360bb9d25d6431476649e1898f901fad37975d6dce9833956e7a78d0306f533d4aa3c9676017c7abc7e1f8f2f117774a4f5beba55d1c3cd580fb18defccc349cce24e94a4cf1f4c6f45d783ee0167a55369c9b5e1eb6d0a836f3eb2354fad3cd771a9d777ff84c63120baee86ddc52b3e6817dce339ac9c240e75f3e2f77afbffbc1d54eb5936d045370ce3b77365c5320892dc7bc36e488019461d2e552969de9f25bd8de049d693be450c43c5d22d7569fc384e8d56ddb577c5f3c3471f5ba2998bc0c697a06b6d8ba5f2f7236e78aaed69b468e761a5f07145c0326ebb94f50aaa8c5666c92006d8d139036f981003933f8e2eba106a0e251fa9f5407544e44aedbbb271a3bf1c660a9cb8c74dbd0713aaebba2dd046af8b9428709646521d6bf387a92996b35748e1e67b602309b7da0fb642e89de19f550925f4db082ef7e9821ac4b2aee93c9cf791c086751c4cb4172608a4f903dc40727858046851529205b45786e294c17abf5e5f6bc730cbfb8fd977c5501a8140ac7984a267880b53cb94157be9ac157be1cf12d8a9e5612947772b734ed6ae30e548a3b2faecf94a7e03f86317f52ac797aefb957d2a29de8f8ced414ce22c800e0dc7e49d3672fca633248f3e68c00", 0x2000, &(0x7f000000dcc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x78, 0x0, 0xa, {0x8, 0x8000000, 0x0, {0x4, 0xffffffffffffff9f, 0x10000000000, 0x8, 0x40000000000003, 0xfffffffffffffffe, 0x0, 0xfff, 0x52, 0x4000, 0xfffffff8, 0x0, 0x0, 0x3d, 0xa5}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet(0x2, 0x3, 0x1b) getsockopt$MRT(r3, 0x0, 0xd0, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r4, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) timer_create(0x7, &(0x7f00000002c0)={0x0, 0x21, 0x2}, &(0x7f0000000b80)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) preadv(r6, &(0x7f00000014c0)=[{&(0x7f0000000100)=""/179, 0xd6defbaf1f74193d}], 0x1, 0x7, 0x200) (async) preadv(r6, &(0x7f00000014c0)=[{&(0x7f0000000100)=""/179, 0xd6defbaf1f74193d}], 0x1, 0x7, 0x200) preadv(r6, &(0x7f0000002740)=[{&(0x7f0000001540)=""/4096, 0x1000}], 0x20, 0x4, 0xa) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e0001"], 0x50}}, 0x0) 0s ago: executing program 1 (id=2957): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x69ee, 0xc00, 0x5, 0x50}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, 0x0) syz_ublk_setup_queues(r0, 0x0, &(0x7f0000019080)={0x0, 0x597f, 0x1, 0x2, 0x10d, 0x0, r0}, &(0x7f0000019180)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2067, 0x8000, 0x3, 0x17, 0x0, r0}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xce5e, 0x10, 0x2, 0x2c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xecae, 0x200, 0x3, 0x11a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88d9, 0x800, 0x0, 0x3bd, 0x0, r0}}], 0x4, 0x0, &(0x7f000001a480)) r7 = socket$pptp(0x18, 0x1, 0x2) accept4(r7, 0x0, 0x0, 0x800) r8 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bind$inet(r8, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3000004, 0x10, r6, 0x24b2000) connect$inet(r8, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0) r10 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r10, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) close_range(r9, 0xffffffffffffffff, 0x3f00000000000000) syz_pidfd_open(0x0, 0x0) sendmmsg(r8, &(0x7f0000007fc0), 0x800001d, 0x1c) kernel console output (not intermixed with test programs): fail, usb_ep_enable returned -22 [ 352.549197][T12536] e1000e 0000:00:02.0 eth1: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx [ 352.552306][ T5887] hub 6-1:1.0: bad descriptor, ignoring hub [ 352.552324][ T5887] hub 6-1:1.0: probe with driver hub failed with error -5 [ 352.552700][ T5887] cdc_wdm 6-1:1.0: skipping garbage [ 352.552711][ T5887] cdc_wdm 6-1:1.0: skipping garbage [ 352.574370][ T5887] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 352.574388][ T5887] cdc_wdm 6-1:1.0: Unknown control protocol [ 352.906601][T12537] usb 8-1: USB disconnect, device number 40 [ 353.148122][ T43] audit: type=1326 audit(1789888927.880:4765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2445" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 353.148154][ T43] audit: type=1326 audit(1789888927.880:4766): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14115 comm="syz.3.2445" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 353.423670][ T5825] usb 6-1: USB disconnect, device number 41 [ 354.332159][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 354.332279][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 354.337240][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 354.337430][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 354.337903][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 354.337974][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 354.362086][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 354.362137][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 354.362147][T14174] UDF-fs: warning (device nbd0): udf_fill_super: No partition found (1) [ 354.658424][ T5824] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 354.810152][ T5824] usb 5-1: New USB device found, idVendor=104f, idProduct=0004, bcdDevice= 1.00 [ 354.811353][ T5824] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 3072, setting to 1024 [ 354.811378][ T5824] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 354.813565][ T5824] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 354.813585][ T5824] usb 5-1: Product: syz [ 354.813596][ T5824] usb 5-1: Manufacturer: syz [ 354.817072][T14174] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 354.830844][ T5824] iuu_phoenix 5-1:1.0: iuu_phoenix converter detected [ 354.847384][ T5824] usb 5-1: iuu_phoenix converter now attached to ttyUSB0 [ 354.863792][T14144] Process accounting paused [ 355.029514][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 355.029608][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 355.030616][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 355.069104][T14183] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 355.069328][T14183] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.069396][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 355.070515][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 355.070568][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 355.070818][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 355.070863][T14174] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 355.070873][T14174] UDF-fs: warning (device nbd0): udf_fill_super: No partition found (1) [ 355.098262][ T5824] usb 5-1: USB disconnect, device number 8 [ 355.104918][ T5824] iuu_phoenix ttyUSB0: iuu_phoenix converter now disconnected from ttyUSB0 [ 355.105205][ T5824] iuu_phoenix 5-1:1.0: device disconnected [ 355.918676][T12536] usb 7-1: new low-speed USB device number 10 using dummy_hcd [ 356.082728][T12536] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 356.093266][T12536] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 356.093504][T12536] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 356.094959][T12536] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 356.098138][T12536] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.205137][T14194] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 356.234549][T12536] hub 7-1:1.0: bad descriptor, ignoring hub [ 356.234571][T12536] hub 7-1:1.0: probe with driver hub failed with error -5 [ 356.237275][T12536] cdc_wdm 7-1:1.0: skipping garbage [ 356.237286][T12536] cdc_wdm 7-1:1.0: skipping garbage [ 356.296417][T12536] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 356.296456][T12536] cdc_wdm 7-1:1.0: Unknown control protocol [ 357.648511][T12536] usb 7-1: USB disconnect, device number 10 [ 358.031147][T14220] CIFS: Attempting to mount //127.0.0.1/share [ 359.052477][T12537] usb 5-1: new low-speed USB device number 9 using dummy_hcd [ 359.215635][T14220] CIFS: VFS: Error connecting to socket. Aborting operation. [ 359.215769][T14220] CIFS: VFS: cifs_mount failed w/return code = -4 [ 359.219360][T12537] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 359.220174][T12537] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 359.220187][T12537] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 359.220206][T12537] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 359.220225][T12537] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.222299][T14234] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 359.223214][T12537] hub 5-1:1.0: bad descriptor, ignoring hub [ 359.223227][T12537] hub 5-1:1.0: probe with driver hub failed with error -5 [ 359.223449][T12537] cdc_wdm 5-1:1.0: skipping garbage [ 359.223457][T12537] cdc_wdm 5-1:1.0: skipping garbage [ 359.224538][T12537] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 359.224547][T12537] cdc_wdm 5-1:1.0: Unknown control protocol [ 359.389897][T14241] overlayfs: failed to resolve './sys': -2 [ 359.487919][T14243] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 359.561632][ C2] wdm_int_callback: 12 callbacks suppressed [ 359.561650][ C2] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 359.561658][ C2] wdm_int_callback: 12 callbacks suppressed [ 359.561664][ C2] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 359.561698][ C2] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 359.678765][ T854] usb 5-1: USB disconnect, device number 9 [ 360.227185][ T854] libceph: connect (1)[c::]:6789 error -101 [ 360.227267][ T854] libceph: mon0 (1)[c::]:6789 connect error [ 360.235249][T14263] ceph: No mds server is up or the cluster is laggy [ 360.467589][T14274] CIFS: Attempting to mount //127.0.0.1/share [ 360.758978][T14283] 9pnet_virtio: no channels available for device syz [ 360.762175][T14280] vxcan1: tx drop: invalid da for name 0x0100000000000000 [ 361.213310][T14274] CIFS: VFS: Error connecting to socket. Aborting operation. [ 361.213337][T14274] CIFS: VFS: cifs_mount failed w/return code = -4 [ 362.548708][ T854] usb 7-1: new low-speed USB device number 11 using dummy_hcd [ 362.699233][ T854] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 362.700564][ T854] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 362.700582][ T854] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 362.700616][ T854] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 362.700648][ T854] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 362.703336][T14297] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 362.704961][ T854] hub 7-1:1.0: bad descriptor, ignoring hub [ 362.704979][ T854] hub 7-1:1.0: probe with driver hub failed with error -5 [ 362.705349][ T854] cdc_wdm 7-1:1.0: skipping garbage [ 362.705360][ T854] cdc_wdm 7-1:1.0: skipping garbage [ 362.707341][ T854] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 362.707354][ T854] cdc_wdm 7-1:1.0: Unknown control protocol [ 362.842487][T14328] configfs-gadget.g1 gadget.0: afunc_bind:1251 Error! [ 362.842566][T14328] udc dummy_udc.0: failed to start g1: -19 [ 362.847125][T14328] UDC core: g1: couldn't find an available UDC or it's busy [ 363.098171][T12537] usb 7-1: USB disconnect, device number 11 [ 363.148013][T12534] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 363.318406][T12534] usb 5-1: Using ep0 maxpacket: 8 [ 363.319100][T12534] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 363.320225][T12534] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 363.320259][T12534] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.326518][T12534] usb 5-1: config 0 descriptor?? [ 363.529556][T12534] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 363.589087][ T854] usb 8-1: new high-speed USB device number 41 using dummy_hcd [ 363.655839][T14345] CIFS: Attempting to mount //127.0.0.1/share [ 363.787939][ T854] usb 8-1: Using ep0 maxpacket: 8 [ 363.788672][ T854] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 363.789654][ T854] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 363.789690][ T854] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 363.789707][ T854] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 363.789727][ T854] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 363.789745][ T854] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 363.789776][ T854] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 364.455609][T14345] CIFS: VFS: cifs_mount failed w/return code = -112 [ 364.878800][ T1179] nvmet: connect request for invalid subsystem testsubsys! [ 364.881936][T14373] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 364.912912][T14377] netlink: 'syz.3.2501': attribute type 11 has an invalid length. [ 364.923753][T14375] overlayfs: conflicting lowerdir path [ 365.211714][T12537] usb 5-1: USB disconnect, device number 10 [ 365.740008][T12537] usb 6-1: new low-speed USB device number 42 using dummy_hcd [ 365.899873][T12537] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 365.902317][T12537] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 365.902360][T12537] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 365.912498][T12537] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 365.917400][T12537] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 365.943008][T14386] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 365.951052][T12537] hub 6-1:1.0: bad descriptor, ignoring hub [ 365.951065][T12537] hub 6-1:1.0: probe with driver hub failed with error -5 [ 365.951282][T12537] cdc_wdm 6-1:1.0: skipping garbage [ 365.951289][T12537] cdc_wdm 6-1:1.0: skipping garbage [ 365.959851][T12537] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 365.959862][T12537] cdc_wdm 6-1:1.0: Unknown control protocol [ 366.271522][T14395] CIFS: Attempting to mount //127.0.0.1/share [ 366.376643][ T5824] usb 8-1: USB disconnect, device number 41 [ 367.450996][T14400] netlink: 'syz.3.2515': attribute type 4 has an invalid length. [ 367.451009][T14400] netlink: 17 bytes leftover after parsing attributes in process `syz.3.2515'. [ 367.567987][T12537] usb 6-1: USB disconnect, device number 42 [ 367.778426][T14405] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 367.875209][T14395] CIFS: VFS: cifs_mount failed w/return code = -112 [ 368.172361][T14414] netlink: 'syz.1.2520': attribute type 1 has an invalid length. [ 368.172376][T14414] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2520'. [ 368.489136][T14410] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 368.489153][T14410] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 368.489184][T14410] vhci_hcd vhci_hcd.0: Device attached [ 368.797692][ T9] usb 38-1: SetAddress Request (2) to port 0 [ 368.797729][ T9] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 368.921720][T14418] vhci_hcd: connection reset by peer [ 368.922293][T12305] vhci_hcd vhci_hcd.0: stop threads [ 368.922315][T12305] vhci_hcd vhci_hcd.0: release socket [ 368.922359][T12305] vhci_hcd vhci_hcd.0: disconnect device [ 370.143687][T14462] netlink: 'syz.0.2530': attribute type 1 has an invalid length. [ 370.143700][T14462] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2530'. [ 370.412358][T14467] lo speed is unknown, defaulting to 1000 [ 370.413456][T14467] wlan0 speed is unknown, defaulting to 1000 [ 371.145185][T14493] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 371.342581][ T5887] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 371.488289][ T5887] usb 7-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 371.489407][ T5887] usb 7-1: config index 0 descriptor too short (expected 23569, got 27) [ 371.489430][ T5887] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 371.490237][ T5887] usb 7-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 371.490248][ T5887] usb 7-1: Manufacturer: syz [ 371.491541][ T5887] usb 7-1: config 0 descriptor?? [ 371.558218][ T5887] rc_core: IR keymap rc-hauppauge not found [ 371.558235][ T5887] Registered IR keymap rc-empty [ 371.559729][ T5887] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0 [ 371.561649][ T5887] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/rc/rc0/input26 [ 371.718820][ T5887] usb 7-1: USB disconnect, device number 12 [ 372.057726][T14529] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2542'. [ 372.317480][ T5825] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 372.468005][ T5825] usb 5-1: Using ep0 maxpacket: 8 [ 372.468643][ T5825] usb 5-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 372.469470][ T5825] usb 5-1: config 1 has an invalid descriptor of length 173, skipping remainder of the config [ 372.469482][ T5825] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 372.469492][ T5825] usb 5-1: config 1 has no interface number 0 [ 372.469509][ T5825] usb 5-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0xBC, changing to 0x8C [ 372.469521][ T5825] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x8C has an invalid bInterval 93, changing to 7 [ 372.469533][ T5825] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x8C has invalid maxpacket 9440, setting to 1024 [ 372.471145][ T5825] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.471157][ T5825] usb 5-1: Product: syz [ 372.471164][ T5825] usb 5-1: Manufacturer: syz [ 372.471171][ T5825] usb 5-1: SerialNumber: syz [ 373.073786][T14562] netlink: 'syz.2.2546': attribute type 1 has an invalid length. [ 373.073803][T14562] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2546'. [ 373.535105][T14558] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 373.586028][T14576] netlink: 'syz.0.2543': attribute type 1 has an invalid length. [ 373.847401][ T9] usb 38-1: device descriptor read/8, error -110 [ 374.208038][T14582] tmpfs: Bad value for 'mpol' [ 374.215114][T14582] syz_tun: entered allmulticast mode [ 374.241092][ T9] usb usb38-port1: attempt power cycle [ 374.330387][T12537] hid-generic 0000:0010:025E.0009: unknown main item tag 0x0 [ 374.346528][T12537] hid-generic 0000:0010:025E.0009: hidraw1: HID v0.00 Device [syz1] on syz0 [ 374.421265][T14595] fido_id[14595]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 374.948159][ T9] usb usb38-port1: unable to enumerate USB device [ 375.106933][ T9] usb 5-1: USB disconnect, device number 11 [ 375.242483][T14607] FAULT_INJECTION: forcing a failure. [ 375.242483][T14607] name failslab, interval 1, probability 0, space 0, times 0 [ 375.242507][T14607] CPU: 0 UID: 0 PID: 14607 Comm: syz.0.2557 Tainted: G L syzkaller #0 PREEMPT(full) [ 375.242522][T14607] Tainted: [L]=SOFTLOCKUP [ 375.242526][T14607] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 375.242533][T14607] Call Trace: [ 375.242537][T14607] [ 375.242541][T14607] dump_stack_lvl+0x100/0x190 [ 375.242599][T14607] should_fail_ex.cold+0x5/0xa [ 375.242614][T14607] should_failslab+0xc2/0x120 [ 375.242648][T14607] __kmalloc_noprof+0xfc/0x840 [ 375.242661][T14607] ? lsm_blob_alloc+0x68/0x90 [ 375.242677][T14607] lsm_blob_alloc+0x68/0x90 [ 375.242689][T14607] security_sk_alloc+0x2d/0x290 [ 375.242723][T14607] sk_prot_alloc+0x1d1/0x2a0 [ 375.242765][T14607] sk_alloc+0x36/0xe80 [ 375.242779][T14607] inet6_create+0x385/0x12b0 [ 375.242793][T14607] ? inet6_create+0x7f/0x12b0 [ 375.242807][T14607] __sock_create+0x339/0x860 [ 375.242821][T14607] __sys_socket+0x14d/0x260 [ 375.242832][T14607] ? xfd_validate_state+0x129/0x190 [ 375.242853][T14607] ? __pfx___sys_socket+0x10/0x10 [ 375.242869][T14607] __ia32_sys_socket+0x72/0xb0 [ 375.242879][T14607] ? lockdep_hardirqs_on+0x7d/0x110 [ 375.242919][T14607] __do_fast_syscall_32+0x13a/0x8b0 [ 375.242936][T14607] ? lockdep_hardirqs_on+0x7d/0x110 [ 375.242953][T14607] do_fast_syscall_32+0x32/0x70 [ 375.242971][T14607] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 375.242985][T14607] RIP: 0023:0xf7f03fec [ 375.242999][T14607] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 375.243004][T14607] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 375.243014][T14607] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000000000002 [ 375.243021][T14607] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 375.243026][T14607] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 375.243032][T14607] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 375.243038][T14607] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 375.243051][T14607] [ 375.245969][T14607] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2557'. [ 375.437253][ T854] usb 6-1: new low-speed USB device number 43 using dummy_hcd [ 375.479453][T14619] 9pnet_virtio: no channels available for device syz [ 375.635168][ T854] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 375.645427][ T854] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 375.645484][ T854] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 375.646226][ T854] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 375.646688][ T854] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 375.749577][T14593] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 375.820852][ T854] hub 6-1:1.0: bad descriptor, ignoring hub [ 375.821117][ T854] hub 6-1:1.0: probe with driver hub failed with error -5 [ 375.838793][ T854] cdc_wdm 6-1:1.0: skipping garbage [ 375.838840][ T854] cdc_wdm 6-1:1.0: skipping garbage [ 375.913957][ T854] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 375.914309][ T854] cdc_wdm 6-1:1.0: Unknown control protocol [ 376.047291][ T854] usb 6-1: USB disconnect, device number 43 [ 376.405497][T14626] futex_wake_op: syz.2.2564 tries to shift op by 144; fix this program [ 376.428711][T14624] ip6tnl2: entered promiscuous mode [ 376.428731][T14624] ip6tnl2: entered allmulticast mode [ 377.469389][T14662] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input27 [ 378.090154][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.439648][T14674] FAT-fs (sr0): bogus number of reserved sectors [ 378.439666][T14674] FAT-fs (sr0): Can't find a valid FAT filesystem [ 378.461183][ T5752] Bluetooth: hci2: unexpected event for opcode 0x2028 [ 378.804513][ T9] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 379.157116][ T9] usb 7-1: device descriptor read/64, error -71 [ 379.397119][T12534] usb 8-1: new low-speed USB device number 42 using dummy_hcd [ 379.398515][ T9] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 379.527341][ T9] usb 7-1: device descriptor read/64, error -71 [ 379.567693][T12534] usb 8-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 379.568667][T12534] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 379.568686][T12534] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 379.568720][T12534] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 379.568751][T12534] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.573612][T14690] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 379.574728][T12534] hub 8-1:1.0: bad descriptor, ignoring hub [ 379.574740][T12534] hub 8-1:1.0: probe with driver hub failed with error -5 [ 379.575348][T12534] cdc_wdm 8-1:1.0: skipping garbage [ 379.575356][T12534] cdc_wdm 8-1:1.0: skipping garbage [ 379.581725][T12534] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 379.581740][T12534] cdc_wdm 8-1:1.0: Unknown control protocol [ 379.637258][ T9] usb usb7-port1: attempt power cycle [ 379.937930][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 379.937956][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 379.938153][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 379.938163][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 379.938370][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 379.938380][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 379.987044][ T9] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 379.999417][T12534] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 380.008039][ T9] usb 7-1: device descriptor read/8, error -71 [ 380.049677][ T854] usb 8-1: USB disconnect, device number 42 [ 380.147909][T12534] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 380.148938][T12534] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 380.151605][T12534] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 380.151626][T12534] usb 5-1: Product: syz [ 380.151638][T12534] usb 5-1: Manufacturer: syz [ 380.151652][T12534] usb 5-1: SerialNumber: syz [ 380.247658][ T9] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 380.267708][ T9] usb 7-1: device descriptor read/8, error -71 [ 380.377491][ T9] usb usb7-port1: unable to enumerate USB device [ 380.467073][T12534] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 13 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 380.752768][ C3] usblp0: nonzero write bulk status received: -71 [ 380.753833][T12534] usb 5-1: USB disconnect, device number 13 [ 380.765363][T12534] usblp0: removed [ 381.106115][ T10] kernel read not supported for file /video9 (pid: 10 comm: kworker/0:1) [ 381.156766][T14735] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2589'. [ 381.577554][T14750] hsr0: entered promiscuous mode [ 381.578292][T14750] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2593'. [ 381.582926][T14750] hsr_slave_0: left promiscuous mode [ 381.583508][T14750] hsr_slave_1: left promiscuous mode [ 381.598774][T14750] hsr0 (unregistering): left promiscuous mode [ 381.759134][T14755] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2595'. [ 382.061246][T14769] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2597'. [ 382.323428][T14784] hsr0: entered promiscuous mode [ 382.324334][T14784] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2603'. [ 382.361063][T14784] hsr_slave_0: left promiscuous mode [ 382.373050][T14784] hsr_slave_1: left promiscuous mode [ 382.403566][T14784] hsr0 (unregistering): left promiscuous mode [ 383.519193][T14797] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2605'. [ 383.528811][T14797] null_blk: nullb1: using native zone append [ 383.569011][T14797] null_blk: disk nullb1 created [ 384.266791][ T43] audit: type=1800 audit(1789888958.912:4767): pid=14827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2613" name="file1" dev="overlay" ino=3159 res=0 errno=0 [ 384.530919][T14836] hsr0: entered promiscuous mode [ 384.539726][T14836] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2615'. [ 384.539873][T14836] hsr_slave_0: left promiscuous mode [ 384.540382][T14836] hsr_slave_1: left promiscuous mode [ 384.544548][T14836] hsr0 (unregistering): left promiscuous mode [ 385.593909][T14838] Process accounting resumed [ 385.641326][T14853] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2618'. [ 385.653027][T14853] null_blk: nullb1: using native zone append [ 385.735665][T14853] null_blk: disk nullb1 created [ 385.931983][ T73] nvmet: Created discovery controller 1 for subsystem nqn.2014-08.org.nvmexpress.discovery for NQN nqn.2014-08.org.nvmexpress:uuid:34308a1f-b44b-4ce9-93ef-91131f1066ac. [ 385.965259][T14864] nvme nvme0: new ctrl: "nqn.2014-08.org.nvmexpress.discovery" [ 386.046737][ T10] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 386.199990][ T10] usb 7-1: Using ep0 maxpacket: 8 [ 386.200420][ T10] usb 7-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 386.201209][ T10] usb 7-1: config index 0 descriptor too short (expected 5924, got 36) [ 386.201221][ T10] usb 7-1: config 250 has an invalid interface number: 228 but max is -1 [ 386.201231][ T10] usb 7-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 386.201241][ T10] usb 7-1: config 250 has no interface number 0 [ 386.201259][ T10] usb 7-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 386.201273][ T10] usb 7-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 386.201285][ T10] usb 7-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 36 [ 386.201296][ T10] usb 7-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 386.201309][ T10] usb 7-1: config 250 interface 228 has no altsetting 0 [ 386.202477][ T10] usb 7-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 386.202489][ T10] usb 7-1: Product: syz [ 386.202496][ T10] usb 7-1: SerialNumber: syz [ 386.229969][ T10] hub 7-1:250.228: bad descriptor, ignoring hub [ 386.229991][ T10] hub 7-1:250.228: probe with driver hub failed with error -5 [ 386.269997][ T5887] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 386.416829][ T5887] usb 5-1: device descriptor read/64, error -71 [ 386.436878][ T10] usblp 7-1:250.228: usblp0: USB Bidirectional printer dev 17 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 386.676809][ T5887] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 386.827992][ T5887] usb 5-1: device descriptor read/64, error -71 [ 386.938735][ T5887] usb usb5-port1: attempt power cycle [ 387.092259][T14861] usb 7-1: reset high-speed USB device number 17 using dummy_hcd [ 387.202066][T14891] hsr0: entered promiscuous mode [ 387.203277][T14891] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2628'. [ 387.203456][T14891] hsr_slave_0: left promiscuous mode [ 387.204293][T14891] hsr_slave_1: left promiscuous mode [ 387.211308][T14891] hsr0 (unregistering): left promiscuous mode [ 387.287819][ T5887] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 387.309514][ T5887] usb 5-1: device descriptor read/8, error -71 [ 387.490460][ C0] usblp0: nonzero read bulk status received: -71 [ 387.654090][ T5887] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 387.699588][ T5887] usb 5-1: device descriptor read/8, error -71 [ 387.706803][ T10] usb 7-1: USB disconnect, device number 17 [ 387.708587][ T10] usblp0: removed [ 387.829807][ T5887] usb usb5-port1: unable to enumerate USB device [ 388.876906][T14908] netlink: 'syz.3.2633': attribute type 1 has an invalid length. [ 388.877211][T14908] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2633'. [ 389.030916][ T43] audit: type=1326 audit(1789888963.772:4768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14911 comm="syz.1.2634" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f06fec code=0x7ffc0000 [ 389.031054][ T43] audit: type=1326 audit(1789888963.772:4769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14911 comm="syz.1.2634" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f06fec code=0x7ffc0000 [ 389.031077][ T43] audit: type=1326 audit(1789888963.772:4770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14911 comm="syz.1.2634" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f06fec code=0x7ffc0000 [ 389.031145][ T43] audit: type=1326 audit(1789888963.772:4771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14911 comm="syz.1.2634" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f06fec code=0x7ffc0000 [ 389.032095][ T43] audit: type=1326 audit(1789888963.772:4772): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14911 comm="syz.1.2634" exe="/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf7f06fec code=0x7ffc0000 [ 389.032247][T14913] IPVS: ip_vs_add_dest(): server weight less than zero [ 389.033231][ T43] audit: type=1326 audit(1789888963.772:4773): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14911 comm="syz.1.2634" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f06fec code=0x7ffc0000 [ 389.033299][ T43] audit: type=1326 audit(1789888963.772:4774): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14911 comm="syz.1.2634" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f06fec code=0x7ffc0000 [ 389.034824][ T43] audit: type=1326 audit(1789888963.772:4775): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14911 comm="syz.1.2634" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f06fec code=0x7ffc0000 [ 389.619507][ T5102] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 389.631699][ T5102] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 389.635593][ T5102] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 389.650707][ T5102] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 389.654988][ T5102] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 389.786232][ T43] audit: type=1326 audit(1789888964.522:4776): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14949 comm="syz.0.2642" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f03fec code=0x0 [ 390.003484][T14942] lo speed is unknown, defaulting to 1000 [ 390.004651][T14942] wlan0 speed is unknown, defaulting to 1000 [ 390.187803][T14942] bridge0: port 1(bridge_slave_0) entered blocking state [ 390.187874][T14942] bridge0: port 1(bridge_slave_0) entered disabled state [ 390.187930][T14942] bridge_slave_0: entered allmulticast mode [ 390.188769][T14942] bridge_slave_0: entered promiscuous mode [ 390.199597][T14942] bridge0: port 2(bridge_slave_1) entered blocking state [ 390.199669][T14942] bridge0: port 2(bridge_slave_1) entered disabled state [ 390.199728][T14942] bridge_slave_1: entered allmulticast mode [ 390.200434][T14942] bridge_slave_1: entered promiscuous mode [ 390.229304][T14942] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 390.234459][T14942] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 390.249673][T14942] team0: Port device team_slave_0 added [ 390.251090][T14942] team0: Port device team_slave_1 added [ 390.262726][T14942] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 390.262736][T14942] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 390.262748][T14942] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 390.263955][T14942] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 390.263963][T14942] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 390.263975][T14942] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 390.297178][T14942] hsr_slave_0: entered promiscuous mode [ 390.297592][T14942] hsr_slave_1: entered promiscuous mode [ 390.457612][T14942] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.474947][T14986] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.475312][T14986] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.480322][T14987] tipc: Started in network mode [ 390.480333][T14987] tipc: Node identity 2000004, cluster identity 4711 [ 390.480339][T14987] tipc: Node number set to 33554436 [ 390.553868][T14942] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.628214][T14942] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.705439][T14942] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.736523][ T854] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 390.857423][T14942] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 390.861266][T14942] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 390.861890][T14942] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 390.863550][T14942] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 390.863916][T14942] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 390.865299][T14942] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 390.865713][T14942] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 390.867463][T14942] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 390.882505][T14942] bridge0: port 2(bridge_slave_1) entered blocking state [ 390.882553][T14942] bridge0: port 2(bridge_slave_1) entered forwarding state [ 390.882712][T14942] bridge0: port 1(bridge_slave_0) entered blocking state [ 390.882762][T14942] bridge0: port 1(bridge_slave_0) entered forwarding state [ 390.886373][ T854] usb 7-1: device descriptor read/64, error -71 [ 390.924480][T14942] 8021q: adding VLAN 0 to HW filter on device bond0 [ 390.929491][ T73] bridge0: port 1(bridge_slave_0) entered disabled state [ 390.929930][ T73] bridge0: port 2(bridge_slave_1) entered disabled state [ 390.940671][T14942] 8021q: adding VLAN 0 to HW filter on device team0 [ 390.946840][ T8826] bridge0: port 1(bridge_slave_0) entered blocking state [ 390.946884][ T8826] bridge0: port 1(bridge_slave_0) entered forwarding state [ 390.949863][ T8826] bridge0: port 2(bridge_slave_1) entered blocking state [ 390.949944][ T8826] bridge0: port 2(bridge_slave_1) entered forwarding state [ 391.116576][ T854] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 391.257337][ T854] usb 7-1: device descriptor read/64, error -71 [ 391.368297][ T854] usb usb7-port1: attempt power cycle [ 391.649349][T14942] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 391.680631][T14942] veth0_vlan: entered promiscuous mode [ 391.684333][T14942] veth1_vlan: entered promiscuous mode [ 391.686400][ T5752] Bluetooth: hci1: command tx timeout [ 391.704556][T14942] veth0_macvtap: entered promiscuous mode [ 391.709395][T14942] veth1_macvtap: entered promiscuous mode [ 391.719211][T14942] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 391.721400][T14942] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 391.756425][ T854] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 391.779084][ T854] usb 7-1: device descriptor read/8, error -71 [ 391.965452][ T8826] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 391.965466][ T8826] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 391.989396][ T8829] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 391.989409][ T8829] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 392.006508][T12305] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.006534][T12305] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.006551][T12305] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.006568][T12305] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.026501][ T854] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 392.047182][ T854] usb 7-1: device descriptor read/8, error -71 [ 392.173716][ T854] usb usb7-port1: unable to enumerate USB device [ 393.054696][T15046] loop4: detected capacity change from 0 to 7 [ 393.071986][T15046] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 393.072002][T15046] loop4: partition table partially beyond EOD, truncated [ 393.072093][T15046] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 393.718793][T15064] syzkaller0: entered promiscuous mode [ 393.718807][T15064] syzkaller0: entered allmulticast mode [ 393.767619][ T5752] Bluetooth: hci1: command tx timeout [ 393.846487][T12534] usb 8-1: new low-speed USB device number 43 using dummy_hcd [ 394.239382][T12534] usb 8-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 394.241309][T12534] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 394.241381][T12534] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 394.241658][T12534] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 394.241771][T12534] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 394.683721][T15061] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 394.726905][T12534] hub 8-1:1.0: bad descriptor, ignoring hub [ 394.726920][T12534] hub 8-1:1.0: probe with driver hub failed with error -5 [ 394.763848][T12534] cdc_wdm 8-1:1.0: skipping garbage [ 394.764789][T12534] cdc_wdm 8-1:1.0: skipping garbage [ 394.868785][T12534] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 394.868824][T12534] cdc_wdm 8-1:1.0: Unknown control protocol [ 395.396701][ T5102] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 395.402944][ T5102] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 395.405016][ T5102] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 395.405940][ T5102] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 395.419452][ T5102] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 395.704220][ T7546] syz_tun (unregistering): left allmulticast mode [ 395.726814][ T62] usb 8-1: USB disconnect, device number 43 [ 395.846303][ T5752] Bluetooth: hci1: command tx timeout [ 395.901121][T15086] lo speed is unknown, defaulting to 1000 [ 395.902950][T15086] wlan0 speed is unknown, defaulting to 1000 [ 396.113360][T15086] bridge0: port 1(bridge_slave_0) entered blocking state [ 396.113494][T15086] bridge0: port 1(bridge_slave_0) entered disabled state [ 396.113789][T15086] bridge_slave_0: entered allmulticast mode [ 396.115094][T15086] bridge_slave_0: entered promiscuous mode [ 396.126709][T15086] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.126837][T15086] bridge0: port 2(bridge_slave_1) entered disabled state [ 396.126932][T15086] bridge_slave_1: entered allmulticast mode [ 396.128189][T15086] bridge_slave_1: entered promiscuous mode [ 396.157288][T15086] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 396.161762][T15086] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 396.233030][T15086] team0: Port device team_slave_0 added [ 396.235420][T15086] team0: Port device team_slave_1 added [ 396.273832][T15086] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 396.273848][T15086] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 396.273868][T15086] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 396.275206][T15086] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 396.275218][T15086] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 396.275238][T15086] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 396.306909][T15086] hsr_slave_0: entered promiscuous mode [ 396.307686][T15086] hsr_slave_1: entered promiscuous mode [ 396.308305][T15086] debugfs: 'hsr0' already exists in 'hsr' [ 396.308327][T15086] Cannot create hsr debugfs directory [ 396.490653][T15086] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 396.490686][T15086] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 396.591884][T15086] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 396.591917][T15086] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.450792][ T5752] Bluetooth: hci3: command tx timeout [ 397.726064][T12534] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 397.858289][T15086] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.858312][T15086] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.877325][T12534] usb 7-1: device descriptor read/64, error -71 [ 397.932551][ T5752] Bluetooth: hci1: command tx timeout [ 397.938772][T15086] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.938793][T15086] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.055282][T15086] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 398.058001][T15086] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 398.058493][T15086] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 398.060064][T15086] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 398.060539][T15086] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 398.065055][T15086] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 398.065524][T15086] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 398.078063][T15086] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 398.136983][T12534] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 398.141197][T15086] 8021q: adding VLAN 0 to HW filter on device bond0 [ 398.150788][T15086] 8021q: adding VLAN 0 to HW filter on device team0 [ 398.154732][ T238] bridge0: port 1(bridge_slave_0) entered blocking state [ 398.154776][ T238] bridge0: port 1(bridge_slave_0) entered forwarding state [ 398.167635][ T238] bridge0: port 2(bridge_slave_1) entered blocking state [ 398.167717][ T238] bridge0: port 2(bridge_slave_1) entered forwarding state [ 398.191629][T15086] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 398.191643][T15086] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 398.265949][T12534] usb 7-1: device descriptor read/64, error -71 [ 398.377143][T12534] usb usb7-port1: attempt power cycle [ 398.438345][T15086] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 398.462218][T15086] veth0_vlan: entered promiscuous mode [ 398.466532][T15086] veth1_vlan: entered promiscuous mode [ 398.481124][T15086] veth0_macvtap: entered promiscuous mode [ 398.483645][T15086] veth1_macvtap: entered promiscuous mode [ 398.502073][T15086] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 398.514674][T15086] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 398.536079][ T5555] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 398.536105][ T5555] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 398.536122][ T5555] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 398.536139][ T5555] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 398.635535][ T238] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 398.635549][ T238] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 398.659099][ T8829] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 398.659113][ T8829] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 398.716709][T12534] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 398.737179][T12534] usb 7-1: device descriptor read/8, error -71 [ 398.985920][T12534] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 399.012136][T12534] usb 7-1: device descriptor read/8, error -71 [ 399.118514][T12534] usb usb7-port1: unable to enumerate USB device [ 399.410142][ T62] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 399.526555][ T5752] Bluetooth: hci3: command tx timeout [ 400.116667][ T62] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 400.174780][ T62] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 400.220616][ T62] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 400.220633][ T62] usb 6-1: Product: syz [ 400.220640][ T62] usb 6-1: Manufacturer: syz [ 400.220648][ T62] usb 6-1: SerialNumber: syz [ 401.105945][ T62] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 44 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 401.110291][ T62] usb 6-1: USB disconnect, device number 44 [ 401.146395][ T62] usblp0: removed [ 401.475789][T12534] usb 7-1: new low-speed USB device number 26 using dummy_hcd [ 401.606264][ T5752] Bluetooth: hci3: command tx timeout [ 401.626420][T12534] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 401.627323][T12534] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 401.627337][T12534] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 401.627369][T12534] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 401.627400][T12534] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.632535][T15173] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 401.633865][T12534] hub 7-1:1.0: bad descriptor, ignoring hub [ 401.633878][T12534] hub 7-1:1.0: probe with driver hub failed with error -5 [ 401.634097][T12534] cdc_wdm 7-1:1.0: skipping garbage [ 401.634105][T12534] cdc_wdm 7-1:1.0: skipping garbage [ 401.636218][T12534] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 401.636228][T12534] cdc_wdm 7-1:1.0: Unknown control protocol [ 402.480053][T12537] usb 7-1: USB disconnect, device number 26 [ 403.694903][ T5752] Bluetooth: hci3: command tx timeout [ 404.055675][ T5824] usb 8-1: new high-speed USB device number 44 using dummy_hcd [ 404.185763][ T5824] usb 8-1: device descriptor read/64, error -71 [ 404.425656][ T5824] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 404.555861][ T5824] usb 8-1: device descriptor read/64, error -71 [ 404.665992][ T5824] usb usb8-port1: attempt power cycle [ 404.937069][ T62] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 405.005593][ T5824] usb 8-1: new high-speed USB device number 46 using dummy_hcd [ 405.026175][ T5824] usb 8-1: device descriptor read/8, error -71 [ 405.094304][ T62] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 405.101755][ T62] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 405.115101][ T62] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 405.115203][ T62] usb 5-1: Product: syz [ 405.115247][ T62] usb 5-1: Manufacturer: syz [ 405.115288][ T62] usb 5-1: SerialNumber: syz [ 405.265579][ T5824] usb 8-1: new high-speed USB device number 47 using dummy_hcd [ 405.287470][ T5824] usb 8-1: device descriptor read/8, error -71 [ 405.375194][ T62] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 18 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 405.395762][ T5824] usb usb8-port1: unable to enumerate USB device [ 405.616416][ C3] usblp0: nonzero write bulk status received: -71 [ 405.619804][ T62] usb 5-1: USB disconnect, device number 18 [ 405.758267][ T62] usblp0: removed [ 406.248387][T15221] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input28 [ 408.585519][T12537] usb 5-1: new low-speed USB device number 19 using dummy_hcd [ 408.746814][T12537] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 408.748516][T12537] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 408.748537][T12537] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 408.748571][T12537] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 408.748603][T12537] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.777189][T15253] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 408.814509][T12537] hub 5-1:1.0: bad descriptor, ignoring hub [ 408.814624][T12537] hub 5-1:1.0: probe with driver hub failed with error -5 [ 408.827428][T12537] cdc_wdm 5-1:1.0: skipping garbage [ 408.827446][T12537] cdc_wdm 5-1:1.0: skipping garbage [ 408.833757][T12537] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 408.834082][T12537] cdc_wdm 5-1:1.0: Unknown control protocol [ 409.855624][T12537] usb 5-1: USB disconnect, device number 19 [ 410.675767][ T854] usb 8-1: new high-speed USB device number 48 using dummy_hcd [ 410.832416][ T854] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 410.841046][ T854] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 410.852387][ T854] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 410.852409][ T854] usb 8-1: Product: syz [ 410.852453][ T854] usb 8-1: Manufacturer: syz [ 410.852497][ T854] usb 8-1: SerialNumber: syz [ 411.119760][ T854] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 48 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 411.315376][ T854] usb 8-1: USB disconnect, device number 48 [ 411.354766][ T854] usblp0: removed [ 413.119089][T15308] nfs4: Unknown parameter 'eth1_to_hsr' [ 414.225063][T12536] usb 8-1: new high-speed USB device number 49 using dummy_hcd [ 414.395034][T12536] usb 8-1: Using ep0 maxpacket: 8 [ 414.395550][T12536] usb 8-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 414.396514][T12536] usb 8-1: config index 0 descriptor too short (expected 5924, got 36) [ 414.396528][T12536] usb 8-1: config 250 has an invalid interface number: 228 but max is -1 [ 414.396537][T12536] usb 8-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 414.396548][T12536] usb 8-1: config 250 has no interface number 0 [ 414.396565][T12536] usb 8-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 414.396579][T12536] usb 8-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 414.396591][T12536] usb 8-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 36 [ 414.396602][T12536] usb 8-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 414.396615][T12536] usb 8-1: config 250 interface 228 has no altsetting 0 [ 414.398011][T12536] usb 8-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 414.398023][T12536] usb 8-1: Product: syz [ 414.398031][T12536] usb 8-1: SerialNumber: syz [ 414.890661][T12536] hub 8-1:250.228: bad descriptor, ignoring hub [ 414.890678][T12536] hub 8-1:250.228: probe with driver hub failed with error -5 [ 414.892259][T12536] usblp 8-1:250.228: usblp0: USB Bidirectional printer dev 49 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 415.285127][T12536] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 415.456409][T12536] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 415.458836][T12536] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 415.462421][T12536] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 415.462552][T12536] usb 7-1: Product: syz [ 415.462561][T12536] usb 7-1: Manufacturer: syz [ 415.462601][T12536] usb 7-1: SerialNumber: syz [ 415.680240][T15322] usb 8-1: reset high-speed USB device number 49 using dummy_hcd [ 416.050759][ C0] usblp0: nonzero read bulk status received: -71 [ 416.075629][T12536] usblp 7-1:1.0: usblp1: USB Unidirectional printer dev 27 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 416.161635][T12536] usb 7-1: USB disconnect, device number 27 [ 416.241725][T12536] usblp1: removed [ 416.435559][ T25] usb 8-1: USB disconnect, device number 49 [ 416.601872][ T25] usblp0: removed [ 419.394750][ T10] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 419.544775][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 419.545206][ T10] usb 5-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 419.546110][ T10] usb 5-1: config index 0 descriptor too short (expected 5924, got 36) [ 419.546124][ T10] usb 5-1: config 250 has an invalid interface number: 228 but max is -1 [ 419.546134][ T10] usb 5-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 419.546144][ T10] usb 5-1: config 250 has no interface number 0 [ 419.546162][ T10] usb 5-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 419.546176][ T10] usb 5-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 419.546188][ T10] usb 5-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 36 [ 419.546200][ T10] usb 5-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 419.546213][ T10] usb 5-1: config 250 interface 228 has no altsetting 0 [ 419.547396][ T10] usb 5-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 419.547408][ T10] usb 5-1: Product: syz [ 419.547416][ T10] usb 5-1: SerialNumber: syz [ 419.645084][ T10] hub 5-1:250.228: bad descriptor, ignoring hub [ 419.645102][ T10] hub 5-1:250.228: probe with driver hub failed with error -5 [ 419.805075][ T10] usblp 5-1:250.228: usblp0: USB Bidirectional printer dev 20 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 420.383144][T15382] usb 5-1: reset high-speed USB device number 20 using dummy_hcd [ 420.424712][ T10] usb 8-1: new high-speed USB device number 50 using dummy_hcd [ 420.578718][ T10] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 420.580912][ T10] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 420.588691][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 420.588762][ T10] usb 8-1: Product: syz [ 420.588776][ T10] usb 8-1: Manufacturer: syz [ 420.588789][ T10] usb 8-1: SerialNumber: syz [ 420.736068][ C0] usblp0: nonzero read bulk status received: -71 [ 420.806235][ T10] usblp 8-1:1.0: usblp1: USB Unidirectional printer dev 50 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 420.998525][ T10] usb 5-1: USB disconnect, device number 20 [ 421.001187][ T10] usblp0: removed [ 421.014573][T12294] usb 8-1: USB disconnect, device number 50 [ 421.268984][T12294] usblp1: removed [ 421.990349][T15410] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 421.997066][T15410] pci 0000:00:01.0: BAR 0 [mem 0x81000000-0x81ffffff pref] [ 421.997196][T15410] pci 0000:00:01.0: BAR 2 [mem 0x80001000-0x80001fff] [ 421.997425][T15410] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 421.998260][T15410] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 422.008430][T15410] pci 0000:00:01.0: Adding to iommu group 1 [ 422.010704][T15410] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 422.010715][T15410] pci 0000:00:01.0: vgaarb: bridge control possible [ 422.010721][T15410] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 422.014433][T15410] pci 0000:00:03.0: [1af4:1005] type 00 class 0x00ff00 conventional PCI endpoint [ 422.019630][T15410] pci 0000:00:03.0: BAR 0 [io 0x2000-0x201f] [ 422.019701][T15410] pci 0000:00:03.0: BAR 1 [mem 0x80000000-0x80000fff] [ 422.019885][T15410] pci 0000:00:03.0: BAR 4 [mem 0x580000000-0x580003fff 64bit pref] [ 422.032414][T15410] pci 0000:00:03.0: Adding to iommu group 3 [ 422.050637][T15410] pci 0000:00:01.0: BAR 0 [mem 0x81000000-0x81ffffff pref]: assigned [ 422.050784][T15410] pci 0000:00:03.0: BAR 4 [mem 0x580000000-0x580003fff 64bit pref]: assigned [ 422.053630][T15410] pci 0000:00:01.0: BAR 2 [mem 0x80000000-0x80000fff]: assigned [ 422.055007][T15410] pci 0000:00:03.0: BAR 1 [mem 0x80001000-0x80001fff]: assigned [ 422.056443][T15410] pci 0000:00:03.0: BAR 0 [io 0x2000-0x201f]: assigned [ 422.058655][T15410] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 422.070155][T15410] [drm] Found bochs VGA, ID 0xb0c5. [ 422.070166][T15410] [drm] Framebuffer size 16384 kB @ 0x81000000, mmio @ 0x80000000. [ 422.088157][T15410] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 422.166740][T15416] netlink: 145 bytes leftover after parsing attributes in process `syz.2.2748'. [ 422.234865][T15410] Console: switching to colour frame buffer device 160x50 [ 422.302378][T15410] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 423.011200][T15425] tipc: Enabling of bearer rejected, failed to enable media [ 425.014531][ T25] usb 8-1: new high-speed USB device number 51 using dummy_hcd [ 425.168044][ T25] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 425.174171][ T25] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 425.186425][ T25] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 425.186440][ T25] usb 8-1: Product: syz [ 425.186447][ T25] usb 8-1: Manufacturer: syz [ 425.186455][ T25] usb 8-1: SerialNumber: syz [ 425.615001][ T25] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 51 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 425.928098][T15481] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 425.928116][T15481] overlayfs: missing 'lowerdir' [ 426.241969][ T25] usb 8-1: USB disconnect, device number 51 [ 426.243370][ T25] usblp0: removed [ 429.504449][T12294] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 429.655655][T12294] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 429.659723][T12294] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 429.673399][T12294] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 429.673414][T12294] usb 6-1: Product: syz [ 429.673421][T12294] usb 6-1: Manufacturer: syz [ 429.673492][T12294] usb 6-1: SerialNumber: syz [ 430.132243][T12294] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 45 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 430.702025][ T9] usb 6-1: USB disconnect, device number 45 [ 430.724471][ T9] usblp0: removed [ 430.727520][T15537] FAULT_INJECTION: forcing a failure. [ 430.727520][T15537] name failslab, interval 1, probability 0, space 0, times 0 [ 430.727540][T15537] CPU: 0 UID: 0 PID: 15537 Comm: syz.3.2775 Tainted: G L syzkaller #0 PREEMPT(full) [ 430.727555][T15537] Tainted: [L]=SOFTLOCKUP [ 430.727559][T15537] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 430.727566][T15537] Call Trace: [ 430.727570][T15537] [ 430.727575][T15537] dump_stack_lvl+0x100/0x190 [ 430.727642][T15537] should_fail_ex.cold+0x5/0xa [ 430.727657][T15537] should_failslab+0xc2/0x120 [ 430.727692][T15537] __kmalloc_cache_noprof+0x91/0x6d0 [ 430.727710][T15537] ? copy_mount_options+0x55/0x190 [ 430.727729][T15537] copy_mount_options+0x55/0x190 [ 430.727747][T15537] __ia32_sys_mount+0x1ab/0x310 [ 430.727762][T15537] ? __pfx___ia32_sys_mount+0x10/0x10 [ 430.727777][T15537] ? ksys_write+0x1ac/0x250 [ 430.727788][T15537] ? __pfx_ksys_write+0x10/0x10 [ 430.727802][T15537] __do_fast_syscall_32+0x13a/0x8b0 [ 430.727838][T15537] ? lockdep_hardirqs_on+0x7d/0x110 [ 430.727856][T15537] do_fast_syscall_32+0x32/0x70 [ 430.727873][T15537] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 430.727887][T15537] RIP: 0023:0xf709efec [ 430.727900][T15537] Code: Unable to access opcode bytes at 0xf709efc2. [ 430.727905][T15537] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 430.727917][T15537] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000140 [ 430.727924][T15537] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 00000000800001c0 [ 430.727931][T15537] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 430.727938][T15537] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 430.727944][T15537] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 430.727957][T15537] [ 431.075750][T15548] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2777'. [ 431.117908][T12305] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.476705][T15563] Invalid option length (149) for dns_resolver key [ 431.606702][T15571] FAULT_INJECTION: forcing a failure. [ 431.606702][T15571] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 431.606735][T15571] CPU: 2 UID: 0 PID: 15571 Comm: syz.1.2786 Tainted: G L syzkaller #0 PREEMPT(full) [ 431.606761][T15571] Tainted: [L]=SOFTLOCKUP [ 431.606770][T15571] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 431.606781][T15571] Call Trace: [ 431.606788][T15571] [ 431.606797][T15571] dump_stack_lvl+0x100/0x190 [ 431.606825][T15571] should_fail_ex.cold+0x5/0xa [ 431.606850][T15571] _copy_from_user+0x2e/0xd0 [ 431.606874][T15571] copy_mount_options+0x76/0x190 [ 431.606902][T15571] __ia32_sys_mount+0x1ab/0x310 [ 431.606929][T15571] ? __pfx___ia32_sys_mount+0x10/0x10 [ 431.606954][T15571] ? ksys_write+0x1ac/0x250 [ 431.606972][T15571] ? __pfx_ksys_write+0x10/0x10 [ 431.606998][T15571] __do_fast_syscall_32+0x13a/0x8b0 [ 431.607025][T15571] ? lockdep_hardirqs_on+0x7d/0x110 [ 431.607055][T15571] do_fast_syscall_32+0x32/0x70 [ 431.607084][T15571] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 431.607108][T15571] RIP: 0023:0xf704efec [ 431.607129][T15571] Code: Unable to access opcode bytes at 0xf704efc2. [ 431.607138][T15571] RSP: 002b:00000000f543d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 431.607156][T15571] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000140 [ 431.607168][T15571] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 00000000800001c0 [ 431.607180][T15571] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 431.607190][T15571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 431.607200][T15571] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 431.607223][T15571] [ 432.749594][T15583] syzkaller0: entered promiscuous mode [ 432.749609][T15583] syzkaller0: entered allmulticast mode [ 432.763646][T15585] loop5: detected capacity change from 0 to 4095 [ 432.779972][ T5756] Buffer I/O error on dev loop5, logical block 511, async page read [ 432.794105][ T62] usb 8-1: new high-speed USB device number 52 using dummy_hcd [ 432.874047][T12534] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 432.952458][T15593] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 432.958148][ T62] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 432.961228][ T62] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 432.961243][ T62] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 432.961254][ T62] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 432.963011][ T62] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.963029][ T62] usb 8-1: Product: syz [ 432.963036][ T62] usb 8-1: Manufacturer: syz [ 432.963044][ T62] usb 8-1: SerialNumber: syz [ 432.969455][ T62] hub 8-1:1.0: bad descriptor, ignoring hub [ 432.969467][ T62] hub 8-1:1.0: probe with driver hub failed with error -5 [ 432.974378][T15593] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2794'. [ 433.037236][T12534] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 433.038468][T12534] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 433.040376][T12534] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 433.040397][T12534] usb 7-1: Product: syz [ 433.040412][T12534] usb 7-1: Manufacturer: syz [ 433.040425][T12534] usb 7-1: SerialNumber: syz [ 433.172723][ T62] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 52 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 433.269286][T12534] usblp 7-1:1.0: usblp1: USB Unidirectional printer dev 28 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 433.374149][T12534] libceph: connect (1)[c::]:6789 error -101 [ 433.374244][T12534] libceph: mon0 (1)[c::]:6789 connect error [ 433.425259][T12534] libceph: connect (1)[c::]:6789 error -101 [ 433.425353][T12534] libceph: mon0 (1)[c::]:6789 connect error [ 433.758970][T12536] libceph: connect (1)[c::]:6789 error -101 [ 433.759127][T12536] libceph: mon0 (1)[c::]:6789 connect error [ 433.759572][T12536] libceph: connect (1)[c::]:6789 error -101 [ 433.759709][T12536] libceph: mon0 (1)[c::]:6789 connect error [ 433.875370][T15608] FAULT_INJECTION: forcing a failure. [ 433.875370][T15608] name failslab, interval 1, probability 0, space 0, times 0 [ 433.875399][T15608] CPU: 2 UID: 0 PID: 15608 Comm: syz.1.2796 Tainted: G L syzkaller #0 PREEMPT(full) [ 433.875419][T15608] Tainted: [L]=SOFTLOCKUP [ 433.875424][T15608] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 433.875433][T15608] Call Trace: [ 433.875438][T15608] [ 433.875444][T15608] dump_stack_lvl+0x100/0x190 [ 433.875469][T15608] should_fail_ex.cold+0x5/0xa [ 433.875490][T15608] should_failslab+0xc2/0x120 [ 433.875510][T15608] kmem_cache_alloc_noprof+0x92/0x6a0 [ 433.875529][T15608] ? do_getname+0x35/0x390 [ 433.875554][T15608] do_getname+0x35/0x390 [ 433.875577][T15608] user_path_at+0x26/0x60 [ 433.875598][T15608] __ia32_sys_mount+0x1fb/0x310 [ 433.875646][T15608] ? __pfx___ia32_sys_mount+0x10/0x10 [ 433.875671][T15608] ? ksys_write+0x1ac/0x250 [ 433.875689][T15608] ? __pfx_ksys_write+0x10/0x10 [ 433.875719][T15608] __do_fast_syscall_32+0x13a/0x8b0 [ 433.875746][T15608] ? lockdep_hardirqs_on+0x7d/0x110 [ 433.875769][T15608] do_fast_syscall_32+0x32/0x70 [ 433.875792][T15608] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 433.875811][T15608] RIP: 0023:0xf704efec [ 433.875828][T15608] Code: Unable to access opcode bytes at 0xf704efc2. [ 433.875835][T15608] RSP: 002b:00000000f543d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 433.875850][T15608] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000140 [ 433.875860][T15608] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 00000000800001c0 [ 433.875869][T15608] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 433.875878][T15608] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 433.875888][T15608] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 433.875911][T15608] [ 433.971757][T15612] FAULT_INJECTION: forcing a failure. [ 433.971757][T15612] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 433.971783][T15612] CPU: 2 UID: 0 PID: 15612 Comm: syz.0.2806 Tainted: G L syzkaller #0 PREEMPT(full) [ 433.971807][T15612] Tainted: [L]=SOFTLOCKUP [ 433.971814][T15612] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 433.971824][T15612] Call Trace: [ 433.971831][T15612] [ 433.971840][T15612] dump_stack_lvl+0x100/0x190 [ 433.971867][T15612] should_fail_ex.cold+0x5/0xa [ 433.971885][T15612] strncpy_from_user+0x3b/0x2d0 [ 433.971902][T15612] do_getname+0x78/0x390 [ 433.971919][T15612] user_path_at+0x26/0x60 [ 433.971931][T15612] __ia32_sys_mount+0x1fb/0x310 [ 433.971947][T15612] ? __pfx___ia32_sys_mount+0x10/0x10 [ 433.971961][T15612] ? ksys_write+0x1ac/0x250 [ 433.971972][T15612] ? __pfx_ksys_write+0x10/0x10 [ 433.971986][T15612] __do_fast_syscall_32+0x13a/0x8b0 [ 433.972004][T15612] ? lockdep_hardirqs_on+0x7d/0x110 [ 433.972020][T15612] do_fast_syscall_32+0x32/0x70 [ 433.972038][T15612] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 433.972052][T15612] RIP: 0023:0xf7f03fec [ 433.972065][T15612] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 433.972070][T15612] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 433.972081][T15612] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000140 [ 433.972088][T15612] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 00000000800001c0 [ 433.972094][T15612] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 433.972101][T15612] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 433.972107][T15612] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 433.972120][T15612] [ 434.184123][T15577] usb 8-1: reset high-speed USB device number 52 using dummy_hcd [ 434.337705][T15577] usb 8-1: device firmware changed [ 434.406800][ T5824] usb 7-1: USB disconnect, device number 28 [ 434.525394][ T5824] usblp1: removed [ 434.992245][T12534] usb 8-1: USB disconnect, device number 52 [ 435.552828][T15580] ceph: No mds server is up or the cluster is laggy [ 435.553009][T15597] ceph: No mds server is up or the cluster is laggy [ 435.737940][ T25] libceph: connect (1)[c::]:6789 error -101 [ 435.738093][ T25] libceph: mon0 (1)[c::]:6789 connect error [ 435.738223][T12534] usblp0: removed [ 435.739001][ T25] libceph: connect (1)[c::]:6789 error -101 [ 435.739127][ T25] libceph: mon0 (1)[c::]:6789 connect error [ 435.928079][T15635] null_blk: nullb1: using native zone append [ 435.969122][T15635] null_blk: disk nullb1 created [ 436.008806][T15641] FAULT_INJECTION: forcing a failure. [ 436.008806][T15641] name failslab, interval 1, probability 0, space 0, times 0 [ 436.008829][T15641] CPU: 2 UID: 0 PID: 15641 Comm: syz.2.2809 Tainted: G L syzkaller #0 PREEMPT(full) [ 436.008845][T15641] Tainted: [L]=SOFTLOCKUP [ 436.008849][T15641] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 436.008856][T15641] Call Trace: [ 436.008860][T15641] [ 436.008864][T15641] dump_stack_lvl+0x100/0x190 [ 436.008882][T15641] should_fail_ex.cold+0x5/0xa [ 436.008897][T15641] should_failslab+0xc2/0x120 [ 436.008912][T15641] __kmalloc_noprof+0xfc/0x840 [ 436.008925][T15641] ? tomoyo_encode2+0xfb/0x3c0 [ 436.008940][T15641] tomoyo_encode2+0xfb/0x3c0 [ 436.008952][T15641] tomoyo_encode+0x29/0x50 [ 436.008962][T15641] tomoyo_mount_acl+0x14c/0x8b0 [ 436.008979][T15641] ? is_bpf_text_address+0x8a/0x1a0 [ 436.008994][T15641] ? is_bpf_text_address+0x8a/0x1a0 [ 436.009011][T15641] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 436.009041][T15641] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 436.009058][T15641] ? kernel_text_address+0x8d/0x100 [ 436.009073][T15641] ? unwind_get_return_address+0x59/0xa0 [ 436.009087][T15641] ? arch_stack_walk+0xa6/0xf0 [ 436.009101][T15641] ? __lock_acquire+0x5c0/0x1f40 [ 436.009125][T15641] ? tomoyo_mount_permission+0x1f6/0x460 [ 436.009144][T15641] ? tomoyo_domain+0xb2/0x150 [ 436.009156][T15641] ? tomoyo_profile+0x47/0x60 [ 436.009170][T15641] tomoyo_mount_permission+0x214/0x460 [ 436.009187][T15641] ? tomoyo_mount_permission+0x1f6/0x460 [ 436.009205][T15641] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 436.009231][T15641] security_sb_mount+0xdd/0x270 [ 436.009246][T15641] path_mount+0x158/0x24c0 [ 436.009264][T15641] ? __pfx_path_mount+0x10/0x10 [ 436.009278][T15641] ? lockdep_hardirqs_on+0x7d/0x110 [ 436.009297][T15641] ? putname+0xb1/0x110 [ 436.009309][T15641] ? kmem_cache_free+0x127/0x6c0 [ 436.009331][T15641] ? __ia32_sys_mount+0x292/0x310 [ 436.009346][T15641] __ia32_sys_mount+0x292/0x310 [ 436.009361][T15641] ? __pfx___ia32_sys_mount+0x10/0x10 [ 436.009376][T15641] ? ksys_write+0x1ac/0x250 [ 436.009387][T15641] ? __pfx_ksys_write+0x10/0x10 [ 436.009402][T15641] __do_fast_syscall_32+0x13a/0x8b0 [ 436.009418][T15641] ? lockdep_hardirqs_on+0x7d/0x110 [ 436.009435][T15641] do_fast_syscall_32+0x32/0x70 [ 436.009453][T15641] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 436.009467][T15641] RIP: 0023:0xf7fb6fec [ 436.009480][T15641] Code: Unable to access opcode bytes at 0xf7fb6fc2. [ 436.009485][T15641] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 436.009496][T15641] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000140 [ 436.009503][T15641] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 00000000800001c0 [ 436.009509][T15641] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 436.009516][T15641] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 436.009522][T15641] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 436.009536][T15641] [ 436.118783][T15653] fuse: Bad value for 'fd' [ 436.903936][T12534] usb 8-1: new high-speed USB device number 54 using dummy_hcd [ 437.057061][T12534] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 437.062605][T12534] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 437.085880][T12534] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 437.085973][T12534] usb 8-1: Product: syz [ 437.086606][T12534] usb 8-1: Manufacturer: syz [ 437.086639][T12534] usb 8-1: SerialNumber: syz [ 437.392635][T15662] netlink: 'syz.2.2813': attribute type 1 has an invalid length. [ 437.496192][T15662] 8021q: adding VLAN 0 to HW filter on device bond1 [ 437.502030][T15662] bond0: (slave bond1): making interface the new active one [ 437.503211][T15662] bond0: (slave bond1): Enslaving as an active interface with an up link [ 437.520845][T15662] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2813'. [ 437.522508][T15665] bond0: (slave gretap1): Enslaving as a backup interface with an up link [ 437.522919][T15662] bond0: entered promiscuous mode [ 437.522928][T15662] bond1: entered promiscuous mode [ 437.533139][T15662] 8021q: adding VLAN 0 to HW filter on device bond0 [ 437.537359][T12534] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 54 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 438.195338][ T5824] usb 8-1: USB disconnect, device number 54 [ 438.203375][ T5824] usblp0: removed [ 438.372852][T15678] FAULT_INJECTION: forcing a failure. [ 438.372852][T15678] name failslab, interval 1, probability 0, space 0, times 0 [ 438.372876][T15678] CPU: 0 UID: 0 PID: 15678 Comm: syz.1.2818 Tainted: G L syzkaller #0 PREEMPT(full) [ 438.372891][T15678] Tainted: [L]=SOFTLOCKUP [ 438.372896][T15678] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 438.372902][T15678] Call Trace: [ 438.372906][T15678] [ 438.372911][T15678] dump_stack_lvl+0x100/0x190 [ 438.372929][T15678] should_fail_ex.cold+0x5/0xa [ 438.372944][T15678] should_failslab+0xc2/0x120 [ 438.372959][T15678] __kmalloc_noprof+0xfc/0x840 [ 438.372971][T15678] ? rcu_is_watching+0x13/0xc0 [ 438.372982][T15678] ? tomoyo_realpath_from_path+0xb6/0x690 [ 438.372998][T15678] tomoyo_realpath_from_path+0xb6/0x690 [ 438.373012][T15678] tomoyo_mount_acl+0x1b6/0x8b0 [ 438.373028][T15678] ? is_bpf_text_address+0x8a/0x1a0 [ 438.373044][T15678] ? is_bpf_text_address+0x8a/0x1a0 [ 438.373078][T15678] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 438.373094][T15678] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 438.373111][T15678] ? kernel_text_address+0x8d/0x100 [ 438.373125][T15678] ? unwind_get_return_address+0x59/0xa0 [ 438.373139][T15678] ? arch_stack_walk+0xa6/0xf0 [ 438.373153][T15678] ? __lock_acquire+0x5c0/0x1f40 [ 438.373174][T15678] ? tomoyo_mount_permission+0x1f6/0x460 [ 438.373193][T15678] ? tomoyo_domain+0xb2/0x150 [ 438.373206][T15678] ? tomoyo_profile+0x47/0x60 [ 438.373220][T15678] tomoyo_mount_permission+0x214/0x460 [ 438.373236][T15678] ? tomoyo_mount_permission+0x1f6/0x460 [ 438.373254][T15678] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 438.373280][T15678] security_sb_mount+0xdd/0x270 [ 438.373295][T15678] path_mount+0x158/0x24c0 [ 438.373313][T15678] ? __pfx_path_mount+0x10/0x10 [ 438.373327][T15678] ? lockdep_hardirqs_on+0x7d/0x110 [ 438.373345][T15678] ? putname+0xb1/0x110 [ 438.373358][T15678] ? kmem_cache_free+0x127/0x6c0 [ 438.373379][T15678] ? __ia32_sys_mount+0x292/0x310 [ 438.373394][T15678] __ia32_sys_mount+0x292/0x310 [ 438.373409][T15678] ? __pfx___ia32_sys_mount+0x10/0x10 [ 438.373424][T15678] ? ksys_write+0x1ac/0x250 [ 438.373435][T15678] ? __pfx_ksys_write+0x10/0x10 [ 438.373449][T15678] __do_fast_syscall_32+0x13a/0x8b0 [ 438.373466][T15678] ? lockdep_hardirqs_on+0x7d/0x110 [ 438.373482][T15678] do_fast_syscall_32+0x32/0x70 [ 438.373500][T15678] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 438.373514][T15678] RIP: 0023:0xf704efec [ 438.373526][T15678] Code: Unable to access opcode bytes at 0xf704efc2. [ 438.373531][T15678] RSP: 002b:00000000f543d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 438.373542][T15678] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000140 [ 438.373549][T15678] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 00000000800001c0 [ 438.373556][T15678] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 438.373562][T15678] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 438.373569][T15678] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 438.373582][T15678] [ 438.479749][T15678] ERROR: Out of memory at tomoyo_realpath_from_path. [ 438.618741][T15692] No such timeout policy "s" [ 438.618754][T15692] netlink: Failed to associated timeout policy 's' [ 439.150720][T15676] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 439.159468][T15676] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 439.175026][T15676] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 439.180143][T15676] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 439.180383][T15676] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 439.182546][T15676] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 439.191695][T15676] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 439.191737][T15676] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 439.196870][T15676] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 439.273291][T15722] FAULT_INJECTION: forcing a failure. [ 439.273291][T15722] name failslab, interval 1, probability 0, space 0, times 0 [ 439.273313][T15722] CPU: 3 UID: 0 PID: 15722 Comm: syz.3.2827 Tainted: G L syzkaller #0 PREEMPT(full) [ 439.273328][T15722] Tainted: [L]=SOFTLOCKUP [ 439.273333][T15722] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 439.273339][T15722] Call Trace: [ 439.273343][T15722] [ 439.273348][T15722] dump_stack_lvl+0x100/0x190 [ 439.273366][T15722] should_fail_ex.cold+0x5/0xa [ 439.273381][T15722] should_failslab+0xc2/0x120 [ 439.273396][T15722] __kmalloc_noprof+0xfc/0x840 [ 439.273412][T15722] ? tomoyo_encode2+0xfb/0x3c0 [ 439.273432][T15722] tomoyo_encode2+0xfb/0x3c0 [ 439.273451][T15722] tomoyo_encode+0x29/0x50 [ 439.273467][T15722] tomoyo_realpath_from_path+0x18c/0x690 [ 439.273492][T15722] tomoyo_mount_acl+0x1b6/0x8b0 [ 439.273517][T15722] ? is_bpf_text_address+0x8a/0x1a0 [ 439.273540][T15722] ? is_bpf_text_address+0x8a/0x1a0 [ 439.273582][T15722] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 439.273603][T15722] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 439.273628][T15722] ? kernel_text_address+0x8d/0x100 [ 439.273652][T15722] ? unwind_get_return_address+0x59/0xa0 [ 439.273674][T15722] ? arch_stack_walk+0xa6/0xf0 [ 439.273696][T15722] ? __lock_acquire+0x5c0/0x1f40 [ 439.273729][T15722] ? tomoyo_mount_permission+0x1f6/0x460 [ 439.273758][T15722] ? tomoyo_domain+0xb2/0x150 [ 439.273778][T15722] ? tomoyo_profile+0x47/0x60 [ 439.273801][T15722] tomoyo_mount_permission+0x214/0x460 [ 439.273828][T15722] ? tomoyo_mount_permission+0x1f6/0x460 [ 439.273858][T15722] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 439.273901][T15722] security_sb_mount+0xdd/0x270 [ 439.273927][T15722] path_mount+0x158/0x24c0 [ 439.273956][T15722] ? __pfx_path_mount+0x10/0x10 [ 439.273980][T15722] ? lockdep_hardirqs_on+0x7d/0x110 [ 439.274010][T15722] ? putname+0xb1/0x110 [ 439.274031][T15722] ? kmem_cache_free+0x127/0x6c0 [ 439.274067][T15722] ? __ia32_sys_mount+0x292/0x310 [ 439.274096][T15722] __ia32_sys_mount+0x292/0x310 [ 439.274120][T15722] ? __pfx___ia32_sys_mount+0x10/0x10 [ 439.274144][T15722] ? ksys_write+0x1ac/0x250 [ 439.274163][T15722] ? __pfx_ksys_write+0x10/0x10 [ 439.274187][T15722] __do_fast_syscall_32+0x13a/0x8b0 [ 439.274214][T15722] ? lockdep_hardirqs_on+0x7d/0x110 [ 439.274242][T15722] do_fast_syscall_32+0x32/0x70 [ 439.274270][T15722] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 439.274292][T15722] RIP: 0023:0xf709efec [ 439.274313][T15722] Code: Unable to access opcode bytes at 0xf709efc2. [ 439.274322][T15722] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 439.274340][T15722] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000140 [ 439.274352][T15722] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 00000000800001c0 [ 439.274362][T15722] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 439.274372][T15722] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 439.274385][T15722] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 439.274422][T15722] [ 439.274712][T15722] ERROR: Out of memory at tomoyo_realpath_from_path. [ 439.525783][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.173638][T12534] usb 8-1: new high-speed USB device number 55 using dummy_hcd [ 440.259029][T15744] netlink: 'syz.0.2832': attribute type 5 has an invalid length. [ 440.259058][T15744] netlink: 'syz.0.2832': attribute type 1 has an invalid length. [ 440.259073][T15744] nbd: couldn't find device at index 65544 [ 440.331154][T12534] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 440.332009][T12534] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 440.333646][T12534] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 440.333659][T12534] usb 8-1: Product: syz [ 440.333666][T12534] usb 8-1: Manufacturer: syz [ 440.333673][T12534] usb 8-1: SerialNumber: syz [ 440.485176][ T5752] Bluetooth: hci2: command 0x0405 tx timeout [ 440.525114][T15752] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2835'. [ 440.550555][T12534] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 55 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 440.703704][ T5887] usb 7-1: new full-speed USB device number 29 using dummy_hcd [ 440.720286][T15749] netlink: 'syz.2.2834': attribute type 10 has an invalid length. [ 440.720513][T15749] macvlan1: entered promiscuous mode [ 440.720524][T15749] macvlan1: entered allmulticast mode [ 440.753080][ T854] usb 8-1: USB disconnect, device number 55 [ 440.760715][ T854] usblp0: removed [ 440.784195][T12294] usb 5-1: new low-speed USB device number 21 using dummy_hcd [ 440.905756][T15755] FAULT_INJECTION: forcing a failure. [ 440.905756][T15755] name failslab, interval 1, probability 0, space 0, times 0 [ 440.905786][T15755] CPU: 3 UID: 0 PID: 15755 Comm: syz.1.2836 Tainted: G L syzkaller #0 PREEMPT(full) [ 440.905811][T15755] Tainted: [L]=SOFTLOCKUP [ 440.905817][T15755] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 440.905828][T15755] Call Trace: [ 440.905834][T15755] [ 440.905842][T15755] dump_stack_lvl+0x100/0x190 [ 440.905870][T15755] should_fail_ex.cold+0x5/0xa [ 440.905894][T15755] should_failslab+0xc2/0x120 [ 440.905918][T15755] __kmalloc_noprof+0xfc/0x840 [ 440.905948][T15755] ? tomoyo_encode2+0xfb/0x3c0 [ 440.905972][T15755] tomoyo_encode2+0xfb/0x3c0 [ 440.905991][T15755] ? __get_fs_type+0xe3/0x200 [ 440.906017][T15755] tomoyo_encode+0x29/0x50 [ 440.906034][T15755] tomoyo_mount_acl+0x388/0x8b0 [ 440.906061][T15755] ? is_bpf_text_address+0x8a/0x1a0 [ 440.906084][T15755] ? is_bpf_text_address+0x8a/0x1a0 [ 440.906111][T15755] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 440.906135][T15755] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 440.906161][T15755] ? kernel_text_address+0x8d/0x100 [ 440.906185][T15755] ? unwind_get_return_address+0x59/0xa0 [ 440.906207][T15755] ? arch_stack_walk+0xa6/0xf0 [ 440.906229][T15755] ? __lock_acquire+0x5c0/0x1f40 [ 440.906265][T15755] ? tomoyo_mount_permission+0x1f6/0x460 [ 440.906295][T15755] ? tomoyo_domain+0xb2/0x150 [ 440.906314][T15755] ? tomoyo_profile+0x47/0x60 [ 440.906336][T15755] tomoyo_mount_permission+0x214/0x460 [ 440.906362][T15755] ? tomoyo_mount_permission+0x1f6/0x460 [ 440.906392][T15755] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 440.906469][T15755] security_sb_mount+0xdd/0x270 [ 440.906495][T15755] path_mount+0x158/0x24c0 [ 440.906523][T15755] ? __pfx_path_mount+0x10/0x10 [ 440.906546][T15755] ? lockdep_hardirqs_on+0x7d/0x110 [ 440.906576][T15755] ? putname+0xb1/0x110 [ 440.906596][T15755] ? kmem_cache_free+0x127/0x6c0 [ 440.906633][T15755] ? __ia32_sys_mount+0x292/0x310 [ 440.906656][T15755] __ia32_sys_mount+0x292/0x310 [ 440.906681][T15755] ? __pfx___ia32_sys_mount+0x10/0x10 [ 440.906705][T15755] ? ksys_write+0x1ac/0x250 [ 440.906723][T15755] ? __pfx_ksys_write+0x10/0x10 [ 440.906746][T15755] __do_fast_syscall_32+0x13a/0x8b0 [ 440.906773][T15755] ? lockdep_hardirqs_on+0x7d/0x110 [ 440.906800][T15755] do_fast_syscall_32+0x32/0x70 [ 440.906826][T15755] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 440.906849][T15755] RIP: 0023:0xf704efec [ 440.906869][T15755] Code: Unable to access opcode bytes at 0xf704efc2. [ 440.906877][T15755] RSP: 002b:00000000f543d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 440.906895][T15755] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000140 [ 440.906906][T15755] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 00000000800001c0 [ 440.906917][T15755] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 440.906928][T15755] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 440.906938][T15755] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 440.906961][T15755] [ 440.944339][T12294] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 440.945232][T12294] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 440.945267][T12294] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 440.945287][T12294] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 440.945307][T12294] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 440.945327][T12294] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 440.946184][T12294] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 440.946216][T12294] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 440.946236][T12294] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 440.946255][T12294] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 440.946275][T12294] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 440.947249][T12294] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 440.947282][T12294] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 440.947302][T12294] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 440.947321][T12294] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 440.947341][T12294] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 440.950053][T12294] usb 5-1: string descriptor 0 read error: -22 [ 440.950149][T12294] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.962591][T12294] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 441.206367][T12294] usb 5-1: USB disconnect, device number 21 [ 441.213909][ T5752] Bluetooth: hci3: command 0x0c1a tx timeout [ 441.213956][ T5752] Bluetooth: hci1: command 0x0c1a tx timeout [ 441.239912][T15765] 9pnet_virtio: no channels available for device syz [ 441.539309][T15781] FAULT_INJECTION: forcing a failure. [ 441.539309][T15781] name failslab, interval 1, probability 0, space 0, times 0 [ 441.539339][T15781] CPU: 2 UID: 0 PID: 15781 Comm: syz.2.2845 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.539362][T15781] Tainted: [L]=SOFTLOCKUP [ 441.539369][T15781] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 441.539379][T15781] Call Trace: [ 441.539384][T15781] [ 441.539392][T15781] dump_stack_lvl+0x100/0x190 [ 441.539417][T15781] should_fail_ex.cold+0x5/0xa [ 441.539438][T15781] should_failslab+0xc2/0x120 [ 441.539461][T15781] __kmalloc_cache_noprof+0x91/0x6d0 [ 441.539485][T15781] ? find_held_lock+0x2b/0x80 [ 441.539503][T15781] ? alloc_fs_context+0x57/0xf40 [ 441.539529][T15781] alloc_fs_context+0x57/0xf40 [ 441.539549][T15781] ? __get_fs_type+0xe3/0x200 [ 441.539573][T15781] path_mount+0xdbd/0x24c0 [ 441.539598][T15781] ? __pfx_path_mount+0x10/0x10 [ 441.539619][T15781] ? lockdep_hardirqs_on+0x7d/0x110 [ 441.539644][T15781] ? putname+0xb1/0x110 [ 441.539662][T15781] ? kmem_cache_free+0x127/0x6c0 [ 441.539694][T15781] ? __ia32_sys_mount+0x292/0x310 [ 441.539715][T15781] __ia32_sys_mount+0x292/0x310 [ 441.539737][T15781] ? __pfx___ia32_sys_mount+0x10/0x10 [ 441.539758][T15781] ? ksys_write+0x1ac/0x250 [ 441.539774][T15781] ? __pfx_ksys_write+0x10/0x10 [ 441.539794][T15781] __do_fast_syscall_32+0x13a/0x8b0 [ 441.539818][T15781] ? lockdep_hardirqs_on+0x7d/0x110 [ 441.539843][T15781] do_fast_syscall_32+0x32/0x70 [ 441.539867][T15781] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 441.539888][T15781] RIP: 0023:0xf7fb6fec [ 441.539911][T15781] Code: Unable to access opcode bytes at 0xf7fb6fc2. [ 441.539918][T15781] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 441.539935][T15781] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000140 [ 441.539946][T15781] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 00000000800001c0 [ 441.539956][T15781] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 441.539966][T15781] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 441.539976][T15781] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 441.540003][T15781] [ 441.605643][ T43] audit: type=1800 audit(1789889016.295:4777): pid=15775 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2843" name="blkio.bfq.time_recursive" dev="tmpfs" ino=252 res=0 errno=0 [ 442.294421][T12534] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 442.535189][T12534] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 442.536752][T12534] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 442.540426][T12534] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 442.540517][T12534] usb 7-1: Product: syz [ 442.540560][T12534] usb 7-1: Manufacturer: syz [ 442.540606][T12534] usb 7-1: SerialNumber: syz [ 442.563513][ T5102] Bluetooth: hci2: command 0x0405 tx timeout [ 442.900454][T12534] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 30 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 442.968597][T12534] usb 7-1: USB disconnect, device number 30 [ 443.025841][T12534] usblp0: removed [ 443.237310][T15807] netlink: 'syz.1.2851': attribute type 1 has an invalid length. [ 443.274455][T15807] bond1: entered promiscuous mode [ 443.274631][T15807] 8021q: adding VLAN 0 to HW filter on device bond1 [ 443.283756][ T5102] Bluetooth: hci1: command 0x0c1a tx timeout [ 443.283780][ T5102] Bluetooth: hci3: command 0x0c1a tx timeout [ 443.387125][T15813] FAULT_INJECTION: forcing a failure. [ 443.387125][T15813] name failslab, interval 1, probability 0, space 0, times 0 [ 443.387159][T15813] CPU: 3 UID: 0 PID: 15813 Comm: syz.0.2854 Tainted: G L syzkaller #0 PREEMPT(full) [ 443.387184][T15813] Tainted: [L]=SOFTLOCKUP [ 443.387191][T15813] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 443.387202][T15813] Call Trace: [ 443.387209][T15813] [ 443.387216][T15813] dump_stack_lvl+0x100/0x190 [ 443.387246][T15813] should_fail_ex.cold+0x5/0xa [ 443.387270][T15813] should_failslab+0xc2/0x120 [ 443.387296][T15813] __kmalloc_cache_noprof+0x91/0x6d0 [ 443.387340][T15813] ? kasan_save_track+0x14/0x30 [ 443.387364][T15813] ? nfs_init_fs_context+0x4f/0x1510 [ 443.387394][T15813] nfs_init_fs_context+0x4f/0x1510 [ 443.387422][T15813] alloc_fs_context+0x60c/0xf40 [ 443.387457][T15813] path_mount+0xdbd/0x24c0 [ 443.387487][T15813] ? __pfx_path_mount+0x10/0x10 [ 443.387511][T15813] ? lockdep_hardirqs_on+0x7d/0x110 [ 443.387541][T15813] ? putname+0xb1/0x110 [ 443.387562][T15813] ? kmem_cache_free+0x127/0x6c0 [ 443.387598][T15813] ? __ia32_sys_mount+0x292/0x310 [ 443.387622][T15813] __ia32_sys_mount+0x292/0x310 [ 443.387647][T15813] ? __pfx___ia32_sys_mount+0x10/0x10 [ 443.387671][T15813] ? ksys_write+0x1ac/0x250 [ 443.387689][T15813] ? __pfx_ksys_write+0x10/0x10 [ 443.387713][T15813] __do_fast_syscall_32+0x13a/0x8b0 [ 443.387741][T15813] ? lockdep_hardirqs_on+0x7d/0x110 [ 443.387767][T15813] do_fast_syscall_32+0x32/0x70 [ 443.387795][T15813] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 443.387818][T15813] RIP: 0023:0xf7f03fec [ 443.387837][T15813] Code: Unable to access opcode bytes at 0xf7f03fc2. [ 443.387846][T15813] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 443.387866][T15813] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000140 [ 443.387878][T15813] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 00000000800001c0 [ 443.387890][T15813] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 443.387901][T15813] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 443.387912][T15813] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 443.387936][T15813] [ 443.583240][T15817] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 443.643825][T15817] md: couldn't update array info. -22 [ 443.831375][T15831] md: recover of RAID array md0 [ 443.862698][T15831] md: md0: recover done. [ 444.329662][T15852] FAULT_INJECTION: forcing a failure. [ 444.329662][T15852] name failslab, interval 1, probability 0, space 0, times 0 [ 444.329693][T15852] CPU: 0 UID: 0 PID: 15852 Comm: syz.3.2864 Tainted: G L syzkaller #0 PREEMPT(full) [ 444.329716][T15852] Tainted: [L]=SOFTLOCKUP [ 444.329723][T15852] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 444.329733][T15852] Call Trace: [ 444.329739][T15852] [ 444.329746][T15852] dump_stack_lvl+0x100/0x190 [ 444.329772][T15852] should_fail_ex.cold+0x5/0xa [ 444.329794][T15852] should_failslab+0xc2/0x120 [ 444.329817][T15852] __kmalloc_cache_noprof+0x91/0x6d0 [ 444.329842][T15852] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 444.329866][T15852] ? nfs_alloc_fhandle+0x3b/0x90 [ 444.329889][T15852] nfs_alloc_fhandle+0x3b/0x90 [ 444.329905][T15852] nfs_init_fs_context+0x65/0x1510 [ 444.329930][T15852] alloc_fs_context+0x60c/0xf40 [ 444.329957][T15852] path_mount+0xdbd/0x24c0 [ 444.329983][T15852] ? __pfx_path_mount+0x10/0x10 [ 444.330003][T15852] ? lockdep_hardirqs_on+0x7d/0x110 [ 444.330030][T15852] ? putname+0xb1/0x110 [ 444.330049][T15852] ? kmem_cache_free+0x127/0x6c0 [ 444.330086][T15852] ? __ia32_sys_mount+0x292/0x310 [ 444.330107][T15852] __ia32_sys_mount+0x292/0x310 [ 444.330146][T15852] ? __pfx___ia32_sys_mount+0x10/0x10 [ 444.330168][T15852] ? ksys_write+0x1ac/0x250 [ 444.330186][T15852] ? __pfx_ksys_write+0x10/0x10 [ 444.330207][T15852] __do_fast_syscall_32+0x13a/0x8b0 [ 444.330232][T15852] ? lockdep_hardirqs_on+0x7d/0x110 [ 444.330256][T15852] do_fast_syscall_32+0x32/0x70 [ 444.330281][T15852] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 444.330302][T15852] RIP: 0023:0xf709efec [ 444.330321][T15852] Code: Unable to access opcode bytes at 0xf709efc2. [ 444.330330][T15852] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 444.330347][T15852] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000140 [ 444.330358][T15852] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 00000000800001c0 [ 444.330369][T15852] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 444.330397][T15852] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 444.330409][T15852] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 444.330430][T15852] [ 444.643999][ T5752] Bluetooth: hci2: command 0x0405 tx timeout [ 445.363299][ T5752] Bluetooth: hci3: command 0x0c1a tx timeout [ 445.363323][ T5752] Bluetooth: hci1: command 0x0c1a tx timeout [ 445.583721][T12537] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 445.630597][ T43] audit: type=1326 audit(1789889020.365:4778): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15882 comm="syz.0.2870" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f03fec code=0x0 [ 445.725972][T15892] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 445.739028][T15892] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2869'. [ 445.747618][T12537] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 445.748797][T12537] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 445.757001][T12537] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 445.757022][T12537] usb 6-1: Product: syz [ 445.757034][T12537] usb 6-1: Manufacturer: syz [ 445.757046][T12537] usb 6-1: SerialNumber: syz [ 445.796346][T15891] smpboot: CPU 3 is now offline [ 445.874129][T15894] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 445.938395][T15894] smpboot: Booting Node 0 Processor 3 APIC 0x3 [ 445.942399][T15896] 9pnet_virtio: no channels available for device syz [ 445.967704][T12537] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 46 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 445.977026][T15899] syzkaller0: left promiscuous mode [ 445.977039][T15899] syzkaller0: left allmulticast mode [ 446.170774][T12536] usb 6-1: USB disconnect, device number 46 [ 446.175437][T12536] usblp0: removed [ 446.224247][T13062] syz_tun (unregistering): left allmulticast mode [ 446.594511][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.594542][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.695406][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.695429][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.777866][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.777888][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.853375][ T5752] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 446.864650][ T5752] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 446.866339][ T5752] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 446.869229][ T5752] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 446.869821][ T5752] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 446.916362][T15911] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2878'. [ 447.100850][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.100884][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.120908][T15911] netlink: 'syz.1.2878': attribute type 2 has an invalid length. [ 447.327640][ T12] bridge_slave_1: left allmulticast mode [ 447.327664][ T12] bridge_slave_1: left promiscuous mode [ 447.331224][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.344719][ T12] bridge_slave_0: left allmulticast mode [ 447.344766][ T12] bridge_slave_0: left promiscuous mode [ 447.345047][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.380119][T15925] 9pnet_virtio: no channels available for device syz [ 447.463238][ T5844] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 447.564278][ T12] bond0 (unregistering): (slave gretap1): Releasing backup interface [ 447.618566][ T12] bond0 (unregistering): (slave bond1): Releasing backup interface [ 447.618591][ T12] bond1 (unregistering): left promiscuous mode [ 447.619394][ T12] bond0 (unregistering): Released all slaves [ 447.629129][ T12] bond1 (unregistering): Released all slaves [ 447.633785][ T5844] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 447.635645][ T5844] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 447.635706][ T5844] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 447.635765][ T5844] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 447.635821][ T5844] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.732489][ T12] tipc: Left network mode [ 447.747572][T15907] lo speed is unknown, defaulting to 1000 [ 447.757028][T15907] wlan0 speed is unknown, defaulting to 1000 [ 447.946830][ T5456] 8021q: adding VLAN 0 to HW filter on device eth2 [ 448.141347][T15919] Bluetooth: MGMT ver 1.23 [ 448.201767][ T5844] cxacru 5-1:1.0: send of cm 0x91 failed (-71) [ 448.201846][ T5844] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 448.201855][ T5844] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 448.202278][ T5456] 8021q: adding VLAN 0 to HW filter on device eth3 [ 448.275677][T15907] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.275805][T15907] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.275929][T15907] bridge_slave_0: entered allmulticast mode [ 448.278045][T15907] bridge_slave_0: entered promiscuous mode [ 448.283984][ T5844] cxacru 5-1:1.0: probe with driver cxacru failed with error -71 [ 448.290098][ T5844] usb 5-1: USB disconnect, device number 22 [ 448.342100][T15907] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.342462][T15907] bridge0: port 2(bridge_slave_1) entered disabled state [ 448.342886][T15907] bridge_slave_1: entered allmulticast mode [ 448.360820][T15907] bridge_slave_1: entered promiscuous mode [ 448.404384][T15907] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 448.422543][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 448.422617][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 448.425868][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 448.425952][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 448.456567][ T12] veth1_macvtap: left promiscuous mode [ 448.456674][ T12] veth0_macvtap: left promiscuous mode [ 448.457551][ T12] veth1_vlan: left promiscuous mode [ 448.457748][ T12] veth0_vlan: left promiscuous mode [ 448.542031][T15950] input: syz0 as /devices/virtual/input/input29 [ 448.800691][T15907] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 448.815056][T15907] team0: Port device team_slave_0 added [ 448.816341][T15907] team0: Port device team_slave_1 added [ 448.838011][T15907] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 448.838024][T15907] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 448.838037][T15907] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 448.838876][T15907] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 448.838884][T15907] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 448.838899][T15907] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 448.896663][T15907] hsr_slave_0: entered promiscuous mode [ 448.899420][T15907] hsr_slave_1: entered promiscuous mode [ 448.899708][T15907] debugfs: 'hsr0' already exists in 'hsr' [ 448.899719][T15907] Cannot create hsr debugfs directory [ 448.963727][ T5102] Bluetooth: hci0: command tx timeout [ 449.020929][ T5456] 8021q: adding VLAN 0 to HW filter on device eth4 [ 449.034444][T12521] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 449.064633][T15907] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 449.072860][T15907] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 449.074481][T15907] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 449.092370][T15907] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 449.093388][T15907] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 449.104597][T15907] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 449.105165][T15907] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 449.114383][T15907] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 449.141031][T15907] bridge0: port 2(bridge_slave_1) entered blocking state [ 449.141081][T15907] bridge0: port 2(bridge_slave_1) entered forwarding state [ 449.206302][T12521] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 449.208232][T12521] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 449.212953][T12521] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 449.212967][T12521] usb 6-1: Product: syz [ 449.212974][T12521] usb 6-1: Manufacturer: syz [ 449.212982][T12521] usb 6-1: SerialNumber: syz [ 449.375501][ T191] bridge0: port 2(bridge_slave_1) entered disabled state [ 449.553117][T12294] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 449.571451][T12521] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 47 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 449.704224][T12294] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 449.706498][T12294] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 449.710941][T12294] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 449.710984][T12294] usb 5-1: Product: syz [ 449.711054][T12294] usb 5-1: Manufacturer: syz [ 449.711120][T12294] usb 5-1: SerialNumber: syz [ 449.740461][T12521] usb 6-1: USB disconnect, device number 47 [ 449.830026][T12521] usblp0: removed [ 450.150166][T12294] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 23 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 450.319072][T12294] usb 5-1: USB disconnect, device number 23 [ 450.367137][T12294] usblp0: removed [ 450.381994][ T5456] 8021q: adding VLAN 0 to HW filter on device eth5 [ 450.385219][T15907] 8021q: adding VLAN 0 to HW filter on device bond0 [ 450.439719][T15907] 8021q: adding VLAN 0 to HW filter on device team0 [ 450.452261][T15988] 9pnet_fd: Insufficient options for proto=fd [ 450.508257][ T191] bridge0: port 1(bridge_slave_0) entered blocking state [ 450.508305][ T191] bridge0: port 1(bridge_slave_0) entered forwarding state [ 450.618630][ T191] bridge0: port 2(bridge_slave_1) entered blocking state [ 450.618676][ T191] bridge0: port 2(bridge_slave_1) entered forwarding state [ 451.046573][ T5102] Bluetooth: hci0: command tx timeout [ 451.810420][T16007] bridge1: entered promiscuous mode [ 451.810442][T16007] bridge1: entered allmulticast mode [ 452.148336][T15907] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 452.628529][T15907] veth0_vlan: entered promiscuous mode [ 452.665739][T15907] veth1_vlan: entered promiscuous mode [ 452.911241][T15907] veth0_macvtap: entered promiscuous mode [ 452.934362][T15907] veth1_macvtap: entered promiscuous mode [ 452.944880][T15907] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 452.951217][T15907] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 453.043205][ T25] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 453.053997][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.054025][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.054044][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.123301][ T5102] Bluetooth: hci0: command tx timeout [ 453.204541][ T25] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 453.223576][ T25] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 453.239831][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 453.239873][ T25] usb 5-1: Product: syz [ 453.239881][ T25] usb 5-1: Manufacturer: syz [ 453.239916][ T25] usb 5-1: SerialNumber: syz [ 453.668088][ T25] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 24 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 453.874791][ C2] usblp0: nonzero write bulk status received: -71 [ 453.876624][ T25] usb 5-1: USB disconnect, device number 24 [ 453.998272][ T25] usblp0: removed [ 455.092741][ T5844] usb 8-1: new high-speed USB device number 56 using dummy_hcd [ 455.202759][ T5102] Bluetooth: hci0: command tx timeout [ 455.734736][ T5844] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 455.740974][ T5844] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 455.770032][ T5844] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 455.770123][ T5844] usb 8-1: Product: syz [ 455.770165][ T5844] usb 8-1: Manufacturer: syz [ 455.770201][ T5844] usb 8-1: SerialNumber: syz [ 455.785624][ T8826] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 455.785635][ T8826] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 455.824022][ T5816] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.873282][ T8828] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 455.873296][ T8828] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 456.038383][ T5844] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 56 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 456.224267][ T5844] usb 8-1: USB disconnect, device number 56 [ 456.412720][ T5844] usblp0: removed [ 456.984508][T16071] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2876'. [ 458.060251][T16093] netlink: 'syz.3.2904': attribute type 88 has an invalid length. [ 458.061915][T16093] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2904'. [ 458.061934][T16093] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2904'. [ 459.625174][T16117] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2909'. [ 460.714559][ T5824] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 460.795007][T16129] kvm: user requested TSC rate below hardware speed [ 460.899091][ T5824] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 460.900659][ T5824] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 460.904679][ T5824] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 460.904719][ T5824] usb 5-1: Product: syz [ 460.904786][ T5824] usb 5-1: Manufacturer: syz [ 460.904819][ T5824] usb 5-1: SerialNumber: syz [ 461.032008][T12537] wiimote 0005:057E:0330.000A: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 461.033156][T12537] wiimote 0005:057E:0330.000A: New device registered [ 461.106558][T16130] wiimote 0005:057E:0330.000A: Device removed [ 461.232884][ T5824] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 25 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 461.398113][T16139] fido_id[16139]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 461.430681][ T5824] usb 5-1: USB disconnect, device number 25 [ 461.516247][ T5824] usblp0: removed [ 462.082804][T12537] wiimote 0005:057E:0330.000A: detected device: Nintendo Wii Remote Plus (Gen 2) [ 462.097493][T12537] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.000A/input/input31 [ 462.111161][T12537] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.000A/input/input32 [ 462.131124][T12537] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.000A/input/input30 [ 462.334755][ T43] audit: type=1326 audit(1789889037.076:4779): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16157 comm="syz.1.2919" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x0 [ 463.535409][T16183] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2920'. [ 464.346087][T16191] overlay: Unknown parameter 'fscontext' [ 464.474975][T16197] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2932'. [ 464.892690][T12536] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 465.066060][T12536] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 465.076577][T12536] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 465.091109][T12536] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 465.091473][T12536] usb 6-1: Product: syz [ 465.091719][T12536] usb 6-1: Manufacturer: syz [ 465.091763][T12536] usb 6-1: SerialNumber: syz [ 465.681672][T12536] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 48 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 466.281846][T12536] usb 6-1: USB disconnect, device number 48 [ 466.284606][T12536] usblp0: removed [ 467.293003][ T50] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 467.538019][ T50] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 467.555532][ T50] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 467.587745][ T50] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 467.587800][ T50] usb 6-1: Product: syz [ 467.587843][ T50] usb 6-1: Manufacturer: syz [ 467.587965][ T50] usb 6-1: SerialNumber: syz [ 468.173736][ T50] usblp 6-1:1.0: usblp0: USB Unidirectional printer dev 49 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 468.492696][ T9] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 468.647321][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 468.651306][ T9] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 468.660364][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 468.660388][ T9] usb 5-1: Product: syz [ 468.660402][ T9] usb 5-1: Manufacturer: syz [ 468.660416][ T9] usb 5-1: SerialNumber: syz [ 468.685997][ T8826] IPVS: starting estimator thread 0... [ 468.774853][T16226] IPVS: using max 26 ests per chain, 62400 per kthread [ 468.911781][ C0] usblp0: nonzero write bulk status received: -71 [ 468.912206][T12537] usb 6-1: USB disconnect, device number 49 [ 468.916803][T16221] usblp0: removed [ 468.939212][ T9] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 26 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 468.949111][ T9] usb 5-1: USB disconnect, device number 26 [ 468.954335][ T9] usblp0: removed [ 469.560963][T16237] ceph: No mds server is up or the cluster is laggy [ 469.561354][T12537] libceph: connect (1)[c::]:6789 error -101 [ 469.561499][T12537] libceph: mon0 (1)[c::]:6789 connect error [ 469.732086][T16245] lo: entered promiscuous mode [ 469.733275][T16245] tunl0: entered promiscuous mode [ 469.734013][T16245] gre0: entered promiscuous mode [ 469.755921][T16245] gretap0: entered promiscuous mode [ 469.779419][T16245] erspan0: entered promiscuous mode [ 469.782509][T16245] ip_vti0: entered promiscuous mode [ 469.783423][T16245] ip6_vti0: entered promiscuous mode [ 469.784329][T16245] sit0: entered promiscuous mode [ 469.786445][T16245] ip6tnl0: entered promiscuous mode [ 469.789273][T16245] ip6gre0: entered promiscuous mode [ 469.796999][T16245] syz_tun: entered promiscuous mode [ 469.799531][T16240] smpboot: CPU 1 is now offline [ 469.805778][T16245] ip6gretap0: entered promiscuous mode [ 469.807156][T16245] bridge0: port 2(bridge_slave_1) entered disabled state [ 469.807402][T16245] bridge0: port 1(bridge_slave_0) entered disabled state [ 469.808044][T16245] bridge0: entered promiscuous mode [ 469.809758][T16245] vcan0: entered promiscuous mode [ 469.826223][T16245] bond0: entered promiscuous mode [ 469.826238][T16245] bond_slave_0: entered promiscuous mode [ 469.826363][T16245] bond_slave_1: entered promiscuous mode [ 469.827914][T16245] team0: entered promiscuous mode [ 469.827932][T16245] team_slave_0: entered promiscuous mode [ 469.828017][T16245] team_slave_1: entered promiscuous mode [ 469.829582][T16245] dummy0: entered promiscuous mode [ 469.859454][T16245] nlmon0: entered promiscuous mode [ 469.860262][T16245] batadv0: entered promiscuous mode [ 469.861449][T16245] vxcan0: entered promiscuous mode [ 469.865339][T16245] vxcan1: entered promiscuous mode [ 469.865755][T16245] veth0: entered promiscuous mode [ 469.867393][T16245] veth1: entered promiscuous mode [ 469.898953][T16240] smpboot: CPU 3 is now offline [ 469.916746][T16245] wg0: entered promiscuous mode [ 469.926688][T16250] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 469.950227][T16250] smpboot: Booting Node 0 Processor 3 APIC 0x3 [ 469.967233][T16245] wg1: entered promiscuous mode [ 469.971349][T16245] wg2: entered promiscuous mode [ 469.972763][T16245] veth0_to_bridge: entered promiscuous mode [ 469.979345][T16245] veth1_to_bridge: entered promiscuous mode [ 469.985379][T16245] veth0_to_bond: entered promiscuous mode [ 469.991749][T16245] veth1_to_bond: entered promiscuous mode [ 469.997095][T16245] veth0_to_team: entered promiscuous mode [ 470.002073][ T9] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 470.006531][T16245] veth1_to_team: entered promiscuous mode [ 470.018478][T16245] veth0_to_batadv: entered promiscuous mode [ 470.019825][T16245] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 470.019850][T16245] batadv_slave_0: entered promiscuous mode [ 470.021697][T16245] veth1_to_batadv: entered promiscuous mode [ 470.024611][T16245] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 470.024636][T16245] batadv_slave_1: entered promiscuous mode [ 470.025685][T16245] xfrm0: entered promiscuous mode [ 470.026797][T16245] veth0_to_hsr: entered promiscuous mode [ 470.029817][T16245] veth1_to_hsr: entered promiscuous mode [ 470.032770][T16245] hsr0: entered promiscuous mode [ 470.035084][T16245] veth1_virt_wifi: entered promiscuous mode [ 470.039923][T16245] veth0_virt_wifi: entered promiscuous mode [ 470.047301][T16245] virt_wifi0: entered promiscuous mode [ 470.059140][T16245] vlan0: entered promiscuous mode [ 470.070210][T16245] vlan1: entered promiscuous mode [ 470.083299][T16245] macvlan0: entered promiscuous mode [ 470.089271][T16245] macvlan1: entered promiscuous mode [ 470.091104][T16245] ipvlan0: entered promiscuous mode [ 470.091198][T16245] ipvlan1: entered promiscuous mode [ 470.115368][T16245] macvtap0: entered promiscuous mode [ 470.118195][T16245] macsec0: entered promiscuous mode [ 470.125857][T16245] geneve0: entered promiscuous mode [ 470.155081][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 470.156459][ T9] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 470.159847][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 470.159869][ T9] usb 5-1: Product: syz [ 470.159883][ T9] usb 5-1: Manufacturer: syz [ 470.159896][ T9] usb 5-1: SerialNumber: syz [ 470.186463][T16245] geneve1: entered promiscuous mode [ 470.195145][T16245] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 470.197485][T16245] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 470.206540][T16245] netdevsim netdevsim3 netdevsim2: entered promiscuous mode [ 470.218858][T16245] netdevsim netdevsim3 netdevsim3: entered promiscuous mode [ 470.246928][T16245] mac80211_hwsim hwsim17 wlan0: entered promiscuous mode [ 470.265539][T16245] mac80211_hwsim hwsim18 wlan1: entered promiscuous mode [ 470.270966][T16245] netdevsim netdevsim10 eth0: entered promiscuous mode [ 470.271100][T16245] syzkaller0: entered promiscuous mode [ 470.272666][ T12] netdevsim netdevsim10 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.272691][ T12] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.272709][ T12] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.272728][ T12] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.272795][ T12] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.438504][ T9] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 27 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 470.914187][ T25] usb 8-1: new high-speed USB device number 57 using dummy_hcd [ 471.012348][ T5844] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 471.073895][ T25] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 471.079120][ T25] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 471.099724][ T25] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 471.099889][ T25] usb 8-1: Product: syz [ 471.099898][ T25] usb 8-1: Manufacturer: syz [ 471.099962][ T25] usb 8-1: SerialNumber: syz [ 471.374976][ T5844] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 471.379858][ T5844] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 471.399215][ T5844] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 471.399242][ T5844] usb 9-1: Product: syz [ 471.399255][ T5844] usb 9-1: Manufacturer: syz [ 471.399268][ T5844] usb 9-1: SerialNumber: syz [ 471.542322][ T25] usblp 8-1:1.0: usblp1: USB Unidirectional printer dev 57 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 471.644805][ T25] usb 8-1: USB disconnect, device number 57 [ 471.709863][ T5844] usblp 9-1:1.0: usblp2: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 471.733829][ T25] usblp1: removed [ 473.321143][T12521] usb 9-1: USB disconnect, device number 2 [ 473.326235][T12521] usblp2: removed [ 473.977005][T16299] smpboot: CPU 1 is now offline [ 474.086381][T16299] smpboot: CPU 3 is now offline [ 474.192891][T16301] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 474.196182][ T5116] ------------[ cut here ]------------ [ 474.196191][ T5116] debug_locks && !(lock_is_held(&(__rq_lockp(rq))->dep_map) != 0) [ 474.196196][ T5116] WARNING: kernel/sched/sched.h:1666 at update_rq_clock+0x40a/0xd20, CPU#0: kworker/0:1H/5116 [ 474.205064][ T5116] Modules linked in: [ 474.206367][ T5116] CPU: 0 UID: 0 PID: 5116 Comm: kworker/0:1H Tainted: G L syzkaller #0 PREEMPT(full) [ 474.209696][ T5116] Tainted: [L]=SOFTLOCKUP [ 474.211009][ T5116] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 474.214020][ T5116] Workqueue: events_highpri snd_vmidi_output_work [ 474.215955][ T5116] RIP: 0010:update_rq_clock+0x40a/0xd20 [ 474.217685][ T5116] Code: ab c8 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 98 a0 fa 09 a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 c0 0b 00 00 48 b8 00 00 00 00 00 [ 474.223585][ T5116] RSP: 0000:ffffc900039e78f0 EFLAGS: 00010046 [ 474.225386][ T5116] RAX: 0000000000000000 RBX: ffff88802b33c040 RCX: 0000000000000001 [ 474.227797][ T5116] RDX: 0000000000000046 RSI: ffffffff8e3cb4bf RDI: ffffffff8c622c80 [ 474.230163][ T5116] RBP: ffffc900039e7a90 R08: 0000000000000001 R09: 0000000000000001 [ 474.232541][ T5116] R10: ffff88802b23cbd8 R11: 0000000000000000 R12: ffffffff914587e4 [ 474.234871][ T5116] R13: ffff88802b33cf20 R14: ffff88802b33c040 R15: 0000000000000001 [ 474.237204][ T5116] FS: 0000000000000000(0000) GS:ffff888096960000(0000) knlGS:0000000000000000 [ 474.239844][ T5116] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 474.241795][ T5116] CR2: 000000008000f000 CR3: 0000000056196000 CR4: 0000000000352ef0 [ 474.244144][ T5116] Call Trace: [ 474.245174][ T5116] [ 474.246076][ T5116] __schedule+0x1c69/0x6920 [ 474.247495][ T5116] ? __pfx___schedule+0x10/0x10 [ 474.248992][ T5116] ? __wake_up+0x3f/0x60 [ 474.250280][ T5116] ? __wake_up+0x3f/0x60 [ 474.251593][ T5116] ? preempt_schedule_thunk+0x16/0x40 [ 474.253220][ T5116] preempt_schedule_common+0x3c/0xb0 [ 474.254798][ T5116] preempt_schedule_thunk+0x16/0x40 [ 474.256345][ T5116] _raw_spin_unlock_irqrestore+0x61/0x80 [ 474.258078][ T5116] snd_rawmidi_transmit+0xf1/0x130 [ 474.259702][ T5116] snd_vmidi_output_work+0x111/0x390 [ 474.261296][ T5116] ? process_one_work+0xa2c/0x1b10 [ 474.262822][ T5116] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 474.264539][ T5116] ? process_one_work+0x906/0x1b10 [ 474.266072][ T5116] ? process_one_work+0x906/0x1b10 [ 474.267622][ T5116] process_one_work+0xac7/0x1b10 [ 474.269141][ T5116] ? __pfx_process_one_work+0x10/0x10 [ 474.270723][ T5116] ? lock_acquire+0x1d1/0x380 [ 474.272178][ T5116] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 474.273927][ T5116] worker_thread+0x5ef/0xe50 [ 474.275357][ T5116] ? __pfx_worker_thread+0x10/0x10 [ 474.276929][ T5116] ? kthread+0x13a/0x450 [ 474.278194][ T5116] ? __pfx_worker_thread+0x10/0x10 [ 474.279749][ T5116] kthread+0x373/0x450 [ 474.281005][ T5116] ? __pfx_kthread+0x10/0x10 [ 474.282431][ T5116] ret_from_fork+0x730/0xd60 [ 474.283812][ T5116] ? __pfx_ret_from_fork+0x10/0x10 [ 474.285308][ T5116] ? __switch_to+0x800/0x10f0 [ 474.286708][ T5116] ? __pfx_kthread+0x10/0x10 [ 474.288080][ T5116] ret_from_fork_asm+0x1a/0x30 [ 474.289533][ T5116] [ 474.290483][ T5116] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 474.292615][ T5116] CPU: 0 UID: 0 PID: 5116 Comm: kworker/0:1H Tainted: G L syzkaller #0 PREEMPT(full) [ 474.295808][ T5116] Tainted: [L]=SOFTLOCKUP [ 474.297503][ T5116] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 474.301409][ T5116] Workqueue: events_highpri snd_vmidi_output_work [ 474.303998][ T5116] Call Trace: [ 474.305344][ T5116] [ 474.306596][ T5116] dump_stack_lvl+0x100/0x190 [ 474.308489][ T5116] vpanic+0x553/0x970 [ 474.310094][ T5116] ? __pfx_vpanic+0x10/0x10 [ 474.311952][ T5116] panic+0xd1/0xe0 [ 474.313504][ T5116] ? __pfx_panic+0x10/0x10 [ 474.315326][ T5116] check_panic_on_warn.cold+0x19/0x34 [ 474.317459][ T5116] ? update_rq_clock+0x40a/0xd20 [ 474.319496][ T5116] __warn.cold+0x191/0x318 [ 474.321312][ T5116] __report_bug+0x30f/0x440 [ 474.323189][ T5116] ? update_rq_clock+0x40a/0xd20 [ 474.325047][ T5116] ? __pfx___report_bug+0x10/0x10 [ 474.326580][ T5116] ? __lock_acquire+0x5c0/0x1f40 [ 474.328278][ T5116] ? __lock_acquire+0x5c0/0x1f40 [ 474.330055][ T5116] ? update_rq_clock+0x40a/0xd20 [ 474.331544][ T5116] report_bug+0xb3/0x220 [ 474.332859][ T5116] ? update_rq_clock+0x40a/0xd20 [ 474.334358][ T5116] handle_bug+0x16a/0x2a0 [ 474.335656][ T5116] exc_invalid_op+0x17/0x50 [ 474.337049][ T5116] asm_exc_invalid_op+0x1a/0x20 [ 474.338571][ T5116] RIP: 0010:update_rq_clock+0x40a/0xd20 [ 474.340244][ T5116] Code: ab c8 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 98 a0 fa 09 a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 c0 0b 00 00 48 b8 00 00 00 00 00 [ 474.345879][ T5116] RSP: 0000:ffffc900039e78f0 EFLAGS: 00010046 [ 474.347774][ T5116] RAX: 0000000000000000 RBX: ffff88802b33c040 RCX: 0000000000000001 [ 474.350253][ T5116] RDX: 0000000000000046 RSI: ffffffff8e3cb4bf RDI: ffffffff8c622c80 [ 474.352714][ T5116] RBP: ffffc900039e7a90 R08: 0000000000000001 R09: 0000000000000001 [ 474.355107][ T5116] R10: ffff88802b23cbd8 R11: 0000000000000000 R12: ffffffff914587e4 [ 474.357431][ T5116] R13: ffff88802b33cf20 R14: ffff88802b33c040 R15: 0000000000000001 [ 474.360480][ T5116] __schedule+0x1c69/0x6920 [ 474.362395][ T5116] ? __pfx___schedule+0x10/0x10 [ 474.364456][ T5116] ? __wake_up+0x3f/0x60 [ 474.366291][ T5116] ? __wake_up+0x3f/0x60 [ 474.368076][ T5116] ? preempt_schedule_thunk+0x16/0x40 [ 474.370321][ T5116] preempt_schedule_common+0x3c/0xb0 [ 474.372533][ T5116] preempt_schedule_thunk+0x16/0x40 [ 474.374734][ T5116] _raw_spin_unlock_irqrestore+0x61/0x80 [ 474.377100][ T5116] snd_rawmidi_transmit+0xf1/0x130 [ 474.379274][ T5116] snd_vmidi_output_work+0x111/0x390 [ 474.381520][ T5116] ? process_one_work+0xa2c/0x1b10 [ 474.383646][ T5116] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 474.386087][ T5116] ? process_one_work+0x906/0x1b10 [ 474.388258][ T5116] ? process_one_work+0x906/0x1b10 [ 474.390433][ T5116] process_one_work+0xac7/0x1b10 [ 474.392045][ T5116] ? __pfx_process_one_work+0x10/0x10 [ 474.393715][ T5116] ? lock_acquire+0x1d1/0x380 [ 474.395173][ T5116] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 474.396953][ T5116] worker_thread+0x5ef/0xe50 [ 474.398414][ T5116] ? __pfx_worker_thread+0x10/0x10 [ 474.400486][ T5116] ? kthread+0x13a/0x450 [ 474.402044][ T5116] ? __pfx_worker_thread+0x10/0x10 [ 474.403656][ T5116] kthread+0x373/0x450 [ 474.404963][ T5116] ? __pfx_kthread+0x10/0x10 [ 474.406436][ T5116] ret_from_fork+0x730/0xd60 [ 474.407907][ T5116] ? __pfx_ret_from_fork+0x10/0x10 [ 474.409482][ T5116] ? __switch_to+0x800/0x10f0 [ 474.410967][ T5116] ? __pfx_kthread+0x10/0x10 [ 474.412410][ T5116] ret_from_fork_asm+0x1a/0x30 [ 474.413912][ T5116] [ 475.483032][ T5116] Shutting down cpus with NMI [ 475.485102][ T5116] Kernel Offset: disabled [ 475.486523][ T5116] Rebooting in 86400 seconds..