last executing test programs: 16m12.299677988s ago: executing program 0 (id=11152): r0 = syz_open_dev$loop(&(0x7f00000001c0), 0x8, 0x248c0) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000200)) 16m12.14663144s ago: executing program 0 (id=11154): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'lo\x00', &(0x7f0000006280)=@ethtool_gstrings={0x1b, 0x1}}) 16m11.930279901s ago: executing program 0 (id=11159): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_ALLOC_STREAMS(r0, 0x8008551c, &(0x7f0000000180)=ANY=[@ANYBLOB="1c0300001e"]) 16m11.851458091s ago: executing program 0 (id=11162): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x58}}]}, &(0x7f0000000240)='syzkaller\x00', 0xc, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 16m11.767282396s ago: executing program 0 (id=11165): r0 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x3, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00', '-[\'\x00', 'r\x0e\x81|\x0f\xa3\x8a\xb9\x8c\x94\x04\x17\v\rh\x10'], 0xc15c}) 16m11.709987466s ago: executing program 0 (id=11168): r0 = syz_open_dev$usbfs(&(0x7f0000000380), 0x10, 0x2) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x0, 0x1, 0x17, 0x1, 0x0, 0x27, 0x0}) 15m56.644768818s ago: executing program 32 (id=11168): r0 = syz_open_dev$usbfs(&(0x7f0000000380), 0x10, 0x2) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x0, 0x1, 0x17, 0x1, 0x0, 0x27, 0x0}) 14m49.56201765s ago: executing program 1 (id=12935): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001) sendmsg$kcm(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000000200)="bfa4", 0x2}, {0x0}], 0x2}, 0x80c0) 14m49.432978508s ago: executing program 1 (id=12938): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=r1, @ANYBLOB="00000000000000001c0012800b00010067656e65766500000c00028008000200ac1414"], 0x44}, 0x1, 0x2}, 0x40000) 14m49.316186238s ago: executing program 1 (id=12940): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000140)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x1, @loopback, 0x3}, r1}}, 0x30) 14m49.233656687s ago: executing program 1 (id=12944): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000000680)=[{{&(0x7f0000000140)={0xa, 0x4e22, 0x7, @private1, 0x6}, 0x1c, &(0x7f00000005c0)=[{&(0x7f0000000240)="c6ed", 0x2}], 0x1}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x24, 0x0, 0x0) 14m48.326487104s ago: executing program 1 (id=12961): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x100) fcntl$notify(r0, 0x402, 0x8000000b) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x20) 14m48.326297161s ago: executing program 1 (id=12962): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_CROPCAP(r1, 0xc02c563a, &(0x7f0000000280)={0x8, {0x9, 0x3f9b, 0x7fffffff, 0xaa}, {0x2, 0x1ff, 0x4, 0x80000001}, {0x4, 0xe}}) 14m33.231107133s ago: executing program 33 (id=12962): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_CROPCAP(r1, 0xc02c563a, &(0x7f0000000280)={0x8, {0x9, 0x3f9b, 0x7fffffff, 0xaa}, {0x2, 0x1ff, 0x4, 0x80000001}, {0x4, 0xe}}) 10m41.815941385s ago: executing program 3 (id=18223): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0x3a0af83a) listen(r0, 0x20) shutdown(r0, 0x0) 10m41.656768487s ago: executing program 3 (id=18225): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f00000025c0)=[{{&(0x7f0000000700)={0xa, 0x4e24, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x107}, 0x1c, &(0x7f0000001f00)=[{&(0x7f0000000cc0)='n', 0x1}], 0x1}}, {{&(0x7f0000000c40)={0xa, 0x4e20, 0x40, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x1}, 0x1c, &(0x7f0000002140)=[{&(0x7f0000001f40)=':', 0x1}], 0x1}}], 0x2, 0x240408d1) shutdown(r0, 0x1) setsockopt(r0, 0x84, 0x80, &(0x7f00000001c0)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x8) 10m41.53330993s ago: executing program 3 (id=18229): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/sda\x00', 0x3, 0x0) ioctl$BLKDISCARD(r0, 0x1277, &(0x7f0000000000)) 10m41.500585289s ago: executing program 3 (id=18230): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) 10m41.398532056s ago: executing program 3 (id=18234): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002680)={0x20, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x4}]]}, 0x20}, 0x1, 0x0, 0x0, 0x400c000}, 0x0) 10m41.100311465s ago: executing program 3 (id=18238): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/intel_xhci_usb_sw/uevent\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)="41bdb5c420", 0x5) 10m40.972706046s ago: executing program 34 (id=18238): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/intel_xhci_usb_sw/uevent\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)="41bdb5c420", 0x5) 9m32.082074518s ago: executing program 6 (id=19277): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/ipv4/conf/default/accept_source_route\x00', 0x1, 0x0) write(r0, 0x0, 0x0) 9m31.972050231s ago: executing program 6 (id=19279): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000740), 0xfffffc8f) splice(r0, 0x0, r2, 0x0, 0x10000, 0x0) 9m31.090943913s ago: executing program 6 (id=19287): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r0, 0x6, 0x3, 0xffffffffffffffff, &(0x7f0000000040)=0x1) 9m30.955229169s ago: executing program 6 (id=19291): mkdirat(0xffffffffffffff9c, &(0x7f00000010c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x911091, 0x0) chroot(&(0x7f0000000040)='./file0/file0\x00') mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x2125099, 0x0) 9m30.87598721s ago: executing program 6 (id=19292): openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x40, &(0x7f0000000100)={0x2, 0x0, 0x1, 0xfffffffffffffffc, 0x800, 0x0, 0x100001, 0x5}, 0x0, &(0x7f0000000240)={0x1f, 0x2, 0x10003, 0x6, 0x40004, 0x7ffffffffffffd, 0x6a6}, &(0x7f0000000040)={0x0, 0x3938700}, 0x0) 9m30.428200728s ago: executing program 6 (id=19297): r0 = syz_open_dev$usbmon(&(0x7f0000000300), 0x7, 0x0) syz_clone(0x40011, 0x0, 0x0, 0x0, 0x0, 0x0) read$usbmon(r0, 0x0, 0x0) ioctl$MON_IOCH_MFLUSH(r0, 0x9208, 0x7ff) 9m30.283657266s ago: executing program 35 (id=19297): r0 = syz_open_dev$usbmon(&(0x7f0000000300), 0x7, 0x0) syz_clone(0x40011, 0x0, 0x0, 0x0, 0x0, 0x0) read$usbmon(r0, 0x0, 0x0) ioctl$MON_IOCH_MFLUSH(r0, 0x9208, 0x7ff) 29.420487269s ago: executing program 4 (id=21159): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'pimreg\x00', 0x5005}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) write$tun(r0, &(0x7f00000003c0)={@void, @val={0x0, 0x83, 0x8, 0xe057, 0x15, 0xd}, @ipv6=@icmpv6={0x6, 0x6, '\x00', 0xf98, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x12}, @mcast2, {[], @dest_unreach={0x1, 0x0, 0x0, 0x6a, '\x00', {0x4, 0x6, 'A\x00', 0x8, 0x3c, 0x0, @dev={0xfe, 0x80, '\x00', 0x2a}, @local, [@dstopts={0x2c, 0x1, '\x00', [@padn={0x1, 0x1, [0x0]}, @jumbo={0xc2, 0x4, 0x400}]}, @srh={0x2b, 0x0, 0x4, 0x0, 0x10, 0x58, 0x6}, @srh={0x2c, 0x2, 0x4, 0x1, 0x1, 0x48, 0x10, [@mcast2]}], "84941749d8b6da8c9b9e0b07e22a7e71b0c74db7dd36c984a125d66b8ebfa2626df1bbceef3bff0e6afc8fe076466866f3524fa994aea131c7f676972fbe42a3085122e80aa23c28da20e0de828239b260fe9f3f49b5ca1dd6eae0c8dce0d4b67bad623b4b4ff7bce8265973d6452ca6d2ceee800b95dc3b21fc70b74cfdcef87dcd20a1ce7aad3028a0992fec0907e0c5720385c885e3e1ae3712ab74626f86d54e2b5f1505baf619e8bf32fbed5816c792e715a831457d916801e6014b8bfb25a1fca23272bd8e77751cfa7ccfce0ef6ef86cf3a75ef4891ad4c34305328e10af207d896bbd50faae7f25090f55e5bbeabab26c242ad30b270b312f8798a6a3cd31018884842032207a3807690217212d1873ee8e5b65817aca957433b39f4690080712e9075a2d4647896b3244aec5b5f39bcd5813d6cf5b8c7bb43a67a140e373f2989401f223f1212d062bfd9a07745ad2df2638055495008cb4925ad823912a553ddef4df0a0b1b6349322aff433b168efd21e839027bae9ffc864a2082ca0cfdf78ce83da031823fa558e92a4e4d531491b99a6f8507faeef095019cd28c9f04cba0646bf5128edb9cce78b97897c325b1e317d0786f93cec2c6923687acbffd83a9a3e895aafea344df2cc59decf06cda01a51572e06f373154ea0f1dd15ec7aa05ec8d764f5d78c2008a144d6895b56aef5874da5af000b7e076f594146153a12a193835a0c7f758421fec0b27596d5f5b5eedc2d213ec2b854379fac501ec67b5d66c2d4f17f3e061b83429084832b87ae8da8ce7df3334e36626d285f2dcd97a8d44394c7d7ddbf7dbbee6210cc9cb3e186e5f25e197e4ee8cc5d358f8e85e4ccef1bf45457ebf5c7965e4a87ca828aa773ef15761d45f335851de5ee80582ad12ded8cb69a604531cb955a7c49648e19004ad079b052b997329bf606bd3beb57c28018315e307142027accc809390184231da931f0c99aa19d0645ebb87daa16ee652ddf6d1331590ff537684b0b6d16d56085cb6736321bea4927ff70d5484d4a7af8c736e07d1c2e6564e09ab4ff843f760f77a14bef908e779202e9715c69eba13564e1fcf8d71d37eb295bbd6b571e25ec5cf380c00f1c2361af18c848b34365524a1cbb9287622e8e321f583b6aa6f76f2125af922ffd8d35985c1ae65dbe378fc0ce8328ac922119d385f01044d887b447d9cf564ae8f8c2722955e5f5e4a9ec95df8f0f705bde2fbccd776b9a2406c79dab9b262fbc005fcaf9f913ff4947538e0cd06a3e22e17c1fab55d9683e23a65372de06bf45d9cd9aa5d3a4ae3c3f5de34a12129238a9e0a334af9f6cad0bd021fca7561fc53c8d711ce6294f75c3cf606584eb4a95d0b8addb8a9c2ea6162017df3578d4623c950648c4d9f0f1d978a9c5bcc5c4c0ce1f58488b6eee469afaa7b63f3096ea572f552c55ba4643909efc306d327a2817f3c45d08a2d970729a72510e651b3f9802eb019558aae079d4d79140728d69fbf2677db8e2990a726c46be3109327940437badc0b703410bed46ae46b83473d31791ef0a106eaa63e790cb4d8a9706d4672e0d9791a4c7339333bd5df0550a9b6d58471e0ad3d212ca2b5898e3460f072f4d8248d4d15cf9f847dbb2b7aa714c84e2f680a7a0a817c546c15b07ccac4a40aaed43fdaeabd3ea7d31315cc2ada7ea9a3759b52b932e9e766298fbdef06d396f29187c8e87a15f280cf26fec7d0fc357f4a68d9c3e8b3aeca659b970677bbf3905065bc91c32cdbb782466436abdb8df6bd6deda3bc15228fc7e53f760b6d4dd9433e3306e5ecb58d728823311b61f388f2ed9de64edc28fc6ca0ed0816d03ab41081f913f9e5207858368751176004ef76eac2e0a66443c0dc35c5cd790fa633dc6062d130339a2263b4d3798de20de2fad44f77a51828e929dd646ab05d500024b74fc0fe0c8c88cc424a8cff1fdc2ec79efb0cab48f86b47e6c0d786c4b86218fd24e39255ce6e6eb1f46759e394ea6beb37ac9cc1a1ef66ee2b437a7e4e1fddcde65d837d793cae90899eec51ec69afe87d635601bc34d887c45bb6f1a13ef1c4f99d480c47d05710856bd1f2906e694b3a0954f3f0bc433212beddddabc5008a6d7e4921946bd1098db51e49a6b8edf6e9aecc2863f9a7fe4ab1c37575eb20f851a1a98a59c3b0e108ba1405a088d33a0913c3f7fc8002e47476f9e283c1fb87e4fa2334e2713b115a4a03a1bdf36dd37c5a85fb6313dfd57cab1a67d4813d05f9d0783100af8d3881c2bf6e942efacb44cc70daaf0e257d1378fc8334d33eaf38788194db2fcc518ff5e9fca3309a524e46eaa5219d7f2e06340d2ddff584423d0299f8b20c7270bd6096bd3c93f0429ddc0a66b1a17ef1d9986b819e60e5dc2f486b712c864aea255884e38d3ec0d4b88c9bfc8a3e055810e6e55f42c5e2ca24f09c994d8213ddd86e029c86232f9f021ac9fab1c15e9b8185dec6cac4fba6610998e971bbe7bdd937872bfd03df8a94eeea9d9daa2c4dd4426928e87ae8c8e1a6ed640b771f642925307d28eb7673b1949b80e073536ed01f9dab0832109c228339c688bba6f1bc55733f61ce2ad54bddbdc20f480cd227c1f607321e591a754f8751b2f55a340c2876986e81ff1ab9b5f5aac0d884ccbe8d3ffd37d76d2dd23ab93668218648ae2eeaf01c27b0dc858744aa8137d0b95996c624b0c3b28376383c0b2d79c3f68f1da4120d46e04732e376edb99e42383e26603ce118f45313ce0fa4892556527b677a797499353543c460845a4663bf54e5b5e4f3b1f60095a689188556705fe50006b18e1a54ddc6c03995048568d4b55f22cafe9f204482a4608869107352f2db6963b126b023530dcb4ac8e89a02f143a5d53bdad1b5d8186c63da3c4aa5ecb0a445829853563c47b899a8d3fed3cfd026e1ac1ab060110990d3514793e8caa2023e19618d5aa587772a72cbedb9a08a231ef47258984384ff523dd0519a87460bacb0200542c93167fb5b5af3a4f5df9dec738f8a40bc53304f7e71b99d76c292e0861b1166419622b5b67b060acfa8116eb207af95c6a8bc271bcc592af35d3884181e973eedfc33af1efd5f40a1998588933a5cda27ab14778d36c6c3fafd95046bdbd4392f84a8bea2be9279cb67eaaf4ca3487dadd5594bb426a7e3a54ed259159e043457704bbab5f4847693f22de6a7026c91d060c8fba176f626455c0c6f5eeed1be109d0b2239e8125ceb6e6d07d4a702df7bbe7ef7c103d2cf6b86373313fcaf8a426404f691ef945b9cc21ff70b65528856c8d0f62bbcb1d741d26cad04dbb9c28aeaf45294afd3156ea978ccf30517fe544e60e8d66a79b6f127a62022d3fced773e228cfc5a2e25dcf07ef417a8e8f6f9a6a573627acf1cca364cc6d7fa033bd547d420b2c1d099ad047d9b22a6a743e97b5cab715d6cb26032d7733cdcecfb63847acb7f28ae80fcf9647a9261391c7e754de69479216b691831e40a825506901d45d54001f375513afaccebd909a673d8bb10d0390740a8b657f6d6fd7fcdf4f27fea8384dff17a7b63931cd8217a7c937b692489fb038448043b3d87599f75474e7289e3af345ca598fd885331e58c20319447903a8db455d7d1a119dc5693dc42d94e24c327a5216b3ae50a0d3530cb8c9a4d023f795b93839e0160332958806dd57b94917726749d6b3c25103c66fb736d6307f2d5f0d81d39f3a3386b0c1f8939c1707d7b0a970ce1faf489d4f5e391fcc937000ae68145f18c7b0f153ea2405e57615e8efce117f8d1885a2445762b256846baab3bbf42970caff15ccb60a5df776f171d4c8351dbe58575307052d6a89bc0b335d6f896249a97b4025de660a931981e173b0704b57394d30159d05cc44709af7a47f41b70e7fd3f4b4ca68e718be643c6e8ca151a0e86934676b1298ba6dcafd35eb2ff7ba1b4070f76a0329a6683caacad09c097758a61714a89cecba940b7aa21e1b9f4c95c8c617a34dee442da1a05f5af052484e9878a2bfd17f6ffe6186866777a70c8e94e54b58c86328ec188d36b897a3aa06df2138a117c0f5c71bad6c332e3fc4a1dd330d9721dad458564ee445defe1d0f682a4298b075a3d943fe8f141ca10deaa8ecc390ada23dc5d929cdcf6784166eef355ee1fa86c1b09389051699e1cc49b4ad50f39c8bfd54b6c1944b47c359c14ae459b3c598c49e1261844e2b374bfd262ec6e92efd302b9f6902645fcbdcd839eada8f359d31400a4e84d87cdecbf76d0b8593df11f8627935c8ec59f3e279f4128c699520fdef898a409c03d41e6fb71f6dae17c98b4556d9cdcb33d81eceac07574c496d70387ef23c4eefddb29ca90f19e905f0eddacc618d51cbe95ddc303004a2545af2d4a1ab2bc5da5dc1204a78c7c9bd79b7bdfd782d3ca1a9758ea63bae830e5bacc89d51d1b6fb4a7c20a0d675ac88405e2fba6078c5c206c4f8bf36f510b06653d801319341c3f810bbd4d16806c54558f00cbe50a6c7cbf1aebdfbf97c59517361bd6ee30609489b19a084bd64be513f0ac706f14fec4da31e4d7b1c072a73bc7d8115cf151ee7fe8d48fba6514662afcb76c20af41c4ae7939a768d0009fa91a02c4dd116c378928cca8cd5ff951a144628fa1d965809f6509ab162e7453696630d2df0bc15c9bee18ec1c996c78c96ef615e5375bac22d75c2be259a19a1869778b349562d7c82990ed2e6be56dc86f21af2a2ac9a461600cdbfac1fb54a6187d171e0cf09d96931d1e4fa6c8a6d1956111037cd167a452a55b2e4d96278e782ba32645c345bc4b6ff9da6b1acb5c3e87267226dc072a32338b47e119843d56aa95d7e94640f9b8dbed6d942fff494f578608c84940b46a93376913a853443b9769325c74ed45a85930953c1e0823e8beff4267ba9b34f7a3ad825d525b4185bb8333a1f8fb1ee81515a123ee2fecb12cb655bae143cf667b88a9357c6ea3cf3c906d627952a348f805e063aa347c06acafa1c399bd9e681c1286dcf8556cba8d02e11b6772453abfeeba5ff73438a4c25a27838806f8a09c6e7748e2f8b2ba850e5ac7eac05c053a489a8539849cd25007a17a9220955bb84e9621b5b871d90409fcb1f8b653e830b53528c30aeaddabc9a5d39c2eb525e435e4d8f8c875ca3e051ac3ba235e9fc4ac261fba3eebd3e5c87fe9735522971be57e9ef1e1ced41dbaeb5114a730f4c33519d8402851da1cb37ae4a7dc2eccbbdc2792e9df1c935a0a42666e1552b9121fb404eb43df14031a4d0c670c36300c0428c621d8c4adbddc0aa22c625d3ef51b084ae1684e3d3bc31f9fc2553a9adb8466ac3a436d7cc445fa71ea624f8cb392091589c1eda49b119ac9ef287d8f28b7adb5f8c16a97ed9ae00258236f386067f8d2c21c56192aec17efe031b43a0261bf3cf7230c10c61f5b8971f7efcd2046c39bbf1df57a16a5adac9c993995bc93189b24e29eafa73d290db21b4"}}}}}, 0xfca) 25.185742611s ago: executing program 4 (id=21163): sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x24, 0x0, 0x70b, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x6a}, @val={0x8}, @void}}}, 0x24}, 0x1, 0x0, 0x0, 0x400d0}, 0x24000050) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) unshare(0x22020600) r0 = socket(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @empty, 0x4000002}, 0x1c) 22.585679282s ago: executing program 7 (id=21166): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000440)={@val={0x8, 0x800}, @val={0x0, 0x0, 0x6, 0x0, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x2, 0x2, 0xfc0, 0x66, 0x0, 0x3, 0x73, 0x0, @rand_addr=0x64010120, @broadcast, {[@ra={0x94, 0x4}]}}, "3297e3ba0fa8a2e71bd9fe1a399b5110420b70460c0dad392d66248a43540df968e7fcaab34569c0e36170578c0d3c546a98b26295e2592f360905866eb4720fed03a977a3df4224895629fd6ccec64f13a999f18f518e3ee28798381975e862f1db9dccdb2f1c1fb60f5ffc7a339d40a8bd1f24cede8a32f186f142e194d4fb48224759faf813ea80e6a853e79b4fe27fe3e1aec5897b314a7f0d515b07b1835986b4885e9826d902c40f16cd77c58b6433ab039955ce9db11f36f459e7114ace6c9989eecea80a81fd39f339356c7c3391af83da2486503a7973f6db4806cf3e5ca94cf7e1f79fd00decd76100c18251a59d1474caabf4d3ca6a9a9885df710e68c5b0dc11832dbb5eecb5c88c2f8f02bdbd88569ad4a740359cbca8c378118220d73bdd1e661c3a74f77aa931b11cd38119b0f084bb96e84803fca6566c33ee1e4e34ab0253fbf24f9f5974af5e1fc2a43a4ec9dd9928a8f38a128ea27c429300ae5a6bd7740471f973d8224b2b07879f4fbe7dcbed776a72ebdc713bcf1d7aa45b01c32a1003e6670d58510bd79ba2fde5cb2b82cef2cc315648f4e9d96d848ba327949b8926253cbdef6888a8982108b6ac7a1108533dd3fe125002e2e286362d1055082a9d73ec5ac3080f2a501ff27250b62c8965f371cf9205000000000000001eb08a2f8fe50049e102c69ce703d116d0834208cc957d0f1376457a90245816d7642412897fdd2f982fdfbc3af65aa0446b00c767b79aec40e460887ea02188e3a0960eea39b144859467b881978378c9fd593259e0f63148179fe2c2f6d40987b63a6e384e63027f03d8039d707522942d5dc88fd842524d006290b6a65e9cc86cc5b401a60ec4aedfb3bf4d0447bb681810a16b9684b72c2f4593ef834a0203e78cd1d9dbc978e9ae8f3ab62c07f1e41d59470decee7b0cc41ac49e4b7589ab6da65849f62ec217bb39ed161e7d337822d96badbd74d66451ea9a74bed591dc9631bf639dcf7846ee428a9fa55bfceedf3b1c23642f3b58dd0a7273664c6c49c9160a4b9cc5b72d0210e305b94e2cb09ae1d4af9d365b5093851f229c8c30aef75d45ccdbab4b86d801a9ad3b27f26ba601d531c0743717aa7aae29d37f496fec7682c5a1abd321ad61941a2d23fcac6af1d1875e308c8d8c64a5152be47b59c09d293f46b857310a99f1885f0a49d432aa0d39a3e8fc885e75e66b63215133175a19267c8d0adf7d8f644e742ed5369d1405e99e63b78727f135e0243f24d9ce354a1562102ee8de4c191508343b86bf7e7519ddd770ce55e17e590561b2f437194c97ad46622a6ae3dd68d9993e6744954f4cd308bd6594fdccedc578e80aed274a65219697229059723ac37d535cca0e9c314e7941b4160bbd2ffba71f26ffe3228431bc81463078ad70583277ef18bce23ca2e5b9a00670956ea8e0e2c739c00e106c8c9ee3f92ba728d8490742b74a9a18cbedfc4e69bb87e0da4c7dfb964374c28c837d4641fb99a19b233675f8526af395335e0185cf3934805442ac379980b687a7128e53284ba9e741b5fe9bc969bfbd55cbce76842915e076e2adf844338d16d3802c681bafdcc60465bd34dfc2d1c069ceee40060e0570fc1275ccabfe3f9be3e84ceedf72cd649c082232008e2b0c94594588c00e0fe911bbf1c12eb6c37ce05674a7597feecf27f5e051ffa824d9ff93638dfa9a84c77562aa2cf897f55a97b79c18544ad03480e1011b8f93e0ead9c2c6672448f585c5803ae99be777fbc662ef4450c1e936ed8b3c8047f00e72adc84561f417f8e5e1dde4967005d96a64fc75d9f486b3ebdb5904a0a56ec48542f0efce939f66fd69259e7376ad37e84434ea90f35b2d3bd63b5c36b267d8f2c7dc5a50b46e00ed086dff8b039e07b84c60611269d4f282ad04dc8e0b481eece2f8a614734be73617f0ad5be195446b09dca4cf1f32653dd3e188aece76f3014deb2ba61744835c0f735234b6a4637c948a7b4fd4203b286ca87d669e325d70277075b094f59eb1dff6c9c05c40d5e464c563df79486e1a32e6ed9bcf675aac7968b4e98dc4e210215b0d3b6a2525b2e3df11f3f1490eb39cabffbe32e23659121fde8e4e346e0f595aaf3666a5f6f118c1a1128039502ac04c40b85eb4c54e6c95b8d1c2aac74ae9e1c355ccde9d54d5d833293f5df09224482179e5bcd8e227c99172a6e14c2cd4e6462ceb0a905a1d64804840ce62e350c6efac10a7fcb029f84af64e2256d45afd3b3f59379895740e0cd2fd24c63264f785bb6e3f40ec72cd67d1a7d87dd264743d9c951cb5aa8bc6f1d1bc9b23303d5aa7f8f6f961326757456057000cb2bacf78cc229002777e932c2640b8dfa793846ca49fa93996db95104a8808a1906b19df17e754b90582b6c49efb3ddce067dd9292291cfd2bb0323ce8098f29e4fce0de31cf5c7e2e2da5d0d0996a8be776de8fecfd3ce68e80d21f1701f6b90ac51278abbd727d19415e0ebe001b990b177b8db0c592b18a4b5e4a6221902362e5b20e6e6f2131a5a5e03c1150b179ef40c933c2fef1b79de738652ec4c32565f5cf751a11db177099c4e2e5bd7616cd0dd501d5bfccf5691de3cca590365328648baf8a9487a3c212193c9bb837594460967e823067a9465eba7001eaf609a810488ef5c147aaa5e9e8c75b585ac3582b6915e20b5aa2f79b7a94857122988c56dbce1ea52de1a56652e839bb853be3ee16052b33fb83ca54d8e4e19440a5e81492107043a66286f63ca87a1f7b8a4e9547a7eb6005419cfd28cb37e9e374f4d0143973286e87070754025c1a6fccfdc6858eaca8c35ecb19584ce7141cc79a5bc813469161b87a19fc21f3373d1f25b3427916dd1be2a589b70ea3b39fcc7801e13beaf19b76164faf3dc4ab8faa5648d24eddd6caceaa0d5ac9cad633c19a4a4d059ee823a49b7cf82c5777d376c111f58ea8fd473429907852301a2c856f27bd0c687ab5be0e2bbef64ddee1601375a4440e3f59d60f57caebfe457f82432523ec4a61cdbb7f1e91e4b05fda892df131c274b19929d26f7a5a6d3ca487983f729601ed9bb4bf5c1cc3d453d406e9534688dec6a2dd0b9db149365c125a95e129565e62cc91f7d960abe1055b730ae0994e7eb08392d5745d0e4f529c4defc3d3e43d0815b0cc63effa88d20c13b14e780c2f6c89a1ee5e4db45a5c272186cc3e51b13dab3add5f467e8ca0f4c45a1fc76db2f0cbf794102946aafcd8cd8a3e935a606b9721645c4d550ae04753d474a73626041d3a54f8fb50de2a6335611a3779da3a02daceb2256d9b102d4d30dd3cd389a04b1a7a6076879f36534bb3379debb46ed1fa2c40096c752017dd024345c58313b43070ff7bef94dc3cafbe6ec20d59e5ea3c196ba3b783bfa87384407efc664cd350c80ac397516018e35371956e414755cde304d2a228c1540ba6fd6a7402d11c666964f024da4c016eb556ba2c5fab86c60c12efb1496295d80f0383526e8e0fc55a287bbd3cb966a916f57958d8b6ef97aa0c4b47f7746bab6b99698c1c96b25c4e2e084147866fe0970b109dd26984adc0758eb6442712cc46dcd8ed3038b0595252eed1b8a46525862662d1e67eba66ac341f8d27853eed54854f488f079bd48df6ce7a4be8b1b61fd23a2dc4d3ade0992011539cc63f80fcfc75008c20cb639348cb218f8f476a6d56917f4ca07e67fc20ea2e9642eaf2182b397e279f5f6c70438fb8aa39cba788588c181461ea7efe1a0dd5b95eb26f7158b91012f7ce0ee1b4e79ce4da377bea4551738a0f491a84f19b3be9827b4469c299527aa9c20b8bf12f919976a0356bba720fb91010763c79bcbb10d89280f0f97cdd19aa0d54828b308195fac170613cf4b515e340a9ef2c97f618a9f50b30ae34ebeed9a38b4c6969680accc740b154ecb014fb5d543a59ccb98a7de2823a2dec39f331cb503eb74fef61262c6d4050bc723caee834eb28c64ce007f6027375e936b62387cf1778970e88b0574a0106d4c855be7425767c551b2fa644d9d8a59f787e7610581b768057d229673344571c3d6e3f10975b2859f568398b1f38f89524d9ad0c1588617c3883a1227b714c81cdf28da54f33968c1c50f28da01c308eb31d319b3e77f96bec001c9300000000000000009cc0062283ac112868592619db14d629c47bfb793a723dcd2f7b07ae4ec14c17564b955ea5b2b153a279b080f6236d418075b86850974c8850efb306d5c304e726bf2643b4403e6d46b0e0395b02e93308b4b2c3e957308d497dc51c753344a7878f1f0c91295fd76e3d1cc9ef813161c6b92b7ea6068ceb97d8f45a4ce57af7d7632d699951f7fe3c71c3a32b014c74425c67e5030546b10cf7edcec2eca5ba31dc62c08f83f35bc2e36b93f15f071bc2537ebe9ca19f86dce4e84272e10323d0ceaa2cc47fe4f6ad101d454c761f9863e94af91199ce5f12469bca7ba39314b84aa7efa4bdc18f7700c19511d48d6132450111d70401a8ac73565d5386ca12345e884d08b23f9c901000a95eb4167865e58c28b112f47c96beeaa6657c923e25e56529107c5c30e65bb485d5ed21b91332db4e09df7e59dcfa05c994570deb3f9b838e22ae4abbf9a9a8c319cc9112c8dba7c2278f78b9578b0254c46a4c04b8fa4fedad6bd275f70b1618971ef6503379bfb0a508c9944328af2c820091a89e3f75e68e7f980ddc9154d273f7f2ce7a6294aefe93136860786679b80e41f6636ff45efeacfb52e2ba2bd9bd9c9030079a46caca5c4b340c17d01ba8ecbc5c561b2038481a8321c009d12136a3ad5461881d998eeaac5236fdcd8f81fb5e53848bb096d9198fd0d38830d1809f2a632b31e2b67754140c907ed58aead048b2d8af9a1c407e48db815212cfdcca97222dabdfe01f311a73e1e82c3e189ec5add48d3f8190eb9e14b58e540f7f1388a7c687629eadb19fd8a133dc8177629270ecaabff79efb6c1f750d89b9e6c5f34c6238066f8e3e425e46a27b3c0d2e9e2ed3cffe2a6f39b8e0137ea5de689b94107fb4748a5feb3902f0feba64dae4c2e69bc8d86463575c6b0ef4a8a64fef41121e57a8c67eda07e9fc8f98299677de198ea0a649ef3c00591940b2c27ba1414aaa1633deb52e3a44cfa8d7a00d014317c026a7d7f42a34b97128e1bf9cda4d8315819ac73ed5061bf9b5631d07b09b85b78ff1b6eb86e9e8c4faa0f991cd6fa0b0eb71b39c35ca9bc7c156f3bd255a5b408df172396bafd7f0fb11c6eaf1eb0a06576d37bee00424bf699584b1dfed68f0d8d8a35f0427c783fe2d79b4373628971e87501a5e4bb05b5058d0b2132741f26e76065b6f4017d963c8ee5605c4c5b6eebb96fca0a41893cb6add3fb0d728abeb860f22cedbd36e464bdaf124a7041460f7af3d64b54e9ffd240b5afad9baf6e5dd8406bc1b205da5848f51fc9dd5197716e144e1b0386614bd3cfd5ddb80ada1e5ca74c8960093a553b1f6288aa7f53663cdd867f658e51b95772dc7a6fa45fa03e14988a33250e6c16fbf0351769080d64ddfbdbf77e1215563bf2e82ecc38a682846d7e2e2ac4e87d715f97f15e84c3df04affee49612a735907d3c4d310a54a6f609873ad56f29a138f4d5661f6865e030487429a8da93c5e2a14f727"}}, 0xfdef) 22.476743892s ago: executing program 4 (id=21167): getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/sched/preempt\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='lazy', 0x4) 20.904763102s ago: executing program 5 (id=21168): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000100)={0x2046e7c4ac1d1537}) r2 = fcntl$dupfd(r0, 0x0, r0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000040)={0x20000004}) 20.031904401s ago: executing program 2 (id=21169): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) 17.068371606s ago: executing program 7 (id=21170): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRES8], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) dup3(r1, r2, 0x80000) syz_usb_disconnect(r0) 16.339532324s ago: executing program 5 (id=21171): openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="043e1f0a00c9000201"], 0x22) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000040)={0x4000, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x8) 15.624574026s ago: executing program 2 (id=21172): unshare(0x24040400) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000003c0)={0x5, 0x3000, 0x8, 0xffffffffffffffff, 0x4}) 11.932665616s ago: executing program 5 (id=21173): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000270600000ee60000bf2500000000000073350000000000006507000002001000070700004c0000001f75000000000000bf54000000000000070400004400f9f0ad32010000000000950000000000000005000000000000009500000000000000debfa255e44e4cc39f211fb04d7f202e6a53bd86bde99b679b4e6d24b8125690361eec3b181dcfd7c2fb2d1f8975b579a085bee32d414c1f3ab987a9de6385ae8021f4ca33b9b35fe817e98beb9cefe7f40fd6f0ea3affbdaaa897c70fb01d270a7b00d36fb5ab8fa92ac014a106e3e4decc68652503ca54fcef437d96c8a05d59ddcc8abf09cd77e93e940207b03189c5d4661e43df6f1f036c8d85a2ad7615a021f8cbe507ef94fb9f33315366e9ae080000001b532226b63b460d68808a67529637bf7f6731ad0cf1718bae3c8b9d2f89050cb496fe791381af6fab290900000000000000d640a5fde1f7d5eaa97cd25523fbd77300000000000000d67559b0c848aa3e7091f33e2dfc351e903ce85488fb25691249545bcf877011847df184bae6d3f5d0c016ec7d581d5b2fcb494d8c2df1929398ec5c3675ed16c27fff46a695eed7f50c531a612d5677b5e949ee4f16d10e41074702c4e89ee401ec2ec65f38f64189f1fa2cc0a42add3119025764759de2f093c26fe51d2f7635bb06"], 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000c0000004300000040000000c0"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000780)=[{0x1, 0x2, 0x2, 0x7}], 0x10, 0xffff4fb5}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100), &(0x7f00000001c0), 0x10f0, r0}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000004c0), &(0x7f0000000640), 0x16c5, r0}, 0x38) 11.554573839s ago: executing program 2 (id=21174): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'macvlan1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=@newlink={0x48, 0x10, 0xffffffffffffffff, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2017, 0x2021}, [@IFLA_LINK={0x8, 0x5, r2}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x48}}, 0x8004042) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 10.996595537s ago: executing program 7 (id=21175): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r0, &(0x7f0000000000)='7', 0x1) lgetxattr(&(0x7f0000000240)='./proc/thread-self/fail-nth\x00', &(0x7f00000003c0)=ANY=[@ANYBLOB='oc'], &(0x7f00000002c0)=""/122, 0x7a) 9.954529732s ago: executing program 4 (id=21176): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x80, 0x2, 0x27e}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000980)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x44, 0x0, r0, 0x0, 0x0, 0x0, 0x40000000}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000540)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x1, 0x612, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x4c}}}, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r1, 0x18, &(0x7f0000000080)={0x9, 0xffffffffffffffff, 0xc, {0xfff, 0x7}}, 0x1) 7.950275222s ago: executing program 7 (id=21177): mkdir(&(0x7f0000000080)='./bus\x00', 0x63) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000440)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40086602, &(0x7f0000000140)) 7.65225652s ago: executing program 5 (id=21178): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0), 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ftruncate(r0, 0x1) 6.816187582s ago: executing program 2 (id=21179): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000300)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1}, 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={0x0, 0x1}, 0x8) 5.72017838s ago: executing program 4 (id=21180): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f00000000c0)={0x1, 0x0, [{0x40000070, 0x0, 0x100000001}]}) 5.100356435s ago: executing program 7 (id=21181): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x7fff, @empty, 0x19f4d29}], 0x1c) sendto$inet6(r0, &(0x7f0000000140)="f0", 0x1, 0x20004000, &(0x7f0000000200)={0xa, 0x4e24, 0x2, @loopback, 0x8}, 0x1c) listen(r0, 0x100) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @remote}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000100)="d8f849", 0x3}], 0x1, 0x0, 0x0, 0x48d5}, 0x48850) 4.744929684s ago: executing program 5 (id=21182): r0 = epoll_create(0x4) r1 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r1, &(0x7f0000000880)={0x28, 0x0, 0x0, @local}, 0x10) shutdown(r1, 0x1) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000280)={0x30000010}) 3.738178745s ago: executing program 2 (id=21183): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) sendmsg$NL80211_CMD_GET_WIPHY(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000a00)={0x30, r3, 0x5707b563827c8365, 0x1, 0xbffffffd, {{}, {@val={0x8, 0x1, 0x80}, @val={0x8, 0x3, r1}, @val={0xc, 0x99, {0xfffffffb, 0x4e}}}}}, 0x30}, 0x1, 0x0, 0x0, 0x40804}, 0x4) 2.457513699s ago: executing program 4 (id=21184): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x3a, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000008c0)=@bpf_tracing={0x1a, 0xf, &(0x7f00000005c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x1}}}, &(0x7f0000000700)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, 0x1a, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x8ad4, r3, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) 2.432192516s ago: executing program 5 (id=21185): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x53, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/109, 0x20001c34}], 0x1, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) 1.091874337s ago: executing program 7 (id=21186): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./security/ima/policy\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='measure func=FILE_CHECK', 0x17) close(r0) 0s ago: executing program 2 (id=21187): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x1, 0x0, 0x0, 0x0, {0xa, 0xfffe, 0x0, @local}}}, 0x32) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0xe4, r2, 0x4, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x32) kernel console output (not intermixed with test programs): ss Event (cmd=0x8B1A) too big (33) [ 811.982268][T14031] batman_adv: batadv0: Adding interface: vlan3 [ 811.985690][T14031] batman_adv: batadv0: The MTU of interface vlan3 is too small (1464) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 811.998620][T14031] batman_adv: batadv0: Not using interface vlan3 (retrying later): interface not active [ 813.509316][T14085] Console: switching to colour dummy device 80x25 [ 816.044709][T14164] fuse-io-uring is disabled by module parameter [ 816.099039][T14166] binder: Binderfs stats mode cannot be changed during a remount [ 816.671432][T14187] bond0: option slaves: invalid value (-veth0) [ 817.111212][T31404] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 817.371159][T14207] netlink: 52 bytes leftover after parsing attributes in process `syz.5.19076'. [ 817.478237][T14211] openvswitch: netlink: IP tunnel TTL not specified. [ 817.478340][T14211] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 818.011668][T30931] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 818.175990][T14239] netlink: 76 bytes leftover after parsing attributes in process `syz.4.19090'. [ 818.176043][T14239] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 818.192921][T30931] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 818.194099][T30931] usb 10-1: config 0 has no interfaces? [ 818.199171][T30931] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 818.199268][T30931] usb 10-1: Product: syz [ 818.199301][T30931] usb 10-1: Manufacturer: syz [ 818.199315][T30931] usb 10-1: SerialNumber: syz [ 818.214075][T30931] usb 10-1: config 0 descriptor?? [ 818.427042][T30931] usb 10-1: USB disconnect, device number 8 [ 819.041915][T14256] netlink: 56 bytes leftover after parsing attributes in process `syz.2.19099'. [ 819.218584][T14268] ubi: bad wear-leveling threshold 1 [ 819.276701][T30931] kernel write not supported for file /sg0 (pid: 30931 comm: kworker/2:1) [ 820.243069][T14316] MTRR 2 not used [ 821.091759][ T4414] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 821.753633][ T6148] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 822.001842][ T6607] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 825.544837][T14419] synth uevent: /devices/platform/pcspkr: unknown uevent action string [ 825.544962][T14419] platform pcspkr: uevent: failed to send synthetic uevent: -22 [ 825.628110][T14424] ieee802154 phy1 wpan1: encryption failed: -22 [ 828.240661][T28826] usb 11-1: new high-speed USB device number 3 using dummy_hcd [ 828.405923][T28826] usb 11-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 828.413129][T28826] usb 11-1: config 0 has no interfaces? [ 828.417302][T28826] usb 11-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 828.421719][T28826] usb 11-1: Manufacturer: syz [ 828.439048][T14523] pimreg1: tun_chr_ioctl cmd 1074025676 [ 828.439126][T14523] pimreg1: owner set to 0 [ 828.456323][T28826] usb 11-1: config 0 descriptor?? [ 828.580357][T14525] block nbd5: server does not support multiple connections per device. [ 828.585995][T14525] block nbd5: shutting down sockets [ 828.679445][T28826] usb 11-1: USB disconnect, device number 3 [ 829.498171][T14566] block nbd4: Unsupported socket: should be TCP or UNIX. [ 829.507958][T14413] udevd[14413]: inotify_add_watch(7, /dev/nbd4, 10) failed: No such file or directory [ 830.164726][T14598] IPVS: sync thread started: state = BACKUP, mcast_ifn = sit0, syncid = 0, id = 0 [ 830.331217][ T43] kauditd_printk_skb: 6347 callbacks suppressed [ 830.331264][ T43] audit: type=1400 audit(2000000589.054:42630): apparmor="STATUS" info="failed to unpack profile flags" error=-71 profile="unconfined" name="p" pid=14603 comm="syz.4.19238" name="p" offset=58 [ 830.348238][T14608] netlink: 'syz.5.19240': attribute type 8 has an invalid length. [ 830.585730][T14618] bond0: option slaves: interface -v does not exist! [ 830.919659][T14643] kAFS: Invalid Command on /proc/fs/afs/cells file [ 831.041041][T28826] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 831.060760][ T929] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 831.191747][T28826] usb 9-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 831.197944][T28826] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 831.198054][T28826] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 831.198088][T28826] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 831.216468][T28826] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 831.216527][T28826] usb 9-1: Product: syz [ 831.216588][T28826] usb 9-1: Manufacturer: syz [ 831.216618][T28826] usb 9-1: SerialNumber: syz [ 831.233527][ T929] usb 10-1: Using ep0 maxpacket: 32 [ 831.241488][ T929] usb 10-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 831.242906][ T929] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 831.248856][ T929] usb 10-1: config 0 descriptor?? [ 831.264591][ T929] as10x_usb: device has been detected [ 831.265435][ T929] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 831.323834][ T929] usb 10-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 831.500935][T14661] netlink: 4 bytes leftover after parsing attributes in process `syz.2.19267'. [ 831.521949][ T929] as10x_usb: error during firmware upload part1 [ 831.523109][ T929] Registered device nBox DVB-T Dongle [ 831.529203][ T929] usb 10-1: USB disconnect, device number 9 [ 831.657757][ T929] Unregistered device nBox DVB-T Dongle [ 831.672579][ T929] as10x_usb: device has been disconnected [ 831.741657][T28826] usb 9-1: Cannot retrieve CPort count: -110 [ 831.741732][T28826] usb 9-1: Cannot retrieve CPort count: -110 [ 831.741849][T28826] es2_ap_driver 9-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 832.099571][ T929] usb 9-1: USB disconnect, device number 12 [ 832.812463][T14698] pimreg: tun_chr_ioctl cmd 1074025672 [ 832.812873][T14698] pimreg: ignored: set checksum disabled [ 833.462472][T14714] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 833.466375][T14714] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 833.984072][T30495] netdevsim netdevsim6 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.117007][ T5753] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 834.142907][ T5753] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 834.166230][ T5753] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 834.171003][ T5753] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 834.180775][ T5753] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 834.396920][T30495] netdevsim netdevsim6 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.546441][T30495] netdevsim netdevsim6 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.641325][ T5753] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 834.658252][ T5753] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 834.664760][ T5753] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 834.676974][ T5753] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 834.688588][ T5753] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 834.766293][T30495] netdevsim netdevsim6 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.862447][T14752] rnbd_client L607: Mapping device /dev/ram0 on session s1, (access_mode: rw, nr_poll_queues: 0) [ 835.044187][T14752] rtrs_client L2095: : Failed to resolve address, err: -ENODEV [ 835.045406][T14752] rtrs_client L2636: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 835.208505][T30495] bridge_slave_1: left allmulticast mode [ 835.208597][T30495] bridge_slave_1: left promiscuous mode [ 835.212753][T30495] bridge0: port 2(bridge_slave_1) entered disabled state [ 835.235110][T30495] bridge_slave_0: left allmulticast mode [ 835.235209][T30495] bridge_slave_0: left promiscuous mode [ 835.235604][T30495] bridge0: port 1(bridge_slave_0) entered disabled state [ 835.521139][T31404] Bluetooth: hci4: command 0x0c1a tx timeout [ 835.631446][T30495] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 835.638518][T30495] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 835.647872][T30495] bond0 (unregistering): Released all slaves [ 835.743150][T30495] tipc: Disabling bearer [ 835.759488][T30495] tipc: Left network mode [ 836.080780][ T5454] 8021q: adding VLAN 0 to HW filter on device eth10 [ 836.090985][T30496] netdevsim netdevsim6 eth13: set [1, 0] type 2 family 0 port 6081 - 0 [ 836.091073][T30496] netdevsim netdevsim6 eth10: set [1, 0] type 2 family 0 port 6081 - 0 [ 836.091112][T30496] netdevsim netdevsim6 eth11: set [1, 0] type 2 family 0 port 6081 - 0 [ 836.091146][T30496] netdevsim netdevsim6 eth12: set [1, 0] type 2 family 0 port 6081 - 0 [ 836.284899][T30495] hsr_slave_0: left promiscuous mode [ 836.287867][T30495] hsr_slave_1: left promiscuous mode [ 836.291666][T30495] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 836.299091][T30495] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 836.312449][T31404] Bluetooth: hci0: command tx timeout [ 836.326442][T30495] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 836.326518][T30495] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 836.353844][T30495] veth1_macvtap: left promiscuous mode [ 836.353985][T30495] veth0_macvtap: left promiscuous mode [ 836.354093][T30495] veth1_vlan: left promiscuous mode [ 836.354203][T30495] veth0_vlan: left promiscuous mode [ 836.796519][T30495] team0 (unregistering): Port device team_slave_1 removed [ 836.801018][T31404] Bluetooth: hci1: command tx timeout [ 836.814850][T30495] team0 (unregistering): Port device team_slave_0 removed [ 836.992971][ T5454] 8021q: adding VLAN 0 to HW filter on device eth11 [ 837.000670][T30931] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 837.181358][T30931] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 837.183102][T30931] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 837.183133][T30931] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 837.183169][T30931] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 837.189320][T14790] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 837.229561][T30931] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 837.298291][T14731] bridge0: port 1(bridge_slave_0) entered blocking state [ 837.298492][T14731] bridge0: port 1(bridge_slave_0) entered disabled state [ 837.298608][T14731] bridge_slave_0: entered allmulticast mode [ 837.303930][T14731] bridge_slave_0: entered promiscuous mode [ 837.332843][T14731] bridge0: port 2(bridge_slave_1) entered blocking state [ 837.333055][T14731] bridge0: port 2(bridge_slave_1) entered disabled state [ 837.333219][T14731] bridge_slave_1: entered allmulticast mode [ 837.341665][T14731] bridge_slave_1: entered promiscuous mode [ 837.399315][T14731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 837.407000][T14731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 837.465448][T14731] team0: Port device team_slave_0 added [ 837.479672][T14731] team0: Port device team_slave_1 added [ 837.600713][T14731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 837.602092][T14731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 837.602121][T14731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 837.629323][ T5454] 8021q: adding VLAN 0 to HW filter on device eth12 [ 837.675071][T14731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 837.675600][T14731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 837.675625][T14731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 837.780166][T30931] usb 9-1: USB disconnect, device number 13 [ 837.892740][T14744] bridge0: port 1(bridge_slave_0) entered blocking state [ 837.892872][T14744] bridge0: port 1(bridge_slave_0) entered disabled state [ 837.893079][T14744] bridge_slave_0: entered allmulticast mode [ 837.894572][T14744] bridge_slave_0: entered promiscuous mode [ 837.909719][T14744] bridge0: port 2(bridge_slave_1) entered blocking state [ 837.914013][T14744] bridge0: port 2(bridge_slave_1) entered disabled state [ 837.917254][T14744] bridge_slave_1: entered allmulticast mode [ 837.935295][T14744] bridge_slave_1: entered promiscuous mode [ 837.963541][T14731] hsr_slave_0: entered promiscuous mode [ 837.966589][T14731] hsr_slave_1: entered promiscuous mode [ 837.969193][T14731] debugfs: 'hsr0' already exists in 'hsr' [ 837.969280][T14731] Cannot create hsr debugfs directory [ 838.193511][T14744] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 838.204853][T14744] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 838.375398][T14744] team0: Port device team_slave_0 added [ 838.394894][T14744] team0: Port device team_slave_1 added [ 838.401434][T31404] Bluetooth: hci0: command tx timeout [ 838.497631][ T5454] 8021q: adding VLAN 0 to HW filter on device eth13 [ 838.501590][T14744] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 838.501662][T14744] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 838.501703][T14744] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 838.504705][T14744] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 838.504725][T14744] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 838.504749][T14744] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 838.644634][T14744] hsr_slave_0: entered promiscuous mode [ 838.645891][T14744] hsr_slave_1: entered promiscuous mode [ 838.646526][T14744] debugfs: 'hsr0' already exists in 'hsr' [ 838.646548][T14744] Cannot create hsr debugfs directory [ 838.871002][T31404] Bluetooth: hci1: command tx timeout [ 839.185774][T14731] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 839.228439][T14731] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 839.244838][T14731] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 839.269572][T14731] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 839.272800][T14731] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 839.286132][T14731] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 839.287142][T14731] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 839.301868][T14731] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 839.392160][T14744] netdevsim netdevsim5 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 839.392226][T14744] netdevsim netdevsim5 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 839.587087][T14731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 839.613861][T14744] netdevsim netdevsim5 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 839.613966][T14744] netdevsim netdevsim5 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 839.681387][T14851] workqueue: name exceeds WQ_NAME_LEN. Truncating to: `ݗb"^6C2W [ 839.681387][T14851] 7 [ 839.775766][T14744] netdevsim netdevsim5 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 839.775838][T14744] netdevsim netdevsim5 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 839.862660][T14731] 8021q: adding VLAN 0 to HW filter on device team0 [ 839.902399][ T1172] bridge0: port 1(bridge_slave_0) entered blocking state [ 839.902528][ T1172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 839.965345][ T1172] bridge0: port 2(bridge_slave_1) entered blocking state [ 839.965499][ T1172] bridge0: port 2(bridge_slave_1) entered forwarding state [ 839.984091][T14744] netdevsim netdevsim5 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 839.984175][T14744] netdevsim netdevsim5 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 840.458318][T14871] lo: entered allmulticast mode [ 840.470740][T31404] Bluetooth: hci0: command tx timeout [ 840.585654][T14878] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 840.601725][T14744] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 840.638101][T14744] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 840.642636][T14744] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 840.663716][T14744] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 840.665052][T14744] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 840.679466][T14744] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 840.687294][T14744] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 840.716838][T14744] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 840.951998][T31404] Bluetooth: hci1: command tx timeout [ 841.027582][T14731] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 841.115223][T14744] 8021q: adding VLAN 0 to HW filter on device bond0 [ 841.142908][T14744] 8021q: adding VLAN 0 to HW filter on device team0 [ 841.155490][ T55] bridge0: port 1(bridge_slave_0) entered blocking state [ 841.155634][ T55] bridge0: port 1(bridge_slave_0) entered forwarding state [ 841.163470][ T55] bridge0: port 2(bridge_slave_1) entered blocking state [ 841.163618][ T55] bridge0: port 2(bridge_slave_1) entered forwarding state [ 841.496842][T14731] veth0_vlan: entered promiscuous mode [ 841.506635][T14731] veth1_vlan: entered promiscuous mode [ 841.559898][T14731] veth0_macvtap: entered promiscuous mode [ 841.565396][T14731] veth1_macvtap: entered promiscuous mode [ 841.587362][T14731] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 841.625411][T14731] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 841.684052][T30501] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 841.684526][T30501] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 841.684811][T30501] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 841.685011][T30501] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 841.892618][T14744] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 841.908326][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 841.908968][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 842.034126][T28091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 842.034256][T28091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 842.390036][T14744] veth0_vlan: entered promiscuous mode [ 842.419092][T14744] veth1_vlan: entered promiscuous mode [ 842.427190][T14941] bonding: no command found in bonding_masters - use +ifname or -ifname [ 842.452149][T14942] busy [ 842.563594][T31404] Bluetooth: hci0: command tx timeout [ 842.603851][T14744] veth0_macvtap: entered promiscuous mode [ 842.616160][T14744] veth1_macvtap: entered promiscuous mode [ 842.653729][T14744] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 842.676711][T14744] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 842.701345][T28090] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 842.701421][T28090] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 842.701454][T28090] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 842.768052][T28090] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 842.876659][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 842.876740][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 842.924474][T28091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 842.924582][T28091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 843.002980][T14954] usb usb7: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 843.043248][T31404] Bluetooth: hci1: command tx timeout [ 843.224157][ T10] hid_parser_main: 6 callbacks suppressed [ 843.224989][ T10] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 843.225024][ T10] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 843.230758][ T10] hid-generic 0000:0000:0000.000F: hidraw0: HID v0.00 Device [syz0] on syz0 [ 843.399987][T14968] loop9: detected capacity change from 0 to 7 [ 843.404174][T14962] fido_id[14962]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 843.430607][T14968] Dev loop9: unable to read RDB block 7 [ 843.430678][T14968] loop9: unable to read partition table [ 843.430933][T14968] loop9: partition table beyond EOD, truncated [ 843.430950][T14968] loop_reread_partitions: partition scan of loop9 (被x ) failed (rc=-5) [ 844.246344][T14999] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x88d7 instead [ 844.251743][T14999] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x5aa4 instead [ 844.257004][T14999] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000100: 0x642f instead [ 844.262095][T14999] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000104: 0x6d2f instead [ 844.267688][T14999] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000108: 0x0023 instead [ 844.272746][T14999] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000244: 0x00e4 instead [ 844.272769][T14999] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000024c: 0x00e4 instead [ 844.296606][T14999] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 844.301381][T14999] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 844.586788][T15009] netlink: 4 bytes leftover after parsing attributes in process `syz.7.19368'. [ 844.836928][T15016] kAFS: bad VL server IP address [ 845.072720][T15024] netlink: 16 bytes leftover after parsing attributes in process `syz.7.19374'. [ 846.017872][T15054] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 846.018309][T15054] overlayfs: NFS export requires an index dir, falling back to nfs_export=off. [ 849.380414][T15159] loop5: detected capacity change from 0 to 7 [ 849.410752][T15159] Dev loop5: unable to read RDB block 7 [ 849.410806][T15159] loop5: AHDI p1 [ 849.410861][T15159] loop5: partition table partially beyond EOD, truncated [ 849.427253][ T5152] Dev loop5: unable to read RDB block 7 [ 849.427365][ T5152] loop5: AHDI p1 [ 849.427420][ T5152] loop5: partition table partially beyond EOD, truncated [ 850.945187][T15210] netlink: 'syz.7.19454': attribute type 1 has an invalid length. [ 850.945243][T15210] netlink: 8 bytes leftover after parsing attributes in process `syz.7.19454'. [ 850.945320][T15210] netlink: 'syz.7.19454': attribute type 1 has an invalid length. [ 850.945348][T15210] netlink: 8 bytes leftover after parsing attributes in process `syz.7.19454'. [ 850.945416][T15210] iwpm_send_hello: Unable to send a nlmsg [ 850.994598][T15213] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 851.208064][T15215] netdevsim netdevsim1 eth9 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 851.525160][ T43] audit: type=1400 audit(2000000610.244:42631): apparmor="STATUS" info="invalid profile format" error=-93 profile="unconfined" pid=15232 comm="syz.2.19460" [ 851.606838][T15215] netdevsim netdevsim1 eth8 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 851.775986][T15215] netdevsim netdevsim1 eth7 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 851.800686][ T25] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 851.972877][ T25] usb 10-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 851.974233][ T25] usb 10-1: config 1 has an invalid interface number: 3 but max is 0 [ 851.974259][ T25] usb 10-1: config 1 has no interface number 0 [ 851.976903][ T25] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 851.976928][ T25] usb 10-1: Product: syz [ 851.976943][ T25] usb 10-1: Manufacturer: syz [ 851.976957][ T25] usb 10-1: SerialNumber: syz [ 851.985999][ T25] usb 10-1: 3:1 : does not exist [ 851.986020][ T25] usb 10-1: 3:2 : does not exist [ 852.188685][T15215] netdevsim netdevsim1 eth6 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 852.211612][ T3270] usb 10-1: USB disconnect, device number 10 [ 852.391191][T31404] Bluetooth: hci3: Entering manufacturer mode failed (-110) [ 853.259303][T15295] Bluetooth: MGMT ver 1.23 [ 857.446351][T15494] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -11 0 [ 858.189200][T15511] netlink: 12 bytes leftover after parsing attributes in process `syz.7.19554'. [ 858.507103][ C0] vcan0: j1939_tp_rxtimer: 0xffff88806b320c00: rx timeout, send abort [ 858.734710][T15535] profile_transition: unconfined exec no attachment [ 859.010802][ C0] vcan0: j1939_tp_rxtimer: 0xffff88806b320c00: abort rx timeout. Force session deactivation [ 859.355101][T15557] netlink: 8 bytes leftover after parsing attributes in process `syz.5.19577'. [ 859.374433][T15557] macvlan0: entered allmulticast mode [ 859.374502][T15557] dummy0: entered allmulticast mode [ 859.417169][T15557] dummy0: entered promiscuous mode [ 859.606925][T15566] profile_transition: unconfined exec no attachment [ 859.631988][T15569] profile_transition: unconfined exec no attachment [ 859.646586][T15570] profile_transition: unconfined exec no attachment [ 859.727330][T15573] profile_transition: unconfined exec no attachment [ 859.736656][T15574] profile_transition: unconfined exec no attachment [ 859.774932][T15578] profile_transition: unconfined exec no attachment [ 859.954345][T15584] profile_transition: unconfined exec no attachment [ 860.076792][T15590] profile_transition: unconfined exec no attachment [ 860.097800][ T43] audit: type=1326 audit(2000000618.814:42632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=15587 comm="syz.2.19587" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 860.097900][ T43] audit: type=1326 audit(2000000618.814:42633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=15587 comm="syz.2.19587" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 860.123083][ T43] audit: type=1326 audit(2000000618.834:42634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=15587 comm="syz.2.19587" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 860.123134][ T43] audit: type=1326 audit(2000000618.834:42635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=15587 comm="syz.2.19587" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 860.123169][ T43] audit: type=1326 audit(2000000618.834:42636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=15587 comm="syz.2.19587" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 860.123207][ T43] audit: type=1326 audit(2000000618.844:42637): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=15587 comm="syz.2.19587" exe="/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 860.313915][T15599] profile_transition: unconfined exec no attachment [ 860.627996][ T43] audit: type=1326 audit(2000000619.344:42638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=15587 comm="syz.2.19587" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 860.631494][ T43] audit: type=1326 audit(2000000619.344:42639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=15587 comm="syz.2.19587" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 860.775469][T15609] netlink: 'syz.5.19594': attribute type 4 has an invalid length. [ 861.282889][T15627] netlink: 12 bytes leftover after parsing attributes in process `syz.7.19601'. [ 861.294596][T15627] ipvlan2: entered allmulticast mode [ 861.294661][T15627] syz_tun: entered allmulticast mode [ 861.592143][T15636] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 861.958422][T15658] aa_policy_admin_capable: cap_mac_admin? 1 [ 861.963433][T15658] aa_policy_admin_capable: policy locked? 0 [ 861.966391][T15658] unpack_pdb: unpacking tags [ 861.966530][T15658] unpack_pdb: done unpacking tags [ 861.968521][ T43] audit: type=1400 audit(2000000620.684:42640): apparmor="STATUS" info="failed to unpack profile flags" error=-71 profile="unconfined" name="p" pid=15656 comm="syz.5.19615" name="p" offset=48 [ 861.979275][T15658] aa_free_profile: aa_free_profile(ffff88806d48dc00) [ 862.193633][ T30] logitech-hidpp-device 0005:046D:B012.0010: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 862.409344][T15674] bond0: invalid ARP target specified [ 862.413466][T15669] fido_id[15669]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 862.420798][ T25] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 862.580792][ T25] usb 12-1: Using ep0 maxpacket: 8 [ 862.581637][ T25] usb 12-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 862.585566][ T25] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 862.585610][ T25] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 862.612814][ T25] usb 12-1: config 0 descriptor?? [ 862.719117][T15687] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 862.878513][ T25] iowarrior 12-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 863.316561][T15709] netlink: 12 bytes leftover after parsing attributes in process `syz.5.19639'. [ 863.331189][T15709] ipvlan2: entered allmulticast mode [ 863.331226][T15709] syz_tun: entered allmulticast mode [ 865.048108][T28826] usb 12-1: USB disconnect, device number 2 [ 866.304959][ T441] IPVS: starting estimator thread 0... [ 866.410739][T15791] IPVS: using max 23 ests per chain, 55200 per kthread [ 867.020197][T15813] smc: removing net device vlan1 with user defined pnetid SYZ2 [ 867.834492][T15844] profile_transition: 6 callbacks suppressed [ 867.838612][T15844] profile_transition: unconfined exec no attachment [ 867.887052][T15847] netlink: 68 bytes leftover after parsing attributes in process `syz.4.19693'. [ 867.913198][T15850] profile_transition: unconfined exec no attachment [ 868.951737][T15880] profile_transition: unconfined exec no attachment [ 868.993259][T15881] profile_transition: unconfined exec no attachment [ 869.282545][T15894] bond0: invalid ARP target specified [ 869.410631][ T10] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 869.458866][T15897] can0: slcan on ttyS3. [ 869.707164][ T10] usb 9-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 869.711420][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 869.711444][ T10] usb 9-1: Product: syz [ 869.711458][ T10] usb 9-1: Manufacturer: syz [ 869.711469][ T10] usb 9-1: SerialNumber: syz [ 869.722162][T15897] can0 (unregistered): slcan off ttyS3. [ 870.012860][ T10] rtl8150 9-1:1.0: couldn't reset the device [ 870.013782][ T10] rtl8150 9-1:1.0: probe with driver rtl8150 failed with error -5 [ 870.049299][T15907] profile_transition: unconfined exec no attachment [ 870.149032][T15909] profile_transition: unconfined exec no attachment [ 870.228654][T15912] profile_transition: unconfined exec no attachment [ 870.281205][ T10] usb 9-1: USB disconnect, device number 14 [ 870.285016][T15913] profile_transition: unconfined exec no attachment [ 870.323955][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.251296][T15930] profile_transition: unconfined exec no attachment [ 871.426394][T15938] profile_transition: unconfined exec no attachment [ 871.668117][T15946] profile_transition: name lookup ix on error [ 872.024237][T15959] gretap0: entered promiscuous mode [ 872.029593][T15959] netlink: 8 bytes leftover after parsing attributes in process `syz.4.19738'. [ 872.034199][T15959] gretap0: left promiscuous mode [ 872.631092][T29872] usb 12-1: new full-speed USB device number 3 using dummy_hcd [ 872.988540][T29872] usb 12-1: unable to get BOS descriptor or descriptor too short [ 872.992812][T29872] usb 12-1: New USB device found, idVendor=0021, idProduct=0000, bcdDevice= 0.00 [ 872.992878][T29872] usb 12-1: no configurations [ 872.992933][T29872] usb 12-1: can't read configurations, error -22 [ 873.809312][T31404] Bluetooth: hci4: unexpected event for opcode 0x1005 [ 874.071867][ T43] audit: type=1400 audit(2000000632.794:42641): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=3AAE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F7D91F81B621CC4214D4A27E1614FBEE0BEAC8F4A045070B770212D46D4A2DF096B791F2A4BA218E12CB76AA24945B70A7C9DD5EDEAC52B5A876F73CFBE66371A72F11F3D9544D6B59B4A5541DCEF5CBF11FFFF37DFD147C8A3E5098A207BE806EA7167101F8C1B5C8FE41E170FD0C775DBC5BE0B6D3AB625AB702E5B1DC15F9C4B3D09BE812F340E681E0694F5BADF640DA3FDFC2F929B4C2BEB9A592C577287B6021BFEEC24146C7F95608BB60A736207A09D9F47E89C4044EADDE57CDEFD15F25B822D2EAF2205DF0D6B71B63EE0B63CB598F26509AF36983578F6F4198A0843CC1B1BD780015007AB9709CC6211E3B5C685B972B5C5E95F054A7A9FE149282F679C8466B9734E3850EC98419DD0C887715902F9E7802842085BC606F30C2654869E9E3701FD0FC69137FE165592689465EEBD5CAFAD7C29DE2ADADEC42A818D8EE389CA1FE33A1EF23617C89116A3A458B56612E4C36C43A9150D5331ADBB0BEB01A062B1F1349FC2ECEA76CB7C40CDFE378185F3099B1D71414D0FDA5A47F8593260CC0BD723A4CCA81435F [ 874.397984][T16059] netlink: 28 bytes leftover after parsing attributes in process `syz.5.19783'. [ 874.443207][T15252] usb 12-1: new high-speed USB device number 5 using dummy_hcd [ 874.646727][T15252] usb 12-1: unable to get BOS descriptor or descriptor too short [ 874.647299][T15252] usb 12-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 874.647320][T15252] usb 12-1: no configurations [ 874.647328][T15252] usb 12-1: can't read configurations, error -22 [ 875.234461][T16086] team_slave_0: entered promiscuous mode [ 875.235941][T16085] team_slave_0: left promiscuous mode [ 875.323411][T31404] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 875.323485][T31404] CPU: 2 UID: 0 PID: 31404 Comm: kworker/u34:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 875.323516][T31404] Tainted: [L]=SOFTLOCKUP [ 875.323524][T31404] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 875.323538][T31404] Workqueue: hci0 hci_rx_work [ 875.323564][T31404] Call Trace: [ 875.323572][T31404] [ 875.323601][T31404] dump_stack_lvl+0x100/0x190 [ 875.323632][T31404] sysfs_warn_dup.cold+0x1c/0x28 [ 875.323661][T31404] sysfs_create_dir_ns+0x24b/0x2b0 [ 875.323682][T31404] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 875.323703][T31404] ? find_held_lock+0x2b/0x80 [ 875.323722][T31404] ? kobject_add_internal+0x25f/0x930 [ 875.323752][T31404] ? kobject_add_internal+0x25f/0x930 [ 875.323781][T31404] ? do_raw_spin_unlock+0x145/0x1e0 [ 875.323810][T31404] kobject_add_internal+0x2c8/0x930 [ 875.323841][T31404] kobject_add+0x16a/0x1e0 [ 875.323859][T31404] ? __pfx_kobject_add+0x10/0x10 [ 875.323876][T31404] ? class_to_subsys+0x10f/0x150 [ 875.323906][T31404] ? kobject_put+0xb9/0x640 [ 875.323931][T31404] ? _raw_spin_unlock+0x28/0x50 [ 875.323958][T31404] device_add+0x294/0x1970 [ 875.323983][T31404] ? __pfx_dev_set_name+0x10/0x10 [ 875.324011][T31404] ? __pfx_device_add+0x10/0x10 [ 875.324035][T31404] ? mgmt_send_event_skb+0x2fb/0x460 [ 875.324066][T31404] hci_conn_add_sysfs+0x1a3/0x260 [ 875.324091][T31404] le_conn_complete_evt+0x122f/0x2130 [ 875.324120][T31404] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 875.324140][T31404] ? hci_event_packet+0x186/0xcd0 [ 875.324161][T31404] ? hci_event_packet+0x186/0xcd0 [ 875.324212][T31404] hci_le_enh_conn_complete_evt+0x23d/0x3b0 [ 875.324238][T31404] ? skb_pull_data+0x15f/0x1e0 [ 875.324269][T31404] hci_le_meta_evt+0x34a/0x5f0 [ 875.324293][T31404] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 875.324318][T31404] hci_event_packet+0x51c/0xcd0 [ 875.324340][T31404] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 875.324362][T31404] ? __pfx_hci_event_packet+0x10/0x10 [ 875.324388][T31404] ? lockdep_hardirqs_on+0x7d/0x110 [ 875.324416][T31404] hci_rx_work+0x451/0xfc0 [ 875.324453][T31404] process_one_work+0xac7/0x1b10 [ 875.324487][T31404] ? __pfx_process_one_work+0x10/0x10 [ 875.324512][T31404] ? lock_acquire+0x1d1/0x380 [ 875.324540][T31404] ? __pfx_hci_rx_work+0x10/0x10 [ 875.324562][T31404] worker_thread+0x5ef/0xe50 [ 875.324591][T31404] ? __pfx_worker_thread+0x10/0x10 [ 875.324615][T31404] ? kthread+0x13a/0x450 [ 875.324633][T31404] ? __pfx_worker_thread+0x10/0x10 [ 875.324652][T31404] kthread+0x373/0x450 [ 875.324672][T31404] ? __pfx_kthread+0x10/0x10 [ 875.324694][T31404] ret_from_fork+0x730/0xd60 [ 875.324724][T31404] ? __pfx_ret_from_fork+0x10/0x10 [ 875.324751][T31404] ? rcu_is_watching+0x13/0xc0 [ 875.324769][T31404] ? __switch_to+0x800/0x10f0 [ 875.324792][T31404] ? __pfx_kthread+0x10/0x10 [ 875.324812][T31404] ret_from_fork_asm+0x1a/0x30 [ 875.324840][T31404] [ 875.324929][T31404] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 875.324962][T31404] Bluetooth: hci0: failed to register connection device [ 875.386900][T14662] udevd[14662]: inotify_add_watch(7, /dev/nbd4, 10) failed: No such file or directory [ 875.394083][ T67] block nbd4: Receive control failed (result -32) [ 875.400808][T14662] udevd[14662]: inotify_add_watch(7, /dev/nbd4, 10) failed: No such file or directory [ 875.574268][T16088] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 875.578347][T16088] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 875.647357][T16088] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 875.690148][T16098] VIDIOC_REQBUFS: count=2, type=vid-out, memory=mmap [ 875.724207][T16088] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 875.726412][T16103] profile_transition: 2 callbacks suppressed [ 875.728788][T16103] profile_transition: unconfined exec no attachment [ 875.750234][T16088] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 875.767018][T16088] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 875.767289][T16088] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 875.782563][T16088] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 876.629603][T16147] bond6: invalid ARP target 0.0.0.0 specified for addition [ 876.634654][T16147] bond6: option arp_ip_target: invalid value (0) [ 876.779961][T16147] bond6 (unregistering): Released all slaves [ 876.830951][ T5857] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 876.994066][ T5857] usb 10-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 876.995341][ T5857] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 876.995360][ T5857] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 876.995380][ T5857] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 877.009774][ T5857] spcp8x5 10-1:1.0: SPCP8x5 converter detected [ 877.062553][ T5857] usb 10-1: SPCP8x5 converter now attached to ttyUSB0 [ 877.144125][T15252] logitech-hidpp-device 0003:046D:C082.0011: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 877.178879][T16153] profile_transition: unconfined exec no attachment [ 877.274314][T16153] fido_id[16153]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 877.390288][ T10] usb 10-1: USB disconnect, device number 11 [ 877.424675][T16158] profile_transition: unconfined exec no attachment [ 877.430230][ T10] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 877.435451][ T10] spcp8x5 10-1:1.0: device disconnected [ 877.548000][T16162] profile_transition: unconfined exec no attachment [ 877.591767][ T5753] Bluetooth: hci0: command 0x0c1a tx timeout [ 877.593092][ T5753] Bluetooth: hci4: command 0x0c1a tx timeout [ 877.611319][T16165] profile_transition: unconfined exec no attachment [ 877.727051][T16169] profile_transition: unconfined exec no attachment [ 877.830757][T31404] Bluetooth: hci1: command 0x0c1a tx timeout [ 877.837351][T16172] profile_transition: unconfined exec no attachment [ 878.067983][T16176] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 878.068224][T16176] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 878.068378][T16176] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 878.155732][T16182] netlink: 'syz.5.19834': attribute type 1 has an invalid length. [ 878.156713][T16182] block nbd5: shutting down sockets [ 878.288129][T16192] ref_ctr_offset mismatch. inode: 0x265 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x300000018 [ 878.605302][T16205] Failed to get privilege flags for destination (handle=0x2:0x0) [ 878.684352][T16210] profile_transition: unconfined exec no attachment [ 878.731613][T16209] netlink: 8 bytes leftover after parsing attributes in process `syz.5.19848'. [ 878.872527][T16209] bridge0: port 2(bridge_slave_1) entered disabled state [ 878.897864][T16217] usbip-vudc usbip-vudc.0: gadget not bound [ 879.734292][T16249] ALSA: mixer_oss: invalid OSS volume '{~/' [ 880.072968][ T5753] Bluetooth: hci1: command 0x0c1a tx timeout [ 880.073050][ T5753] Bluetooth: hci0: command 0x0c1a tx timeout [ 880.073150][ T5753] Bluetooth: hci4: command 0x0c1a tx timeout [ 880.242953][T30931] wiimote 0005:057E:0306.0012: hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 880.243399][T30931] wiimote 0005:057E:0306.0012: New device registered [ 880.266202][T16274] profile_transition: unconfined exec no attachment [ 880.434730][T16281] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 880.440712][ T5857] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 880.594597][ T5857] usb 10-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 880.596588][ T5857] usb 10-1: config 1 has an invalid interface number: 3 but max is 0 [ 880.596613][ T5857] usb 10-1: config 1 has no interface number 0 [ 880.601426][ T5857] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 880.601449][ T5857] usb 10-1: Product: syz [ 880.601462][ T5857] usb 10-1: Manufacturer: syz [ 880.601475][ T5857] usb 10-1: SerialNumber: syz [ 880.613800][ T5857] usb 10-1: cannot find UAC_HEADER [ 880.733404][ T5857] snd-usb-audio 10-1:1.3: probe with driver snd-usb-audio failed with error -22 [ 880.775564][T14662] udevd[14662]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb10/10-1/10-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 880.790405][T16301] netlink: 24 bytes leftover after parsing attributes in process `syz.7.19888'. [ 880.834080][T16270] wiimote 0005:057E:0306.0012: Unhandled report 0 size 6 [ 880.841449][ T5857] usb 10-1: USB disconnect, device number 12 [ 880.853268][T16269] wiimote 0005:057E:0306.0012: Device removed [ 881.280828][ T25] wiimote 0005:057E:0306.0012: detected device: Nintendo Wii Remote (Gen 1) [ 881.293219][ T25] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0012/input/input87 [ 881.387230][ T25] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0012/input/input88 [ 881.457416][ T25] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0012/input/input86 [ 882.155768][T31404] Bluetooth: hci0: command 0x0c1a tx timeout [ 882.155850][T31404] Bluetooth: hci1: command 0x0c1a tx timeout [ 882.217510][T16340] profile_transition: unconfined exec no attachment [ 882.375225][T16347] bond1: invalid ARP target 0.0.0.0 specified for addition [ 882.379172][T16347] bond1: option arp_ip_target: invalid value (0) [ 882.387254][T16347] bond1 (unregistering): Released all slaves [ 883.498655][T16389] batadv_slave_1: entered promiscuous mode [ 883.500702][T16389] batadv_slave_1: left promiscuous mode [ 883.709680][T16397] input: syz1 as /devices/virtual/input/input89 [ 883.780619][ T10] usb 12-1: new high-speed USB device number 7 using dummy_hcd [ 883.909704][T16408] profile_transition: unconfined exec no attachment [ 883.943899][T16409] profile_transition: unconfined exec no attachment [ 883.961379][ T10] usb 12-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 883.962930][ T10] usb 12-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 883.962956][ T10] usb 12-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 883.962986][ T10] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 883.977781][ T10] spcp8x5 12-1:1.0: SPCP8x5 converter detected [ 884.001434][ T10] usb 12-1: SPCP8x5 converter now attached to ttyUSB0 [ 884.231159][ T5753] Bluetooth: hci0: command 0x0c1a tx timeout [ 884.309976][T29872] usb 12-1: USB disconnect, device number 7 [ 884.346842][T29872] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 884.354713][T29872] spcp8x5 12-1:1.0: device disconnected [ 884.463439][T16426] profile_transition: unconfined exec no attachment [ 884.896787][T16437] vxcan0: tx address claim with dlc 0 [ 884.982419][ T5753] Bluetooth: hci0: unexpected subevent 0x18 length: 30 > 19 [ 884.982535][ T5753] Bluetooth: hci0: Unable to find connection for dst 00:00:00:00:00:00 sid 0x00 [ 885.737837][T16447] netlink: 4 bytes leftover after parsing attributes in process `syz.2.19952'. [ 885.761469][T16439] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 885.761753][T16439] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 885.761884][T16439] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 886.269969][T16468] nfsd: exp_rootfh path not found ./export_dir [ 886.371371][T16474] profile_transition: unconfined exec no attachment [ 886.875633][T16493] profile_transition: unconfined exec no attachment [ 886.910109][T16494] profile_transition: unconfined exec no attachment [ 887.031027][ T5753] Bluetooth: hci4: command 0x0c1a tx timeout [ 887.830559][ T5753] Bluetooth: hci0: command 0x0c1a tx timeout [ 887.926149][T16539] netlink: 4 bytes leftover after parsing attributes in process `syz.7.19993'. [ 888.083052][T16545] usb usb8: usbfs: process 16545 (syz.7.19996) did not claim interface 0 before use [ 888.087308][T16547] veth0: entered promiscuous mode [ 888.114616][T16547] veth0: left promiscuous mode [ 888.319794][T16559] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 888.319979][T16559] overlayfs: overlapping lowerdir path [ 888.941138][ T5857] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 889.104595][ T5857] usb 9-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 889.131424][ T5857] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.131502][ T5857] usb 9-1: Product: syz [ 889.131588][ T5857] usb 9-1: Manufacturer: syz [ 889.131598][ T5857] usb 9-1: SerialNumber: syz [ 889.282778][ T25] usb 9-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 890.078896][T16603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 890.103567][T16603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 890.392719][ T25] ath9k_htc 9-1:1.0: ath9k_htc: Target is unresponsive [ 890.393162][ T25] ath9k_htc: Failed to initialize the device [ 890.421536][ T25] usb 9-1: ath9k_htc: USB layer deinitialized [ 890.502898][ T5857] usb 9-1: USB disconnect, device number 15 [ 891.957618][T16608] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 891.957798][T16608] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 891.957902][T16608] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 892.297046][T16618] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 892.297163][T16618] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 892.297220][T16618] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 892.297277][T16618] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 892.297333][T16618] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 892.297389][T16618] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 892.297446][T16618] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 892.297502][T16618] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 892.297558][T16618] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 892.297615][T16618] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 892.449025][T16624] loop9: detected capacity change from 0 to 524287998 [ 892.856480][ T30] wiimote 0005:057E:0306.0013: hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 892.862635][ T30] wiimote 0005:057E:0306.0013: New device registered [ 892.932290][T16633] profile_transition: unconfined exec no attachment [ 893.100667][ T30] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 893.215104][T16640] profile_transition: unconfined exec no attachment [ 893.252190][ T30] usb 9-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 893.261357][ T30] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 893.261408][ T30] usb 9-1: config 1 has no interface number 0 [ 893.275757][ T30] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 893.275838][ T30] usb 9-1: Product: syz [ 893.275891][ T30] usb 9-1: Manufacturer: syz [ 893.275921][ T30] usb 9-1: SerialNumber: syz [ 893.285383][T31404] Bluetooth: hci4: command 0x0c1a tx timeout [ 893.310416][ T30] usb 9-1: cannot find UAC_HEADER [ 893.424765][ T30] snd-usb-audio 9-1:1.3: probe with driver snd-usb-audio failed with error -22 [ 893.541093][T28826] wiimote 0005:057E:0306.0013: detected device: Nintendo Wii Remote (Gen 1) [ 893.602306][ T5857] usb 9-1: USB disconnect, device number 16 [ 893.619128][T16626] wiimote 0005:057E:0306.0013: Device removed [ 893.636576][T28826] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0013/input/input97 [ 893.647135][T28826] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0013/input/input98 [ 893.669739][T28826] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0013/input/input96 [ 893.898805][T16654] netlink: 'syz.5.20051': attribute type 14 has an invalid length. [ 893.923060][T14662] udevd[14662]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb9/9-1/9-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 894.000640][T31404] Bluetooth: hci1: command 0x0c1a tx timeout [ 894.011389][ T5753] Bluetooth: hci0: command 0x0c1a tx timeout [ 894.051756][T16660] profile_transition: unconfined exec no attachment [ 894.056474][T16633] fido_id[16633]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 894.216305][T16663] sctp: Trying to GSO but underlying device doesn't support it. [ 895.137937][T16694] netlink: 'syz.5.20060': attribute type 9 has an invalid length. [ 895.479240][T16703] serio: Serial port ttynull [ 895.500067][ T5857] hid-generic 0000:0000:0000.0014: unknown main item tag 0x0 [ 895.504025][ T5857] hid-generic 0000:0000:0000.0014: hidraw1: HID v0.00 Device [syz1] on syz0 [ 895.550537][T16707] profile_transition: unconfined exec no attachment [ 895.641090][T16701] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input99 [ 896.046155][ T64] bridge0: port 2(bridge_slave_1) entered blocking state [ 896.046317][ T64] bridge0: port 2(bridge_slave_1) entered forwarding state [ 896.071050][T31404] Bluetooth: hci1: command 0x0c1a tx timeout [ 896.278814][ T5753] Bluetooth: hci3: sending frame failed (-49) [ 896.280547][T31404] Bluetooth: hci3: Opcode 0x1003 failed: -49 [ 896.480676][T29872] usb 12-1: new high-speed USB device number 8 using dummy_hcd [ 896.631185][T29872] usb 12-1: Using ep0 maxpacket: 8 [ 896.634416][T29872] usb 12-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 896.639417][T29872] usb 12-1: config index 0 descriptor too short (expected 74, got 45) [ 896.639484][T29872] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 896.639564][T29872] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 896.639599][T29872] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 896.639652][T29872] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 896.639685][T29872] usb 12-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 896.639731][T29872] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 896.935062][T29872] usb 12-1: GET_CAPABILITIES returned 0 [ 896.935142][T29872] usbtmc 12-1:16.0: can't read capabilities [ 897.157705][T29872] usb 12-1: USB disconnect, device number 8 [ 899.037494][T31404] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 899.044611][ T5753] Bluetooth: hci3: command 0x1003 tx timeout [ 899.404426][T16761] profile_transition: unconfined exec no attachment [ 899.421265][T16760] loop9: detected capacity change from 0 to 524287998 [ 899.465049][T16763] snd_hda_intel 0000:00:00.0: Unknown PCI class/subclass/prog-if information (0x060000) found, selecting HDAudio legacy driver [ 899.465140][T16763] snd_hda_intel 0000:00:00.0: Too small PCI BAR0 [ 899.476594][T16763] snd_hda_intel 0000:00:00.0: probe with driver snd_hda_intel failed with error -22 [ 899.667813][T16766] profile_transition: unconfined exec no attachment [ 900.106441][T16770] pimreg: entered allmulticast mode [ 900.124174][T16770] pimreg: left allmulticast mode [ 900.842850][T16784] netlink: 4 bytes leftover after parsing attributes in process `syz.5.20097'. [ 901.058781][T29872] kernel write not supported for file bpf-map (pid: 29872 comm: kworker/1:3) [ 901.373151][T16800] netlink: 8 bytes leftover after parsing attributes in process `syz.5.20106'. [ 901.421627][T16802] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 901.501365][T16807] profile_transition: unconfined exec no attachment [ 902.703976][T16863] netlink: 16 bytes leftover after parsing attributes in process `syz.7.20133'. [ 903.665895][T16909] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 904.774779][T16945] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x88d7 instead [ 904.775373][T16945] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x5aa4 instead [ 904.775422][T16945] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000100: 0x642f instead [ 904.775442][T16945] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000104: 0x6d2f instead [ 904.775461][T16945] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000108: 0x0023 instead [ 904.775509][T16945] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000244: 0x00e4 instead [ 904.775527][T16945] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000024c: 0x00e4 instead [ 904.814626][T16945] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 904.815147][T16945] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 905.131416][T16954] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0, syncid = 1, id = 0 [ 905.369091][T16962] profile_transition: unconfined exec no attachment [ 905.448782][T16964] profile_transition: unconfined exec no attachment [ 906.423009][T16999] kernel read not supported for file /eth0 (pid: 16999 comm: syz.7.20193) [ 906.423953][ T43] audit: type=1800 audit(2000000665.144:42642): pid=16999 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed comm="syz.7.20193" name="eth0" dev="mqueue" ino=178769 res=0 errno=0 [ 906.704359][T17013] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x88d7 instead [ 906.704755][T17013] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x5aa4 instead [ 906.704783][T17013] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000100: 0x642f instead [ 906.704793][T17013] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000104: 0x6d2f instead [ 906.704803][T17013] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000108: 0x0023 instead [ 906.704831][T17013] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000244: 0x00e4 instead [ 906.704842][T17013] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000024c: 0x00e4 instead [ 906.726035][T17013] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 906.726048][T17013] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 907.200814][T17028] netlink: 4 bytes leftover after parsing attributes in process `syz.4.20206'. [ 907.200907][T17028] netlink: 16 bytes leftover after parsing attributes in process `syz.4.20206'. [ 907.847162][T17064] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x88d7 instead [ 907.847253][T17064] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x5aa4 instead [ 907.848057][T17064] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000100: 0x642f instead [ 907.848083][T17064] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000104: 0x6d2f instead [ 907.848102][T17064] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000108: 0x0023 instead [ 907.848161][T17064] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000244: 0x00e4 instead [ 907.848229][T17064] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000024c: 0x00e4 instead [ 907.863572][ T43] audit: type=1326 audit(2000000666.584:42643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=17062 comm="syz.2.20222" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 907.863814][ T43] audit: type=1326 audit(2000000666.584:42644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=17062 comm="syz.2.20222" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 907.865404][ T43] audit: type=1326 audit(2000000666.584:42645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=17062 comm="syz.2.20222" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 907.865634][ T43] audit: type=1326 audit(2000000666.584:42646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=17062 comm="syz.2.20222" exe="/syz-executor" sig=0 arch=40000003 syscall=460 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 907.866036][ T43] audit: type=1326 audit(2000000666.584:42647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=17062 comm="syz.2.20222" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 907.866082][ T43] audit: type=1326 audit(2000000666.584:42648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=17062 comm="syz.2.20222" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 907.866125][ T43] audit: type=1326 audit(2000000666.584:42649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=17062 comm="syz.2.20222" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 907.866744][ T43] audit: type=1326 audit(2000000666.584:42650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=17062 comm="syz.2.20222" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 907.867525][T17064] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 907.867540][T17064] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 907.870695][ T43] audit: type=1326 audit(2000000666.594:42651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=17062 comm="syz.2.20222" exe="/syz-executor" sig=0 arch=40000003 syscall=252 compat=1 ip=0xf7f34fec code=0x7ffc0000 [ 908.176356][T17070] 8021q: adding VLAN 0 to HW filter on device b [ 908.179352][T17070] batman_adv: batadv0: Interface activated: vlan3 [ 908.180216][T17070] net_ratelimit: 44 callbacks suppressed [ 908.180233][T17070] A link change request failed with some changes committed already. Interface dvmrp0 may have been left with an inconsistent configuration, please check. [ 911.990649][T29872] usb 12-1: new high-speed USB device number 9 using dummy_hcd [ 912.140710][T29872] usb 12-1: Using ep0 maxpacket: 16 [ 912.141756][T29872] usb 12-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 912.142604][T29872] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 912.142622][T29872] usb 12-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 912.142643][T29872] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 912.143912][T29872] usb 12-1: config 0 descriptor?? [ 912.283685][T17152] netlink: 24 bytes leftover after parsing attributes in process `syz.2.20263'. [ 912.311663][T17156] rnbd_client L213: map_device: Parameters missing [ 913.065879][T17184] aa_policy_admin_capable: cap_mac_admin? 1 [ 913.066044][T17184] aa_policy_admin_capable: policy locked? 0 [ 913.066939][ T43] audit: type=1400 audit(2000000671.784:42652): apparmor="STATUS" info="unsupported interface version" error=-93 profile="unconfined" pid=17183 comm="syz.5.20277" offset=16 [ 913.247140][T17193] netlink: 24 bytes leftover after parsing attributes in process `syz.4.20282'. [ 914.001331][ T1129] ata1.00: exception Emask 0x0 SAct 0x80 SErr 0x0 action 0x6 [ 914.022566][ T1129] ata1.00: waking up from sleep [ 914.025675][ T1129] ata1: hard resetting link [ 914.365628][ T1129] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300) [ 914.371028][ T1129] ata1.00: configured for UDMA/100 [ 914.373880][ T1129] ata1: EH complete [ 914.515841][T17229] profile_transition: unconfined exec no attachment [ 914.701557][T17233] profile_transition: unconfined exec no attachment [ 914.798781][T29872] usbhid 12-1:0.0: can't add hid device: -71 [ 914.798951][T29872] usbhid 12-1:0.0: probe with driver usbhid failed with error -71 [ 914.826733][T29872] usb 12-1: USB disconnect, device number 9 [ 915.669451][T17280] bond0: no command found in arp_ip_targets file - use + or - [ 915.698531][T17286] netlink: 4 bytes leftover after parsing attributes in process `syz.2.20325'. [ 915.715682][T17286] netlink: 4 bytes leftover after parsing attributes in process `syz.2.20325'. [ 915.813891][ T5857] kernel write not supported for file /ppp (pid: 5857 comm: kworker/2:5) [ 916.367633][T17313] program syz.2.20337 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 916.698723][T17329] aa_policy_admin_capable: cap_mac_admin? 1 [ 916.699195][T17329] aa_policy_admin_capable: policy locked? 0 [ 916.699772][T17329] unpack_pdb: unpacking tags [ 916.700263][T17329] unpack_pdb: done unpacking tags [ 916.700481][T17329] unpack_pdb: unpacking tags [ 916.700926][T17329] unpack_pdb: done unpacking tags [ 916.701939][T17329] aa_free_profile: aa_free_profile(ffff88806035b000) [ 916.701957][ T43] audit: type=1400 audit(2000000675.424:42653): apparmor="STATUS" info="failed to unpack end of profile" error=-71 profile="unconfined" name="p" pid=17328 comm="syz.4.20345" name="p" offset=79 [ 916.861343][T17337] profile_transition: unconfined exec no attachment [ 917.038061][T17343] netlink: 'syz.7.20352': attribute type 1 has an invalid length. [ 917.038152][T17343] netlink: 'syz.7.20352': attribute type 2 has an invalid length. [ 917.244630][T17349] tipc: Enabling of bearer rejected, already enabled [ 917.434664][ T43] audit: type=1326 audit(2000000676.154:42654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=17360 comm="syz.2.20361" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f34fec code=0x0 [ 918.545326][T17396] nvme_fcloop: unknown parameter or missing value 'ww' [ 919.077728][T17425] profile_transition: unconfined exec no attachment [ 919.448963][T17441] profile_transition: unconfined exec no attachment [ 919.591155][T17444] profile_transition: unconfined exec no attachment [ 919.687641][T17446] netlink: 8 bytes leftover after parsing attributes in process `syz.7.20399'. [ 919.699659][T17448] netlink: 24 bytes leftover after parsing attributes in process `syz.5.20400'. [ 919.725143][T17452] profile_transition: unconfined exec no attachment [ 919.725401][T17453] profile_transition: unconfined exec no attachment [ 919.949365][T17462] profile_transition: unconfined exec no attachment [ 920.159900][T17473] profile_transition: unconfined exec no attachment [ 920.220879][T17476] 8021q: adding VLAN 0 to HW filter on device bond6 [ 920.225165][T17476] bond0: (slave bond6): Enslaving as an active interface with an up link [ 920.447569][T17482] profile_transition: unconfined exec no attachment [ 920.588427][T17489] profile_transition: unconfined exec no attachment [ 920.692547][T17492] profile_transition: unconfined exec no attachment [ 920.777941][T17493] profile_transition: unconfined exec no attachment [ 921.945512][T17521] dummy0: left promiscuous mode [ 921.948456][T17521] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 921.967261][T17530] profile_transition: unconfined exec no attachment [ 921.984341][T17521] wireguard: wg2: Could not create IPv4 socket [ 921.985743][T17521] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 922.950703][T29865] usb 12-1: new high-speed USB device number 10 using dummy_hcd [ 923.111337][T29865] usb 12-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 923.113335][T29865] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 923.113358][T29865] usb 12-1: config 0 has no interfaces? [ 923.113382][T29865] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 923.116094][T29865] usb 12-1: config 0 descriptor?? [ 923.222502][T17564] netlink: 20 bytes leftover after parsing attributes in process `syz.5.20449'. [ 923.260981][T17564] bridge0: port 2(bridge_slave_1) entered disabled state [ 923.268579][T17564] bridge0: port 1(bridge_slave_0) entered disabled state [ 923.344719][T29865] usb 12-1: USB disconnect, device number 10 [ 923.431156][T17572] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 924.007721][T17598] aa_policy_admin_capable: cap_mac_admin? 1 [ 924.008173][T17598] aa_policy_admin_capable: policy locked? 0 [ 924.099743][T17603] netlink: 'syz.4.20474': attribute type 8 has an invalid length. [ 924.412783][T17623] netlink: 20 bytes leftover after parsing attributes in process `syz.4.20476'. [ 924.952996][T29872] usb 12-1: new high-speed USB device number 11 using dummy_hcd [ 925.101408][T29872] usb 12-1: Using ep0 maxpacket: 8 [ 925.102342][T29872] usb 12-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 925.103571][T29872] usb 12-1: config index 0 descriptor too short (expected 301, got 45) [ 925.103618][T29872] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 925.103640][T29872] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 925.103662][T29872] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 925.103682][T29872] usb 12-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 925.103718][T29872] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 925.327828][T29872] usb 12-1: usb_control_msg returned -32 [ 925.327942][T29872] usbtmc 12-1:16.0: can't read capabilities [ 925.336611][T17643] 8021q: adding VLAN 0 to HW filter on device bond1 [ 925.377206][T17643] bond0: (slave bond1): Enslaving as an active interface with an up link [ 925.380213][T29872] usb 12-1: USB disconnect, device number 11 [ 925.625969][T17652] nvme_fcloop: fcloop_set_cmd_drop: DROP: Starting at instance 0 of fabric opcode x1 drop +0 instances [ 925.636660][T17654] block2mtd: device name too long [ 925.944257][T29865] kernel read not supported for file /tomoyo/domain_policy (pid: 29865 comm: kworker/0:0) [ 926.182220][T17672] profile_transition: 2 callbacks suppressed [ 926.182982][T17672] profile_transition: unconfined exec no attachment [ 926.232221][T17673] netlink: 4 bytes leftover after parsing attributes in process `syz.2.20497'. [ 926.377334][T17680] profile_transition: unconfined exec no attachment [ 926.383802][T17678] block2mtd: device name too long [ 926.597014][T17684] overlayfs: invalid origin (0000) [ 926.915097][T17695] profile_transition: unconfined exec no attachment [ 927.072429][T17698] profile_transition: unconfined exec no attachment [ 927.582794][T17706] kAFS: bad VL server IP address [ 927.957634][T17712] overlayfs: failed to clone lowerpath [ 928.081416][T17710] zram0: detected capacity change from 0 to 8 [ 929.302958][T17740] lpc_ich 0000:00:00.0: I/O space for ACPI uninitialized [ 929.303087][T17740] lpc_ich 0000:00:00.0: I/O space for ACPI uninitialized [ 929.303633][T17740] lpc_ich 0000:00:00.0: I/O space for GPIO uninitialized [ 929.303650][T17740] lpc_ich 0000:00:00.0: No MFD cells added [ 929.588872][T17745] netlink: 4 bytes leftover after parsing attributes in process `syz.4.20529'. [ 929.627115][T17745] netlink: 220 bytes leftover after parsing attributes in process `syz.4.20529'. [ 929.627984][T17745] netlink: 220 bytes leftover after parsing attributes in process `syz.4.20529'. [ 930.195649][T17756] Format for deleting device is "id" (uint). [ 931.781868][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.878211][T17798] bad cache= option: noner_mlock 0 [ 931.878211][T17798] nr_zspages 1810 [ 931.878211][T17798] nr_free_cma 0 [ 931.878211][T17798] numa_hit 449782 [ 931.878211][T17798] numa_miss 6420416 [ 931.878211][T17798] numa_foreign 6420416 [ 931.878211][T17798] numa_interleave 5419 [ 931.878211][T17798] numa_local 434344 [ 931.878211][T17798] numa_other 6435854 [ 931.878211][T17798] nr_inactive_anon 919 [ 931.878211][T17798] nr_active_anon 1192 [ 931.878211][T17798] nr_inactive_file 13282 [ 931.878211][T17798] nr_active_file 3019 [ 931.878211][T17798] nr_unevictable 1000 [ 931.878211][T17798] nr_slab_reclaimable 7106 [ 931.878211][T17798] nr_slab_unreclaimable 84297 [ 931.878211][T17798] nr_isolated_anon 0 [ 931.878211][T17798] nr_isolated_file 0 [ 931.878211][T17798] workingset_nodes 218 [ 931.878211][T17798] workingset_refault_anon 5229 [ 931.878211][T17798] workingset_refault_file 45081 [ 931.878211][T17798] workingset_activate_anon 906 [ 931.878211][T17798] workingset_activate_file 4261 [ 931.878211][T17798] workingset_restore_anon 907 [ 931.878211][T17798] workingset_restore_file 4299 [ 931.878211][T17798] workingset_nodereclaim 108 [ 931.878211][T17798] nr_anon_pages 1209 [ 931.878211][T17798] nr_mapped 22114 [ 931.878211][T17798] nr_file_pages 18545 [ 931.878211][T17798] nr_dirty 437 [ 931.878211][T17798] nr_writeback 0 [ 931.878211][T17798] nr_shmem 1003 [ 931.878211][T17798] nr_shmem_hugepages 0 [ 931.878211][T17798] nr_shmem_pmdmapped 0 [ 931.878211][T17798] nr_file_hugepages 0 [ 931.878211][T17798] nr_file_pmdmapped 0 [ 931.878211][T17798] nr_anon_transparent_hugepages 0 [ 931.878211][T17798] nr_vmscan_write 108404 [ 931.878211][T17798] nr_vmscan_immediate_reclaim 241 [ 931.878211][T17798] nr_dirtied 52280 [ 931.878211][T17798] nr_written 51843 [ 931.878211][T17798] nr_throttled_written 160 [ 931.878211][T17798] nr_kernel_misc_reclaimable 0 [ 931.878211][T17798] nr_foll_pin_acquired 37699 [ 931.878211][T17798] nr_foll_pin_released 37699 [ 931.879313][T17798] CIFS: VFS: bad cache= option: noner_mlock 0 [ 931.879313][T17798] nr_zspages 1810 [ 931.879313][T17798] nr_free_cma 0 [ 931.879313][T17798] numa_hit 449782 [ 931.879313][T17798] numa_miss 6420416 [ 931.879313][T17798] numa_foreign 6420416 [ 931.879313][T17798] numa_interleave 5419 [ 931.879313][T17798] numa_local 434344 [ 931.879313][T17798] numa_other 6435854 [ 931.879313][T17798] nr_inactive_anon 919 [ 931.879313][T17798] nr_active_anon 1192 [ 931.879313][T17798] nr_inactive_file 13282 [ 931.879313][T17798] nr_active_file 3019 [ 931.879313][T17798] nr_unevictable 1000 [ 931.879313][T17798] nr_slab_reclaimable 7106 [ 931.879313][T17798] nr_slab_unreclaimable 84297 [ 931.879313][T17798] nr_isolated_anon 0 [ 931.879313][T17798] nr_isolated_file 0 [ 931.879313][T17798] workingset_nodes 218 [ 931.879313][T17798] workingset_refault_anon 5229 [ 931.879313][T17798] workingset_refault_file 45081 [ 931.879313][T17798] workingset_activate_anon 906 [ 931.879313][T17798] workingset_activate_file 4261 [ 931.879313][T17798] workingset_restore_anon 907 [ 931.879313][T17798] workingset_restore_file 4299 [ 931.879313][T17798] workingset_nodereclaim 108 [ 931.879313][T17798] nr_anon_pages 1209 [ 931.879313][T17798] nr_mapped 22114 [ 931.879313][T17798] nr_file_pages 18545 [ 931.879313][T17798] nr_dirty 437 [ 931.879313][T17798] nr_writeback 0 [ 931.879313][T17798] nr_shmem 1003 [ 931.879313][T17798] nr_shmem_hugepages 0 [ 931.879313][T17798] nr_shmem_pmdmapped 0 [ 931.879313][T17798] nr_file_hugepages 0 [ 931.879313][T17798] nr_file_pmdmapped 0 [ 931.879313][T17798] nr_anon_transparent_hugepages 0 [ 931.879313][T17798] nr_vmscan_write 108404 [ 931.879313][T17798] nr_vmscan_immediate_reclaim 241 [ 931.879313][T17798] nr_dirtied 52280 [ 931.879313][T17798] nr_written 51843 [ 931.879313][T17798] nr_throttled_written 160 [ 931.879313][T17798] nr_kernel_misc_reclaimable 0 [ 931.879313][T17798] nr_foll_pin_acquired 37699 [ 932.467756][T17818] profile_transition: unconfined exec no attachment [ 932.587342][T17821] profile_transition: unconfined exec no attachment [ 934.060617][T29865] usb 12-1: new full-speed USB device number 12 using dummy_hcd [ 934.290997][T29865] usb 12-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 934.316732][T29865] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 934.317170][T29865] usb 12-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 934.317208][T29865] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 934.328060][T29865] usb 12-1: config 0 descriptor?? [ 934.384044][T29865] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 934.384569][T29865] dvb-usb: bulk message failed: -22 (3/0) [ 934.428074][T29865] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 934.429296][T29865] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 934.429344][T29865] usb 12-1: media controller created [ 934.449388][T29865] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 934.457948][T29865] dvb-usb: bulk message failed: -22 (6/0) [ 934.458507][T29865] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 934.506143][T29865] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.7/usb12/12-1/input/input100 [ 934.519506][T29865] dvb-usb: schedule remote query interval to 150 msecs. [ 934.520040][T29865] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 934.616324][T17841] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 934.619767][T17841] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 934.677415][T28826] usb 12-1: USB disconnect, device number 12 [ 934.810724][ T5857] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 934.826039][T28826] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 934.993831][ T5857] usb 10-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 934.996083][ T5857] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 934.996110][ T5857] usb 10-1: config 0 has no interfaces? [ 934.996147][ T5857] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 935.009358][ T5857] usb 10-1: config 0 descriptor?? [ 935.323425][ T5857] usb 10-1: USB disconnect, device number 13 [ 935.533913][T17863] bonding: no command found in bonding_masters - use +ifname or -ifname [ 936.350841][ T5857] usb 2-1: new high-speed USB device number 4 using ehci-pci [ 936.378878][T17883] netlink: 20 bytes leftover after parsing attributes in process `syz.7.20593'. [ 936.532984][ T5857] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 936.546675][ T5857] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 936.546787][ T5857] usb 2-1: Product: QEMU USB Tablet [ 936.546829][ T5857] usb 2-1: Manufacturer: QEMU [ 936.546869][ T5857] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 936.692755][ T5857] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb2/2-1/2-1:1.0/0003:0627:0001.0015/input/input101 [ 936.839037][ T5857] hid-generic 0003:0627:0001.0015: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 937.204946][T17893] profile_transition: unconfined exec no attachment [ 937.751858][T17903] netlink: 4 bytes leftover after parsing attributes in process `syz.2.20600'. [ 937.777307][T17903] netlink: 'syz.2.20600': attribute type 12 has an invalid length. [ 938.807127][T17924] block2mtd: too many arguments [ 939.427816][T17933] netlink: 24 bytes leftover after parsing attributes in process `syz.7.20613'. [ 939.995030][ T43] audit: type=1326 audit(2000000698.714:42655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=17939 comm="syz.4.20618" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb4fec code=0x0 [ 940.946089][T17956] dyndbg: expected <4096 bytes into control [ 941.394178][T17966] netlink: 'syz.4.20627': attribute type 39 has an invalid length. [ 941.633343][T17970] device-mapper: ioctl: name not supplied when creating device [ 943.044498][T17993] syz.2.20640 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=1, oom_score_adj=1000 [ 943.044601][T17993] CPU: 2 UID: 0 PID: 17993 Comm: syz.2.20640 Tainted: G L syzkaller #0 PREEMPT(full) [ 943.044642][T17993] Tainted: [L]=SOFTLOCKUP [ 943.044652][T17993] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 943.044664][T17993] Call Trace: [ 943.044673][T17993] [ 943.044685][T17993] dump_stack_lvl+0x100/0x190 [ 943.044729][T17993] dump_header+0xfb/0x606 [ 943.044762][T17993] out_of_memory.cold+0xd/0x170 [ 943.044820][T17993] ? __pfx_out_of_memory+0x10/0x10 [ 943.044873][T17993] mem_cgroup_out_of_memory+0xc6/0x130 [ 943.044904][T17993] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 943.044948][T17993] ? do_raw_spin_unlock+0x53/0x1e0 [ 943.044981][T17993] ? do_raw_spin_unlock+0x145/0x1e0 [ 943.045020][T17993] ? _raw_spin_unlock+0x28/0x50 [ 943.045057][T17993] try_charge_memcg+0x783/0xf60 [ 943.045115][T17993] ? __pfx_try_charge_memcg+0x10/0x10 [ 943.045150][T17993] ? find_held_lock+0x2b/0x80 [ 943.045176][T17993] ? rcu_read_unlock+0x17/0x60 [ 943.045208][T17993] ? rcu_read_unlock+0x17/0x60 [ 943.045269][T17993] __memcg_slab_post_alloc_hook+0x4a1/0x1270 [ 943.045329][T17993] ? kasan_unpoison+0x27/0x60 [ 943.045366][T17993] __kmalloc_cache_noprof+0x52a/0x6d0 [ 943.045405][T17993] ? mem_cgroup_css_alloc+0x8cd/0x1d10 [ 943.045447][T17993] mem_cgroup_css_alloc+0x8cd/0x1d10 [ 943.045494][T17993] cgroup_apply_control_enable+0x602/0xdd0 [ 943.045559][T17993] cgroup_mkdir+0x57f/0x1330 [ 943.045605][T17993] ? __pfx_cgroup_mkdir+0x10/0x10 [ 943.045641][T17993] kernfs_iop_mkdir+0x111/0x190 [ 943.045670][T17993] ? bpf_lsm_inode_mkdir+0x9/0x10 [ 943.045705][T17993] vfs_mkdir+0x364/0x850 [ 943.045755][T17993] filename_mkdirat+0x48b/0x5e0 [ 943.045794][T17993] ? __pfx_filename_mkdirat+0x10/0x10 [ 943.045825][T17993] ? strncpy_from_user+0x19d/0x2d0 [ 943.045866][T17993] ? do_getname+0x191/0x390 [ 943.045909][T17993] __ia32_sys_mkdirat+0x88/0xc0 [ 943.045941][T17993] __do_fast_syscall_32+0x13a/0x8b0 [ 943.045985][T17993] do_fast_syscall_32+0x32/0x70 [ 943.046018][T17993] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 943.046047][T17993] RIP: 0023:0xf7f34fec [ 943.046076][T17993] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 943.046088][T17993] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000128 [ 943.046116][T17993] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000040 [ 943.046132][T17993] RDX: 0000000000000020 RSI: 0000000000000000 RDI: 0000000000000000 [ 943.046145][T17993] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 943.046160][T17993] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 943.046172][T17993] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 943.046229][T17993] [ 943.058301][T17997] aa_policy_admin_capable: cap_mac_admin? 1 [ 943.058324][T17997] aa_policy_admin_capable: policy locked? 0 [ 943.058532][T17997] unpack_pdb: unpacking tags [ 943.058543][T17997] unpack_pdb: done unpacking tags [ 943.058583][T17997] unpack_pdb: unpacking tags [ 943.058593][T17997] unpack_pdb: done unpacking tags [ 943.058788][ T43] audit: type=1400 audit(2000000701.774:42656): apparmor="STATUS" info="missing required dfa" error=-71 profile="unconfined" name="p" pid=17996 comm="syz.7.20643" name="p" offset=92 [ 943.060811][T17997] aa_free_profile: aa_free_profile(ffff88805f107800) [ 943.066959][T17993] memory: usage 0kB, limit 0kB, failcnt 19 [ 943.066985][T17993] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 943.067007][T17993] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 943.067026][T17993] Memory cgroup stats for /syz2/test: [ 943.067260][T17993] cache 0 [ 943.067275][T17993] rss 0 [ 943.067285][T17993] rss_huge 0 [ 943.067299][T17993] shmem 0 [ 943.067310][T17993] mapped_file 0 [ 943.067322][T17993] dirty 0 [ 943.067510][T17993] writeback 0 [ 943.067526][T17993] workingset_refault_anon 0 [ 943.067541][T17993] workingset_refault_file 0 [ 943.067553][T17993] swap 0 [ 943.067563][T17993] swapcached 0 [ 943.067576][T17993] pgpgin 0 [ 943.067587][T17993] pgpgout 0 [ 943.067600][T17993] pgfault 0 [ 943.067611][T17993] pgmajfault 0 [ 943.067623][T17993] inactive_anon 0 [ 943.067635][T17993] active_anon 0 [ 943.067648][T17993] inactive_file 0 [ 943.067660][T17993] active_file 0 [ 943.067670][T17993] unevictable 0 [ 943.067684][T17993] hierarchical_memory_limit 0 [ 943.067697][T17993] hierarchical_memsw_limit 9223372036854771712 [ 943.067711][T17993] total_cache 0 [ 943.067724][T17993] total_rss 0 [ 943.067735][T17993] total_rss_huge 0 [ 943.067746][T17993] total_shmem 0 [ 943.067759][T17993] total_mapped_file 0 [ 943.067772][T17993] total_dirty 0 [ 943.067784][T17993] total_writeback 0 [ 943.067914][T17993] total_workingset_refault_anon 0 [ 943.067929][T17993] total_workingset_refault_file 0 [ 943.067943][T17993] total_swap 0 [ 943.067954][T17993] total_swapcached 0 [ 943.067967][T17993] total_pgpgin 0 [ 943.067979][T17993] total_pgpgout 0 [ 943.067993][T17993] total_pgfault 0 [ 943.068003][T17993] total_pgmajfault 0 [ 943.068012][T17993] total_inactive_anon 0 [ 943.068021][T17993] total_active_anon 0 [ 943.068030][T17993] total_inactive_file 0 [ 943.068039][T17993] total_active_file 0 [ 943.068049][T17993] total_unevictable 0 [ 943.068057][T17993] anon_cost 0 [ 943.068064][T17993] file_cost 0 [ 943.068073][T17993] Out of memory and no killable processes... [ 943.891495][T18017] profile_transition: unconfined exec no attachment [ 943.962901][T18020] profile_transition: unconfined exec no attachment [ 944.054277][T18022] team0: No ports can be present during mode change [ 945.759548][T18070] kAFS: bad VL server IP address [ 946.324275][T18083] netlink: 8 bytes leftover after parsing attributes in process `syz.2.20680'. [ 946.328522][T18083] netlink: 12 bytes leftover after parsing attributes in process `syz.2.20680'. [ 947.031310][ T5753] Bluetooth: hci3: command 0x1003 tx timeout [ 947.041910][T31404] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 954.469759][ T43] audit: type=1326 audit(2000000713.174:42657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=18101 comm="syz.4.20686" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fb4fec code=0x0 [ 954.611106][ T43] audit: type=1326 audit(2000000713.324:42658): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=18100 comm="syz.7.20687" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x0 [ 957.766254][T18109] kAFS: Invalid Command on /proc/fs/afs/cells file [ 959.414029][T18116] aa_policy_admin_capable: cap_mac_admin? 1 [ 959.417355][T18116] aa_policy_admin_capable: policy locked? 0 [ 959.420349][T18116] unpack_pdb: unpacking tags [ 959.420369][T18116] unpack_pdb: done unpacking tags [ 959.434672][T18116] unpack_pdb: unpacking tags [ 959.434774][T18116] unpack_pdb: done unpacking tags [ 959.590866][ T43] audit: type=1400 audit(2000000718.294:42659): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/:o" pid=18115 comm="syz.5.20692" [ 962.209175][T18126] vxcan0: tx address claim with dest, not broadcast [ 966.138712][T18137] gfs2: path_lookup on /dev/loop# returned error -2 [ 970.795488][ T43] audit: type=1326 audit(2000000729.514:42660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=18149 comm="syz.2.20706" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f34fec code=0x0 [ 973.727096][T18162] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 973.727684][T18162] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 978.672784][T29872] usb 12-1: new high-speed USB device number 13 using dummy_hcd [ 978.985598][T29872] usb 12-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 979.083932][T29872] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 979.084117][T29872] usb 12-1: config 0 has no interfaces? [ 979.087765][T29872] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 979.256929][T29872] usb 12-1: config 0 descriptor?? [ 980.022745][T29872] usb 12-1: USB disconnect, device number 13 [ 990.644448][ T74] rpcbind: server 127.0.0.1 not responding, timed out [ 990.842959][ T43] audit: type=1326 audit(2000000749.524:42661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=18198 comm="syz.5.20722" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f26fec code=0x0 [ 993.256156][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 1002.129277][T18224] netlink: 4 bytes leftover after parsing attributes in process `syz.5.20731'. [ 1015.307075][T18263] netlink: 4 bytes leftover after parsing attributes in process `syz.7.20745'. [ 1017.551815][T15252] usb 9-1: new full-speed USB device number 17 using dummy_hcd [ 1017.873428][T15252] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1017.908247][T15252] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1017.910114][T15252] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1017.911884][T15252] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1017.986932][T18271] profile_transition: unconfined exec no attachment [ 1018.098980][T15252] usb 9-1: config 0 descriptor?? [ 1018.542497][T15252] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1018.553547][T15252] dvb-usb: bulk message failed: -22 (3/0) [ 1018.939847][T15252] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1018.996436][T15252] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1019.009541][T15252] usb 9-1: media controller created [ 1019.111711][T15252] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1019.637039][T15252] dvb-usb: bulk message failed: -22 (6/0) [ 1019.663496][T15252] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1019.938079][T18275] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x88d7 instead [ 1019.943067][T18275] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x5aa4 instead [ 1019.943106][T18275] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000100: 0x642f instead [ 1019.943129][T18275] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000104: 0x6d2f instead [ 1019.943148][T18275] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000108: 0x0023 instead [ 1019.943185][T18275] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000244: 0x00e4 instead [ 1019.943208][T18275] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000024c: 0x00e4 instead [ 1020.021456][T15252] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb9/9-1/input/input102 [ 1020.092541][T18275] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 1020.099658][T18275] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 1020.483791][T15252] dvb-usb: schedule remote query interval to 150 msecs. [ 1020.492380][T15252] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1020.609314][T15252] usb 9-1: USB disconnect, device number 17 [ 1021.109705][T18281] profile_transition: unconfined exec no attachment [ 1021.693270][T15252] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1024.087769][T18288] profile_transition: unconfined exec no attachment [ 1026.003774][T18295] profile_transition: unconfined exec no attachment [ 1038.028850][T18332] netlink: 12 bytes leftover after parsing attributes in process `syz.5.20768'. [ 1038.283159][T16632] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 1038.461988][T16632] usb 9-1: Using ep0 maxpacket: 8 [ 1038.653194][T16632] usb 9-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1038.682715][T16632] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1038.683059][T16632] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1038.949309][T16632] usb 9-1: config 0 descriptor?? [ 1039.953050][T16632] iowarrior 9-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 1040.000251][ T43] audit: type=1326 audit(2000000798.714:42662): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=18336 comm="syz.7.20771" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fcefec code=0x0 [ 1040.204466][T16632] usb 9-1: USB disconnect, device number 18 [ 1044.142647][T18356] netlink: 100 bytes leftover after parsing attributes in process `syz.2.20778'. [ 1047.361756][ T30] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 1047.530677][ T30] usb 10-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 1047.581174][ T30] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1047.617531][ T30] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1047.617679][ T30] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1047.617800][ T30] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1047.617837][ T30] usb 10-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 1047.617973][ T30] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1047.838148][T18362] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1047.998464][ T30] keyspan 10-1:1.0: Keyspan 2 port adapter converter detected [ 1048.140091][ T30] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 84 [ 1048.154325][ T30] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 2 [ 1048.470008][ T30] usb 10-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 1048.679269][ T30] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 88 [ 1048.692117][ T30] keyspan 10-1:1.0: found no endpoint descriptor for endpoint 6 [ 1048.975947][ T30] usb 10-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 1049.717887][ T30] usb 10-1: USB disconnect, device number 14 [ 1050.977394][ T30] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 1051.133363][ T30] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 1051.185813][ T30] keyspan 10-1:1.0: device disconnected [ 1054.677348][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 1056.460816][T18387] openvswitch: netlink: Missing key (keys=c0, expected=480) [ 1057.387576][T18395] profile_transition: unconfined exec no attachment [ 1062.763218][T18410] profile_transition: unconfined exec no attachment [ 1078.149050][T18464] profile_transition: unconfined exec no attachment [ 1080.812653][T18470] input: syz0 as /devices/virtual/input/input103 [ 1098.321306][T31404] Bluetooth: hci1: command 0x0c1a tx timeout [ 1102.983717][T18533] netlink: 8 bytes leftover after parsing attributes in process `syz.7.20845'. [ 1104.093586][T18539] loop5: detected capacity change from 0 to 6 [ 1104.235589][T18539] loop5: [POWERTEC] p1 p2 p3 [ 1104.313494][T18539] loop5: p1 start 2738982409 is beyond EOD, truncated [ 1104.323453][T18539] loop5: p2 start 3318134482 is beyond EOD, truncated [ 1104.329751][T18539] loop5: p3 start 3832978868 is beyond EOD, truncated [ 1107.781315][T18551] netlink: 8 bytes leftover after parsing attributes in process `syz.7.20852'. [ 1107.781461][T18551] netlink: 12 bytes leftover after parsing attributes in process `syz.7.20852'. [ 1108.474014][T18553] clocksource: Switched to clocksource tsc [ 1110.072499][T18555] scsi_dev_info_list_add_str: bad dev info string 'vendor;model' 'fl' '' [ 1110.118910][T18557] netlink: 4 bytes leftover after parsing attributes in process `syz.5.20855'. [ 1116.139015][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 1117.222318][T18577] netlink: 4 bytes leftover after parsing attributes in process `syz.2.20863'. [ 1119.283517][T18583] aa_policy_admin_capable: cap_mac_admin? 1 [ 1119.285128][T18583] aa_policy_admin_capable: policy locked? 0 [ 1119.288578][T18583] unpack_pdb: unpacking tags [ 1119.290163][T18583] unpack_pdb: done unpacking tags [ 1119.324959][T18583] aa_free_profile: aa_free_profile(ffff88806d488800) [ 1119.338644][ T43] audit: type=1400 audit(2000000878.039:42663): apparmor="STATUS" info="failed to unpack profile flags" error=-71 profile="unconfined" name="p" pid=18582 comm="syz.5.20865" name="p" offset=48 [ 1121.981785][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 1121.992606][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 1122.231998][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 1122.460665][ T0] NOHZ tick-stop error: local softirq work is pending, handler #380!!! [ 1122.480628][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 1122.810546][ T0] NOHZ tick-stop error: local softirq work is pending, handler #302!!! [ 1125.678220][T18611] netlink: 'syz.5.20873': attribute type 11 has an invalid length. [ 1125.743992][T18610] block2mtd: illegal erase size [ 1128.440936][T18616] loop5: detected capacity change from 0 to 7 [ 1130.492686][T18624] netlink: 'syz.4.20879': attribute type 1 has an invalid length. [ 1130.619304][T18625] netlink: 'syz.4.20879': attribute type 1 has an invalid length. [ 1131.249124][T18624] gretap0: entered promiscuous mode [ 1133.001823][T18631] netlink: 4 bytes leftover after parsing attributes in process `syz.7.20883'. [ 1133.168179][T18631] netlink: 72 bytes leftover after parsing attributes in process `syz.7.20883'. [ 1134.466068][T18616] Dev loop5: unable to read RDB block 7 [ 1134.466264][T18616] loop5: unable to read partition table [ 1134.488010][T18616] loop5: partition table beyond EOD, truncated [ 1134.488264][T18616] loop_reread_partitions: partition scan of loop5 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 1134.659011][ C1] blk_print_req_error: 30 callbacks suppressed [ 1134.659328][ C1] invalid error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800800 phys_seg 1 prio class 2 [ 1134.659958][ C1] buffer_io_error: 30 callbacks suppressed [ 1134.659982][ C1] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 1141.218238][T18656] profile_transition: name lookup ix on error [ 1143.808754][T18669] profile_transition: unconfined exec no attachment [ 1146.825650][ T929] kworker/0:3 (929) used greatest stack depth: 16024 bytes left [ 1153.638491][T18699] input: syz1 as /devices/virtual/input/input104 [ 1154.232443][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 1154.310642][ T0] NOHZ tick-stop error: local softirq work is pending, handler #182!!! [ 1154.392552][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 1154.452776][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 1164.559530][T18738] netlink: 'syz.2.20917': attribute type 11 has an invalid length. [ 1171.451106][T18760] /dev/nullb0: Can't open blockdev [ 1177.564406][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.333085][T18780] netlink: 8 bytes leftover after parsing attributes in process `syz.5.20933'. [ 1180.267491][T18789] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x88d7 instead [ 1180.267727][T18789] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x5aa4 instead [ 1180.272228][T18789] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000100: 0x642f instead [ 1180.272258][T18789] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000104: 0x6d2f instead [ 1180.272280][T18789] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000108: 0x0023 instead [ 1180.272320][T18789] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000244: 0x00e4 instead [ 1180.272342][T18789] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000024c: 0x00e4 instead [ 1180.319285][T18789] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 1180.319395][T18789] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 1193.941928][T18831] tipc: Started in network mode [ 1193.944349][T18831] tipc: Node identity ac14140f, cluster identity 4711 [ 1193.967775][T18831] tipc: New replicast peer: 255.255.255.255 [ 1194.005937][T18831] tipc: Enabled bearer , priority 4 [ 1194.989045][ T5857] tipc: Node number set to 2886997007 [ 1206.822341][ T5753] Bluetooth: hci0: Zero size dump init pkt [ 1216.032091][T18909] kAFS: bad VL server IP address [ 1219.732949][T18922] profile_transition: unconfined exec no attachment [ 1220.126249][T18927] netlink: 4 bytes leftover after parsing attributes in process `syz.2.20989'. [ 1223.536380][T18933] ipvlan2: entered allmulticast mode [ 1223.542360][T18933] ip6gretap0: entered allmulticast mode [ 1223.617656][T18933] batman_adv: batadv0: Adding interface: ipvlan2 [ 1223.623146][T18933] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1223.636489][T18933] batman_adv: batadv0: Interface activated: ipvlan2 [ 1227.145807][T18945] netlink: 4 bytes leftover after parsing attributes in process `syz.5.20995'. [ 1227.556604][T18945] netlink: 72 bytes leftover after parsing attributes in process `syz.5.20995'. [ 1236.669755][ T25] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 1236.904971][ T25] usb 10-1: Using ep0 maxpacket: 8 [ 1236.942073][ T25] usb 10-1: New USB device found, idVendor=0d8c, idProduct=000c, bcdDevice= 0.40 [ 1236.956821][ T25] usb 10-1: config 0 has no interfaces? [ 1236.998800][ T25] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1237.002281][ T25] usb 10-1: Product: syz [ 1237.004066][ T25] usb 10-1: Manufacturer: syz [ 1237.018391][ T25] usb 10-1: SerialNumber: syz [ 1237.108322][ T3270] input: syz0 as /devices/virtual/misc/uhid/0004:057E:0306.0016/input/input105 [ 1237.126072][ T25] usb 10-1: config 0 descriptor?? [ 1237.623270][ T25] usb 10-1: USB disconnect, device number 15 [ 1238.381657][ T3270] hid-generic 0004:057E:0306.0016: input,hidraw1: HID v0.06 Gamepad [syz0] on syz0 [ 1238.997628][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 1240.466268][T18978] profile_transition: unconfined exec no attachment [ 1242.429001][T18978] fido_id[18978]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1246.094791][T18628] IPVS: starting estimator thread 0... [ 1246.192102][T18996] IPVS: using max 6 ests per chain, 14400 per kthread [ 1248.722739][T19002] aa_policy_admin_capable: cap_mac_admin? 1 [ 1248.722859][T19002] aa_policy_admin_capable: policy locked? 0 [ 1253.945456][ T43] audit: type=1807 audit(2000001012.659:42664): action=measure uid>1 res=1 [ 1253.972013][T19015] ima: policy update completed [ 1253.973328][ T43] audit: type=1802 audit(2000001012.689:42665): pid=19015 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=policy_update cause=completed comm="syz.5.21022" res=1 errno=0 [ 1257.585131][T19032] profile_transition: unconfined exec no attachment [ 1258.438260][T19039] profile_transition: unconfined exec no attachment [ 1266.616068][T19066] netlink: 36 bytes leftover after parsing attributes in process `syz.5.21041'. [ 1271.190366][T19079] skbuff: bad partial csum: csum=65535/2 headroom=178 headlen=65543 [ 1272.530935][ T43] audit: type=1326 audit(2000001031.239:42666): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_unconfined pid=19087 comm="syz.2.21050" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f34fec code=0x0 [ 1300.437071][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.893492][T19166] profile_transition: unconfined exec no attachment [ 1302.080320][T19174] FAULT_INJECTION: forcing a failure. [ 1302.080320][T19174] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 1302.093906][T19174] CPU: 1 UID: 0 PID: 19174 Comm: syz.5.21084 Tainted: G L syzkaller #0 PREEMPT(full) [ 1302.093947][T19174] Tainted: [L]=SOFTLOCKUP [ 1302.093960][T19174] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1302.093978][T19174] Call Trace: [ 1302.094003][T19174] [ 1302.094029][T19174] dump_stack_lvl+0x100/0x190 [ 1302.094154][T19174] should_fail_ex.cold+0x5/0xa [ 1302.094177][T19174] ? prepare_alloc_pages+0x16d/0x5b0 [ 1302.094276][T19174] should_fail_alloc_page+0xeb/0x140 [ 1302.094352][T19174] prepare_alloc_pages+0x1f0/0x5b0 [ 1302.094532][T19174] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 1302.094648][T19174] ? prepare_alloc_pages+0x131/0x5b0 [ 1302.094805][T19174] ? rcu_is_watching+0x13/0xc0 [ 1302.094835][T19174] ? __alloc_frozen_pages_noprof+0x56b/0x3300 [ 1302.094938][T19174] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1302.094977][T19174] ? __rb_reserve_next.constprop.0+0x6f7/0x1640 [ 1302.095194][T19174] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1302.095714][T19174] alloc_pages_bulk_noprof+0x5e1/0x13c0 [ 1302.095883][T19174] ? policy_nodemask+0xed/0x4f0 [ 1302.095990][T19174] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 1302.096297][T19174] __kasan_populate_vmalloc+0xf0/0x210 [ 1302.096522][T19174] alloc_vmap_area+0x95d/0x2bb0 [ 1302.096738][T19174] ? kasan_save_track+0x14/0x30 [ 1302.096795][T19174] ? __kasan_kmalloc+0xaa/0xb0 [ 1302.096846][T19174] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1302.096895][T19174] ? rb_read_data_buffer.isra.0+0x174/0x470 [ 1302.096932][T19174] ? __get_vm_area_node+0x124/0x350 [ 1302.097064][T19174] __get_vm_area_node+0x1ed/0x350 [ 1302.097203][T19174] __vmalloc_node_range_noprof+0x268/0x1420 [ 1302.097263][T19174] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1302.097375][T19174] ? __pfx_check_buffer+0x10/0x10 [ 1302.097565][T19174] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1302.097656][T19174] ? __rb_reserve_next.constprop.0+0x6f7/0x1640 [ 1302.097791][T19174] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1302.097985][T19174] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1302.098038][T19174] __vmalloc_node_noprof+0xad/0xf0 [ 1302.098106][T19174] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1302.098182][T19174] __vmalloc_noprof+0xa3/0x120 [ 1302.098266][T19174] ? __pfx___vmalloc_noprof+0x10/0x10 [ 1302.098390][T19174] ? rcu_is_watching+0x13/0xc0 [ 1302.098449][T19174] ? apparmor_capable+0x1d7/0x4d0 [ 1302.098522][T19174] bpf_prog_alloc_no_stats+0x58/0x690 [ 1302.098558][T19174] ? security_capable+0x80/0x260 [ 1302.098688][T19174] bpf_prog_alloc+0x3b/0x200 [ 1302.098735][T19174] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1302.098792][T19174] bpf_prog_load+0x49e/0x2a80 [ 1302.098982][T19174] ? __pfx_bpf_prog_load+0x10/0x10 [ 1302.099745][T19174] __sys_bpf+0x1f46/0x4a30 [ 1302.099946][T19174] ? __pfx___sys_bpf+0x10/0x10 [ 1302.100106][T19174] ? rb_commit+0x129/0x9d0 [ 1302.100451][T19174] ? trace_buffer_unlock_commit_regs+0x37b/0x540 [ 1302.100563][T19174] ? trace_event_buffer_commit+0x20a/0xa80 [ 1302.101099][T19174] ? find_held_lock+0x2b/0x80 [ 1302.101206][T19174] ? __ia32_sys_bpf+0xcc/0x170 [ 1302.101240][T19174] __ia32_sys_bpf+0xcc/0x170 [ 1302.101303][T19174] ? rcu_is_watching+0x13/0xc0 [ 1302.101432][T19174] __do_fast_syscall_32+0x13a/0x8b0 [ 1302.101526][T19174] do_fast_syscall_32+0x32/0x70 [ 1302.101594][T19174] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1302.101646][T19174] RIP: 0023:0xf7f26fec [ 1302.101722][T19174] Code: Unable to access opcode bytes at 0xf7f26fc2. [ 1302.101737][T19174] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1302.101770][T19174] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000080 [ 1302.101788][T19174] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 1302.101809][T19174] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1302.101826][T19174] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1302.101842][T19174] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1302.102126][T19174] [ 1302.267925][T19174] syz.5.21084: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1302.268042][T19174] CPU: 0 UID: 0 PID: 19174 Comm: syz.5.21084 Tainted: G L syzkaller #0 PREEMPT(full) [ 1302.268068][T19174] Tainted: [L]=SOFTLOCKUP [ 1302.268082][T19174] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1302.268099][T19174] Call Trace: [ 1302.268131][T19174] [ 1302.268168][T19174] dump_stack_lvl+0x100/0x190 [ 1302.268251][T19174] warn_alloc.cold+0x9e/0xb2 [ 1302.268386][T19174] ? __pfx_warn_alloc+0x10/0x10 [ 1302.268452][T19174] ? lockdep_hardirqs_on+0x7d/0x110 [ 1302.268599][T19174] ? __get_vm_area_node+0x2f0/0x350 [ 1302.268762][T19174] ? __get_vm_area_node+0x22b/0x350 [ 1302.268968][T19174] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 1302.269041][T19174] ? __pfx_check_buffer+0x10/0x10 [ 1302.269283][T19174] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1302.269358][T19174] ? __rb_reserve_next.constprop.0+0x6f7/0x1640 [ 1302.269461][T19174] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1302.269718][T19174] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1302.269772][T19174] __vmalloc_node_noprof+0xad/0xf0 [ 1302.269858][T19174] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1302.270012][T19174] __vmalloc_noprof+0xa3/0x120 [ 1302.270063][T19174] ? __pfx___vmalloc_noprof+0x10/0x10 [ 1302.270176][T19174] ? rcu_is_watching+0x13/0xc0 [ 1302.270298][T19174] ? apparmor_capable+0x1d7/0x4d0 [ 1302.270428][T19174] bpf_prog_alloc_no_stats+0x58/0x690 [ 1302.270464][T19174] ? security_capable+0x80/0x260 [ 1302.270580][T19174] bpf_prog_alloc+0x3b/0x200 [ 1302.270630][T19174] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1302.270772][T19174] bpf_prog_load+0x49e/0x2a80 [ 1302.270937][T19174] ? __pfx_bpf_prog_load+0x10/0x10 [ 1302.271508][T19174] __sys_bpf+0x1f46/0x4a30 [ 1302.271770][T19174] ? __pfx___sys_bpf+0x10/0x10 [ 1302.271900][T19174] ? rb_commit+0x129/0x9d0 [ 1302.272326][T19174] ? trace_buffer_unlock_commit_regs+0x37b/0x540 [ 1302.272462][T19174] ? trace_event_buffer_commit+0x20a/0xa80 [ 1302.272940][T19174] ? find_held_lock+0x2b/0x80 [ 1302.273067][T19174] ? __ia32_sys_bpf+0xcc/0x170 [ 1302.273093][T19174] __ia32_sys_bpf+0xcc/0x170 [ 1302.273134][T19174] ? rcu_is_watching+0x13/0xc0 [ 1302.273243][T19174] __do_fast_syscall_32+0x13a/0x8b0 [ 1302.273385][T19174] do_fast_syscall_32+0x32/0x70 [ 1302.273434][T19174] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1302.273470][T19174] RIP: 0023:0xf7f26fec [ 1302.273526][T19174] Code: Unable to access opcode bytes at 0xf7f26fc2. [ 1302.273539][T19174] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1302.273565][T19174] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000080 [ 1302.273580][T19174] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 1302.273595][T19174] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1302.273610][T19174] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1302.273625][T19174] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1302.273906][T19174] [ 1302.388078][T19174] Mem-Info: [ 1302.388106][T19174] active_anon:851 inactive_anon:1718 isolated_anon:0 [ 1302.388106][T19174] active_file:985 inactive_file:13525 isolated_file:0 [ 1302.388106][T19174] unevictable:1000 dirty:325 writeback:0 [ 1302.388106][T19174] slab_reclaimable:7109 slab_unreclaimable:84914 [ 1302.388106][T19174] mapped:22557 shmem:1011 pagetables:1854 [ 1302.388106][T19174] sec_pagetables:349 bounce:0 [ 1302.388106][T19174] kernel_misc_reclaimable:0 [ 1302.388106][T19174] free:20852 free_pcp:8827 free_cma:0 [ 1302.388163][T19174] Node 0 active_anon:72kB inactive_anon:296kB active_file:392kB inactive_file:2888kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:216kB dirty:16kB writeback:0kB shmem:2004kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7808kB pagetables:1216kB sec_pagetables:1176kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1302.388221][T19174] Node 1 active_anon:3332kB inactive_anon:6576kB active_file:3548kB inactive_file:51212kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:90012kB dirty:1284kB writeback:0kB shmem:2040kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7972kB pagetables:6200kB sec_pagetables:220kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1302.388279][T19174] Node 0 DMA free:2780kB boost:2048kB min:2792kB low:2976kB high:3160kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:4kB unevictable:0kB writepending:8kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:220kB local_pcp:16kB free_cma:0kB [ 1302.388345][T19174] lowmem_reserve[]: 0 278 278 278 278 [ 1302.388445][T19174] Node 0 DMA32 free:14332kB boost:0kB min:13804kB low:17252kB high:20700kB reserved_highatomic:2048kB free_highatomic:84kB active_anon:72kB inactive_anon:296kB active_file:388kB inactive_file:2884kB unevictable:2000kB writepending:8kB zspages:720kB present:1032196kB managed:284672kB mlocked:0kB bounce:0kB free_pcp:9232kB local_pcp:900kB free_cma:0kB [ 1302.388518][T19174] lowmem_reserve[]: 0 0 0 0 0 [ 1302.388598][T19174] Node 1 DMA32 free:66296kB boost:0kB min:45984kB low:57480kB high:68976kB reserved_highatomic:0kB free_highatomic:0kB active_anon:3332kB inactive_anon:6576kB active_file:3548kB inactive_file:51212kB unevictable:2000kB writepending:1284kB zspages:6492kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:25856kB local_pcp:7820kB free_cma:0kB [ 1302.388648][T19174] lowmem_reserve[]: 0 0 0 0 0 [ 1302.388703][T19174] Node 0 DMA: 85*4kB (UE) 21*8kB (UE) 6*16kB (UE) 10*32kB (UE) 9*64kB (UE) 0*128kB 1*256kB (E) 0*512kB 1*1024kB (E) 0*2048kB 0*4096kB = 2780kB [ 1302.388875][T19174] Node 0 DMA32: 407*4kB (UMEH) 120*8kB (UEH) 12*16kB (UMH) 87*32kB (UE) 61*64kB (UME) 20*128kB (UME) 7*256kB (UM) 1*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 14332kB [ 1302.389654][T19174] Node 1 DMA32: 848*4kB (UME) 535*8kB (UME) 296*16kB (UME) 368*32kB (UME) 138*64kB (UM) 44*128kB (UM) 18*256kB (M) 9*512kB (UME) 2*1024kB (M) 6*2048kB (UM) 1*4096kB (U) = 66296kB [ 1302.389946][T19174] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1302.389960][T19174] Node 0 hugepages_total=1 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1302.389974][T19174] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1302.389988][T19174] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1302.390003][T19174] 17193 total pagecache pages [ 1302.390013][T19174] 1674 pages in swap cache [ 1302.390024][T19174] Free swap = 93936kB [ 1302.390035][T19174] Total swap = 124996kB [ 1302.390046][T19174] 524155 pages RAM [ 1302.390057][T19174] 0 pages HighMem/MovableOnly [ 1302.390068][T19174] 212095 pages reserved [ 1302.390079][T19174] 0 pages cma reserved [ 1310.722603][T19198] FAULT_INJECTION: forcing a failure. [ 1310.722603][T19198] name failslab, interval 1, probability 0, space 9, times 1 [ 1310.723982][T19198] CPU: 0 UID: 0 PID: 19198 Comm: syz.2.21092 Tainted: G L syzkaller #0 PREEMPT(full) [ 1310.724008][T19198] Tainted: [L]=SOFTLOCKUP [ 1310.724018][T19198] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1310.724032][T19198] Call Trace: [ 1310.724054][T19198] [ 1310.724079][T19198] dump_stack_lvl+0x100/0x190 [ 1310.724210][T19198] should_fail_ex.cold+0x5/0xa [ 1310.724303][T19198] should_failslab+0xc2/0x120 [ 1310.724355][T19198] __kmalloc_node_noprof+0xff/0x880 [ 1310.724390][T19198] ? __get_vm_area_node+0x1ff/0x350 [ 1310.724434][T19198] ? __get_vm_area_node+0x22b/0x350 [ 1310.724482][T19198] ? __vmalloc_node_range_noprof+0x3d4/0x1420 [ 1310.724617][T19198] __vmalloc_node_range_noprof+0x3d4/0x1420 [ 1310.724678][T19198] ? __pfx_check_buffer+0x10/0x10 [ 1310.724900][T19198] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1310.724964][T19198] ? __rb_reserve_next.constprop.0+0x6f7/0x1640 [ 1310.725051][T19198] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1310.725259][T19198] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1310.725302][T19198] __vmalloc_node_noprof+0xad/0xf0 [ 1310.725368][T19198] ? bpf_prog_alloc_no_stats+0x58/0x690 [ 1310.725482][T19198] __vmalloc_noprof+0xa3/0x120 [ 1310.725524][T19198] ? __pfx___vmalloc_noprof+0x10/0x10 [ 1310.725616][T19198] ? rcu_is_watching+0x13/0xc0 [ 1310.725696][T19198] ? apparmor_capable+0x1d7/0x4d0 [ 1310.725799][T19198] bpf_prog_alloc_no_stats+0x58/0x690 [ 1310.725830][T19198] ? security_capable+0x80/0x260 [ 1310.725925][T19198] bpf_prog_alloc+0x3b/0x200 [ 1310.725964][T19198] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1310.726078][T19198] bpf_prog_load+0x49e/0x2a80 [ 1310.726248][T19198] ? __pfx_bpf_prog_load+0x10/0x10 [ 1310.726736][T19198] __sys_bpf+0x1f46/0x4a30 [ 1310.726952][T19198] ? __pfx___sys_bpf+0x10/0x10 [ 1310.727064][T19198] ? rb_commit+0x129/0x9d0 [ 1310.727483][T19198] ? trace_buffer_unlock_commit_regs+0x37b/0x540 [ 1310.727605][T19198] ? trace_event_buffer_commit+0x20a/0xa80 [ 1310.728030][T19198] ? find_held_lock+0x2b/0x80 [ 1310.728141][T19198] ? __ia32_sys_bpf+0xcc/0x170 [ 1310.728166][T19198] __ia32_sys_bpf+0xcc/0x170 [ 1310.728206][T19198] ? rcu_is_watching+0x13/0xc0 [ 1310.728310][T19198] __do_fast_syscall_32+0x13a/0x8b0 [ 1310.728432][T19198] do_fast_syscall_32+0x32/0x70 [ 1310.728479][T19198] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1310.728515][T19198] RIP: 0023:0xf7f34fec [ 1310.728572][T19198] Code: Unable to access opcode bytes at 0xf7f34fc2. [ 1310.728584][T19198] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1310.728612][T19198] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080001b00 [ 1310.728627][T19198] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 1310.728641][T19198] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1310.728655][T19198] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1310.728670][T19198] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1310.728934][T19198] [ 1313.711879][ T30] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 1313.885411][ T30] usb 10-1: Using ep0 maxpacket: 8 [ 1313.889483][T19210] loop8: detected capacity change from 0 to 7 [ 1313.914300][ T30] usb 10-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1313.944513][T19210] Dev loop8: unable to read RDB block 7 [ 1313.944624][T19210] loop8: unable to read partition table [ 1313.953987][ T30] usb 10-1: config 0 has an invalid interface number: 55 but max is 0 [ 1313.959535][T19210] loop8: partition table beyond EOD, truncated [ 1313.959624][T19210] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1313.967775][ T30] usb 10-1: config 0 has no interface number 0 [ 1313.968195][ T30] usb 10-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1313.968229][ T30] usb 10-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1313.968264][ T30] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1313.968308][ T30] usb 10-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1313.968543][ T30] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1314.249484][ T30] usb 10-1: config 0 descriptor?? [ 1314.492486][ T30] ldusb 10-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1315.334921][ T30] usb 10-1: USB disconnect, device number 16 [ 1315.619300][ T30] ldusb 10-1:0.55: LD USB Device #0 now disconnected [ 1322.176612][T19234] loop5: detected capacity change from 0 to 7 [ 1324.724565][T19234] Dev loop5: unable to read RDB block 7 [ 1324.724829][T19234] loop5: unable to read partition table [ 1324.729964][T19234] loop5: partition table beyond EOD, truncated [ 1324.730049][T19234] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 1327.533374][T19254] profile_transition: unconfined exec no attachment [ 1328.007813][T19258] profile_transition: unconfined exec no attachment [ 1348.808424][T19326] profile_transition: unconfined exec no attachment [ 1349.770149][T19329] profile_transition: unconfined exec no attachment [ 1357.548289][T19343] profile_transition: unconfined exec no attachment [ 1359.102659][T19350] profile_transition: unconfined exec no attachment [ 1361.899649][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 1368.834878][T19379] FAULT_INJECTION: forcing a failure. [ 1368.834878][T19379] name failslab, interval 1, probability 0, space 9, times 0 [ 1368.835103][T19379] CPU: 2 UID: 0 PID: 19379 Comm: syz.5.21151 Tainted: G L syzkaller #0 PREEMPT(full) [ 1368.835160][T19379] Tainted: [L]=SOFTLOCKUP [ 1368.835188][T19379] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1368.835220][T19379] Call Trace: [ 1368.835279][T19379] [ 1368.835342][T19379] dump_stack_lvl+0x100/0x190 [ 1368.835516][T19379] should_fail_ex.cold+0x5/0xa [ 1368.835770][T19379] should_failslab+0xc2/0x120 [ 1368.835938][T19379] __kmalloc_cache_noprof+0x91/0x6d0 [ 1368.836158][T19379] ? do_eventfd+0x67/0x2b0 [ 1368.836321][T19379] do_eventfd+0x67/0x2b0 [ 1368.836505][T19379] __ia32_sys_eventfd2+0x53/0x80 [ 1368.836634][T19379] __do_fast_syscall_32+0x13a/0x8b0 [ 1368.836775][T19379] do_fast_syscall_32+0x32/0x70 [ 1368.836870][T19379] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1368.836944][T19379] RIP: 0023:0xf7f26fec [ 1368.837050][T19379] Code: Unable to access opcode bytes at 0xf7f26fc2. [ 1368.837071][T19379] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000148 [ 1368.837121][T19379] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 [ 1368.837147][T19379] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1368.837173][T19379] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1368.837198][T19379] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1368.837222][T19379] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1368.837692][T19379] [ 1373.248509][T19394] netlink: 'syz.7.21156': attribute type 4 has an invalid length. [ 1375.971132][T19405] profile_transition: unconfined exec no attachment [ 1376.759515][T19411] profile_transition: unconfined exec no attachment [ 1377.926488][T19407] A link change request failed with some changes committed already. Interface dvmrp0 may have been left with an inconsistent configuration, please check. [ 1384.599856][T19435] profile_transition: unconfined exec no attachment [ 1385.957309][T19440] profile_transition: unconfined exec no attachment [ 1389.371213][T29865] usb 12-1: new high-speed USB device number 14 using dummy_hcd [ 1389.572936][T29865] usb 12-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1389.607159][T29865] usb 12-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1389.608379][T29865] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1389.608402][T29865] usb 12-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1389.608604][T29865] usb 12-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1389.710775][T29865] usb 12-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1389.712052][T29865] usb 12-1: Product: syz [ 1389.712069][T29865] usb 12-1: Manufacturer: syz [ 1390.236683][T29865] cdc_wdm 12-1:1.0: skipping garbage [ 1390.250702][T29865] cdc_wdm 12-1:1.0: skipping garbage [ 1390.493247][T19448] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1390.498035][T19448] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1390.505352][T19448] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1390.506725][T19448] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1390.545818][T29865] cdc_wdm 12-1:1.0: cdc-wdm0: USB WDM device [ 1390.547411][T29865] cdc_wdm 12-1:1.0: Unknown control protocol [ 1391.103126][T29865] usb 12-1: USB disconnect, device number 14 [ 1392.402850][T19451] Bluetooth: hci4: command 0x0c1a tx timeout [ 1392.625313][T19451] Bluetooth: hci1: command 0x0c1a tx timeout [ 1392.626710][T31404] Bluetooth: hci0: command 0x0c1a tx timeout [ 1393.403841][T19431] Dynamic Preempt: lazy [ 1394.640633][T19451] Bluetooth: hci1: command 0x0c1a tx timeout [ 1395.014791][T19462] FAULT_INJECTION: forcing a failure. [ 1395.014791][T19462] name fail_futex, interval 1, probability 0, space 0, times 1 [ 1395.014867][T19462] CPU: 1 UID: 0 PID: 19462 Comm: syz.7.21175 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 1395.014903][T19462] Tainted: [L]=SOFTLOCKUP [ 1395.014914][T19462] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1395.014928][T19462] Call Trace: [ 1395.014947][T19462] [ 1395.014968][T19462] dump_stack_lvl+0x100/0x190 [ 1395.015076][T19462] should_fail_ex.cold+0x5/0xa [ 1395.015208][T19462] get_futex_key+0x1d0/0x14f0 [ 1395.015312][T19462] ? __pfx_get_futex_key+0x10/0x10 [ 1395.015562][T19462] futex_wake+0xf4/0x5e0 [ 1395.015739][T19462] ? __pfx_futex_wake+0x10/0x10 [ 1395.015796][T19462] ? ring_buffer_unlock_commit+0x2e7/0x700 [ 1395.015885][T19462] ? trace_buffer_unlock_commit_regs+0x37b/0x540 [ 1395.016116][T19462] do_futex+0x2b2/0x440 [ 1395.016184][T19462] ? __pfx_do_futex+0x10/0x10 [ 1395.016243][T19462] ? trace_event_raw_event_lock+0x1e2/0x2b0 [ 1395.016322][T19462] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 1395.016455][T19462] __ia32_sys_futex_time32+0x2f4/0x470 [ 1395.016564][T19462] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 1395.016600][T19462] ? find_held_lock+0x2b/0x80 [ 1395.016653][T19462] ? trace_syscall_enter+0xcc/0x120 [ 1395.016713][T19462] ? trace_syscall_enter+0xcc/0x120 [ 1395.016897][T19462] __do_fast_syscall_32+0x13a/0x8b0 [ 1395.017054][T19462] do_fast_syscall_32+0x32/0x70 [ 1395.017137][T19462] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1395.017167][T19462] RIP: 0023:0xf6fcefec [ 1395.017213][T19462] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 1395.017225][T19462] RSP: 002b:00000000f53bd5cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 1395.017251][T19462] RAX: ffffffffffffffda RBX: 00000000f73c4f8c RCX: 0000000000000081 [ 1395.017266][T19462] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 1395.017280][T19462] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 1395.017324][T19462] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1395.017340][T19462] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1395.017669][T19462] [ 1405.153767][ T43] audit: type=1807 audit(2000001164.873:42667): action=measure func=FILE_CHECK res=1 [ 1405.204287][T19494] ima: policy update completed [ 1405.209242][ T43] audit: type=1802 audit(2000001164.923:42668): pid=19494 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=policy_update cause=completed comm="syz.7.21186" res=1 errno=0 [ 1405.357806][ T5152] [ 1405.358814][ T5152] ====================================================== [ 1405.361529][ T5152] WARNING: possible circular locking dependency detected [ 1405.364363][ T5152] syzkaller #0 Tainted: G L [ 1405.367039][ T5152] ------------------------------------------------------ [ 1405.370110][ T5152] udevd/5152 is trying to acquire lock: [ 1405.372786][ T5152] ffff888029dbddd8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 [ 1405.376215][ T5152] [ 1405.376215][ T5152] but task is already holding lock: [ 1405.379244][ T5152] ffff888014457a28 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2350 [ 1405.384446][ T5152] [ 1405.384446][ T5152] which lock already depends on the new lock. [ 1405.384446][ T5152] [ 1405.388699][ T5152] [ 1405.388699][ T5152] the existing dependency chain (in reverse order) is: [ 1405.392182][ T5152] [ 1405.392182][ T5152] -> #4 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 1405.395539][ T5152] lock_acquire+0x1d1/0x380 [ 1405.397706][ T5152] __mutex_lock+0x1a4/0x1bd0 [ 1405.400192][ T5152] process_measurement+0x5ab/0x2350 [ 1405.402804][ T5152] ima_file_check+0xcc/0x120 [ 1405.404960][ T5152] security_file_post_open+0xc4/0x210 [ 1405.407288][ T5152] path_openat+0x5cd/0x2440 [ 1405.409373][ T5152] do_file_open+0x20e/0x430 [ 1405.411544][ T5152] file_open_name+0x1c3/0x3e0 [ 1405.413776][ T5152] filp_open+0x2e/0x50 [ 1405.416265][ T5152] kernel_read_file_from_path_initns+0xec/0x240 [ 1405.419708][ T5152] _request_firmware+0x733/0x13c0 [ 1405.422037][ T5152] request_firmware+0x35/0x50 [ 1405.424093][ T5152] reg_reload_regdb+0x85/0x460 [ 1405.426371][ T5152] genl_family_rcv_msg_doit+0x214/0x300 [ 1405.429311][ T5152] genl_rcv_msg+0x560/0x800 [ 1405.431606][ T5152] netlink_rcv_skb+0x159/0x420 [ 1405.433994][ T5152] genl_rcv+0x28/0x40 [ 1405.436060][ T5152] netlink_unicast+0x585/0x850 [ 1405.438456][ T5152] netlink_sendmsg+0x8b0/0xda0 [ 1405.440679][ T5152] ____sys_sendmsg+0xa4d/0xbe0 [ 1405.442771][ T5152] ___sys_sendmsg+0x190/0x1e0 [ 1405.444832][ T5152] __sys_sendmsg+0x160/0x210 [ 1405.446878][ T5152] __do_fast_syscall_32+0x13a/0x8b0 [ 1405.449756][ T5152] do_fast_syscall_32+0x32/0x70 [ 1405.451947][ T5152] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1405.454804][ T5152] [ 1405.454804][ T5152] -> #3 (cb_lock){++++}-{4:4}: [ 1405.457538][ T5152] lock_acquire+0x1d1/0x380 [ 1405.459601][ T5152] down_read+0x99/0x4c0 [ 1405.461513][ T5152] genl_release+0x7e/0x1d0 [ 1405.463990][ T5152] netlink_release+0x105e/0x2000 [ 1405.466824][ T5152] __sock_release+0xb3/0x260 [ 1405.469048][ T5152] sock_close+0x1c/0x30 [ 1405.470985][ T5152] __fput+0x3ff/0xb50 [ 1405.472762][ T5152] fput_close_sync+0x118/0x250 [ 1405.474810][ T5152] __x64_sys_close+0x8b/0x120 [ 1405.476878][ T5152] do_syscall_64+0x121/0x770 [ 1405.479042][ T5152] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1405.482649][ T5152] [ 1405.482649][ T5152] -> #2 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}: [ 1405.486440][ T5152] lock_acquire+0x1d1/0x380 [ 1405.488566][ T5152] down_write+0x8b/0x1f0 [ 1405.490602][ T5152] __sock_release+0x86/0x260 [ 1405.492694][ T5152] sock_close+0x1c/0x30 [ 1405.495102][ T5152] __fput+0x3ff/0xb50 [ 1405.497505][ T5152] __fput_sync+0xd7/0x100 [ 1405.499606][ T5152] nvme_tcp_alloc_queue.isra.0+0xd6d/0x1770 [ 1405.502260][ T5152] nvme_tcp_configure_admin_queue+0x26/0x530 [ 1405.504809][ T5152] nvme_tcp_setup_ctrl+0xa4/0xa20 [ 1405.506973][ T5152] nvme_tcp_create_ctrl+0x970/0xd90 [ 1405.509228][ T5152] nvmf_dev_write+0x4ee/0xb60 [ 1405.511624][ T5152] vfs_write+0x2aa/0x1050 [ 1405.514163][ T5152] ksys_write+0x12a/0x250 [ 1405.516640][ T5152] __do_fast_syscall_32+0x13a/0x8b0 [ 1405.519047][ T5152] do_fast_syscall_32+0x32/0x70 [ 1405.521189][ T5152] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1405.523874][ T5152] [ 1405.523874][ T5152] -> #1 (nvmf_dev_mutex){+.+.}-{4:4}: [ 1405.526978][ T5152] lock_acquire+0x1d1/0x380 [ 1405.529381][ T5152] __mutex_lock+0x1a4/0x1bd0 [ 1405.531690][ T5152] nvmf_dev_show+0x26/0x210 [ 1405.533746][ T5152] seq_read_iter+0x32f/0x1270 [ 1405.535893][ T5152] seq_read+0x344/0x4d0 [ 1405.537963][ T5152] vfs_read+0x1e4/0xb40 [ 1405.540163][ T5152] ksys_read+0x12a/0x250 [ 1405.542683][ T5152] __do_fast_syscall_32+0x13a/0x8b0 [ 1405.545370][ T5152] do_fast_syscall_32+0x32/0x70 [ 1405.547476][ T5152] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1405.550145][ T5152] [ 1405.550145][ T5152] -> #0 (&p->lock){+.+.}-{4:4}: [ 1405.552907][ T5152] check_prev_add+0xeb/0xe60 [ 1405.555003][ T5152] __lock_acquire+0x1492/0x1ec0 [ 1405.557409][ T5152] lock_acquire+0x1d1/0x380 [ 1405.559925][ T5152] __mutex_lock+0x1a4/0x1bd0 [ 1405.562167][ T5152] seq_read_iter+0xe1/0x1270 [ 1405.564194][ T5152] kernfs_fop_read_iter+0x46c/0x610 [ 1405.566477][ T5152] __kernel_read+0x397/0xad0 [ 1405.568506][ T5152] integrity_kernel_read+0x7e/0xb0 [ 1405.571005][ T5152] ima_calc_file_hash_tfm+0x25e/0x350 [ 1405.573746][ T5152] ima_calc_file_hash+0x1e3/0x380 [ 1405.576064][ T5152] ima_collect_measurement+0x94f/0xb30 [ 1405.578470][ T5152] process_measurement+0xdfe/0x2350 [ 1405.580860][ T5152] ima_file_check+0xcc/0x120 [ 1405.583201][ T5152] security_file_post_open+0xc4/0x210 [ 1405.585881][ T5152] path_openat+0x5cd/0x2440 [ 1405.588096][ T5152] do_file_open+0x20e/0x430 [ 1405.590291][ T5152] do_sys_openat2+0x10f/0x1e0 [ 1405.592465][ T5152] __x64_sys_openat+0x12d/0x210 [ 1405.594970][ T5152] do_syscall_64+0x121/0x770 [ 1405.597392][ T5152] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1405.600365][ T5152] [ 1405.600365][ T5152] other info that might help us debug this: [ 1405.600365][ T5152] [ 1405.604343][ T5152] Chain exists of: [ 1405.604343][ T5152] &p->lock --> cb_lock --> &ima_iint_mutex_key[depth] [ 1405.604343][ T5152] [ 1405.609220][ T5152] Possible unsafe locking scenario: [ 1405.609220][ T5152] [ 1405.612233][ T5152] CPU0 CPU1 [ 1405.614721][ T5152] ---- ---- [ 1405.616886][ T5152] lock(&ima_iint_mutex_key[depth]); [ 1405.619047][ T5152] lock(cb_lock); [ 1405.621453][ T5152] lock(&ima_iint_mutex_key[depth]); [ 1405.624793][ T5152] lock(&p->lock); [ 1405.626419][ T5152] [ 1405.626419][ T5152] *** DEADLOCK *** [ 1405.626419][ T5152] [ 1405.629381][ T5152] locks held by udevd/5152: 1, last CPU#0: [ 1405.631745][ T5152] #0: ffff888014457a28 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x5ab/0x2350 [ 1405.636237][ T5152] [ 1405.636237][ T5152] stack backtrace: [ 1405.638623][ T5152] CPU: 0 UID: 0 PID: 5152 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(lazy) [ 1405.643264][ T5152] Tainted: [L]=SOFTLOCKUP [ 1405.645340][ T5152] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1405.649658][ T5152] Call Trace: [ 1405.651038][ T5152] [ 1405.652250][ T5152] dump_stack_lvl+0x100/0x190 [ 1405.654325][ T5152] print_circular_bug.cold+0x178/0x1be [ 1405.657031][ T5152] check_noncircular+0x146/0x160 [ 1405.659585][ T5152] ? trace_buffer_unlock_commit_regs+0x37b/0x540 [ 1405.662788][ T5152] check_prev_add+0xeb/0xe60 [ 1405.664755][ T5152] __lock_acquire+0x1492/0x1ec0 [ 1405.666890][ T5152] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 1405.669513][ T5152] lock_acquire+0x1d1/0x380 [ 1405.671392][ T5152] ? seq_read_iter+0xe1/0x1270 [ 1405.673683][ T5152] ? __pfx___might_resched+0x10/0x10 [ 1405.675869][ T5152] ? is_bpf_text_address+0x8a/0x1a0 [ 1405.678034][ T5152] ? is_bpf_text_address+0x8a/0x1a0 [ 1405.680407][ T5152] __mutex_lock+0x1a4/0x1bd0 [ 1405.682589][ T5152] ? seq_read_iter+0xe1/0x1270 [ 1405.684848][ T5152] ? seq_read_iter+0xe1/0x1270 [ 1405.686893][ T5152] ? kernel_text_address+0x8d/0x100 [ 1405.688982][ T5152] ? __kernel_text_address+0xd/0x30 [ 1405.691091][ T5152] ? unwind_get_return_address+0x59/0xa0 [ 1405.693562][ T5152] ? __pfx___mutex_lock+0x10/0x10 [ 1405.696277][ T5152] ? stack_trace_save+0x8e/0xc0 [ 1405.698390][ T5152] ? __pfx_stack_trace_save+0x10/0x10 [ 1405.700837][ T5152] ? seq_read_iter+0xe1/0x1270 [ 1405.702812][ T5152] seq_read_iter+0xe1/0x1270 [ 1405.704981][ T5152] ? kasan_save_stack+0x30/0x50 [ 1405.707252][ T5152] ? kasan_save_track+0x14/0x30 [ 1405.709322][ T5152] ? __kasan_kmalloc+0xaa/0xb0 [ 1405.711313][ T5152] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 1405.713496][ T5152] ? ima_calc_file_hash_tfm+0x236/0x350 [ 1405.715773][ T5152] ? ima_collect_measurement+0x94f/0xb30 [ 1405.718557][ T5152] ? ima_file_check+0xcc/0x120 [ 1405.720954][ T5152] ? security_file_post_open+0xc4/0x210 [ 1405.723283][ T5152] ? do_file_open+0x20e/0x430 [ 1405.725148][ T5152] ? do_sys_openat2+0x10f/0x1e0 [ 1405.727145][ T5152] kernfs_fop_read_iter+0x46c/0x610 [ 1405.729518][ T5152] __kernel_read+0x397/0xad0 [ 1405.731386][ T5152] ? __pfx___kernel_read+0x10/0x10 [ 1405.733985][ T5152] integrity_kernel_read+0x7e/0xb0 [ 1405.736743][ T5152] ? __pfx_integrity_kernel_read+0x10/0x10 [ 1405.739765][ T5152] ? ima_calc_file_hash_tfm+0x236/0x350 [ 1405.742254][ T5152] ima_calc_file_hash_tfm+0x25e/0x350 [ 1405.744489][ T5152] ? __pfx_ima_calc_file_hash_tfm+0x10/0x10 [ 1405.748105][ T5152] ? ima_alloc_tfm+0x21a/0x2e0 [ 1405.750585][ T5152] ? kernfs_iop_getattr+0xc4/0xf0 [ 1405.753478][ T5152] ima_calc_file_hash+0x1e3/0x380 [ 1405.756043][ T5152] ima_collect_measurement+0x94f/0xb30 [ 1405.758433][ T5152] ? __pfx_ima_collect_measurement+0x10/0x10 [ 1405.761505][ T5152] ? vfs_getxattr_alloc+0xec/0x350 [ 1405.763744][ T5152] ? ima_get_hash_algo+0x241/0x400 [ 1405.765808][ T5152] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 1405.768420][ T5152] ? process_measurement+0xdfe/0x2350 [ 1405.771390][ T5152] process_measurement+0xdfe/0x2350 [ 1405.774112][ T5152] ? __pfx_process_measurement+0x10/0x10 [ 1405.776632][ T5152] ? trace_buffer_unlock_commit_regs+0x37b/0x540 [ 1405.779437][ T5152] ? trace_event_raw_event_lock+0x1e2/0x2b0 [ 1405.782306][ T5152] ? kernfs_put_active+0x93/0xe0 [ 1405.784307][ T5152] ? kernfs_fop_open+0x3da/0xd50 [ 1405.786488][ T5152] ima_file_check+0xcc/0x120 [ 1405.788479][ T5152] ? __pfx_ima_file_check+0x10/0x10 [ 1405.791197][ T5152] security_file_post_open+0xc4/0x210 [ 1405.793600][ T5152] path_openat+0x5cd/0x2440 [ 1405.795735][ T5152] ? __pfx_path_openat+0x10/0x10 [ 1405.797752][ T5152] ? trace_event_buffer_commit+0x20a/0xa80 [ 1405.800259][ T5152] do_file_open+0x20e/0x430 [ 1405.802605][ T5152] ? __pfx_do_file_open+0x10/0x10 [ 1405.805147][ T5152] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 1405.808314][ T5152] ? _raw_spin_unlock+0x28/0x50 [ 1405.810318][ T5152] ? alloc_fd+0x471/0x7a0 [ 1405.812268][ T5152] do_sys_openat2+0x10f/0x1e0 [ 1405.814258][ T5152] ? __pfx_do_sys_openat2+0x10/0x10 [ 1405.816589][ T5152] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 1405.819701][ T5152] __x64_sys_openat+0x12d/0x210 [ 1405.822091][ T5152] ? __pfx___x64_sys_openat+0x10/0x10 [ 1405.824434][ T5152] ? find_held_lock+0x2b/0x80 [ 1405.826449][ T5152] ? trace_syscall_enter+0xcc/0x120 [ 1405.828711][ T5152] do_syscall_64+0x121/0x770 [ 1405.830756][ T5152] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1405.833222][ T5152] RIP: 0033:0x7f1019aa7407 [ 1405.835347][ T5152] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1405.843625][ T5152] RSP: 002b:00007fffee0e43e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1405.846933][ T5152] RAX: ffffffffffffffda RBX: 00007f101a196880 RCX: 00007f1019aa7407 [ 1405.850500][ T5152] RDX: 0000000000080000 RSI: 00007fffee0e4560 RDI: ffffffffffffff9c [ 1405.854097][ T5152] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 1405.857577][ T5152] R10: 0000000000000000 R11: 0000000000000202 R12: 000055fafc7ef7f5 [ 1405.860945][ T5152] R13: 000055fafc7ef7f5 R14: 0000000000000001 R15: 00007fffee0e8bb0 [ 1405.864375][ T5152] [ 1406.155817][ T43] audit: type=1800 audit(2000001165.823:42669): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16051 res=0 errno=0 [ 1406.439767][ T43] audit: type=1800 audit(2000001166.153:42670): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16051 res=0 errno=0 [ 1406.484389][ T43] audit: type=1800 audit(2000001166.193:42671): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16309 res=0 errno=0 [ 1406.997046][ T43] audit: type=1800 audit(2000001166.713:42672): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16309 res=0 errno=0 [ 1407.079022][T19504] profile_transition: unconfined exec no attachment [ 1407.843152][T19506] profile_transition: unconfined exec no attachment [ 1409.140728][ T43] audit: type=1800 audit(2000001168.853:42673): pid=5152 uid=0 auid=4294967295 ses=4294967295 subj=_unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16051 res=0 errno=0