endmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:18 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 519.634853][T19987] dlm: no locking on control device 22:08:18 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x2, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 519.689276][ T3784] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 519.694423][T19999] dlm: no locking on control device 22:08:18 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 519.746000][T20005] dlm: no locking on control device [ 519.939265][ T3784] usb 5-1: Using ep0 maxpacket: 8 [ 520.079976][ T3784] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 520.088007][ T3784] usb 5-1: config 0 has no interface number 0 [ 520.095453][ T3784] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 520.107331][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 520.118048][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 520.128741][ T3784] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 520.138576][ T3784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 520.154250][ T3784] usb 5-1: config 0 descriptor?? [ 520.180651][T19951] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 520.187981][T19951] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 520.436244][ T3784] usb 5-1: USB disconnect, device number 92 22:08:19 executing program 1: socket(0x0, 0x0, 0x0) socket$inet(0x2, 0x4000000805, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x80000001, 0x0, 0x20, 0x24}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 22:08:19 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2f) 22:08:19 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:19 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x3, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:19 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xa602, 0x0) 22:08:19 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:19 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x4, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 521.032756][T20066] dlm: no locking on control device 22:08:19 executing program 1: socket(0x0, 0x0, 0x0) socket$inet(0x2, 0x4000000805, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x80000001, 0x0, 0x20, 0x24}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) [ 521.105023][T20072] __nla_validate_parse: 18 callbacks suppressed [ 521.105032][T20072] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 521.122551][T20088] dlm: no locking on control device 22:08:19 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x5, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:19 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xca02, 0x0) [ 521.148195][T20072] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:19 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x6, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:19 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f7574"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:20 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xd400, 0x0) [ 521.319125][ T3784] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 521.338129][T20113] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 521.350314][T20112] dlm: no locking on control device [ 521.569464][T20115] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 521.587138][T20115] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 521.599259][ T3784] usb 5-1: Using ep0 maxpacket: 8 [ 521.729170][ T3784] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 521.737470][ T3784] usb 5-1: config 0 has no interface number 0 [ 521.745629][ T3784] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 521.757520][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 521.769027][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 521.779855][ T3784] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 521.789474][ T3784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 521.810533][ T3784] usb 5-1: config 0 descriptor?? [ 521.830467][T20073] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 521.837779][T20073] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 522.126148][ T2469] usb 5-1: USB disconnect, device number 93 22:08:20 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3a) 22:08:21 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:21 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf203, 0x0) 22:08:21 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x7, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:21 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f7574"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:21 executing program 1: socket(0x0, 0x0, 0x0) socket$inet(0x2, 0x4000000805, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x80000001, 0x0, 0x20, 0x24}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 22:08:21 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x48, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 522.635971][T20178] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 522.652048][T20180] dlm: no locking on control device 22:08:21 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x4c, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:21 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf403, 0x0) [ 522.712290][T20189] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 522.749953][T20200] dlm: no locking on control device 22:08:21 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x50, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 522.802767][T20208] dlm: no locking on control device 22:08:21 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x60, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 522.853298][T20215] dlm: no locking on control device [ 522.861998][T20219] dlm: no locking on control device 22:08:21 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x68, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 522.940704][T20225] dlm: no locking on control device [ 522.948948][ T2469] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 523.026635][T20230] dlm: no locking on control device [ 523.045829][T20233] dlm: no locking on control device [ 523.108157][T20189] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 523.188908][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 523.314832][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 523.335905][ T2469] usb 5-1: config 0 has no interface number 0 [ 523.343156][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 22:08:22 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3c) [ 523.366550][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 523.377846][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 523.389321][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 523.398477][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.413376][ T2469] usb 5-1: config 0 descriptor?? [ 523.440293][T20187] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 523.447623][T20187] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 523.679376][ T2469] usb 5-1: USB disconnect, device number 94 22:08:22 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:22 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x6c, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:22 executing program 1: socket(0x0, 0x0, 0x0) socket$inet(0x2, 0x4000000805, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:08:22 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f7574"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:22 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x74, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 524.264899][T20285] dlm: no locking on control device 22:08:23 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x7a, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 524.346224][T20298] dlm: no locking on control device [ 524.413141][T20305] dlm: no locking on control device [ 524.427323][T20308] dlm: no locking on control device 22:08:23 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x300, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 524.478417][T20286] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 524.500307][T20313] dlm: no locking on control device [ 524.525697][T20296] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 524.568753][ T3785] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 524.858708][ T3785] usb 5-1: Using ep0 maxpacket: 8 [ 525.008804][ T3785] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 525.016908][ T3785] usb 5-1: config 0 has no interface number 0 [ 525.026507][ T3785] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 525.038436][ T3785] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 525.049392][ T3785] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 525.060480][ T3785] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 525.070778][ T3785] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.093007][ T3785] usb 5-1: config 0 descriptor?? [ 525.110104][T20293] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 525.117516][T20293] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 525.369570][ T3785] usb 5-1: USB disconnect, device number 95 22:08:24 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf803, 0x0) 22:08:24 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x500, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:24 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x60) 22:08:24 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:24 executing program 1: socket(0x0, 0x0, 0x0) socket$inet(0x2, 0x4000000805, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:08:24 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:24 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x600, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:24 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 525.890100][T20368] dlm: no locking on control device 22:08:24 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf903, 0x0) [ 525.982190][T20392] dlm: no locking on control device [ 525.996735][T20397] dlm: no locking on control device 22:08:24 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x700, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:24 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:24 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 526.115663][T20413] __nla_validate_parse: 7 callbacks suppressed [ 526.115673][T20413] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 526.118520][T20414] dlm: no locking on control device [ 526.139089][T20413] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 526.150412][T20413] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 526.151565][T20422] dlm: no locking on control device 22:08:24 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x2000, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:24 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xfa03, 0x0) [ 526.221217][T20424] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 526.251919][T20424] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 526.268085][T20430] dlm: no locking on control device [ 526.268513][ T3785] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 526.274082][T20424] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 526.568562][ T3785] usb 5-1: Using ep0 maxpacket: 8 [ 526.698604][ T3785] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 526.706640][ T3785] usb 5-1: config 0 has no interface number 0 [ 526.714427][ T3785] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 526.726393][ T3785] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 526.738088][ T3785] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 526.749987][ T3785] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 526.760046][ T3785] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.772449][ T3785] usb 5-1: config 0 descriptor?? [ 526.789962][T20395] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 526.797391][T20395] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 527.028088][ T3785] usb 5-1: USB disconnect, device number 96 22:08:25 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x500) 22:08:25 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x3f00, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:25 executing program 1: socket(0x0, 0x0, 0x0) socket$inet(0x2, 0x4000000805, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 527.225037][T20479] dlm: no locking on control device 22:08:26 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:26 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xfc01, 0x0) 22:08:26 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x4800, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:26 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x4c00, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 527.600028][T20497] dlm: no locking on control device [ 527.607493][T20500] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 527.654781][T20500] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 527.685412][T20500] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 527.688810][T20516] dlm: no locking on control device 22:08:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:26 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x5000, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 527.718422][T20519] dlm: no locking on control device 22:08:26 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x6000, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:26 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xfe03, 0x0) [ 527.756832][T20521] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 527.776326][T20523] dlm: no locking on control device [ 527.844461][T20538] dlm: no locking on control device [ 527.852645][T20542] dlm: no locking on control device [ 527.898342][ T35] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 528.138282][ T35] usb 5-1: Using ep0 maxpacket: 8 22:08:26 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x600) 22:08:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 528.278405][ T35] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 528.286593][ T35] usb 5-1: config 0 has no interface number 0 [ 528.304867][ T35] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 22:08:27 executing program 1: socket(0x0, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 528.350986][ T35] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 528.391121][ T35] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 528.411003][ T35] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 528.434081][ T35] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 528.458564][ T35] usb 5-1: config 0 descriptor?? [ 528.480153][T20501] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 528.487868][T20501] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 528.732007][ T2469] usb 5-1: USB disconnect, device number 97 22:08:27 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:27 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x6800, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:27 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x20000, 0x0) 22:08:27 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 529.335249][T20607] dlm: no locking on control device [ 529.355127][T20614] dlm: no locking on control device 22:08:28 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x6c00, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:28 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x7400, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:28 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x40000, 0x0) [ 529.444305][T20620] dlm: no locking on control device 22:08:28 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x7a00, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 529.510685][T20632] dlm: no locking on control device [ 529.520456][T20635] dlm: no locking on control device [ 529.571395][T20637] dlm: no locking on control device [ 529.595048][T20640] dlm: no locking on control device [ 529.600843][ T2469] usb 5-1: new high-speed USB device number 98 using dummy_hcd 22:08:28 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x2, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:28 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xe80) 22:08:28 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x100000, 0x0) [ 529.670876][T20648] dlm: no locking on control device 22:08:28 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 529.848081][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 529.968700][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 529.976862][ T2469] usb 5-1: config 0 has no interface number 0 [ 529.985268][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 529.997515][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 530.008673][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 530.019344][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 530.029576][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 530.044055][ T2469] usb 5-1: config 0 descriptor?? [ 530.069537][T20609] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 530.077037][T20609] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 530.318571][ T3785] usb 5-1: USB disconnect, device number 98 22:08:29 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:29 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x4, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:29 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xfea) 22:08:29 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:29 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x400000, 0x0) 22:08:29 executing program 1: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 22:08:29 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x5, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:29 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x6, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:29 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:29 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x1000000, 0x0) 22:08:29 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x7, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 531.063521][T20745] dlm: no locking on control device 22:08:29 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x9, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 531.219916][T20765] dlm: Unknown command passed to DLM device : 9 [ 531.219916][T20765] [ 531.236997][ T0] NOHZ: local_softirq_pending 08 [ 531.243146][ T3787] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 531.315714][T20754] __nla_validate_parse: 5 callbacks suppressed [ 531.315723][T20754] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 531.527850][ T3787] usb 5-1: Using ep0 maxpacket: 8 [ 531.658762][ T3787] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 531.666825][ T3787] usb 5-1: config 0 has no interface number 0 [ 531.674612][ T3787] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 531.685840][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 531.695960][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 531.705988][ T3787] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 531.715718][ T3787] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.730411][ T3787] usb 5-1: config 0 descriptor?? [ 531.758986][T20726] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 531.766305][T20726] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 532.009800][ T3787] usb 5-1: USB disconnect, device number 99 22:08:31 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:31 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x2000000, 0x0) 22:08:31 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x25, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:31 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:31 executing program 1: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 22:08:31 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xfee) 22:08:31 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x39, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 532.586000][T20818] dlm: Unknown command passed to DLM device : 37 [ 532.586000][T20818] [ 532.593339][T20817] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:31 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x63, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:31 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 532.655333][T20834] dlm: Unknown command passed to DLM device : 57 [ 532.655333][T20834] 22:08:31 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xa020000, 0x0) 22:08:31 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1b7, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 532.759126][T20849] dlm: Unknown command passed to DLM device : 99 [ 532.759126][T20849] 22:08:31 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x300, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 532.814398][T20862] dlm: Unknown command passed to DLM device : 183 [ 532.814398][T20862] [ 532.867407][T20868] dlm: Unknown command passed to DLM device : 0 [ 532.867407][T20868] [ 532.907744][ T2469] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 532.975674][T20850] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 533.157638][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 533.277812][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 533.285818][ T2469] usb 5-1: config 0 has no interface number 0 [ 533.293488][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 533.305243][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 533.316060][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 533.326732][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 533.336584][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.349597][ T2469] usb 5-1: config 0 descriptor?? [ 533.369087][T20830] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 533.376483][T20830] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 533.664683][ T3784] usb 5-1: USB disconnect, device number 100 22:08:32 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:32 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x7ffffff2, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:32 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00\x00', @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:32 executing program 1: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10005, 0x0) 22:08:32 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x14030000, 0x0) 22:08:32 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1100) [ 534.199690][T20919] dlm: Unknown command passed to DLM device : 242 [ 534.199690][T20919] [ 534.200389][T20924] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 534.223284][T20928] dlm: Unknown command passed to DLM device : 242 [ 534.223284][T20928] 22:08:33 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x7ffffff8, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 534.288441][T20934] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 534.321956][T20934] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:33 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x1e010000, 0x0) 22:08:33 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x7ffffff9, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 534.351496][T20946] dlm: Unknown command passed to DLM device : 248 [ 534.351496][T20946] 22:08:33 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00\x00', @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:33 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0xffffff1f, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 534.396163][T20952] dlm: Unknown command passed to DLM device : 249 [ 534.396163][T20952] 22:08:33 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef03749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 534.500333][T20966] dlm: Unknown command passed to DLM device : 31 [ 534.500333][T20966] [ 534.593276][T20972] dlm: no locking on control device [ 534.611089][T20975] dlm: no locking on control device [ 534.654356][T20961] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 534.679524][T20968] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 534.689191][T20968] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:33 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:33 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x3f000000, 0x0) 22:08:33 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef39749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:33 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00\x00', @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:33 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 534.849878][T20987] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:33 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2900) 22:08:33 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef070a9fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:33 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:33 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x40000000, 0x0) 22:08:34 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07259fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 535.302772][T21016] dlm: no locking on control device 22:08:34 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:34 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82029cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:34 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:34 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x6cffffff, 0x0) [ 535.408401][T21039] dlm: no locking on control device 22:08:34 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:34 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82039cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 535.474588][T21046] dlm: no locking on control device [ 535.541609][T21064] dlm: no locking on control device [ 535.553632][T21067] dlm: no locking on control device 22:08:34 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:08:34 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2b00) 22:08:34 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/18, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:34 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82049cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:34 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x8a000000, 0x0) 22:08:34 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:35 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82059cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 536.329438][T21081] dlm: no locking on control device [ 536.331041][T21084] __nla_validate_parse: 11 callbacks suppressed [ 536.331051][T21084] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:35 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82069cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 536.411127][T21097] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 536.416366][T21103] dlm: no locking on control device [ 536.446006][T21097] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:35 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/18, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 536.466533][T21110] dlm: no locking on control device 22:08:35 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xa6020000, 0x0) 22:08:35 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82079cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 536.527714][T21116] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 536.564723][T21123] dlm: no locking on control device 22:08:35 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82089cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 536.572702][T21116] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 536.584010][T21116] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 536.617413][ T2469] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 536.642316][T21134] dlm: no locking on control device 22:08:35 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 536.897434][ T2469] usb 5-1: device descriptor read/64, error 18 [ 537.287209][ T2469] usb 5-1: device descriptor read/64, error 18 22:08:36 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2c00) 22:08:36 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/18, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:36 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e820a9cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:36 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xca020000, 0x0) [ 537.452178][T21150] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 537.468583][T21152] dlm: no locking on control device [ 537.496799][T21150] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 537.508133][T21150] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 537.557198][ T2469] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 537.827040][ T2469] usb 5-1: device descriptor read/64, error 18 [ 538.219732][ T2469] usb 5-1: device descriptor read/64, error 18 [ 538.337225][ T2469] usb usb5-port1: attempt power cycle [ 539.046953][ T2469] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 539.217071][ T2469] usb 5-1: device descriptor read/8, error -61 22:08:38 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:38 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e820b9cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:38 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/19, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:38 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xd4000000, 0x0) 22:08:38 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:08:38 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2f00) [ 539.371074][T21184] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 539.373457][T21181] dlm: no locking on control device 22:08:38 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e820c9cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 539.442073][ T2469] usb 5-1: device descriptor read/8, error -71 22:08:38 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/19, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:38 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e820d9cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 539.495772][T21208] dlm: no locking on control device 22:08:38 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf2030000, 0x0) [ 539.552008][T21217] dlm: no locking on control device [ 539.577724][T21221] dlm: no locking on control device 22:08:38 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e820e9cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:38 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/19, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 539.661699][T21235] dlm: no locking on control device [ 539.956947][ T2469] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 540.166897][ T2469] usb 5-1: device descriptor read/8, error -61 [ 540.456971][ T2469] usb 5-1: device descriptor read/8, error -61 [ 540.577003][ T2469] usb usb5-port1: unable to enumerate USB device 22:08:41 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:41 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82109cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:41 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf4030000, 0x0) 22:08:41 executing program 3: socket(0x1000000010, 0x80002, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r2, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:41 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:08:41 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3a00) 22:08:41 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82119cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 542.446596][T21254] dlm: no locking on control device [ 542.463143][T21253] __nla_validate_parse: 8 callbacks suppressed [ 542.463152][T21253] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:41 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82129cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 542.510557][T21271] dlm: no locking on control device [ 542.522194][T21277] dlm: no locking on control device 22:08:41 executing program 3: socket(0x1000000010, 0x80002, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r2, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:41 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82399cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 542.613701][T21282] dlm: no locking on control device 22:08:41 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf8030000, 0x0) 22:08:41 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba095a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 542.644320][T21288] dlm: no locking on control device [ 542.654223][T21290] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 542.709884][T21299] dlm: no locking on control device [ 542.719326][T21308] dlm: no locking on control device [ 542.806518][ T35] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 543.076520][ T35] usb 5-1: device descriptor read/64, error 18 [ 543.466543][ T35] usb 5-1: device descriptor read/64, error 18 [ 543.736376][ T35] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 544.006332][ T35] usb 5-1: device descriptor read/64, error 18 [ 544.396321][ T35] usb 5-1: device descriptor read/64, error 18 [ 544.516970][ T35] usb usb5-port1: attempt power cycle [ 545.226350][ T35] usb 5-1: new high-speed USB device number 107 using dummy_hcd 22:08:44 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:44 executing program 3: socket(0x1000000010, 0x80002, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r2, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:44 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba0a5a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:44 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf9030000, 0x0) 22:08:44 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:08:44 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3c00) [ 545.416778][ T35] usb 5-1: device descriptor read/8, error -61 22:08:44 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba255a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 545.515924][T21320] dlm: no locking on control device [ 545.523905][T21322] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:44 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba305a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 545.595613][T21345] dlm: no locking on control device 22:08:44 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, 0x0, 0x0, 0x0) 22:08:44 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba375a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 545.636522][ T35] usb 5-1: device descriptor read/8, error -71 [ 545.649693][T21350] dlm: no locking on control device [ 545.652078][T21353] dlm: no locking on control device 22:08:44 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xfa030000, 0x0) 22:08:44 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba395a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 545.702850][T21356] dlm: no locking on control device [ 545.709179][T21358] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 545.787571][T21370] dlm: no locking on control device [ 546.126147][ T35] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 546.316828][ T35] usb 5-1: device descriptor read/8, error -61 [ 546.596205][ T35] usb 5-1: device descriptor read/8, error -61 [ 546.716238][ T35] usb usb5-port1: unable to enumerate USB device 22:08:47 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:47 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, 0x0, 0x0, 0x0) 22:08:47 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba635a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:47 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xfc010000, 0x0) 22:08:47 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:08:47 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3f00) 22:08:47 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a39dbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 548.577734][T21386] dlm: no locking on control device [ 548.607375][T21389] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 548.651736][T21408] dlm: no locking on control device 22:08:47 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede539d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:47 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xfe030000, 0x0) 22:08:47 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, 0x0, 0x0, 0x0) 22:08:47 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb398cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 548.734628][T21419] dlm: no locking on control device 22:08:47 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd50aaf872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 548.783537][T21428] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 548.787114][T21432] dlm: no locking on control device [ 548.829765][T21442] dlm: no locking on control device [ 548.945921][ T35] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 549.225896][ T35] usb 5-1: device descriptor read/64, error 18 [ 549.615704][ T35] usb 5-1: device descriptor read/64, error 18 [ 549.895693][ T35] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 550.165664][ T35] usb 5-1: device descriptor read/64, error 18 [ 550.565664][ T35] usb 5-1: device descriptor read/64, error 18 [ 550.696292][ T35] usb usb5-port1: attempt power cycle [ 551.405591][ T35] usb 5-1: new high-speed USB device number 111 using dummy_hcd 22:08:50 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:50 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd523af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:50 executing program 3: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x50, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:50 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xffffff6c, 0x0) 22:08:50 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:08:50 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x4000) [ 551.575690][ T35] usb 5-1: device descriptor read/8, error -61 [ 551.641821][T21458] dlm: no locking on control device 22:08:50 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd525af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:50 executing program 3: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:50 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd52aaf872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 551.748579][T21479] dlm: no locking on control device 22:08:50 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x100000000000, 0x0) 22:08:50 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd52baf872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 551.785650][ T35] usb 5-1: device descriptor read/8, error -71 [ 551.812840][T21489] dlm: no locking on control device [ 551.822070][T21492] dlm: no locking on control device 22:08:50 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd52daf872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 551.871446][T21498] dlm: no locking on control device [ 552.025744][T10916] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 552.265563][T10916] usb 4-1: Using ep0 maxpacket: 8 [ 552.295465][ T35] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 552.386692][T10916] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 552.394932][T10916] usb 4-1: config 0 has no interface number 0 [ 552.402545][T10916] usb 4-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 552.414697][T10916] usb 4-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 552.425970][T10916] usb 4-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 552.436773][T10916] usb 4-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 552.446852][T10916] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.461035][T10916] usb 4-1: config 0 descriptor?? [ 552.466347][ T35] usb 5-1: device descriptor read/8, error -61 [ 552.496276][T21481] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 552.503634][T21481] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 552.736079][ T35] usb 5-1: device descriptor read/8, error -61 [ 552.826402][T10916] usb 4-1: USB disconnect, device number 11 [ 552.873282][ T35] usb usb5-port1: unable to enumerate USB device 22:08:53 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:53 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd52eaf872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:53 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x400000000000, 0x0) 22:08:53 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x6000) 22:08:53 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:08:53 executing program 3 (fault-call:8 fault-nth:0): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 554.739707][T21558] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 554.761309][T21561] dlm: no locking on control device [ 554.773379][T21568] dlm: no locking on control device [ 554.803878][T21558] FAULT_INJECTION: forcing a failure. [ 554.803878][T21558] name failslab, interval 1, probability 0, space 0, times 0 [ 554.829347][T21558] CPU: 1 PID: 21558 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 554.837690][T21558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 554.847739][T21558] Call Trace: [ 554.851029][T21558] dump_stack+0x188/0x20d [ 554.855348][T21558] should_fail.cold+0x5/0xa [ 554.859836][T21558] ? lock_downgrade+0x840/0x840 [ 554.864671][T21558] ? fault_create_debugfs_attr+0x140/0x140 [ 554.870535][T21558] ? netlink_insert+0x180/0x1590 [ 554.875459][T21558] should_failslab+0x5/0xf [ 554.879860][T21558] kmem_cache_alloc_node+0x25c/0x760 [ 554.885133][T21558] __alloc_skb+0xba/0x5a0 [ 554.889457][T21558] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 554.894988][T21558] ? netlink_autobind.isra.0+0x21b/0x300 [ 554.900612][T21558] netlink_sendmsg+0x97b/0xe10 [ 554.905364][T21558] ? aa_af_perm+0x260/0x260 [ 554.909850][T21558] ? netlink_unicast+0x740/0x740 [ 554.914771][T21558] ? netlink_unicast+0x740/0x740 [ 554.919734][T21558] sock_sendmsg+0xcf/0x120 [ 554.924132][T21558] ____sys_sendmsg+0x32f/0x810 [ 554.928889][T21558] ? kernel_sendmsg+0x50/0x50 [ 554.933544][T21558] ? mark_lock+0x11f/0xdd0 [ 554.937946][T21558] ___sys_sendmsg+0x100/0x170 [ 554.942610][T21558] ? debug_smp_processor_id+0x2f/0x185 [ 554.948049][T21558] ? sendmsg_copy_msghdr+0x70/0x70 [ 554.953152][T21558] ? rcu_read_lock_held_common+0xa0/0xa0 [ 554.958772][T21558] ? __fget_files+0x32f/0x500 [ 554.963439][T21558] ? ksys_dup3+0x3c0/0x3c0 [ 554.967853][T21558] ? __fget_light+0x20e/0x270 [ 554.972512][T21558] __sys_sendmmsg+0x195/0x480 [ 554.977168][T21558] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 554.982172][T21558] ? lock_downgrade+0x840/0x840 [ 554.987013][T21558] ? __mutex_unlock_slowpath+0xe2/0x660 [ 554.992541][T21558] ? wait_for_completion+0x270/0x270 [ 554.997800][T21558] ? __this_cpu_preempt_check+0x28/0x190 [ 555.003411][T21558] ? __sb_end_write+0x101/0x1d0 [ 555.008239][T21558] ? vfs_write+0x161/0x5d0 [ 555.012633][T21558] ? fput_many+0x2f/0x1a0 [ 555.016946][T21558] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 555.022381][T21558] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 555.028342][T21558] __x64_sys_sendmmsg+0x99/0x100 [ 555.033264][T21558] do_syscall_64+0xf6/0x7d0 [ 555.037748][T21558] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 555.043642][T21558] RIP: 0033:0x45ca59 [ 555.047618][T21558] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 555.067214][T21558] RSP: 002b:00007f357f15cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 555.076558][T21558] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 555.084515][T21558] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 555.092465][T21558] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 22:08:53 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd530af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 555.100426][T21558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 555.108383][T21558] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f15d6d4 22:08:53 executing program 3 (fault-call:8 fault-nth:1): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:53 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd558af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 555.180546][T21586] dlm: no locking on control device [ 555.199984][T21591] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 555.230906][T21595] dlm: no locking on control device [ 555.233159][T21591] FAULT_INJECTION: forcing a failure. [ 555.233159][T21591] name failslab, interval 1, probability 0, space 0, times 0 [ 555.248408][T21600] dlm: no locking on control device [ 555.252751][T21591] CPU: 1 PID: 21591 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 555.263402][T21591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 555.273464][T21591] Call Trace: [ 555.276768][T21591] dump_stack+0x188/0x20d 22:08:53 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd564af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:54 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd569af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 555.281116][T21591] should_fail.cold+0x5/0xa [ 555.285627][T21591] ? lock_downgrade+0x840/0x840 [ 555.290481][T21591] ? fault_create_debugfs_attr+0x140/0x140 [ 555.296312][T21591] ? fs_reclaim_release+0xa/0x20 [ 555.298229][T21602] dlm: no locking on control device [ 555.301267][T21591] should_failslab+0x5/0xf [ 555.301285][T21591] kmem_cache_alloc_node_trace+0x27c/0x790 [ 555.301305][T21591] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 555.301329][T21591] __kmalloc_node_track_caller+0x38/0x60 22:08:54 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd56caf872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 555.301354][T21591] __kmalloc_reserve.isra.0+0x39/0xe0 [ 555.301375][T21591] __alloc_skb+0xef/0x5a0 [ 555.338078][T21591] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 555.343068][T21607] dlm: no locking on control device [ 555.343654][T21591] ? netlink_autobind.isra.0+0x21b/0x300 [ 555.353260][T21610] dlm: no locking on control device [ 555.354444][T21591] netlink_sendmsg+0x97b/0xe10 [ 555.354468][T21591] ? aa_af_perm+0x260/0x260 [ 555.354483][T21591] ? netlink_unicast+0x740/0x740 [ 555.354508][T21591] ? netlink_unicast+0x740/0x740 [ 555.354525][T21591] sock_sendmsg+0xcf/0x120 [ 555.354546][T21591] ____sys_sendmsg+0x32f/0x810 [ 555.387961][T21591] ? kernel_sendmsg+0x50/0x50 [ 555.392648][T21591] ? mark_lock+0x11f/0xdd0 [ 555.397082][T21591] ___sys_sendmsg+0x100/0x170 [ 555.401767][T21591] ? debug_smp_processor_id+0x2f/0x185 [ 555.407235][T21591] ? sendmsg_copy_msghdr+0x70/0x70 [ 555.408027][T21612] dlm: no locking on control device [ 555.412358][T21591] ? rcu_read_lock_held_common+0xa0/0xa0 [ 555.412378][T21591] ? __fget_files+0x32f/0x500 [ 555.412397][T21591] ? ksys_dup3+0x3c0/0x3c0 [ 555.412420][T21591] ? __fget_light+0x20e/0x270 [ 555.412443][T21591] __sys_sendmmsg+0x195/0x480 [ 555.412462][T21591] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 555.412480][T21591] ? lock_downgrade+0x840/0x840 [ 555.422369][T21615] dlm: no locking on control device [ 555.423288][T21591] ? __mutex_unlock_slowpath+0xe2/0x660 [ 555.423308][T21591] ? wait_for_completion+0x270/0x270 [ 555.423322][T21591] ? __this_cpu_preempt_check+0x28/0x190 [ 555.423339][T21591] ? __sb_end_write+0x101/0x1d0 [ 555.423352][T21591] ? vfs_write+0x161/0x5d0 [ 555.423368][T21591] ? fput_many+0x2f/0x1a0 [ 555.423388][T21591] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 555.423409][T21591] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 555.498106][T21591] __x64_sys_sendmmsg+0x99/0x100 [ 555.503035][T21591] do_syscall_64+0xf6/0x7d0 [ 555.507623][T21591] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 555.513511][T21591] RIP: 0033:0x45ca59 [ 555.517394][T21591] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 555.536981][T21591] RSP: 002b:00007f357f15cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 555.545467][T21591] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 555.553435][T21591] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 555.561399][T21591] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 555.569353][T21591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 555.577305][T21591] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f15d6d4 [ 555.745040][ T3784] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 555.995029][ T3784] usb 5-1: Using ep0 maxpacket: 8 [ 556.145085][ T3784] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 556.155370][ T3784] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 556.164423][ T3784] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 556.175229][ T3784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 556.192058][ T3784] usb 5-1: config 0 descriptor?? [ 556.450189][ T35] usb 5-1: USB disconnect, device number 113 22:08:55 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:55 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 557.264869][ T3784] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 557.504903][ T3784] usb 5-1: Using ep0 maxpacket: 8 [ 557.624990][ T3784] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 557.639285][ T3784] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 557.648355][ T3784] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 557.661527][ T3784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 557.681948][ T3784] usb 5-1: config 0 descriptor?? 22:08:56 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x2000000000000, 0x0) 22:08:56 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd56faf872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:56 executing program 3 (fault-call:8 fault-nth:2): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:56 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x800e) 22:08:56 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd570af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 557.751905][T21641] dlm: no locking on control device [ 557.763015][T21645] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:56 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd573af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 557.805643][T21654] dlm: no locking on control device 22:08:56 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd575af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:56 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 557.841849][T21645] FAULT_INJECTION: forcing a failure. [ 557.841849][T21645] name failslab, interval 1, probability 0, space 0, times 0 [ 557.844547][T21667] dlm: no locking on control device [ 557.881583][T21645] CPU: 1 PID: 21645 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 557.889938][T21645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 557.898430][T21674] dlm: no locking on control device [ 557.899988][T21645] Call Trace: [ 557.900035][T21645] dump_stack+0x188/0x20d [ 557.900059][T21645] should_fail.cold+0x5/0xa [ 557.900077][T21645] ? fault_create_debugfs_attr+0x140/0x140 [ 557.900098][T21645] ? lock_acquire+0x1f2/0x8f0 [ 557.927815][T21645] ? netlink_deliver_tap+0x146/0xb50 [ 557.933110][T21645] should_failslab+0x5/0xf [ 557.937535][T21645] kmem_cache_alloc+0x44/0x740 [ 557.942308][T21645] ? lock_downgrade+0x840/0x840 [ 557.947174][T21645] skb_clone+0x14d/0x3c0 [ 557.951427][T21645] netlink_deliver_tap+0x91c/0xb50 [ 557.956539][T21645] netlink_unicast+0x5e9/0x740 [ 557.961288][T21645] ? netlink_attachskb+0x810/0x810 [ 557.966394][T21645] ? _copy_from_iter_full+0x25c/0x870 [ 557.971771][T21645] ? __check_object_size+0x30/0x437 [ 557.976972][T21645] ? netlink_autobind.isra.0+0x21b/0x300 [ 557.982080][T21681] dlm: no locking on control device [ 557.982636][T21645] netlink_sendmsg+0x882/0xe10 22:08:56 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd578af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:56 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd56363872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 557.992589][T21645] ? aa_af_perm+0x260/0x260 [ 557.997099][T21645] ? netlink_unicast+0x740/0x740 [ 558.002103][T21645] ? netlink_unicast+0x740/0x740 [ 558.007129][T21645] sock_sendmsg+0xcf/0x120 [ 558.011543][T21645] ____sys_sendmsg+0x32f/0x810 [ 558.016316][T21645] ? kernel_sendmsg+0x50/0x50 [ 558.020997][T21645] ? mark_lock+0x11f/0xdd0 [ 558.025430][T21645] ___sys_sendmsg+0x100/0x170 [ 558.030111][T21645] ? debug_smp_processor_id+0x2f/0x185 [ 558.030995][T21687] dlm: no locking on control device [ 558.035570][T21645] ? sendmsg_copy_msghdr+0x70/0x70 [ 558.035592][T21645] ? rcu_read_lock_held_common+0xa0/0xa0 [ 558.035613][T21645] ? __fget_files+0x32f/0x500 [ 558.035633][T21645] ? ksys_dup3+0x3c0/0x3c0 [ 558.035657][T21645] ? __fget_light+0x20e/0x270 [ 558.035676][T21645] __sys_sendmmsg+0x195/0x480 [ 558.035694][T21645] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 558.035709][T21645] ? lock_downgrade+0x840/0x840 [ 558.035737][T21645] ? __mutex_unlock_slowpath+0xe2/0x660 [ 558.035756][T21645] ? wait_for_completion+0x270/0x270 [ 558.085223][T21690] dlm: no locking on control device [ 558.085388][T21645] ? __this_cpu_preempt_check+0x28/0x190 [ 558.101454][T21645] ? __sb_end_write+0x101/0x1d0 [ 558.106308][T21645] ? vfs_write+0x161/0x5d0 [ 558.110732][T21645] ? fput_many+0x2f/0x1a0 [ 558.115081][T21645] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 558.120544][T21645] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 558.126535][T21645] __x64_sys_sendmmsg+0x99/0x100 [ 558.131481][T21645] do_syscall_64+0xf6/0x7d0 [ 558.136028][T21645] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 558.141913][T21645] RIP: 0033:0x45ca59 [ 558.145806][T21645] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 558.165409][T21645] RSP: 002b:00007f357f15cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 558.173809][T21645] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 558.181759][T21645] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 558.189714][T21645] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 558.197667][T21645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 558.205635][T21645] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f15d6d4 [ 558.237399][T10916] usb 5-1: USB disconnect, device number 114 [ 558.262800][T21645] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 558.287140][T21645] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:57 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:57 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af87390a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:57 executing program 3 (fault-call:8 fault-nth:3): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:57 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x4000000000000, 0x0) 22:08:57 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xea0f) 22:08:57 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 558.822498][T21707] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 558.842580][T21709] dlm: no locking on control device [ 558.857757][T21718] dlm: no locking on control device [ 558.875852][T21722] FAULT_INJECTION: forcing a failure. [ 558.875852][T21722] name failslab, interval 1, probability 0, space 0, times 0 [ 558.888899][T21722] CPU: 0 PID: 21722 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 558.897227][T21722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 558.907276][T21722] Call Trace: [ 558.910562][T21722] dump_stack+0x188/0x20d [ 558.914884][T21722] should_fail.cold+0x5/0xa [ 558.919414][T21722] ? fault_create_debugfs_attr+0x140/0x140 [ 558.925207][T21722] ? lock_acquire+0x1f2/0x8f0 [ 558.929904][T21722] ? net_tx_action+0xd20/0xd20 [ 558.934661][T21722] should_failslab+0x5/0xf [ 558.939174][T21722] kmem_cache_alloc+0x44/0x740 [ 558.943962][T21722] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 558.949838][T21722] ? skb_network_protocol+0xf2/0x480 [ 558.955106][T21722] skb_clone+0x14d/0x3c0 [ 558.959349][T21722] dev_queue_xmit_nit+0x398/0xaa0 [ 558.964353][T21722] ? debug_smp_processor_id+0x2f/0x185 [ 558.969794][T21722] dev_hard_start_xmit+0xbb/0x9b0 [ 558.974797][T21722] ? validate_xmit_skb+0x82b/0xe70 [ 558.979896][T21722] __dev_queue_xmit+0x25e1/0x30a0 [ 558.984906][T21722] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 558.990169][T21722] ? __copy_skb_header+0x1f0/0x5b0 [ 558.995261][T21722] ? skb_splice_bits+0x1a0/0x1a0 [ 559.000230][T21722] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 559.006022][T21722] ? __skb_clone+0x5af/0x7a0 [ 559.010602][T21722] ? netlink_deliver_tap+0x8b0/0xb50 [ 559.015864][T21722] netlink_deliver_tap+0x8b0/0xb50 [ 559.020970][T21722] netlink_unicast+0x5e9/0x740 [ 559.025727][T21722] ? netlink_attachskb+0x810/0x810 [ 559.030816][T21722] ? _copy_from_iter_full+0x25c/0x870 [ 559.036179][T21722] ? __check_object_size+0x30/0x437 [ 559.041362][T21722] ? netlink_autobind.isra.0+0x21b/0x300 [ 559.046975][T21722] netlink_sendmsg+0x882/0xe10 [ 559.051734][T21722] ? aa_af_perm+0x260/0x260 [ 559.056226][T21722] ? netlink_unicast+0x740/0x740 [ 559.061148][T21722] ? netlink_unicast+0x740/0x740 [ 559.066065][T21722] sock_sendmsg+0xcf/0x120 [ 559.070466][T21722] ____sys_sendmsg+0x32f/0x810 [ 559.075212][T21722] ? kernel_sendmsg+0x50/0x50 [ 559.079868][T21722] ? mark_lock+0x11f/0xdd0 [ 559.084282][T21722] ___sys_sendmsg+0x100/0x170 [ 559.088939][T21722] ? debug_smp_processor_id+0x2f/0x185 [ 559.094393][T21722] ? sendmsg_copy_msghdr+0x70/0x70 [ 559.099515][T21722] ? rcu_read_lock_held_common+0xa0/0xa0 [ 559.105143][T21722] ? __fget_files+0x32f/0x500 [ 559.109800][T21722] ? ksys_dup3+0x3c0/0x3c0 [ 559.114211][T21722] ? __fget_light+0x20e/0x270 [ 559.118871][T21722] __sys_sendmmsg+0x195/0x480 [ 559.123553][T21722] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 559.128560][T21722] ? lock_downgrade+0x840/0x840 [ 559.133401][T21722] ? __mutex_unlock_slowpath+0xe2/0x660 [ 559.138927][T21722] ? wait_for_completion+0x270/0x270 [ 559.144199][T21722] ? __this_cpu_preempt_check+0x28/0x190 [ 559.149823][T21722] ? __sb_end_write+0x101/0x1d0 [ 559.154653][T21722] ? vfs_write+0x161/0x5d0 [ 559.159059][T21722] ? fput_many+0x2f/0x1a0 [ 559.163369][T21722] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 559.168806][T21722] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 559.174779][T21722] __x64_sys_sendmmsg+0x99/0x100 [ 559.179698][T21722] do_syscall_64+0xf6/0x7d0 [ 559.184181][T21722] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 559.190053][T21722] RIP: 0033:0x45ca59 [ 559.193926][T21722] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 559.213508][T21722] RSP: 002b:00007f357f13bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 22:08:57 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a2518ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 559.221908][T21722] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 559.229867][T21722] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 559.237824][T21722] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 559.245780][T21722] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 559.253739][T21722] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f13c6d4 [ 559.340151][T21722] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 559.356106][T21722] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:58 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x100000000000000, 0x0) 22:08:58 executing program 3 (fault-call:8 fault-nth:4): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:58 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a3918ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 559.419209][T21731] dlm: no locking on control device [ 559.424671][ T3784] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 559.450451][T21736] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:58 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a2fecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 559.478697][T21744] dlm: no locking on control device [ 559.483375][T21736] FAULT_INJECTION: forcing a failure. [ 559.483375][T21736] name failslab, interval 1, probability 0, space 0, times 0 [ 559.509595][T21736] CPU: 1 PID: 21736 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 559.517936][T21736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 559.527986][T21736] Call Trace: [ 559.531271][T21736] dump_stack+0x188/0x20d [ 559.535631][T21736] should_fail.cold+0x5/0xa [ 559.540117][T21736] ? lock_downgrade+0x840/0x840 [ 559.544963][T21736] ? fault_create_debugfs_attr+0x140/0x140 [ 559.550763][T21736] should_failslab+0x5/0xf [ 559.555161][T21736] kmem_cache_alloc_node+0x25c/0x760 [ 559.560434][T21736] ? find_held_lock+0x2d/0x110 [ 559.565192][T21736] ? __might_fault+0x11f/0x1d0 [ 559.569952][T21736] __alloc_skb+0xba/0x5a0 [ 559.574282][T21736] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 559.579811][T21736] ? apparmor_socket_getpeersec_dgram+0x5/0x10 [ 559.585946][T21736] netlink_sendmsg+0x97b/0xe10 [ 559.590703][T21736] ? aa_af_perm+0x260/0x260 [ 559.595206][T21736] ? netlink_unicast+0x740/0x740 [ 559.600129][T21736] ? netlink_unicast+0x740/0x740 [ 559.605046][T21736] sock_sendmsg+0xcf/0x120 [ 559.609442][T21736] ____sys_sendmsg+0x32f/0x810 [ 559.614190][T21736] ? kernel_sendmsg+0x50/0x50 [ 559.618854][T21736] ? __lock_acquire+0x2224/0x48a0 [ 559.623873][T21736] ___sys_sendmsg+0x100/0x170 [ 559.628543][T21736] ? sendmsg_copy_msghdr+0x70/0x70 [ 559.633649][T21736] ? find_held_lock+0x2d/0x110 [ 559.638391][T21736] ? __might_fault+0x11f/0x1d0 [ 559.643132][T21736] ? ksys_dup3+0x3c0/0x3c0 [ 559.647528][T21736] ? lock_downgrade+0x840/0x840 [ 559.652367][T21736] __sys_sendmmsg+0x195/0x480 [ 559.657023][T21736] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 559.662035][T21736] ? lock_downgrade+0x840/0x840 [ 559.666873][T21736] ? __mutex_unlock_slowpath+0xe2/0x660 [ 559.672400][T21736] ? wait_for_completion+0x270/0x270 [ 559.677662][T21736] ? __this_cpu_preempt_check+0x28/0x190 [ 559.683285][T21736] ? __sb_end_write+0x101/0x1d0 [ 559.688111][T21736] ? vfs_write+0x161/0x5d0 [ 559.692515][T21736] ? fput_many+0x2f/0x1a0 [ 559.696840][T21736] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 559.702275][T21736] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 559.708235][T21736] __x64_sys_sendmmsg+0x99/0x100 [ 559.713170][T21736] do_syscall_64+0xf6/0x7d0 [ 559.717655][T21736] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 559.723523][T21736] RIP: 0033:0x45ca59 [ 559.727409][T21736] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 559.746992][T21736] RSP: 002b:00007f357f15cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 559.755391][T21736] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 559.763339][T21736] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 559.771296][T21736] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 22:08:58 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 559.779245][T21736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 559.787207][T21736] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f15d6d4 [ 559.843930][T21754] dlm: no locking on control device [ 559.914617][ T3784] usb 5-1: Using ep0 maxpacket: 8 [ 560.034679][ T3784] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 560.057627][ T3784] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 560.070321][ T3784] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 560.083578][ T3784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.098793][ T3784] usb 5-1: config 0 descriptor?? [ 560.339712][ T3784] usb 5-1: USB disconnect, device number 115 22:08:59 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c0900000905"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:08:59 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:08:59 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a39ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:08:59 executing program 3 (fault-call:8 fault-nth:5): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:08:59 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x200000000000000, 0x0) 22:08:59 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xee0f) 22:08:59 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b30961b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 560.897761][T21780] dlm: no locking on control device [ 560.901121][T21777] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:08:59 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927930b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 560.957651][T21777] FAULT_INJECTION: forcing a failure. [ 560.957651][T21777] name failslab, interval 1, probability 0, space 0, times 0 [ 560.977639][T21801] dlm: no locking on control device [ 560.987716][T21777] CPU: 0 PID: 21777 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 560.996063][T21777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 22:08:59 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927939b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 561.006124][T21777] Call Trace: [ 561.009451][T21777] dump_stack+0x188/0x20d [ 561.013795][T21777] should_fail.cold+0x5/0xa [ 561.014391][T21807] dlm: no locking on control device [ 561.018307][T21777] ? lock_downgrade+0x840/0x840 [ 561.018327][T21777] ? fault_create_debugfs_attr+0x140/0x140 [ 561.018342][T21777] ? fs_reclaim_release+0xa/0x20 [ 561.018363][T21777] should_failslab+0x5/0xf [ 561.026885][T21810] dlm: no locking on control device [ 561.028397][T21777] kmem_cache_alloc_node_trace+0x27c/0x790 [ 561.028417][T21777] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 561.028441][T21777] __kmalloc_node_track_caller+0x38/0x60 [ 561.028465][T21777] __kmalloc_reserve.isra.0+0x39/0xe0 [ 561.071476][T21777] __alloc_skb+0xef/0x5a0 [ 561.075801][T21777] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 561.081329][T21777] ? apparmor_socket_getpeersec_dgram+0x5/0x10 [ 561.087465][T21777] netlink_sendmsg+0x97b/0xe10 [ 561.092213][T21777] ? aa_af_perm+0x260/0x260 [ 561.096696][T21777] ? netlink_unicast+0x740/0x740 [ 561.101618][T21777] ? netlink_unicast+0x740/0x740 [ 561.106534][T21777] sock_sendmsg+0xcf/0x120 [ 561.110942][T21777] ____sys_sendmsg+0x32f/0x810 [ 561.115703][T21777] ? kernel_sendmsg+0x50/0x50 [ 561.120360][T21777] ? __lock_acquire+0x2224/0x48a0 [ 561.125379][T21777] ___sys_sendmsg+0x100/0x170 [ 561.130037][T21777] ? sendmsg_copy_msghdr+0x70/0x70 [ 561.135143][T21777] ? find_held_lock+0x2d/0x110 [ 561.139896][T21777] ? __might_fault+0x11f/0x1d0 [ 561.144638][T21777] ? ksys_dup3+0x3c0/0x3c0 [ 561.149045][T21777] ? lock_downgrade+0x840/0x840 [ 561.153882][T21777] __sys_sendmmsg+0x195/0x480 [ 561.158539][T21777] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 561.163800][T21777] ? lock_downgrade+0x840/0x840 [ 561.168642][T21777] ? __mutex_unlock_slowpath+0xe2/0x660 [ 561.174183][T21777] ? wait_for_completion+0x270/0x270 [ 561.179445][T21777] ? __this_cpu_preempt_check+0x28/0x190 [ 561.185066][T21777] ? __sb_end_write+0x101/0x1d0 [ 561.189893][T21777] ? vfs_write+0x161/0x5d0 [ 561.194284][T21777] ? fput_many+0x2f/0x1a0 [ 561.198595][T21777] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 561.204038][T21777] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 561.210007][T21777] __x64_sys_sendmmsg+0x99/0x100 [ 561.214925][T21777] do_syscall_64+0xf6/0x7d0 [ 561.219416][T21777] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 561.225293][T21777] RIP: 0033:0x45ca59 [ 561.229167][T21777] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 561.248847][T21777] RSP: 002b:00007f357f15cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 561.257246][T21777] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 561.265204][T21777] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 561.273162][T21777] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 561.281108][T21777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 561.289058][T21777] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f15d6d4 22:09:00 executing program 3 (fault-call:8 fault-nth:6): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 561.342994][T21813] dlm: no locking on control device [ 561.353324][T21816] dlm: no locking on control device 22:09:00 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xa02000000000000, 0x0) 22:09:00 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d030a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 561.393084][T21818] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 561.422216][T21818] FAULT_INJECTION: forcing a failure. [ 561.422216][T21818] name failslab, interval 1, probability 0, space 0, times 0 [ 561.442935][T21818] CPU: 1 PID: 21818 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 561.451283][T21818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 561.451355][T21827] dlm: no locking on control device [ 561.461334][T21818] Call Trace: [ 561.461360][T21818] dump_stack+0x188/0x20d [ 561.461382][T21818] should_fail.cold+0x5/0xa [ 561.461402][T21818] ? fault_create_debugfs_attr+0x140/0x140 [ 561.461419][T21818] ? lock_acquire+0x1f2/0x8f0 [ 561.461435][T21818] ? netlink_deliver_tap+0x146/0xb50 [ 561.461453][T21818] should_failslab+0x5/0xf [ 561.461468][T21818] kmem_cache_alloc+0x44/0x740 [ 561.461482][T21818] ? lock_downgrade+0x840/0x840 [ 561.461503][T21818] skb_clone+0x14d/0x3c0 [ 561.461521][T21818] netlink_deliver_tap+0x91c/0xb50 [ 561.461545][T21818] netlink_unicast+0x5e9/0x740 [ 561.461565][T21818] ? netlink_attachskb+0x810/0x810 [ 561.461581][T21818] ? _copy_from_iter_full+0x25c/0x870 [ 561.461650][T21818] ? __phys_addr_symbol+0x2c/0x70 [ 561.461671][T21818] ? __check_object_size+0x171/0x437 [ 561.480350][ T3784] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 561.484703][T21818] netlink_sendmsg+0x882/0xe10 [ 561.484728][T21818] ? aa_af_perm+0x260/0x260 [ 561.484746][T21818] ? netlink_unicast+0x740/0x740 [ 561.565167][T21818] ? netlink_unicast+0x740/0x740 [ 561.570085][T21818] sock_sendmsg+0xcf/0x120 [ 561.574487][T21818] ____sys_sendmsg+0x32f/0x810 [ 561.579232][T21818] ? kernel_sendmsg+0x50/0x50 [ 561.583891][T21818] ? __lock_acquire+0x2224/0x48a0 [ 561.588911][T21818] ___sys_sendmsg+0x100/0x170 [ 561.593571][T21818] ? sendmsg_copy_msghdr+0x70/0x70 [ 561.598682][T21818] ? find_held_lock+0x2d/0x110 [ 561.603425][T21818] ? __might_fault+0x11f/0x1d0 [ 561.608168][T21818] ? ksys_dup3+0x3c0/0x3c0 [ 561.612563][T21818] ? lock_downgrade+0x840/0x840 [ 561.617415][T21818] __sys_sendmmsg+0x195/0x480 [ 561.622074][T21818] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 561.627079][T21818] ? lock_downgrade+0x840/0x840 [ 561.631927][T21818] ? __mutex_unlock_slowpath+0xe2/0x660 [ 561.637455][T21818] ? wait_for_completion+0x270/0x270 [ 561.642717][T21818] ? __this_cpu_preempt_check+0x28/0x190 [ 561.648338][T21818] ? __sb_end_write+0x101/0x1d0 [ 561.653167][T21818] ? vfs_write+0x161/0x5d0 [ 561.657563][T21818] ? fput_many+0x2f/0x1a0 [ 561.661889][T21818] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 561.667329][T21818] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 561.673292][T21818] __x64_sys_sendmmsg+0x99/0x100 [ 561.678393][T21818] do_syscall_64+0xf6/0x7d0 [ 561.682877][T21818] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 561.688744][T21818] RIP: 0033:0x45ca59 [ 561.692625][T21818] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 561.712214][T21818] RSP: 002b:00007f357f15cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 561.720613][T21818] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 561.728562][T21818] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 561.736523][T21818] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 561.744482][T21818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 561.752441][T21818] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f15d6d4 [ 561.956792][ T3784] usb 5-1: Using ep0 maxpacket: 8 [ 561.981001][T21818] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 562.001898][T21818] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 562.075084][ T3784] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 562.083098][ T3784] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 562.093423][ T3784] usb 5-1: config 0 has no interface number 0 [ 562.100244][ T3784] usb 5-1: config 0 interface 2 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 562.110738][ T3784] usb 5-1: config 0 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 562.123607][ T3784] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 562.132708][ T3784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.147566][ T3784] usb 5-1: config 0 descriptor?? [ 562.190253][ T3784] snd-usb-audio: probe of 5-1:0.2 failed with error -2 [ 562.393096][ T3783] usb 5-1: USB disconnect, device number 116 [ 562.592372][ T0] NOHZ: local_softirq_pending 08 22:09:01 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c0900000905"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:01 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d390a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:01 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x1403000000000000, 0x0) 22:09:01 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:01 executing program 3 (fault-call:8 fault-nth:7): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:09:01 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1000000) 22:09:01 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d0225724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 562.973856][T21862] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 562.988826][T21863] dlm: no locking on control device [ 563.029635][T21874] FAULT_INJECTION: forcing a failure. [ 563.029635][T21874] name failslab, interval 1, probability 0, space 0, times 0 [ 563.040334][T21879] dlm: no locking on control device [ 563.042419][T21874] CPU: 0 PID: 21874 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 563.055852][T21874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 563.066098][T21874] Call Trace: [ 563.069386][T21874] dump_stack+0x188/0x20d [ 563.073720][T21874] should_fail.cold+0x5/0xa [ 563.078218][T21874] ? fault_create_debugfs_attr+0x140/0x140 [ 563.084022][T21874] ? lock_acquire+0x1f2/0x8f0 [ 563.088704][T21874] ? net_tx_action+0xd20/0xd20 [ 563.093472][T21874] should_failslab+0x5/0xf [ 563.097869][T21874] kmem_cache_alloc+0x44/0x740 [ 563.102616][T21874] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 563.108503][T21874] ? skb_network_protocol+0xf2/0x480 [ 563.113771][T21874] skb_clone+0x14d/0x3c0 [ 563.118007][T21874] dev_queue_xmit_nit+0x398/0xaa0 [ 563.123120][T21874] ? debug_smp_processor_id+0x2f/0x185 [ 563.128564][T21874] dev_hard_start_xmit+0xbb/0x9b0 [ 563.133566][T21874] ? validate_xmit_skb+0x82b/0xe70 [ 563.138661][T21874] __dev_queue_xmit+0x25e1/0x30a0 [ 563.143674][T21874] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 563.148953][T21874] ? __copy_skb_header+0x1f0/0x5b0 [ 563.154049][T21874] ? skb_splice_bits+0x1a0/0x1a0 [ 563.158984][T21874] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 563.164787][T21874] ? __skb_clone+0x5af/0x7a0 [ 563.169372][T21874] ? netlink_deliver_tap+0x8b0/0xb50 [ 563.174659][T21874] netlink_deliver_tap+0x8b0/0xb50 [ 563.179775][T21874] netlink_unicast+0x5e9/0x740 [ 563.184529][T21874] ? netlink_attachskb+0x810/0x810 [ 563.189624][T21874] ? _copy_from_iter_full+0x25c/0x870 [ 563.194980][T21874] ? __phys_addr_symbol+0x2c/0x70 [ 563.199986][T21874] ? __check_object_size+0x171/0x437 [ 563.205259][T21874] netlink_sendmsg+0x882/0xe10 [ 563.210026][T21874] ? aa_af_perm+0x260/0x260 [ 563.214526][T21874] ? netlink_unicast+0x740/0x740 [ 563.219456][T21874] ? netlink_unicast+0x740/0x740 [ 563.224382][T21874] sock_sendmsg+0xcf/0x120 [ 563.228784][T21874] ____sys_sendmsg+0x32f/0x810 [ 563.233545][T21874] ? kernel_sendmsg+0x50/0x50 [ 563.238207][T21874] ? __lock_acquire+0x2224/0x48a0 [ 563.243222][T21874] ___sys_sendmsg+0x100/0x170 [ 563.247897][T21874] ? sendmsg_copy_msghdr+0x70/0x70 [ 563.253002][T21874] ? find_held_lock+0x2d/0x110 [ 563.257748][T21874] ? __might_fault+0x11f/0x1d0 [ 563.262494][T21874] ? ksys_dup3+0x3c0/0x3c0 [ 563.266896][T21874] ? lock_downgrade+0x840/0x840 [ 563.271767][T21874] __sys_sendmmsg+0x195/0x480 [ 563.276445][T21874] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 563.281452][T21874] ? lock_downgrade+0x840/0x840 [ 563.286317][T21874] ? __mutex_unlock_slowpath+0xe2/0x660 [ 563.291846][T21874] ? wait_for_completion+0x270/0x270 [ 563.297114][T21874] ? __this_cpu_preempt_check+0x28/0x190 [ 563.302746][T21874] ? __sb_end_write+0x101/0x1d0 [ 563.307579][T21874] ? vfs_write+0x161/0x5d0 [ 563.311978][T21874] ? fput_many+0x2f/0x1a0 [ 563.316295][T21874] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 563.321739][T21874] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 563.327720][T21874] __x64_sys_sendmmsg+0x99/0x100 [ 563.332659][T21874] do_syscall_64+0xf6/0x7d0 [ 563.337150][T21874] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 563.343029][T21874] RIP: 0033:0x45ca59 [ 563.346919][T21874] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 563.366512][T21874] RSP: 002b:00007f357f13bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 22:09:02 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d0239724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 563.374924][T21874] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 563.382874][T21874] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 563.390823][T21874] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 563.398771][T21874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 563.406721][T21874] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f13c6d4 22:09:02 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a0a4232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 563.458994][T21889] dlm: no locking on control device [ 563.469481][T21874] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 563.487285][T21874] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:02 executing program 3 (fault-call:8 fault-nth:8): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:09:02 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a254232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 563.532689][T21894] dlm: no locking on control device [ 563.541306][T21897] dlm: no locking on control device 22:09:02 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724239a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 563.585019][T21899] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 563.611154][T21903] dlm: no locking on control device [ 563.614947][T21899] FAULT_INJECTION: forcing a failure. [ 563.614947][T21899] name failslab, interval 1, probability 0, space 0, times 0 [ 563.630347][T21899] CPU: 0 PID: 21899 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 563.638685][T21899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 563.648742][T21899] Call Trace: [ 563.652047][T21899] dump_stack+0x188/0x20d [ 563.656395][T21899] should_fail.cold+0x5/0xa [ 563.660915][T21899] ? fault_create_debugfs_attr+0x140/0x140 [ 563.661313][T21909] dlm: no locking on control device [ 563.666742][T21899] should_failslab+0x5/0xf [ 563.666761][T21899] kmem_cache_alloc_node_trace+0x27c/0x790 [ 563.666784][T21899] ? lock_downgrade+0x840/0x840 [ 563.666804][T21899] __kmalloc_node+0x38/0x60 [ 563.666882][T21899] qdisc_alloc+0xb6/0xcd0 [ 563.666926][T21899] ? do_raw_read_unlock+0x3b/0x70 [ 563.666941][T21899] ? _raw_read_unlock+0x24/0x40 [ 563.666963][T21899] qdisc_create+0xdc/0x1430 [ 563.710355][T21899] ? tc_get_qdisc+0xae0/0xae0 [ 563.715043][T21899] ? __nla_parse+0x3d/0x4a [ 563.719463][T21899] tc_modify_qdisc+0x4c5/0x1a00 [ 563.724330][T21899] ? qdisc_create+0x1430/0x1430 [ 563.729185][T21899] ? mutex_trylock+0x2c0/0x2c0 [ 563.733951][T21899] ? find_held_lock+0x2d/0x110 [ 563.738741][T21899] ? qdisc_create+0x1430/0x1430 [ 563.743647][T21899] rtnetlink_rcv_msg+0x44e/0xad0 [ 563.748588][T21899] ? rtnl_bridge_getlink+0x870/0x870 [ 563.753877][T21899] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 563.759681][T21899] ? __copy_skb_header+0x1f0/0x5b0 [ 563.764791][T21899] ? skb_splice_bits+0x1a0/0x1a0 [ 563.769752][T21899] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 563.775571][T21899] netlink_rcv_skb+0x15a/0x430 [ 563.780327][T21899] ? rtnl_bridge_getlink+0x870/0x870 [ 563.785600][T21899] ? netlink_ack+0xa60/0xa60 [ 563.790192][T21899] netlink_unicast+0x537/0x740 [ 563.794955][T21899] ? netlink_attachskb+0x810/0x810 [ 563.800069][T21899] ? _copy_from_iter_full+0x25c/0x870 [ 563.805440][T21899] ? __phys_addr_symbol+0x2c/0x70 [ 563.810492][T21899] ? __check_object_size+0x171/0x437 [ 563.815774][T21899] netlink_sendmsg+0x882/0xe10 [ 563.820594][T21899] ? aa_af_perm+0x260/0x260 [ 563.825094][T21899] ? netlink_unicast+0x740/0x740 [ 563.830040][T21899] ? netlink_unicast+0x740/0x740 [ 563.834988][T21899] sock_sendmsg+0xcf/0x120 [ 563.839408][T21899] ____sys_sendmsg+0x32f/0x810 [ 563.844182][T21899] ? kernel_sendmsg+0x50/0x50 [ 563.848897][T21899] ? __lock_acquire+0x2224/0x48a0 [ 563.853927][T21899] ___sys_sendmsg+0x100/0x170 [ 563.858603][T21899] ? sendmsg_copy_msghdr+0x70/0x70 [ 563.863754][T21899] ? find_held_lock+0x2d/0x110 [ 563.868515][T21899] ? __might_fault+0x11f/0x1d0 [ 563.873273][T21899] ? ksys_dup3+0x3c0/0x3c0 [ 563.877683][T21899] ? lock_downgrade+0x840/0x840 [ 563.882553][T21899] __sys_sendmmsg+0x195/0x480 [ 563.887227][T21899] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 563.892311][T21899] ? lock_downgrade+0x840/0x840 [ 563.897171][T21899] ? __mutex_unlock_slowpath+0xe2/0x660 [ 563.902720][T21899] ? wait_for_completion+0x270/0x270 [ 563.908001][T21899] ? __this_cpu_preempt_check+0x28/0x190 [ 563.913621][T21899] ? __sb_end_write+0x101/0x1d0 [ 563.918463][T21899] ? vfs_write+0x161/0x5d0 [ 563.922872][T21899] ? fput_many+0x2f/0x1a0 [ 563.927231][T21899] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 563.932717][T21899] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 563.938695][T21899] __x64_sys_sendmmsg+0x99/0x100 [ 563.943681][T21899] do_syscall_64+0xf6/0x7d0 [ 563.948185][T21899] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 563.954083][T21899] RIP: 0033:0x45ca59 [ 563.957979][T21899] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 563.977703][T21899] RSP: 002b:00007f357f15cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 563.986122][T21899] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 563.994085][T21899] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 564.002050][T21899] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 564.010007][T21899] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 564.017977][T21899] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f15d6d4 [ 564.028935][T21899] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 564.038857][T21899] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 564.094212][ T3783] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 564.344204][ T3783] usb 5-1: Using ep0 maxpacket: 8 [ 564.464463][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 564.472576][ T3783] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 564.484352][ T3783] usb 5-1: config 0 has no interface number 0 [ 564.490517][ T3783] usb 5-1: config 0 interface 2 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 564.502745][ T3783] usb 5-1: config 0 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 564.517479][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 564.527160][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 564.538101][ T3783] usb 5-1: config 0 descriptor?? [ 564.578622][ T3783] snd-usb-audio: probe of 5-1:0.2 failed with error -2 [ 564.782895][ T2469] usb 5-1: USB disconnect, device number 117 22:09:04 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c0900000905"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:04 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 565.593974][ T3783] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 565.833945][ T3783] usb 5-1: Using ep0 maxpacket: 8 22:09:04 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x1e01000000000000, 0x0) 22:09:04 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b460ac5e7bef3"}, 0x68) 22:09:04 executing program 3 (fault-call:8 fault-nth:9): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:09:04 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2000000) [ 565.954632][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 565.962649][ T3783] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 565.964642][T21937] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 565.989459][ T3783] usb 5-1: config 0 has no interface number 0 [ 565.997599][T21936] dlm: no locking on control device [ 566.003631][ T3783] usb 5-1: config 0 interface 2 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 566.013425][T21937] FAULT_INJECTION: forcing a failure. [ 566.013425][T21937] name failslab, interval 1, probability 0, space 0, times 0 [ 566.015879][ T3783] usb 5-1: config 0 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 566.044526][T21948] dlm: no locking on control device [ 566.050057][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 566.056503][T21937] CPU: 1 PID: 21937 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 566.067430][T21937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 566.076884][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.077481][T21937] Call Trace: [ 566.077505][T21937] dump_stack+0x188/0x20d [ 566.077530][T21937] should_fail.cold+0x5/0xa [ 566.077550][T21937] ? fault_create_debugfs_attr+0x140/0x140 [ 566.077573][T21937] should_failslab+0x5/0xf [ 566.107792][T21937] kmem_cache_alloc_node_trace+0x27c/0x790 [ 566.113588][T21937] ? debug_smp_processor_id+0x2f/0x185 [ 566.119042][T21937] __kmalloc_node+0x38/0x60 [ 566.123580][T21937] kvmalloc_node+0x61/0xf0 [ 566.127989][T21937] qdisc_class_hash_alloc+0x26/0xa0 [ 566.133183][T21937] qdisc_class_hash_init+0x19/0x110 [ 566.134849][ T3783] usb 5-1: config 0 descriptor?? [ 566.138372][T21937] ? qdisc_watchdog_init+0x20/0x80 [ 566.138463][T21937] hfsc_init_qdisc+0xf9/0x410 [ 566.138483][T21937] ? lockdep_rtnl_is_held+0x22/0x30 [ 566.158343][T21937] ? hfsc_reset_qdisc+0xd30/0xd30 [ 566.163376][T21937] qdisc_create+0x4bd/0x1430 [ 566.167984][T21937] ? tc_get_qdisc+0xae0/0xae0 [ 566.172656][T21937] ? __nla_parse+0x3d/0x4a [ 566.177092][T21937] tc_modify_qdisc+0x4c5/0x1a00 [ 566.181960][T21937] ? qdisc_create+0x1430/0x1430 [ 566.186814][T21937] ? mutex_trylock+0x2c0/0x2c0 [ 566.186820][ T3783] snd-usb-audio: probe of 5-1:0.2 failed with error -2 [ 566.191577][T21937] ? find_held_lock+0x2d/0x110 [ 566.191609][T21937] ? qdisc_create+0x1430/0x1430 [ 566.208008][T21937] rtnetlink_rcv_msg+0x44e/0xad0 [ 566.212956][T21937] ? rtnl_bridge_getlink+0x870/0x870 [ 566.218245][T21937] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 566.223538][T21937] ? __copy_skb_header+0x1f0/0x5b0 [ 566.228654][T21937] ? skb_splice_bits+0x1a0/0x1a0 [ 566.233599][T21937] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 566.239416][T21937] netlink_rcv_skb+0x15a/0x430 [ 566.244186][T21937] ? rtnl_bridge_getlink+0x870/0x870 [ 566.249468][T21937] ? netlink_ack+0xa60/0xa60 [ 566.254095][T21937] netlink_unicast+0x537/0x740 [ 566.258856][T21937] ? netlink_attachskb+0x810/0x810 [ 566.263960][T21937] ? _copy_from_iter_full+0x25c/0x870 [ 566.269395][T21937] ? __phys_addr_symbol+0x2c/0x70 [ 566.274489][T21937] ? __check_object_size+0x171/0x437 [ 566.279769][T21937] netlink_sendmsg+0x882/0xe10 [ 566.284544][T21937] ? aa_af_perm+0x260/0x260 [ 566.289037][T21937] ? netlink_unicast+0x740/0x740 [ 566.293971][T21937] ? netlink_unicast+0x740/0x740 [ 566.298937][T21937] sock_sendmsg+0xcf/0x120 [ 566.303386][T21937] ____sys_sendmsg+0x32f/0x810 [ 566.308136][T21937] ? kernel_sendmsg+0x50/0x50 [ 566.312800][T21937] ? __lock_acquire+0x2224/0x48a0 [ 566.317823][T21937] ___sys_sendmsg+0x100/0x170 [ 566.322481][T21937] ? sendmsg_copy_msghdr+0x70/0x70 [ 566.327582][T21937] ? find_held_lock+0x2d/0x110 [ 566.332327][T21937] ? __might_fault+0x11f/0x1d0 [ 566.337084][T21937] ? ksys_dup3+0x3c0/0x3c0 [ 566.341500][T21937] ? lock_downgrade+0x840/0x840 [ 566.346378][T21937] __sys_sendmmsg+0x195/0x480 [ 566.351053][T21937] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 566.356082][T21937] ? lock_downgrade+0x840/0x840 [ 566.360931][T21937] ? __mutex_unlock_slowpath+0xe2/0x660 [ 566.366460][T21937] ? wait_for_completion+0x270/0x270 [ 566.371722][T21937] ? __this_cpu_preempt_check+0x28/0x190 [ 566.377357][T21937] ? __sb_end_write+0x101/0x1d0 [ 566.382199][T21937] ? vfs_write+0x161/0x5d0 [ 566.386604][T21937] ? fput_many+0x2f/0x1a0 [ 566.390933][T21937] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 566.396406][T21937] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 566.396866][ T3783] usb 5-1: USB disconnect, device number 118 [ 566.402423][T21937] __x64_sys_sendmmsg+0x99/0x100 [ 566.402444][T21937] do_syscall_64+0xf6/0x7d0 [ 566.402464][T21937] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 566.402476][T21937] RIP: 0033:0x45ca59 [ 566.402491][T21937] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 566.402498][T21937] RSP: 002b:00007f357f15cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 22:09:05 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4625c5e7bef3"}, 0x68) [ 566.455652][T21937] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 566.463630][T21937] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 566.471604][T21937] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 566.479579][T21937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 566.487552][T21937] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f15d6d4 22:09:05 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x200000a8) 22:09:05 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 566.517982][T21937] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 566.532986][T21937] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 566.549489][T21967] dlm: no locking on control device 22:09:05 executing program 3 (fault-call:8 fault-nth:10): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:09:05 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x3f00000000000000, 0x0) 22:09:05 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f0000000300)={0x0, 0x5, 0xffffff7f, 0xffffffffffffffff, 0x0, &(0x7f00000002c0)={0x9909cb, 0xd84d, [], @value64=0x2}}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) getsockname$tipc(r1, &(0x7f0000000500)=@id, &(0x7f0000000540)=0x10) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000340)={{0x6, 0x4, 0xfff8, 0x81}, 'syz1\x00', 0x49}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000000440)='/dev/vcs#\x00', 0x7, 0x90000) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f0000000480)={{0xa, 0x4e21, 0x1fe, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x401}, {0xa, 0x4e20, 0xffff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x2}, 0x12f, [0x8, 0x9, 0x7fffffff, 0x4, 0x2, 0x7, 0x27, 0x9]}, 0x5c) r4 = dup(r2) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000400)='mptcp_pm\x00') r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r6, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r6, 0x0, 0x10, &(0x7f0000001500)={{{@in=@multicast2, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@remote}}, &(0x7f0000001600)=0xe8) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000001740)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001700)={&(0x7f0000001640)={0x78, r5, 0x300, 0x70bd2b, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x2c040090}, 0x4000) r8 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r8, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r8, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e23, @empty}}, 0x1, 0x1, 0xff, 0x1, 0x2, 0x8001, 0x7}, &(0x7f0000000180)=0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r8, 0x84, 0x9, &(0x7f00000001c0)={r9, @in6={{0xa, 0x4e20, 0x401, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x89}}, 0x6, 0x0, 0x7, 0x7abc6800, 0x25, 0x3ff, 0x7}, &(0x7f0000000280)=0x9c) [ 566.645378][T21980] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 566.703068][T21980] FAULT_INJECTION: forcing a failure. [ 566.703068][T21980] name failslab, interval 1, probability 0, space 0, times 0 [ 566.716983][T21980] CPU: 1 PID: 21980 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 566.725320][T21980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 566.735378][T21980] Call Trace: [ 566.738673][T21980] dump_stack+0x188/0x20d [ 566.743008][T21980] should_fail.cold+0x5/0xa [ 566.747616][T21980] ? fault_create_debugfs_attr+0x140/0x140 [ 566.753437][T21980] should_failslab+0x5/0xf [ 566.755232][T21994] dlm: no locking on control device [ 566.757851][T21980] kmem_cache_alloc_node_trace+0x27c/0x790 [ 566.757871][T21980] ? debug_smp_processor_id+0x2f/0x185 [ 566.757894][T21980] __kmalloc_node+0x38/0x60 [ 566.757911][T21980] kvmalloc_node+0x61/0xf0 [ 566.757931][T21980] qdisc_class_hash_alloc+0x26/0xa0 [ 566.788391][T21980] qdisc_class_hash_init+0x19/0x110 [ 566.793594][T21980] ? qdisc_watchdog_init+0x20/0x80 [ 566.798699][T21980] hfsc_init_qdisc+0xf9/0x410 [ 566.803366][T21980] ? lockdep_rtnl_is_held+0x22/0x30 [ 566.808550][T21980] ? hfsc_reset_qdisc+0xd30/0xd30 [ 566.813558][T21980] qdisc_create+0x4bd/0x1430 [ 566.818147][T21980] ? tc_get_qdisc+0xae0/0xae0 [ 566.822835][T21980] ? __nla_parse+0x3d/0x4a [ 566.827261][T21980] tc_modify_qdisc+0x4c5/0x1a00 [ 566.830145][T21994] dlm: no locking on control device [ 566.832120][T21980] ? qdisc_create+0x1430/0x1430 [ 566.832138][T21980] ? mutex_trylock+0x2c0/0x2c0 [ 566.832153][T21980] ? find_held_lock+0x2d/0x110 [ 566.832187][T21980] ? qdisc_create+0x1430/0x1430 [ 566.856890][T21980] rtnetlink_rcv_msg+0x44e/0xad0 [ 566.861820][T21980] ? rtnl_bridge_getlink+0x870/0x870 [ 566.867105][T21980] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 566.874482][T21980] ? __copy_skb_header+0x1f0/0x5b0 [ 566.879585][T21980] ? skb_splice_bits+0x1a0/0x1a0 [ 566.884510][T21980] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 566.890323][T21980] netlink_rcv_skb+0x15a/0x430 [ 566.895087][T21980] ? rtnl_bridge_getlink+0x870/0x870 [ 566.900365][T21980] ? netlink_ack+0xa60/0xa60 [ 566.904964][T21980] netlink_unicast+0x537/0x740 [ 566.909737][T21980] ? netlink_attachskb+0x810/0x810 [ 566.914844][T21980] ? _copy_from_iter_full+0x25c/0x870 [ 566.920219][T21980] ? __phys_addr_symbol+0x2c/0x70 [ 566.925243][T21980] ? __check_object_size+0x171/0x437 [ 566.930534][T21980] netlink_sendmsg+0x882/0xe10 [ 566.935306][T21980] ? aa_af_perm+0x260/0x260 [ 566.939810][T21980] ? netlink_unicast+0x740/0x740 [ 566.944762][T21980] ? netlink_unicast+0x740/0x740 [ 566.949702][T21980] sock_sendmsg+0xcf/0x120 22:09:05 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c0900000905011208070000"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) [ 566.954132][T21980] ____sys_sendmsg+0x32f/0x810 [ 566.958912][T21980] ? kernel_sendmsg+0x50/0x50 [ 566.963638][T21980] ? __lock_acquire+0x2224/0x48a0 [ 566.968670][T21980] ___sys_sendmsg+0x100/0x170 [ 566.973342][T21980] ? sendmsg_copy_msghdr+0x70/0x70 [ 566.978465][T21980] ? find_held_lock+0x2d/0x110 [ 566.983235][T21980] ? __might_fault+0x11f/0x1d0 [ 566.988003][T21980] ? ksys_dup3+0x3c0/0x3c0 [ 566.992420][T21980] ? lock_downgrade+0x840/0x840 [ 566.997285][T21980] __sys_sendmmsg+0x195/0x480 [ 567.001956][T21980] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 567.006976][T21980] ? lock_downgrade+0x840/0x840 [ 567.011854][T21980] ? __mutex_unlock_slowpath+0xe2/0x660 [ 567.017396][T21980] ? wait_for_completion+0x270/0x270 [ 567.022673][T21980] ? __this_cpu_preempt_check+0x28/0x190 [ 567.028300][T21980] ? __sb_end_write+0x101/0x1d0 [ 567.033140][T21980] ? vfs_write+0x161/0x5d0 [ 567.037543][T21980] ? fput_many+0x2f/0x1a0 [ 567.041855][T21980] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 567.047303][T21980] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 567.053276][T21980] __x64_sys_sendmmsg+0x99/0x100 [ 567.058207][T21980] do_syscall_64+0xf6/0x7d0 [ 567.062697][T21980] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 567.068577][T21980] RIP: 0033:0x45ca59 [ 567.072462][T21980] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 567.092067][T21980] RSP: 002b:00007f357f15cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 567.100469][T21980] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 567.108440][T21980] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 567.116412][T21980] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 567.124383][T21980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 567.132355][T21980] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f15d6d4 22:09:05 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x4000000000000000, 0x0) [ 567.163276][T21980] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 567.190751][T21980] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:05 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x80001d00c0d0) r2 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="ff000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)=@newlink={0x48, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x3}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r6}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @local}, @IFLA_IPTUN_TTL={0x5}]}}}]}, 0x48}}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000004240)=[{{0x0, 0x0, &(0x7f0000002540)=[{&(0x7f0000000280)="b417b55c1967d1b2f61660e593b732ee987777d097e80a1cfba44fe025a70efeba3752e07f882835b26b504d3be4d0de992db20cee5f4b91c1a58f296c6f3578a30be026936d72d3782fdeaebe1251d728ade752e9a01cacbee0b91f40ed706e3109b394eb4b62fbf8559ae5f187284b4ade0663e15f03e5d5d3799d6c3e93dd9e25a803d3ecc26c4f3220b9f71216e784", 0x91}, {&(0x7f0000000340)="7093ba56b7fd59c369bf362d46b83a1fd514c2c3696f68ffbdfab1a78bd3c9c0bd7df8dd6b447b45912660d3a2eea4b495078a5bdd4544750d646ac5e4366a584adcb5d55a86dacabd154432178480553773a57fc629b604d090f25c1e79cbcb1337f423263a18592e33149836cc8fa1e628ea2ded733e3f9a3b78252a43029156f648e6427805d39ed44f7bf8b66c8b79f3019f688dbdfe21ecf24357fcc0a530a594d9742ea539f42f8c6d0ddc6ca7506d2bd1322630c5823cde5e4f43ca6077f76ee4902518e06153a0bca91a2dcb326f927695d466021eaa198579aa7ab0b1d70005c54a861daace2dd5ae4a345c2c07266a1fbda99648c68c9dd32d00e503d5a2d6cfebc37992f1c3a5e0b6851dd0805b9173d90d004e28c99170efad85677eb2b62246f85627149b444f18032553485eae08e6d4f8af76a043eb5973a15171c594b1e79f6467343bc6a77bec2413f2b872aea69d4f393d1a2fc06871aa3fd7da1a820ac224f5e7f74c39987a776af54fba163938c7b93a224770fecb55b38fa8e9faf718610e0d411c7e062c4bf2916c3cd5b4b68ca9b1e35ac3731a5552d7bd195aa855a564907b758dcdaa31593bb4e3c915143b723439c7baecff8bd2ab946d2fa1c4403f24ce9275049fe3c848a964fbf10bab979342383421ebc5b43d8b8d1be4b58caa2ca8d3bdcc8bf938da0db2711697c1027aadc703605622bc7799e810aee716057d3e30a8b353945276a91b05ae9a818ce4c9eb53c7096ebeec2d19712df94eedbe96fa9b248399d0c979ab0bbd2ceadd4f5fe522557ce585572e34828184403643543f69945c478e13dd14c6d2a197777e1bbfbee2045cb8cd48706f0769060e706a60e7fb8847bf029a4389eb09801fa78f8220025837f562d3baff927ec9ed190ec53515b3605d3eeb862e3e6d26c579d22653e95e7727a867c6c3b07f74a1eee3fbdf44c951c8f857844310ad263556ec9aee5999bd694d5edb1ee26f426e87cd70944a8de5b3bcd882e16ee05e7cb749f9d67796f5d9102fecdc01c4a980e70e3aefa1ac64b9b5dcf41bd9e3d7789c7000d07d71bb9fcdb381e1174f8bf18ee8baa36f07a690e749cb0e41746a52e3db8d737314cb8bc15b3a411d8efbd42da1720681933bde5063c2eed83017f8074410a515d43470d1cf3ff591dbd6b80b250e2f57b2a8edacc14df22b18cc06c3e0276c6979601d30eaad00894c34893a24fc764400d4dd135fbc497c08b82ed701da4f9580efc571b8bd8a82413094baebde9b2328ac805311dca1d38a2e3f8e5cf91ea9b704d222d29d6ecea3d45a00407aa23f0d7269e01a156c60ffb9b1bb1da46351ef0829a212d98e0534a30d2da3263269d103b3b808751457a9287d91ce3e6e5f9f41755ca6d379f9cfef6bbdd4c8ff03c38987464c05a1938d6d5a6342d2ae09f6fe3c76ce369d707e4767f412fdcd7aafcbf754b17d97f552c1c02b56a2a6a3fada522555786dd382b38e217650921256dd143526562b4cc9258f1766d594f146487969dd7fa6a364da44a1db02dc310e0d0e7d8341558c53dd5165d2286e867a6e1f8694d2fcda411d4945f489dbc0feccd7c64cef5b9a0bd919522678c47fb3bec00a2dd1ea42caf677c5d29cfed22f50b93f1dc37ab66c1f80f49f0e341709ae03ae88935e2614c17194cdc58d7bf14518b037996f10661a5376c0ff5da69cc63fb150891dd6670e291b1b059feb99ae0bc4e69cc49886534b9dafc3298ba1c66687730808932097428b57045321c0fc7f61e2d511e62094693ee428b15e7aea31ef0c10b520072f5b3d5e2217775bbef793fa12464a96b49e548e015767381819562fd05f0737c1498e9beaec3389ae972ba736e64e32fe6bd81b4cc8280830ed44210257eff54a0d9d5156764056fffd555ef958897bdd77b4a2ab804eedaedbc1ff6558a518456c39207698762d0b566952a3137145940024d267fcf08b898d32008d0dea95df07bac52cf958ba910e24cd1ba91a5ac3fdbbd578b1d3079f22897e1255568d242aa602cf66e7bff65ac5fc7bbf76f21a8551bb3a2f06dc0f75025d3723bc44f054787236435d7a7ad99e6d9906268e95e62bf66b9a1fdb5e20c381701e06c91b0e367c4ae75137211a776314dc93c160269f8576ae0a26921f52fe50a4b5bb7a95a9b98668bfd0e3ca4b057970b5d9b9ea78e2c27406808461096d89187beea4e1427ac16a286aecd121cb44270930b45217cc0a498b74ff0a3dfe2030b53e9ebc40a01a508bb18f763a49c296e55d50ad4f70005f6d3f9375cc8cfb69d7d1e3d18ab270262f19e4028c3f975aab67d970c2dbc61a93507f30abe1bf779525d3b67775647a53ce9fbeb3892bdad71024f76d8f5a1e3fa034fbeca373bf0ef59e65d8beb2a9c0e1151da6cbd49ea933de8afdcf7156e155df7cef97f95501933c5f79da97fa2dd3b3d6c2f2b9d22e955d437af137b5f61c3b84076f58dcd11c055bb9c7f53dc970959e3d87fc278a254a10ae45b062f1003bcfa20bc23af05432f4f36512f1a0503e4257eb6e600acf0ff056a9172c048510951bd5234fd8c303d4067d81ae0db58c4948a532219ecf39419105a34d0befd174442ad3d748a07240aa1c202c0988f361ed131006514aa7dda0685279ca76e27f834bffe39e14b88e0c728778bb2b372670ded346008c7037608b09d75f48323a325d9e9e916cb0670cacc8faa441e7aad8e2c70daa9490acd1c43e8d8283bbe3e0b6e11bd0211dc248c3069b753f9d8959e5fbfd3aeb6d5207843e00976ebcd71d0b2379b7ee9f17ab7367e884ecac48ce93aa6a9a95946132e0d78886b760e6d64fffa3680e9c1708a7ea8f70882a5f51221972369419c1313179c94569921f1c4fdd52b4af50f0137dab9822e75b00cc1eca382d0ada83b02d9419ceafc541a08f0e2ba5fb2387638cec75a77f5faf03b5db49de6da92ecb7118a18a6cd550cab8c438eabadd70bedcedf5842c0949d859066799a8c611c520ca2b529ba746603eb7c5c2cbdf519627d0124aae412e84fdbcb4bd57ff3170cfe68ef93f8d4094f9f74e34a46db2b221f632424c1953057784a7cf46bfc73317f6546fa34c25a9f8137d4b4850d14cec14c93e12faf62da24dc67820cf6d33492373db08b56a16544fd3cf1ebdf70577aa6d197b714916b565cfe0905f62f3728efb38031c582a8e0b408f6e4c0bd6975b2a562576146f022ad7b38d050aa763c52a30a4831703c5e22767d5f9f27fe3db39aa5a8738eaf1ee8686933a4ec084d48ced02644a97c573cbcc696a535e4828c2ec8285873359613dc0033e9e789a42e391e203661e5b91ac65e3c962f6c0afe2111f0a13d7c7e04e5e35ca8bb66f3edef5c0fcac549a93f6bccb9cba76d8126a7b91deff31ce9fc294d1bc36faae54d5975b435c03a74d9478c02c05aff17df3438588d5e6c61b961e6ee6ffb8566e012213c05e7dd94ecc48418669e4534300dc63043938b9ff64c8f325f13a9f66de4021917e412c85ebdb31afdbdfbac1de9f122f2549e99b4f5f40561d830f4f09b64bb5a3a6b454f73b91f76b0fbb6c323c20aef43bf29bb5d4201a1dcf1524ddad120956ca501efaf8d1504eceaefe3a69ce2edcfcfec31d12d5270176bee372a86732a5430e6aa57426aae5c1286c58789a4a33de422f0e6161ca9d3435d0ae794d685cd733fdca4b5d1b4745632ab36bbc42558938cdc8417ea5fa946f89f54ca43f2663b51a95fdaf25dd09620760c550c0c8ca1fd3c101964f4de80bf1e01a41d27e8e40fa44bdb8591fc2e723fb54f70a4711dff02b0121eff777c892085f18d5538eaaff0650fbdfa4dba54cf32e2b5c98b78441e7750e534c89ae7e969c84a96477ef7fc130a844bc180bb1b08c814f157bfde14242da621fabc548ba1e2d52c31f4038cff3cdf3093e79429156d09fbb1a2b5c233efb592a82050fdbd6884557ed4e70e7fe24f2670ae3df62f0a80837f91717961bc73e8397f222d9431e3845314bd2933bcfcc2d79202cfded19b0495aa9dd4b35d3889e575023a55c95f275c1ea83bf7dae6da1348f5f27d4ef61d85f020ab0575067c3aa0b8d5a58efd3451b6c5f359d3b7025dd6fa9344fd4dd2918513ba02838fde662ddeef5622a9b588d3eeb9f2a6ce9ad9510cdde62a0c906d7f07dba48fb57d1ba05cab4de585e29a2a38c550fca84e5b727aaa4276a2bad1b6ff95e3b1a8796141a8442b32bd8b0324b7afdb312c9ca249b19fa287a83db3316b21393ecde3e6b6de1490cd0dd53bdc89159036ee0121129b88b40a703398a3bd6563edaccab5fac7b64a4162e1d9569f8a464c5643d7ec605ec3edac17e11edb338da24162c0670c21f8482264a637f02f2c8caa31d3d59d0c2eb7244812ecc9b31d392ed4f3cc82ae249a3bc57fdafa119dd2c3f975ac4825fc50a8a2d675d9f57df97cc3db7596d0d39dd462c297dfc0381a79e3671a846f72987ccd044df89720ac53ce6e3c1e2529b8279213882f7b0c6d31dbf0ece36678fad5d7a9abd4d4d01f5091ee366be472bcbfca03ad4bac81863439d35e4b9367121aee861706bcdd4b4c51955411cf74866918f623504f60d61f890f81b7a4a9373f3a2d0050c7c93025fb1d6157c333bfbf8111b2d5b6fccec0ba1258e6835401617ef33adf4937bf26658daa43118a416fb91e38a4126521e7fa851aca0aa8f00aee6a1d6516db3b811eeebfd5ca170e83f396e90afe3e01fe02e37b8214fa1d398a24745c245cc2bea4fe38614efef3d3664c2679c8fffc69b2bc97e5980b3e85fd7825ad2df153657c29c6a9f58e80b62787cd7449d7cd1ffd62196bc5eb642143f43401418cac02a36289481891661ccfd1c1772c442d7f2b6070fbecf6b4bcbd4ca16ce2d844f71750f317492fd82221e641d7ccafb6e973dae438d92378da35ca2448512197f26eda8c33f11254467ca54c0a6080844daa288ff756ccc2590a9e19ed62c2f0a475a6ee710dd742fcc81e0bba537e87db0f5c1a3f4dfd30401d00299e8a36b23bec6a6f043478e9f3fba92bf02035e00d81e7f85495982d0c41600dce87d41d9b493c2d5ee53d567b1e1311cd304807c82358a05f7841cf4c3734f20a442d0be5d4b9b18012d1f7e27556ad99ec5b4ad3dfb789b125497f277c19f98bedb69cb72fbd845e2fe96e206f4407bfe37a47973d588a256de33aa8a7465300f1fc192fe0547e3b540e0dc8c78be4633dce26edd688ff9566cfc5ae3fbcab74846562f272e7e31f2077328a2c9836b2fab5ac4e6cb3992913a9c88af8a7b04755c62c7ac4e961b50c6707eb9ccda9f4807b9b8b59895efba6898f215aba9dd33b1cd452bbd636b5110ef4646c82cd84f9dff4cca5528a44ea08ad1a9663f2d08a72cf19b945b7feb20aad0a53ba5bc620007aec0f3aa6027b4693d87a12afd8cd7b823192d5f9c7d91c0135f274c04d3f6de396aacaf3d2081c7c90a81e63d986707df2d584b0639327f1506dea1aa90702edc5f83da044e4244376e5a025e6c19b81a0518a0a9b4b66a92845b4be0bf10f9e974c3a778ef72ff45c8a8cb91e9b2efb6685fd2e544c7c673e3f8041413f03ea2c136be68335614787ed4be808cff07cdbdc0efa3e845aa32bea5626746480cf25bf0add8b2a5f0d2ff2523564b44e2b1868336d9ea7a45ff002c61c0a1f12e619ecde4527a060885bdfd0deeb713c7e4eedd2c1779d1c964f031c31ca27588c0fb32cd223abc5cba1a11defa05d3ed70c2d9879d364c22adf0", 0x1000}, {&(0x7f0000001340)="f80315c42f49d7e81223ad4e2c48802bce7b802e9c69b7e9714df8d007dc61d006951b92c5a12cd50949b750bc40c5233103002693d993bf1a94b0934beb3c8c7481e4b7d5effc40e50c3681e50878894efc93eda206741d4cdde284f1001a0562cb199038859de90237872fa98437335e00eaad7d379995ccc5dab026fac49e96692e72ecf264ca6960bb89e63219a856e4ae9cee5d4ebf9652d53bcde9ad5c4541ac45c9365c01f87f3821f35e3e2142b0147eed33368fd74987f6", 0xbc}, {&(0x7f0000001400)="228defbe56870e268cb71e24cf73655c71df63842d67e5b19a935ae395fe7b4340cb9a81a54d7dd78283752bad5fbae90b62f9a4afef7a64bf29aee4ff839e7d0ea65f97d43cfb6b19d7d3d4d1376c12f9185acbc112c56528ae82a1661a07e7c832883336c6325871510a3f0d7cb0b99481d4db4750290c7de6f88ffe19e91914c1304fcb7cbc7ee25fa56659fa8a194533a172804c306fe8608fdddbbd8bc5", 0xa0}, {&(0x7f00000014c0)="ab54e04c669bd1b51a6a251cfea7dc1aee33be98211b7bc34be756f5890b2a3c3a555a2c74b916948fe4320d385d069d495ccb38f89efce975c16888dda91985c00e20c8629d02da8a4396d0471a76fe5bb25d69df11b86312bc7c3f3efd323c9a884294ac2602d68e509e92d189d47ca626b55af36a547e9207c8777a70611e054563254ee4f1a7d36269bcfcd040d3673f663c21bfc82ea8ea53c22230546eebffa09c5317651a80e425a7f4c85389111e5872d456931dd2d5fe992cb3eb47bb698ff618df2fb7075e6328f59fdbfa6d2114f349d1421b6e2f3f3fcc5c0a0a94d77a1d4b473a42b3aa0ff8e41ee8aea112a40359b42e815357677f4711494965a1ca2318810c0ddd0a233eb794550a8347bd9836d8e8ca86224687ed043cf8adb4d5ea6d2b64321307271b19ba0e2a63cd2eedec8f4ec727dbcf6f99addeea551e4cc878ddaa336b5bcae0112ba5ad72631594e6ae7be45e7c44b0d6aae6908e9437fb53e2483f92bb41b4739dfe1ce917bfdc2978ebdc87b54a633167f303ef92191a245dcb1008783ae120d15410baf4a3b2e4e437c6e3a14b17194211ec183075c33e1a3f01509c4891e364e068edd833d62c2b61ec104724c5ca82b811df992c7eff8c75b8ec463a5a0b0c166f74224f4091ab3a124c05daa768c1395da0bb9feb76cd466ec9ceea284b2f55aeb98352dfdd75f61f4237498c068a7e8082de0d101d308803538bc37a78606b150b7867304bc704ad73f8110b07e91c89404a79150988e227d803d3001b6fd81840fddde2685424f3312df14030daeb5ef6df8aacd04b35b5212266e8b4cd4e516ba14ebbb0d86d880f28e78fba9b81500153b07b2fb864964e83984257b3c4d4c34c2d5916cea59426e8b1cac09dd9387244443495400c7bc1b9c282c137053c5fbaca11b8214741d17001188a3a56151edabc054fe7bfc20a797293328f406d9f759a55d4f67d51bdccdb878f15a07bf0306ddffd2e01ef3dafd9f64f9eff5e3894f31fe9540a07bfb5bdb5ca6d2a1cb5d7489d2582530d74b6c2d777a894a09d06f8c1aa3ffbef591c910c599f9d41ae5a1fa6f6428f760367de3e555a14909eda51e267b14d5bd85125f02d64a7277e9a6f80107a7e0c0cd72007aae3e48aab543ec2e64ca451571842a05c26796defba1b2929a296d79e4125d55f19898c719ae3e361ffcd880c89a1adfafe16b4f235c4673dbde54b9233679e2310a50597beebe6531882ebb8940a864794ac718898379b847b01b99c4e04ca85cfc83d06a03230c3e407345690285c2fa0215a5aac8242ef6354b29c9c51124430e7c978336fa3b4cbcb1e3e4f2a483d1820ce02d671ed371d360f0cff814e248d328a92b00c9758e90a88a587130a5e42a1eef051af187db4641280fa96de861f7de51058892d825c4936afc0cddb198995acd112c936dbea404b8ba2ad747139078b1ae1314bd1572fa0be272da8c00d6cf329cb59516fdc693aa113ab30fc44d31c4acedb002b4a8dcb12e77e89c8e44084454b3fb48f2dbb6d1f42418ecfb1d433f04299f99e20c1d90ee7cd2c5fde9a0b6a7fab0013ea032113cf031a0d6513212c5a65102e426a5943a43e6e884099e64f11d3f56e363f5bee8b9426f51fadec6f667a9fefa86f32e68d8f35a4702ebe1c904d027cf8992957bc79dd297ef18cfca968331b5dec63db832b0baec581e81d28af9e5b186119a2d79181fc01ede41b302f88bbddb15cf8bdc942ecfec6a4ced6e4a1d86564cb42670ad541637f01a9bb636839c4f5368381122118dd349cbfcd5dd914411e54af2153006a5af734226b679e2d593bfe1866293d8a11b5f8bb87c12e7ad2476c4f981d7d47bf6ca4881ceb42a57ae428ef5fc9769e266189f4926b00827f580281d4bff6315c85dd8b3e0ceaf48b1d1589b04e9a2d6df3828e10e8903b2e97c440ed252386746e38e6bb6112b16145db7238bf317eb48d92bc9bda758bad4e773064abe9516ccb453a8ed3ba4212879773312bf04c6f8c9da68b90a44186800d730c62ef4e2efd9f59ff73af014a81a5b2f86973db4033e4c2c010a5f000a87f9743224f1c54ca19a6090f03b6dd0419aead5dd816a873767d52cbb403bd974dabfd884f11b43bcc450107a886df9abb5c6bc43a7563bed9ae2cfd53cc8e7792d2d494575200a7acd02e7011a4df605da3d96991188b29f90b94599fbc636948fd9ab54ecabc9c47a8c71f1917845becf463a37cc0e9ad5df6373468f7098c6423863e4f951c0b71e17ebfee5dccb507c24fafd87fc70956f05574e8d434d6a8b73725c0d435f80d64bf5cb9e86bce55ec6e95e531f2679703400cd1ef1a9be6ef1e69bc7552d1d760989b06c01878605faeed73cd91f11090794263e8fe80a7d9b4bffba221a27ddf40842ec5035f8ef44138c2cde83a671e04008799056b9575b51277d9ef625f3f28d13ee85b5aec23d6b1aa8fb63a1a2a7afe7e39f638f2a543d452f8c394e3dcf8f2ba5d72f07eda3a322dc03f72575c920383a01f09f178d648eeb967f0ba82165f18b0b8f25316fee0421cd3e8c4d580cdcb2a05f90234355b6693056f44293a1c147d6ec06106c7dca14c90616b1e8c69f77f7c509e54ff38e5df3feb56185aa06e2ded3f10e636a7562dcab8cb3f3f57d3307c206428164f1a3376fc2cc258f3a1410f33ef0fe074afd2892db49525edd68c2fd81eee0aebdda49d97efb4ee82b24bd4438b46b89507e2d6dbc569cc991e85191afa351ea51fd0526f7c4f9d6437ee05130958284eec6896a4308dc7d0c05d5cc8a07c1a65bf363c2120238017b1e8dee1decd35e6902b66811ffa199d5cec37d38a50cfbf02175afb74a8fe354191c18eac23d03420c285613b6e6d9d3341dd7f648a3d29805bbddfcb57d04105cd22c5bbe9e24a242eec4cb27b92bc501958378996384dfc96e7ec8fcde48384a92e1fa7af910e720e067bed97f5ee1fd214bc6b5e8e16ed55885da66c2634efd71937ad091939ae489e19998216ad6cfca57f12e47a8df957d47789faaf51fcb390d9c43e92a768a55c7007c01bf8b005ab583089c42e3f6c6ed1d57cb43f055be81ccc819186abc652fa8e27e9577abbd838671284082b23ee48bd4329baf6eb3a20dd4ae4f624e7daa960d1c486386cc5aeca417de8222260a408f0ea81b92b2bb2b50e12ff96b29dd42561305107cc84c5d0fd37f15ce3fd3ee1b7961f5e74659732393e438d94086b8ceeeb611e3f11696860e3cbd7426402407cf29c6237a06c74a6c3fff7699524fdd05758db0a39b73a70fc592413914b8bda4cd1a4ac74445a5f48e3ddb2d1021609cc62bd7be221c4ea83e40636a3e958e589af4b91c29297a591bbd62dc8e0ba3970a9d50fe00baf835207f21639589bafe22f5d24eef99610c5bcaacd3f994c09c87b7c02ac920df99af83b6d15a19a42dc30751ec50c5ef865667bd0cddaef62e6abbf81ab8671ccb97666ebb1a913e8c7578467fbe81f9dbadb35f5dcba87fd9bfdea730b9f49f499fe2a9be3066bb9c566c8489fb4bdaab62dbbab4f15392edec00ee80349a0bffaefa4334a8d8814e3e29cdb10100b89923fd433bec2a8ad50b5a5778f5fcd50df5d13df0485ba2952225023521bc190aed0346de69590084db2f9beff41e88e0b8335338bb6487de70941b9eb178570578d858b95b046a578a8bddb7fff94291f4afa37ae46ab153f0ef37f098e45951ea4a68c97df58c582bdf02911271dd4ce1217940c94378a7b7577f7d49bf591ce7736df63ecd42e6b3349b55b7890ce5dc15391b9ce66318d4c25ab2154429f070c0741e902388f30fb028ada306bed0e53bc032d73461596d583d9b8588f8b0668bf04044a2b299534542ae70dcd992ab4320a6c66b5374f98b07a4ccfdddc9c01a4860beac686b1756b73a0cf3d82d9f599297c2491ee6ee31bf605d0ca3246a5b5f72ed8b4726b5e9d741477228f92bd62c37b7c06d16847a0df986da9b1470344ed8964577eaf8b8e15d11d5c3f79d1f29511ef867a8a06de2471b44ffa8ea235d207b01778cfeed6c67ebc14bc61b37082c97767ddc4d71d2273b139d26cacde03a33a3496775d4d05e871ee2861f6e60b8ed75b4a62e5f4919585cde0d3c67bacb90a648fe25680b0ae0e0cf2eaf28bc72aefc7200010dfbdfab6d7d8b13a742494d0d833944bc707cce53fc6830e42aa2b42e8c13e7c8dc51d72d6fca9e58184e4e7adb6bf6ce563e468dce192f97ef95d9ffa0e59f35843237d1d9256d48171a3b8707db3cb9a5c0d5ac977d4d76fb927a62da3b627943080ffc7a2e855c567036c86779a2e64c77c779d84a9ac9167a041c17cc9f0c5985d3314dc6ac8b23f7e0379a2ce52baac7ee26243b0719f28f4f41e1de478d32ec98fc8136c347d41aa4b1e643b98efe26e117449e933d67f5f90c4fb5a6bc9e6d68a46a7fb36e62f457125b8926a4fac8240021830808ce3885e6487b9c781a020a9029df89563cda11fe0a9fd5ba4f4d27d14d96308f9076301884b9924106cc8347f647f6f7d207871943fc9bdeb5fbc8ee0f722ac72226a3fe6184288cbd196127b5e6b2a9ad98983086a7f2fa69eed3a46a50ec17a8e191b71282c3764b9fedaf9aa59c9d8e2e531ce6641a2a9b4bbb34b7a54a9663b400aeafec9d876bcb050fad084db1959bc60355d9fb9b16f61ecedd6f6a559f3db4a821d4d1d071d1f0b02a3ed68b195b2cc6b57b01e1aaca62acd3f909dd21ea5333ac83a7ecd077b5cbefe4454f8ab13ba7bcf9350eb74fd0711a109065efa663b398d48578ef4b23843baef9f2b045814023059f8e0de5ef91ad8655ef962ab4b428dff3349e81a2bf2491c756e1548e0dd131248dd52bd7ce97b6eea2a75bd279a6aafdc7f15a92278a27b99db00b77b7a573a6fea8f29dcf0e017f0f24697df4e5917e6e05f11f6614da301af155c9fd65d75908db342853adc54523529b1e5ce6a5074c13b24bb1b196b8a6d33987dab547fade713c80bcce49ce49102d1ac52ce762160a36b928cfdb5c8cefa0b193d7e4991e043a2f0177ddfc686459ca42274da2c7fcfe137e997bc772a3dda8801428a3280ec85fbed959c6c610f35addbc54a09613d29c3bd2314120f75d715b0ed94d4dbdb6144d493d6b40e2051405e32f727816b73c5aafaf7cf6d6266edb3d4bbac1f0a6c50bdec678007cb461990cc201f913e1173d685a1179e776525ed11e0b9dfc8ca7c6fa2bbbb9d620a66fdc28ce676a6e2859055b0ec2cd4c0dc8cd6029ebeee261e6c62d651183a917c76d5c30456c0196f84ec17fe1f37b7bc98e1c3669362a0130e92cd30e43774c0278f24f630ad5d44223371b71fd649918eccc6f46894b938947e226491d13421c944788f1aaf47476f4c531904097365ec1b8c62801d324b89aea927ea3939f1318007156276551d4e82a77aa010c9a50fa1a380cb6c0928dcf758360643594cb12e79eeec7fc67fa5465e754e474003131c67f3be1cf1753e11cd7a4d4f7fc1137ac60b918c2b5b15586eef0ecb80869efdeba997e258619ca09f50c248ade90a01f1c3ca3e166ef3aa551916b998b27041ea3acb3768deb26622733644aaa0ee2790adc05b25897bb4f7b366b01d85369012775a74adf327995b0fe69210fa69d42d919371266ad95c010156714f93acd0cda4e2b4ba3348e94b1061cb82fa4a97140d4ead8e925d2a073c452c1751d439d70149ee2a46c0911e9b2cddfee3fc3ea8460912b632da1018fd65494cae78", 0x1000}, {&(0x7f00000024c0)="1e438c3728873c46609ce9c2be03016dc2921394982db0583d47d80f4ea61094c9a4fc90f9a2d4dca451f597105f1565bcef2724414782c6699ec004a130db6101b48b9363422bf0771ff392d2893ec89729af7d73f4d99c755869bd405d0ba64f337c", 0x63}], 0x6, &(0x7f0000002980)=[@pktinfo={{0x24, 0x29, 0x32, {@empty}}}, @hopopts={{0x20, 0x29, 0x36, {0x73, 0x0, [], [@pad1]}}}, @dstopts_2292={{0x70, 0x29, 0x4, {0x0, 0xa, [], [@enc_lim={0x4, 0x1, 0x7f}, @calipso={0x7, 0x38, {0x0, 0xc, 0x1, 0x1, [0x839, 0x101, 0xe857, 0x4800000000000000, 0x3, 0x6]}}, @hao={0xc9, 0x10, @local}, @jumbo={0xc2, 0x4, 0x2}]}}}, @rthdrdstopts={{0x98, 0x29, 0x37, {0x3c, 0xf, [], [@calipso={0x7, 0x20, {0x0, 0x6, 0xb1, 0x5, [0x3, 0x2, 0x9]}}, @generic={0x81, 0x51, "efe25c0ff8379bee9a5290f1337ccf326a0f14f756e977c63f13d423b8724bebf9b96f59f09257d7030fadb14104909ff37e55094fdc832418ec93ea8bcba9615b242bfa29f46d49662a8e7e521e8cfa49"}, @pad1, @pad1]}}}, @hopopts={{0x28, 0x29, 0x36, {0x4, 0x1, [], [@ra={0x5, 0x2, 0x2}, @jumbo={0xc2, 0x4, 0x1}]}}}], 0x178}}, {{&(0x7f0000002b00)={0xa, 0x4e21, 0x2, @private1={0xfc, 0x1, [], 0x1}, 0xfff}, 0x1c, &(0x7f0000003d40)=[{&(0x7f0000002b40)="23da7675c21b78eedaa2cef8100304acbcbce8826202d72b30bf3d69f90547ead20d50dc6d3be704ae8158c75255b15473aa0ccd7f8b30daebec012912947383", 0x40}, {&(0x7f0000002b80)="823935e05cbf1ca7716cc4e2d15a41bfe0abd3d9d0f18c616bc483d48e8c6163cefd7797524c6129f2508fa0bb51587a9e6e9328acf38f2da3e8f67d05617ff7b1a2b558c7cb30f199538594665ab296ef47a351e3632af4c4f71c0e1d79b00a115c45078e00d2f46ad529727297f1063fb4cdcda389ba3defbc31b1563767fe4f80f0049888019842448187e555af31419f6d1e05901ff7316d72f672050a7afc1ae8e0ee971a9f700e887bf66d7fddba200347507c8f", 0xb7}, {&(0x7f0000002c40)="630f194f2050697e38f1c5c2ce21a4b313d9deb1a0aa7633f13efd52e11220a4e9086c51189d736ba0fcea5b32c6494b8bb9006795811b2575d186887ad201209d9cb95e903cdf972d45f86633d1cdd634ffe8f36664d7d443cb6dfe7e7a77694f072b18588b12c000968fbacad3a5f18d230a7da20113fe83d82cc93324cd6418eb177a603c1da41661f1ee50162826c131303998b5d6351fc63c4b35dce5de1349901c846dea3eb908874a558a2802ad0354fb92f0066ff04f958327bc7091348752976cdc04c25a76d65173a8e1caac447d1844109619726975", 0xdb}, {&(0x7f0000002d40)="ea3126de96de8c4b20dbf1fe0f390cee299b7d86edc8ee82403c2ebd03a609668b69c8f7d5e6ffd7b4bd30b1f9918020d27b5ab919682ba475826bcbdc508d778200d83ed407a60df4dc5d80bc4f706e0c69e5025e4297043d7e5e741fc73f7d02e3d2597e9a25359e643cb5f3d7906eb873655af42a5b74d9140960532677a9035b537523c269dc27f34c31a510cc768a7b6efbc4e701daee14972cc74ef834ccaa3977f617ce7f6f4ee68786ae21fa7623166c5fc1872dbba8d5f14dddf07928bd9a4522cbf01aee0c157c8658f2a649a9c1e4a4d2db6518be178af914abc14eacd63b8fb65f60ed7d06439cf6ac1a0c0032f0d8ab120b4a98ea076a657e1791d848b1a5fd10f5b24b723934a674983a6fc68d3848757c92c32dd461392ed0e546aa9a009dd200df8544bcbdd69a743bb4dc3a8fc6ed3f8c818bd33ab4cf70dc032db0f080667b2565870353dde9cfbc0487bd938439e7ac61fa6311db47a1db7f60570769bd941e265e4d0b3a67af8c8a5ec9c7fe77e056a2ac8d31830a184a1b827ea9157bc5f21205cf2221471c5d16343126c36de00f19314a838722ec1a7383db4cdd8474468f108287f915417f586339df8b99eaa5e41f6c0f0180231b13bfcfcbeffd66c5e9edcd5780afbe505dbd8238892fc8ef32d7837b05d36a1098b1ecfdfc5eed251955a745c4e850b3dbd0e0b932b8725f7056330ccf1a7a7e25eb496b39e72faf60f9dbf6ba7ca73d520978eb3eb2e72ad211ae846a835a764db957a9bdb55fba4ccbb51fb7c357d3934aff95928dd96fcfd5d940e5920a05703c2fd1fca3f201e6f86124ae5db13a8948abc93490fd9597cffc8652c4d301e2e21d9c20cf5ac39d600a9c1dca713d59054d20f6ebfdd04ce362f315a0f219548233b0c7d62b9e8653a61fb1a4dc94a5d59ce7d5b9f0485edee120b099ca1c35550939cdd061bd6d9aed9af4f52f560076e21ee4e1c2f3a5033049c777182452b2e2d405c1374ee29a13449f703996806eb4fa2664d77acf4941f3cf2ab219a4d2e045a26557bb3b647c93477b5de57e9375d3fed74c02bd451cf63df8b4fbec53c6f887b227c045f8dde12eca919d94914a0af267a3d8845146b9e634a464d7982c43db59a1f3404e98077711cc0338315d298523ce1ed2d7c5caca791204a9cfd9b6f4f37a56761372d0ecff9f0a376015dae407ed8aebee62c7a3c6ee89833aeea8da2a424807d103a3faeafe43c8701b66119c621df072c143cbeeb0b7e8f306ebf2f6ca831409a1388d89dca7f58e12fa9e0662ad29598e5aee2180e0c256c51c4d51df55cf6131bf0a8055cea4f3e98d73b57cc3b7d0abc9e196d1aeb6587e4bdb78ffe951f20f6ab07703a2821c79e14be517d9fb6fcb964eb8ba5419fe18c975eb56e9809e6c623aeb88c94ed6f9a3b2827570ec86e703b53496d1695adf5258731ddb133fcd160b7e780c5f2633529172580ce0b207de6151e5a45d645c3a07582c8cc652a8c768a48402215ad0b573a348d3cac4ca9ddae22164b5242f5a877349e773791c89b21b2cedd48a880c6e6653ebada92041eb667dc4f680cb4ec213b64e84c7e41d434a044193fb262c5ac154145ab5556e2654604bfc1f1ad81c7157afe9a691790722c14301e8889979cc659a59ee4986cb988e4ce325600e9d900749a68a7e3cb7a05c09286d20f9ad4ae67624cce78383dd8138b1c190095dcd781a23c26cc89352d32ab404787436d8484ccdb3e5240aa3905825b6cc40b777839e2da18e7d3a2a4d6029b5e5ee836533b5c762bf1dfc0507bd1e570fc674133fe20bda20dcf9e58a97484b78c4341b66c2df4388948d23a2cbbe41fa3813c9c13aa6f3f6a74e9ae86612115f839eded3fbd6074678f21bbd29d4019f721bcb5f84374657111937c7a0f82bf82e31d476062d8f6f5981661619409b8310bf952798e38a8a4e0c7c041255408abdb666ec3b9fcb80cb51e8aedbd9bf3f0185fcb49563f2bccd7ff258997d5a48a0fceb902986ae705cf319266b12db9e7d8cf423dcadcbbe36856aa2c6acf8ff45158b1bf23709512102a629df441615fa23ef93ed47286fe26e81214aa8cd28a1a6c0eb698de50637b7440abc1dbaef6b6a005c5d556eec73ade64a86e737b06a461a24acf8bbfc7d9ebb0a0fb6efd2333f62bb0316f922c99d51d4acb108e5827bf1d7f7b2b6a40272cb9341efc696533c3305b8b5eead390b90c625e73823451e2ba2bcaa728a446009ef01642bdbd46ef5c8549a436a81637ae40cffcea552f5913c4b0a1f4a0d46b00930fad87e51a14faf8945faa57bd8fa73754074ed158217a1074beb69eca0f2216177b27b9216e3f3b28e4892e970d6ead036a974b3a5cdd07f592d9096afa1570ebdacb4d01345d203a3a33822772007fbf59be80ce4e0dfd085cd0da99d032e98467847c258ccd9a0ba1c26956b06e7bcdb6a4270bb7804eda39d979536cfcd1e69c3a54513fe6fd40f1e5f0d5a78870ba4a6536837d09bb54b9ff5b70c3c322dab48464efb4e63cb3776f7b41dfac5327cd6e97f7e25d8e0cffd7da6a71f89856d4112434ff40bfab91f7f385446f64845673acd2c8580d26c9a12b8dc9ce9ecdbb378dabca2cad05e38efc56ead6a19b74a195e3aa2aa8fb75a6066866b3803630e951a66347447252bfb43f3d147517b739cb26d08128eccce8e339f7bc532b73aac01de435248fb4193b88689583473d6351a71eadfc9bad5c085042effbfd2d61c907f045108c6b13fa9ce76424f39b6dae6a4894bff9313fdba898d39489679aca7a20b78c35b0f1c1a26a11684d9d135fd284508796b3ae7777d1ae2c07c1b6cc86d700e68e0606b17888e684a78b263a230a328f6837f7a522781e39ae74324e05c5aac48810ad57a21af02df26ab8d5bd917419bd48998fa5a47da0a4992d00c6f111320093ee0eb27c969325296e3b8033a5d98e0bf57367c5f02140335d2a5cd88e3d640580ec09e2623d0248c1ebff4e14fc28b5bb68d8079bd2109897e58c0f6a5c188d924fdb85a17e90c4891110b3d2c27fdca2d6d0f8712361812c6d9e672c1c77d7a079ac465a0ac6ada80cb2d8100fcba8585f4c2768abd5f4eaba410393e7a0d255624ffe93afe8d78281221bb505c2710bf8559d8a73d27b8077c35541391fa398fd5b4fc0279bc848e2fbf4313c4afc5fbbc0c47038d3655634be01bf896c2fe24584e68ea196af0cf12953def689670f61ab8df9d25f72c8277e702a7cb9abca2f2722e7cd936cf4f08c03c2a32158fb4727e504848576d6de627b2b7fbb7fb1e04014204b6758b038c8574feb7bea1d416baf5e7d2f6f8dbf6b6730f6db73fcdb2ae046ba7ba569e0976693e2f7535101afcd154cf186ada1a0d58ad8639830fd48846ac39f7f208fc7e99d774bf067fcc1c42e0852a1e8be1051738e6467d0282b305cf589d53dff25e66442d628f32e337ad517c60e3b43d6df7515f35a94af4a12c90420878ace546bbc8f6d46d8bdd8f37ed9d0d23928e46950276872354b256a02a23b0c46a758548e3e05f896c2e50792fb9b469856c73128c0f05437d8245647b76636b6fd435c0e5b26b828328864d27bcef87814e17e745b519d619c591fb2fd6dcd112270132023adf97762c7fac761252e377f1143900864131a9da1494d421198c6b962b2f2c23359f729b1ee30280d1e25370fc93dcdf1729b85ca5223f5f84599b0b9adf6993ed3291f433919e52eadf37fb6423b1c0394bb031c9ffb07a7ba5c5b4314ef3810fd27d6a1b6350f5ccc8fe780e91bae1b39ff1a7958574331b0dd78f1c63b018a69eb37ee1b619d28d70f8ad7b423c85867150d00a5b7d76087fa3a91fbcbadcbaeb37cb6e5e4d99cb86d06ddcec7c51cff96a4337a620f9e69e349ecc73bc0040b491633969d74235769d51e74610605a66233193f1269a933534b3ee740e46948b373ff9d022dac50e10800d743af2d7c2a78212c04bb5341799a20968446dc6d95b729d3938578ee44e487b14c3fc746e6d2b2982253296e013373528fdaf4b3deeb52217210b777dd84cb123c6ee2159f7c00409fd6d71a1f4e9adecfc734f0e43713b4248368b07d0820e41aa044f90240322af6ad5223ae7f7378f55c64feebe2e82124807e8e88bed67e84aaa7c2ed67eac2019c681cf5584ec0d48788287b5ab9d7c586a2cf7048e022bd06757735061824c5ed4292b7a6f16ba71b2bb968c4da25e2a96e0e399b002cc42f35fcabfbf111a98458bd4834e07b4613b584fc58785182c4a17727f3ab50459037d4237456908c174951569fcb72b7373f08c4a5bdee56d877d4873a1aa3fd344efdf7fd96b89122a5372f4563bd66a0e5f639f36baff5e58d8c7a6e0380cdecb901a8bb213c85ce81bf959d3915ef42385e19cbda5583cda9b1c4d8649c13702f2c9bf331a9e8e8577e7510e0c96d63171a4827d0e2bc6ecf4f3ef0cd1f3a2154968d3d56c6b1924089e2ed1b4117c8a9bc5bca3b099c1bdb89a2cfc31381597f8f8c8d3c356346294537eb61c930b7f4aefcaf562afa1eba8d5405118c9ec5fa23be35bcedcdbddc4c7039e6d6cbebe99e96883f3219f49b36026de92c77aaafe6bc8564c52d9a63ba597cafff54e52c5dd34db23620f650e8a4d91e0c29514da49f75a0dfa4b4758ee019b9e651c00a130c118fc82db4ee58ec2e43ef4b1f9e4405d54b65c5b750620f2925d651c8d2f26aaed38b923deb023e0d143b7283a07caa7d7dddaf845f70d657253f50c1f80227ec51cea0a925eb84a4019a1be4e89a91230aecbf2cf0fcfcf3bfa5808cb8d2a08b9043c79539387675f834689aef41827943e59e0fb048d95f974166068eea5db710ea4c2a70956e7aae5780df0f908f0e526d5cb579dcbd162242ee761d4e6aeebebe461abdf6d9f30dae2812dd941b0cefe5f1c138c9cbfee3e143c3b6ee5ac1f9e161367e5954911e018700e4ebded8b335ef6c1849b585e6de88eca98bd9a4a68955ac18ec792feb349a0ca809c5be1fb3c289134630f399e283b179c90f594d66665783f5c7d04c76fcd7473f29243645a5604795ffed89fafa76c8f708effb3e1f23b599fd1f55fa0587c57efe6bc08d0feafb33472e785a4f3808acc522def092510b777471b76adf88a61b768e7cedd5fa0a7c8b4026c8d15aedbd404f1161c5370188370797bce9cf7ab0d0374421767ccc588dea235ee54e812934fe1939cb2b9c3aa6dce0552e1f1837a58ef396a8cdda0622a7908da9b93d296c6953d62b06773eb521b235b31da2a941ac9897969d992317cabc7b014f3d25cbebef9c54c10067ba990e1e02a85a341bb198ab73b1c061366fe225ca20bd30a619d24f41baf5bb0978996827f86c361905da19cf7ef140d7eaf92bfc9ebba4a91be909d27d06675b527028b88dd5380ecc371b1432a3f42fbea70862d665ddc76866504a40a65a03d90a01a5aa6d757c7db528c872ee1f06ad1eaadf21e598cca091e18350c3900c552aa1ab9ceca81275f283b517efeb913e68193ad9aba23d0646aa92c442e6aacf3f71d86f9ef3929bb4d729259910b15cede985bcc1e55fb3b2d66f518efa55921595e285cb3b96a2cbc8ce1aac6291dc1c311716214023f74da44fdeb96eba3441bc729253ce4c675613032c03643274d742c27bf04324d1f0602cdfd60f990fff1505f080bf9f1fd18dac0509d9c741da74248192a7fb3c9bd4c5f4473edbe4c76304d9b14c4f08872ef4cb97b2d12bcb87ee3546d724d7b420347", 0x1000}], 0x4, &(0x7f0000003f80)=[@pktinfo={{0x24, 0x29, 0x32, {@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, @pktinfo={{0x24, 0x29, 0x32, {@private1={0xfc, 0x1, [], 0x1}, r6}}}, @rthdr={{0x98, 0x29, 0x39, {0x3b, 0x10, 0x1, 0x58, 0x0, [@private1, @local, @loopback, @private2={0xfc, 0x2, [], 0x1}, @mcast2, @mcast2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @mcast1]}}}, @tclass={{0x14, 0x29, 0x43, 0xfff}}, @hopopts_2292={{0x98, 0x29, 0x36, {0x33, 0xf, [], [@enc_lim={0x4, 0x1, 0x7f}, @generic={0x81, 0x63, "0273fce7c2c29e4cdb249649ba0078a4bfe803158977274a5489c7e6fc1a84541f971cdf0e10122945f9543cd2ba83ec422cbf7a9419936b6367e7006456ada9a27102f8deb3a8d0bc6236f72b50f693bdf204c47be297cf3c34756b4797351f53442c"}, @hao={0xc9, 0x10, @empty}, @enc_lim={0x4, 0x1, 0x5}]}}}, @hopopts={{0xd0, 0x29, 0x36, {0x8d, 0x16, [], [@enc_lim={0x4, 0x1, 0x1}, @calipso={0x7, 0x30, {0x2, 0xa, 0x40, 0x300, [0x8, 0x1, 0xfffffffffffffffe, 0x0, 0x10001]}}, @enc_lim={0x4, 0x1, 0x7}, @ra, @jumbo, @calipso={0x7, 0x58, {0x3, 0x14, 0xff, 0xfffb, [0x3237, 0x892d48e, 0x4, 0x9, 0x7, 0x114, 0x20000000, 0xec78, 0x7, 0x3]}}, @ra={0x5, 0x2, 0x1}, @enc_lim, @hao={0xc9, 0x10, @mcast2}]}}}, @rthdr_2292={{0x28, 0x29, 0x39, {0x88, 0x2, 0x2, 0x0, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02']}}}], 0x290}}], 0x2, 0x8000) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0xb4, r2, 0x2, 0x0, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x22, 0x8}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1a}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x17, 0x1}}, @IPVS_SVC_ATTR_FLAGS={0xc}]}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x8001}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_batadv\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000014}, 0x4080) sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x65100008}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xa0, r2, 0x20, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3a}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x20}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3f}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xaa8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}]}, 0xa0}, 0x1, 0x0, 0x0, 0x40014}, 0x4000010) r7 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x203f, 0x0) write$nbd(r7, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:05 executing program 3 (fault-call:8 fault-nth:11): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:09:06 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f00000000c0)=[@in6={0xa, 0x4e24, 0x2043a866, @loopback, 0x7}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3d}}], 0x2c) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r1, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 567.364015][ T3783] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 567.396006][T22020] dlm: no locking on control device [ 567.491640][T22018] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 567.513120][T22022] FAULT_INJECTION: forcing a failure. [ 567.513120][T22022] name failslab, interval 1, probability 0, space 0, times 0 [ 567.534318][T22022] CPU: 0 PID: 22022 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 567.542648][T22022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 567.552790][T22022] Call Trace: [ 567.556076][T22022] dump_stack+0x188/0x20d [ 567.560407][T22022] should_fail.cold+0x5/0xa [ 567.564921][T22022] ? fault_create_debugfs_attr+0x140/0x140 [ 567.570848][T22022] should_failslab+0x5/0xf [ 567.575246][T22022] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 567.580611][T22022] ? __raw_spin_lock_init+0x34/0x100 [ 567.585882][T22022] tcf_block_get_ext+0x14a/0x1810 [ 567.590892][T22022] tcf_block_get+0xa5/0xf0 [ 567.595286][T22022] ? tcf_block_get_ext+0x1810/0x1810 [ 567.600552][T22022] ? blackhole_dequeue+0x10/0x10 [ 567.605478][T22022] ? qdisc_class_hash_alloc+0x86/0xa0 [ 567.610851][T22022] hfsc_init_qdisc+0x155/0x410 [ 567.615595][T22022] ? lockdep_rtnl_is_held+0x22/0x30 [ 567.620780][T22022] ? hfsc_reset_qdisc+0xd30/0xd30 [ 567.625793][T22022] qdisc_create+0x4bd/0x1430 [ 567.630365][T22022] ? tc_get_qdisc+0xae0/0xae0 [ 567.635062][T22022] ? __nla_parse+0x3d/0x4a [ 567.639544][T22022] tc_modify_qdisc+0x4c5/0x1a00 [ 567.644379][T22022] ? qdisc_create+0x1430/0x1430 [ 567.649210][T22022] ? mutex_trylock+0x2c0/0x2c0 [ 567.653964][T22022] ? find_held_lock+0x2d/0x110 [ 567.658717][T22022] ? qdisc_create+0x1430/0x1430 [ 567.663559][T22022] rtnetlink_rcv_msg+0x44e/0xad0 [ 567.668479][T22022] ? rtnl_bridge_getlink+0x870/0x870 [ 567.673768][T22022] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 567.679045][T22022] ? __copy_skb_header+0x1f0/0x5b0 [ 567.684146][T22022] ? skb_splice_bits+0x1a0/0x1a0 [ 567.689069][T22022] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 567.694856][T22022] netlink_rcv_skb+0x15a/0x430 [ 567.699599][T22022] ? rtnl_bridge_getlink+0x870/0x870 [ 567.704876][T22022] ? netlink_ack+0xa60/0xa60 [ 567.709455][T22022] netlink_unicast+0x537/0x740 [ 567.714203][T22022] ? netlink_attachskb+0x810/0x810 [ 567.719299][T22022] ? _copy_from_iter_full+0x25c/0x870 [ 567.724650][T22022] ? __phys_addr_symbol+0x2c/0x70 [ 567.729664][T22022] ? __check_object_size+0x171/0x437 [ 567.734935][T22022] netlink_sendmsg+0x882/0xe10 [ 567.739681][T22022] ? aa_af_perm+0x260/0x260 [ 567.744166][T22022] ? netlink_unicast+0x740/0x740 [ 567.749084][T22022] ? netlink_unicast+0x740/0x740 [ 567.754105][T22022] sock_sendmsg+0xcf/0x120 [ 567.758503][T22022] ____sys_sendmsg+0x32f/0x810 [ 567.763248][T22022] ? kernel_sendmsg+0x50/0x50 [ 567.767927][T22022] ? __lock_acquire+0x2224/0x48a0 [ 567.772949][T22022] ___sys_sendmsg+0x100/0x170 [ 567.777618][T22022] ? sendmsg_copy_msghdr+0x70/0x70 [ 567.782731][T22022] ? find_held_lock+0x2d/0x110 [ 567.787487][T22022] ? __might_fault+0x11f/0x1d0 [ 567.792236][T22022] ? ksys_dup3+0x3c0/0x3c0 [ 567.796642][T22022] ? lock_downgrade+0x840/0x840 [ 567.801481][T22022] __sys_sendmmsg+0x195/0x480 [ 567.806141][T22022] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 567.811159][T22022] ? lock_downgrade+0x840/0x840 [ 567.815994][T22022] ? __mutex_unlock_slowpath+0xe2/0x660 [ 567.821519][T22022] ? wait_for_completion+0x270/0x270 [ 567.826780][T22022] ? __this_cpu_preempt_check+0x28/0x190 [ 567.832391][T22022] ? __sb_end_write+0x101/0x1d0 [ 567.837230][T22022] ? vfs_write+0x161/0x5d0 [ 567.841625][T22022] ? fput_many+0x2f/0x1a0 [ 567.845935][T22022] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 567.851384][T22022] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 567.857344][T22022] __x64_sys_sendmmsg+0x99/0x100 [ 567.862266][T22022] do_syscall_64+0xf6/0x7d0 [ 567.866753][T22022] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 567.872631][T22022] RIP: 0033:0x45ca59 [ 567.876506][T22022] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 567.896102][T22022] RSP: 002b:00007f357f13bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 567.904521][T22022] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 567.912494][T22022] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 567.920455][T22022] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 567.928404][T22022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 567.936365][T22022] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f13c6d4 22:09:06 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x4000000) 22:09:06 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x6cffffff00000000, 0x0) 22:09:06 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nvram\x00', 0x800000, 0x0) write$nbd(r0, &(0x7f00000000c0)={0x6000000, 0x0, 0x2, 0x0, 0x8081, "a3ef07749fa55f62d3adff7ff39f54f49d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd363af872a0a18ecf6449fe66884b33c61b39279173a5a61e75ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x6c) 22:09:06 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 567.993960][T22022] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 568.003470][T22022] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 568.013204][ T3783] usb 5-1: Using ep0 maxpacket: 8 22:09:06 executing program 3 (fault-call:8 fault-nth:12): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:09:06 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(r1, 0x80045505, &(0x7f00000000c0)=0x6) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="0600000000000000ffff000001000000a30000749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a1806000000e66884b33c61b3927917b259ef665ad9b19f55dd7d020a724232a8b58c9eb39b4667c5e7bef3"], 0x68) [ 568.081987][T22034] dlm: Unknown command passed to DLM device : 129 [ 568.081987][T22034] [ 568.095256][T22036] dlm: Unknown command passed to DLM device : 129 [ 568.095256][T22036] [ 568.134441][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 568.142460][ T3783] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 568.153510][T22049] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 568.167077][ T3783] usb 5-1: config 0 has no interface number 0 22:09:06 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x8a00000000000000, 0x0) [ 568.182758][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 568.211947][T22060] FAULT_INJECTION: forcing a failure. [ 568.211947][T22060] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 568.225172][T22060] CPU: 0 PID: 22060 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 568.233508][T22060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 568.243567][T22060] Call Trace: [ 568.246868][T22060] dump_stack+0x188/0x20d [ 568.251215][T22060] should_fail.cold+0x5/0xa [ 568.255723][T22060] ? fault_create_debugfs_attr+0x140/0x140 [ 568.261521][T22060] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 568.267549][T22060] ? stack_trace_save+0x8c/0xc0 [ 568.272386][T22060] ? stack_trace_consume_entry+0x160/0x160 [ 568.278178][T22060] __alloc_pages_nodemask+0x17a/0x810 [ 568.283533][T22060] ? __alloc_pages_slowpath.constprop.0+0x2640/0x2640 [ 568.290271][T22060] ? find_held_lock+0x2d/0x110 [ 568.295019][T22060] ? netlink_sendmsg+0x882/0xe10 [ 568.299937][T22060] ? sock_sendmsg+0xcf/0x120 [ 568.304509][T22060] cache_grow_begin+0x8c/0xc10 [ 568.309253][T22060] ? cache_alloc_pfmemalloc+0x1e/0x140 [ 568.314693][T22060] kmem_cache_alloc_trace+0x6ed/0x7d0 [ 568.320045][T22060] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 568.326004][T22060] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 568.331791][T22060] tcf_block_get_ext+0x84a/0x1810 [ 568.336812][T22060] tcf_block_get+0xa5/0xf0 [ 568.341208][T22060] ? tcf_block_get_ext+0x1810/0x1810 [ 568.346470][T22060] ? blackhole_dequeue+0x10/0x10 [ 568.351397][T22060] ? qdisc_class_hash_alloc+0x86/0xa0 [ 568.356858][T22060] hfsc_init_qdisc+0x155/0x410 [ 568.361611][T22060] ? lockdep_rtnl_is_held+0x22/0x30 [ 568.366789][T22060] ? hfsc_reset_qdisc+0xd30/0xd30 [ 568.371799][T22060] qdisc_create+0x4bd/0x1430 [ 568.376379][T22060] ? tc_get_qdisc+0xae0/0xae0 [ 568.381054][T22060] ? __nla_parse+0x3d/0x4a [ 568.385463][T22060] tc_modify_qdisc+0x4c5/0x1a00 [ 568.390308][T22060] ? qdisc_create+0x1430/0x1430 [ 568.395247][T22060] ? mutex_trylock+0x2c0/0x2c0 [ 568.400013][T22060] ? find_held_lock+0x2d/0x110 [ 568.404785][T22060] ? qdisc_create+0x1430/0x1430 [ 568.409621][T22060] rtnetlink_rcv_msg+0x44e/0xad0 [ 568.414542][T22060] ? rtnl_bridge_getlink+0x870/0x870 [ 568.419812][T22060] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 568.425079][T22060] ? __copy_skb_header+0x1f0/0x5b0 [ 568.430170][T22060] ? skb_splice_bits+0x1a0/0x1a0 [ 568.435097][T22060] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 568.440897][T22060] netlink_rcv_skb+0x15a/0x430 [ 568.445653][T22060] ? rtnl_bridge_getlink+0x870/0x870 [ 568.450956][T22060] ? netlink_ack+0xa60/0xa60 [ 568.455561][T22060] netlink_unicast+0x537/0x740 [ 568.460313][T22060] ? netlink_attachskb+0x810/0x810 [ 568.465405][T22060] ? _copy_from_iter_full+0x25c/0x870 [ 568.470775][T22060] ? __phys_addr_symbol+0x2c/0x70 [ 568.475782][T22060] ? __check_object_size+0x171/0x437 [ 568.481049][T22060] netlink_sendmsg+0x882/0xe10 [ 568.485946][T22060] ? aa_af_perm+0x260/0x260 [ 568.490448][T22060] ? netlink_unicast+0x740/0x740 [ 568.495727][T22060] ? netlink_unicast+0x740/0x740 [ 568.500657][T22060] sock_sendmsg+0xcf/0x120 [ 568.505062][T22060] ____sys_sendmsg+0x32f/0x810 [ 568.509813][T22060] ? kernel_sendmsg+0x50/0x50 [ 568.514477][T22060] ? __lock_acquire+0x2224/0x48a0 [ 568.519487][T22060] ___sys_sendmsg+0x100/0x170 [ 568.524157][T22060] ? sendmsg_copy_msghdr+0x70/0x70 [ 568.529257][T22060] ? find_held_lock+0x2d/0x110 [ 568.534000][T22060] ? __might_fault+0x11f/0x1d0 [ 568.538740][T22060] ? ksys_dup3+0x3c0/0x3c0 [ 568.543134][T22060] ? lock_downgrade+0x840/0x840 [ 568.547978][T22060] __sys_sendmmsg+0x195/0x480 [ 568.552635][T22060] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 568.557649][T22060] ? lock_downgrade+0x840/0x840 [ 568.562489][T22060] ? __mutex_unlock_slowpath+0xe2/0x660 [ 568.568025][T22060] ? wait_for_completion+0x270/0x270 [ 568.573287][T22060] ? __this_cpu_preempt_check+0x28/0x190 [ 568.578897][T22060] ? __sb_end_write+0x101/0x1d0 [ 568.583725][T22060] ? vfs_write+0x161/0x5d0 [ 568.588119][T22060] ? fput_many+0x2f/0x1a0 [ 568.592430][T22060] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 568.597878][T22060] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 568.603838][T22060] __x64_sys_sendmmsg+0x99/0x100 [ 568.608767][T22060] do_syscall_64+0xf6/0x7d0 [ 568.613250][T22060] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 568.619118][T22060] RIP: 0033:0x45ca59 [ 568.623002][T22060] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 568.642591][T22060] RSP: 002b:00007f357f13bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 568.650989][T22060] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 568.658940][T22060] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 568.666891][T22060] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 568.674851][T22060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 568.682812][T22060] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f13c6d4 [ 568.708291][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 568.718962][ T3783] usb 5-1: config 0 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 568.733030][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 568.742969][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 568.753067][ T3783] usb 5-1: config 0 descriptor?? [ 568.775428][T22003] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 568.833961][ T3783] usb 5-1: invalid MIDI in EP 0 [ 568.839999][ T3783] snd-usb-audio: probe of 5-1:0.2 failed with error -12 [ 569.020685][ T3783] usb 5-1: USB disconnect, device number 119 22:09:08 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c0900000905011208070000"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:08 executing program 3 (fault-call:8 fault-nth:13): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) 22:09:08 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x803e, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) write$nbd(r0, &(0x7f00000000c0)={0x6000000, 0x1, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3ad7dff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2daef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x69) 22:09:08 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xa602000000000000, 0x0) 22:09:08 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:08 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x5000000) 22:09:08 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f00000000c0)={0x6000000, 0x0, 0x0, 0x1, 0x1, "a3ef07749fa55f62d3adffff9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b39279c0b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x35) [ 569.637705][T22094] FAULT_INJECTION: forcing a failure. [ 569.637705][T22094] name failslab, interval 1, probability 0, space 0, times 0 [ 569.678002][T22112] dlm: no locking on control device [ 569.684812][T22094] CPU: 0 PID: 22094 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 569.692789][T22118] dlm: no locking on control device [ 569.693144][T22094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 569.693151][T22094] Call Trace: [ 569.693174][T22094] dump_stack+0x188/0x20d [ 569.693195][T22094] should_fail.cold+0x5/0xa [ 569.693215][T22094] ? fault_create_debugfs_attr+0x140/0x140 [ 569.728982][T22094] should_failslab+0x5/0xf [ 569.733391][T22094] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 569.738750][T22094] ? __raw_spin_lock_init+0x34/0x100 [ 569.744025][T22094] tcf_block_get_ext+0x14a/0x1810 [ 569.749034][T22094] tcf_block_get+0xa5/0xf0 [ 569.753518][T22094] ? tcf_block_get_ext+0x1810/0x1810 [ 569.758781][T22094] ? blackhole_dequeue+0x10/0x10 [ 569.763713][T22094] ? qdisc_class_hash_alloc+0x86/0xa0 [ 569.769081][T22094] hfsc_init_qdisc+0x155/0x410 [ 569.773823][T22094] ? lockdep_rtnl_is_held+0x22/0x30 [ 569.778997][T22094] ? hfsc_reset_qdisc+0xd30/0xd30 [ 569.783997][T22094] qdisc_create+0x4bd/0x1430 [ 569.788584][T22094] ? tc_get_qdisc+0xae0/0xae0 [ 569.793245][T22094] ? __nla_parse+0x3d/0x4a [ 569.797649][T22094] tc_modify_qdisc+0x4c5/0x1a00 [ 569.802535][T22094] ? qdisc_create+0x1430/0x1430 [ 569.807373][T22094] ? mutex_trylock+0x2c0/0x2c0 [ 569.812138][T22094] ? find_held_lock+0x2d/0x110 [ 569.817005][T22094] ? qdisc_create+0x1430/0x1430 [ 569.821848][T22094] rtnetlink_rcv_msg+0x44e/0xad0 [ 569.826783][T22094] ? rtnl_bridge_getlink+0x870/0x870 [ 569.832070][T22094] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 569.837353][T22094] ? __copy_skb_header+0x1f0/0x5b0 [ 569.842461][T22094] ? skb_splice_bits+0x1a0/0x1a0 [ 569.847383][T22094] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 569.853176][T22094] netlink_rcv_skb+0x15a/0x430 [ 569.857949][T22094] ? rtnl_bridge_getlink+0x870/0x870 [ 569.863220][T22094] ? netlink_ack+0xa60/0xa60 [ 569.867799][T22094] netlink_unicast+0x537/0x740 [ 569.872572][T22094] ? netlink_attachskb+0x810/0x810 [ 569.877676][T22094] ? _copy_from_iter_full+0x25c/0x870 [ 569.883046][T22094] ? __phys_addr_symbol+0x2c/0x70 [ 569.888058][T22094] ? __check_object_size+0x171/0x437 [ 569.893325][T22094] netlink_sendmsg+0x882/0xe10 [ 569.898073][T22094] ? aa_af_perm+0x260/0x260 [ 569.902579][T22094] ? netlink_unicast+0x740/0x740 [ 569.907693][T22094] ? netlink_unicast+0x740/0x740 [ 569.912610][T22094] sock_sendmsg+0xcf/0x120 [ 569.917005][T22094] ____sys_sendmsg+0x32f/0x810 [ 569.921749][T22094] ? kernel_sendmsg+0x50/0x50 [ 569.926406][T22094] ? __lock_acquire+0x2224/0x48a0 [ 569.931413][T22094] ___sys_sendmsg+0x100/0x170 [ 569.936069][T22094] ? sendmsg_copy_msghdr+0x70/0x70 [ 569.941165][T22094] ? find_held_lock+0x2d/0x110 [ 569.945921][T22094] ? __might_fault+0x11f/0x1d0 [ 569.950662][T22094] ? ksys_dup3+0x3c0/0x3c0 [ 569.955056][T22094] ? lock_downgrade+0x840/0x840 [ 569.959906][T22094] __sys_sendmmsg+0x195/0x480 [ 569.964582][T22094] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 569.969584][T22094] ? lock_downgrade+0x840/0x840 [ 569.974422][T22094] ? __mutex_unlock_slowpath+0xe2/0x660 [ 569.980034][T22094] ? wait_for_completion+0x270/0x270 [ 569.985314][T22094] ? __this_cpu_preempt_check+0x28/0x190 [ 569.990948][T22094] ? __sb_end_write+0x101/0x1d0 [ 569.995777][T22094] ? vfs_write+0x161/0x5d0 [ 570.000173][T22094] ? fput_many+0x2f/0x1a0 [ 570.004482][T22094] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 570.010012][T22094] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 570.015988][T22094] __x64_sys_sendmmsg+0x99/0x100 [ 570.020907][T22094] do_syscall_64+0xf6/0x7d0 [ 570.025411][T22094] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 570.031304][T22094] RIP: 0033:0x45ca59 [ 570.035177][T22094] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 570.054844][T22094] RSP: 002b:00007f357f15cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 570.063317][T22094] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 570.071267][T22094] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 570.079228][T22094] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 570.087191][T22094] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 570.095157][T22094] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f15d6d4 22:09:08 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xca02000000000000, 0x0) 22:09:08 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x1000, 0x3, 0x3, 0x1, 0x4}}) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:08 executing program 3 (fault-call:8 fault-nth:14): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 570.200664][T22121] dlm: no locking on control device 22:09:08 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/timer\x00', 0x0, 0x0) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) write$nbd(r0, &(0x7f00000000c0)={0x6000000, 0x0, 0x4, 0x1, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef308c79d877297ee4dfb2a1af3fae323285dffbbe7698b3a268d481a2322f52bbeee8259cdb0a5d32793a600722ef557c7fb33caafa661418d29a395323866256b77b37a9ce99648ca991b12bacd09409a698eeaa4df643b1fa73d30fb71d76a12663998afa601eb3d17a4a7702625040cb441526701f3aaf380e32b460e3b3f77e787dd57460aa559dad2db8515b2bcecf6be586626862d3308"}, 0x101) [ 570.228053][T22126] FAULT_INJECTION: forcing a failure. [ 570.228053][T22126] name failslab, interval 1, probability 0, space 0, times 0 [ 570.250284][T22126] CPU: 0 PID: 22126 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 570.258644][T22126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 570.268736][T22126] Call Trace: [ 570.272048][T22126] dump_stack+0x188/0x20d [ 570.276458][T22126] should_fail.cold+0x5/0xa [ 570.280985][T22126] ? fault_create_debugfs_attr+0x140/0x140 [ 570.286829][T22126] should_failslab+0x5/0xf [ 570.291254][T22126] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 570.296647][T22126] ? __raw_spin_lock_init+0x34/0x100 [ 570.301939][T22126] tcf_block_get_ext+0x30f/0x1810 [ 570.306976][T22126] tcf_block_get+0xa5/0xf0 [ 570.311385][T22126] ? tcf_block_get_ext+0x1810/0x1810 [ 570.316779][T22126] ? blackhole_dequeue+0x10/0x10 [ 570.321705][T22126] ? qdisc_class_hash_alloc+0x86/0xa0 [ 570.327081][T22126] hfsc_init_qdisc+0x155/0x410 [ 570.331841][T22126] ? lockdep_rtnl_is_held+0x22/0x30 [ 570.337035][T22126] ? hfsc_reset_qdisc+0xd30/0xd30 [ 570.342058][T22126] qdisc_create+0x4bd/0x1430 [ 570.346635][T22126] ? tc_get_qdisc+0xae0/0xae0 [ 570.351324][T22126] ? __nla_parse+0x3d/0x4a [ 570.355739][T22126] tc_modify_qdisc+0x4c5/0x1a00 [ 570.360587][T22126] ? qdisc_create+0x1430/0x1430 [ 570.365429][T22126] ? mutex_trylock+0x2c0/0x2c0 [ 570.370180][T22126] ? find_held_lock+0x2d/0x110 [ 570.374953][T22126] ? qdisc_create+0x1430/0x1430 [ 570.379803][T22126] rtnetlink_rcv_msg+0x44e/0xad0 [ 570.384744][T22126] ? rtnl_bridge_getlink+0x870/0x870 [ 570.390032][T22126] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 570.395313][T22126] ? __copy_skb_header+0x1f0/0x5b0 [ 570.400510][T22126] ? skb_splice_bits+0x1a0/0x1a0 [ 570.405436][T22126] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 570.411231][T22126] netlink_rcv_skb+0x15a/0x430 [ 570.415998][T22126] ? rtnl_bridge_getlink+0x870/0x870 [ 570.421285][T22126] ? netlink_ack+0xa60/0xa60 [ 570.425890][T22126] netlink_unicast+0x537/0x740 [ 570.430651][T22126] ? netlink_attachskb+0x810/0x810 [ 570.435761][T22126] ? _copy_from_iter_full+0x25c/0x870 [ 570.441125][T22126] ? __phys_addr_symbol+0x2c/0x70 [ 570.446142][T22126] ? __check_object_size+0x171/0x437 [ 570.451433][T22126] netlink_sendmsg+0x882/0xe10 [ 570.456202][T22126] ? aa_af_perm+0x260/0x260 [ 570.460688][T22126] ? netlink_unicast+0x740/0x740 [ 570.465617][T22126] ? netlink_unicast+0x740/0x740 [ 570.470557][T22126] sock_sendmsg+0xcf/0x120 [ 570.474969][T22126] ____sys_sendmsg+0x32f/0x810 [ 570.479730][T22126] ? kernel_sendmsg+0x50/0x50 [ 570.484394][T22126] ? __lock_acquire+0x2224/0x48a0 [ 570.489938][T22126] ___sys_sendmsg+0x100/0x170 [ 570.494620][T22126] ? sendmsg_copy_msghdr+0x70/0x70 [ 570.499724][T22126] ? find_held_lock+0x2d/0x110 [ 570.504474][T22126] ? __might_fault+0x11f/0x1d0 [ 570.509217][T22126] ? ksys_dup3+0x3c0/0x3c0 [ 570.513623][T22126] ? lock_downgrade+0x840/0x840 [ 570.518467][T22126] __sys_sendmmsg+0x195/0x480 [ 570.523133][T22126] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 570.528138][T22126] ? lock_downgrade+0x840/0x840 [ 570.532979][T22126] ? __mutex_unlock_slowpath+0xe2/0x660 [ 570.538504][T22126] ? wait_for_completion+0x270/0x270 [ 570.543777][T22126] ? __this_cpu_preempt_check+0x28/0x190 [ 570.549389][T22126] ? __sb_end_write+0x101/0x1d0 [ 570.554231][T22126] ? vfs_write+0x161/0x5d0 [ 570.559493][T22126] ? fput_many+0x2f/0x1a0 [ 570.563805][T22126] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 570.569254][T22126] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 570.575214][T22126] __x64_sys_sendmmsg+0x99/0x100 [ 570.580144][T22126] do_syscall_64+0xf6/0x7d0 [ 570.584643][T22126] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 570.590514][T22126] RIP: 0033:0x45ca59 [ 570.594389][T22126] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 570.613973][T22126] RSP: 002b:00007f357f15cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 570.622360][T22126] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 570.630322][T22126] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 570.638271][T22126] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 570.646230][T22126] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 570.654178][T22126] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f15d6d4 [ 570.665583][ T3783] usb 5-1: new high-speed USB device number 120 using dummy_hcd 22:09:09 executing program 3 (fault-call:8 fault-nth:15): r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 570.903487][ T3783] usb 5-1: Using ep0 maxpacket: 8 [ 571.024110][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 571.036995][ T3783] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 571.072529][ T3783] usb 5-1: config 0 has no interface number 0 [ 571.094605][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 571.131966][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 571.159582][ T3783] usb 5-1: config 0 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 571.188811][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 571.217828][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.232132][ T3783] usb 5-1: config 0 descriptor?? [ 571.264743][T22099] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 571.283586][T22146] __nla_validate_parse: 8 callbacks suppressed [ 571.283597][T22146] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 571.343606][ T3783] usb 5-1: invalid MIDI in EP 0 [ 571.349490][ T3783] snd-usb-audio: probe of 5-1:0.2 failed with error -12 [ 571.372617][T22147] FAULT_INJECTION: forcing a failure. [ 571.372617][T22147] name failslab, interval 1, probability 0, space 0, times 0 [ 571.400391][T22147] CPU: 0 PID: 22147 Comm: syz-executor.3 Not tainted 5.7.0-syzkaller #0 [ 571.408742][T22147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 571.418802][T22147] Call Trace: [ 571.422130][T22147] dump_stack+0x188/0x20d [ 571.426475][T22147] should_fail.cold+0x5/0xa [ 571.431012][T22147] ? fault_create_debugfs_attr+0x140/0x140 [ 571.436831][T22147] should_failslab+0x5/0xf [ 571.441249][T22147] kmem_cache_alloc_node_trace+0x27c/0x790 [ 571.447052][T22147] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 571.453038][T22147] __kmalloc_node_track_caller+0x38/0x60 [ 571.458684][T22147] __kmalloc_reserve.isra.0+0x39/0xe0 [ 571.464177][T22147] __alloc_skb+0xef/0x5a0 [ 571.468503][T22147] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 571.474053][T22147] ? mark_held_locks+0x9f/0xe0 [ 571.478870][T22147] ? do_raw_spin_lock+0x129/0x2e0 [ 571.483880][T22147] qdisc_notify.isra.0+0x87/0x340 [ 571.488887][T22147] notify_and_destroy+0x46/0xb0 [ 571.493717][T22147] qdisc_graft+0xc85/0x1120 [ 571.498201][T22147] ? tc_dump_tclass+0x480/0x480 [ 571.503034][T22147] ? tc_get_qdisc+0xae0/0xae0 [ 571.507708][T22147] ? __nla_parse+0x3d/0x4a [ 571.512106][T22147] tc_modify_qdisc+0xba3/0x1a00 [ 571.516941][T22147] ? qdisc_create+0x1430/0x1430 [ 571.521784][T22147] ? mutex_trylock+0x2c0/0x2c0 [ 571.526524][T22147] ? find_held_lock+0x2d/0x110 [ 571.531280][T22147] ? qdisc_create+0x1430/0x1430 [ 571.536121][T22147] rtnetlink_rcv_msg+0x44e/0xad0 [ 571.541049][T22147] ? rtnl_bridge_getlink+0x870/0x870 [ 571.546401][T22147] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 571.551694][T22147] ? __copy_skb_header+0x1f0/0x5b0 [ 571.556802][T22147] ? skb_splice_bits+0x1a0/0x1a0 [ 571.561838][T22147] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 571.567694][T22147] netlink_rcv_skb+0x15a/0x430 [ 571.572459][T22147] ? rtnl_bridge_getlink+0x870/0x870 [ 571.577738][T22147] ? netlink_ack+0xa60/0xa60 [ 571.582316][T22147] netlink_unicast+0x537/0x740 [ 571.587072][T22147] ? netlink_attachskb+0x810/0x810 [ 571.592175][T22147] ? _copy_from_iter_full+0x25c/0x870 [ 571.597527][T22147] ? __phys_addr_symbol+0x2c/0x70 [ 571.602529][T22147] ? __check_object_size+0x171/0x437 [ 571.607807][T22147] netlink_sendmsg+0x882/0xe10 [ 571.612553][T22147] ? aa_af_perm+0x260/0x260 [ 571.617035][T22147] ? netlink_unicast+0x740/0x740 [ 571.621956][T22147] ? netlink_unicast+0x740/0x740 [ 571.626871][T22147] sock_sendmsg+0xcf/0x120 [ 571.631268][T22147] ____sys_sendmsg+0x32f/0x810 [ 571.636029][T22147] ? kernel_sendmsg+0x50/0x50 [ 571.640700][T22147] ? __lock_acquire+0x2224/0x48a0 [ 571.645710][T22147] ___sys_sendmsg+0x100/0x170 [ 571.650367][T22147] ? sendmsg_copy_msghdr+0x70/0x70 [ 571.655490][T22147] ? find_held_lock+0x2d/0x110 [ 571.660253][T22147] ? __might_fault+0x11f/0x1d0 [ 571.665016][T22147] ? ksys_dup3+0x3c0/0x3c0 [ 571.669414][T22147] ? lock_downgrade+0x840/0x840 [ 571.674253][T22147] __sys_sendmmsg+0x195/0x480 [ 571.679546][T22147] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 571.684566][T22147] ? lock_downgrade+0x840/0x840 [ 571.689530][T22147] ? __mutex_unlock_slowpath+0xe2/0x660 [ 571.695079][T22147] ? wait_for_completion+0x270/0x270 [ 571.700343][T22147] ? __this_cpu_preempt_check+0x28/0x190 [ 571.705952][T22147] ? __sb_end_write+0x101/0x1d0 [ 571.710794][T22147] ? vfs_write+0x161/0x5d0 [ 571.715190][T22147] ? fput_many+0x2f/0x1a0 [ 571.719513][T22147] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 571.724957][T22147] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 571.730919][T22147] __x64_sys_sendmmsg+0x99/0x100 [ 571.735837][T22147] do_syscall_64+0xf6/0x7d0 [ 571.740336][T22147] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 571.746205][T22147] RIP: 0033:0x45ca59 [ 571.750167][T22147] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 571.769760][T22147] RSP: 002b:00007f357f13bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 571.778150][T22147] RAX: ffffffffffffffda RBX: 00000000004fd380 RCX: 000000000045ca59 [ 571.786186][T22147] RDX: 010efe10675dec16 RSI: 0000000020000200 RDI: 0000000000000003 [ 571.794145][T22147] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 571.802096][T22147] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 571.810042][T22147] R13: 0000000000000900 R14: 00000000004cbcfa R15: 00007f357f13c6d4 [ 571.829763][T22147] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 571.839986][ T3784] usb 5-1: USB disconnect, device number 120 [ 571.853778][T22147] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:11 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c0900000905011208070000"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:11 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xd400000000000000, 0x0) 22:09:11 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f00000000c0)={0x0, 0x40, 0xd2, 0x6, 0x6, 0x3f, 0xff, 0x5, 0xff, 0x5, 0x0, 0x4, 0x20, 0x7f}, 0xe) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000180)={{0x1, 0x0, @descriptor="04469c1a8e91f12b"}, 0x3e, 0x0, [], "33424b94486dd88f2555d526083b13563a5bc27cae6030fa6192e1dd9cab5112e1a25ada82eb43b393fc569945ed80f242771e672b30b4ef63224bba8c2a"}) read$usbfs(r1, 0x0, 0x0) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000040)=0x50a0100) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3841c1ab9afb286109361bb3027"], 0x68) 22:09:11 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:11 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x6000000) 22:09:11 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0) [ 572.422599][T22173] dlm: no locking on control device [ 572.428417][T22174] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:11 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf203000000000000, 0x0) [ 572.505327][T22174] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 572.530754][T22174] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:11 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec68, 0x0) [ 572.615108][T22203] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 572.645772][T22203] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 572.656729][T22203] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 572.671528][T22203] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:11 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x2) 22:09:11 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf403000000000000, 0x0) [ 572.754489][ T3784] usb 5-1: new high-speed USB device number 121 using dummy_hcd 22:09:11 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x3) 22:09:11 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf803000000000000, 0x0) [ 573.033314][ T3784] usb 5-1: Using ep0 maxpacket: 8 [ 573.165855][ T3784] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 573.177579][ T3784] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 573.188277][ T3784] usb 5-1: config 0 has no interface number 0 [ 573.195599][ T3784] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 573.207658][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 573.219839][ T3784] usb 5-1: config 0 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 573.234111][ T3784] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 573.244360][ T3784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.259078][ T3784] usb 5-1: config 0 descriptor?? [ 573.294740][T22182] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 573.363529][ T3784] usb 5-1: invalid MIDI in EP 0 [ 573.369444][ T3784] snd-usb-audio: probe of 5-1:0.2 failed with error -12 [ 573.530486][ T2469] usb 5-1: USB disconnect, device number 121 22:09:12 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c0900000905011208070000000905"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:12 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x4) 22:09:12 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xf903000000000000, 0x0) 22:09:12 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x10000000) 22:09:12 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:12 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xfa03000000000000, 0x0) 22:09:12 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x5) 22:09:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6) [ 574.405142][ T3783] usb 5-1: new high-speed USB device number 122 using dummy_hcd 22:09:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x7) 22:09:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x8) [ 574.653115][ T3783] usb 5-1: Using ep0 maxpacket: 8 22:09:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x9) 22:09:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xa) [ 574.783751][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 574.795510][ T3783] usb 5-1: config 0 has no interface number 0 [ 574.811727][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 574.837741][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 574.861611][ T3783] usb 5-1: config 0 interface 2 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 574.886354][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 574.906977][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.929877][ T3783] usb 5-1: config 0 descriptor?? [ 574.964493][T22265] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 575.023271][ T3783] usb 5-1: invalid MIDI in EP 0 [ 575.029196][ T3783] snd-usb-audio: probe of 5-1:0.2 failed with error -12 [ 575.215846][ T3783] usb 5-1: USB disconnect, device number 122 22:09:14 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c0900000905011208070000000905"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:14 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xb) 22:09:14 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x11000000) 22:09:14 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000000c0)={0x400, 0x0}, 0x8) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000100)={0x3, r1}, 0x8) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:14 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 575.741412][T22350] dlm: no locking on control device [ 576.052902][ T3783] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 576.292881][ T3783] usb 5-1: Using ep0 maxpacket: 8 [ 576.413374][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 576.421542][ T3783] usb 5-1: config 0 has no interface number 0 [ 576.437274][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 576.448373][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 576.462553][ T3783] usb 5-1: config 0 interface 2 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 576.477992][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 576.487127][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 576.500470][ T3783] usb 5-1: config 0 descriptor?? [ 576.524299][T22359] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 576.583176][ T3783] usb 5-1: invalid MIDI in EP 0 [ 576.588931][ T3783] snd-usb-audio: probe of 5-1:0.2 failed with error -12 [ 576.754362][ T3784] usb 5-1: USB disconnect, device number 123 22:09:15 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xfc01000000000000, 0x0) 22:09:15 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) write$nbd(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="06000000000000000000000004000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef66d683eb9355dd7d020a724232a8b58e9eb39b4667c5e7bef3"], 0x68) 22:09:15 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xc) 22:09:15 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x29000000) 22:09:15 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:16 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c0900000905011208070000000905"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) [ 577.263114][T22391] __nla_validate_parse: 42 callbacks suppressed [ 577.263123][T22391] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:16 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$P9_RLOCK(r0, &(0x7f00000000c0)={0x8, 0x35, 0x2}, 0x8) read$usbfs(r1, 0x0, 0x0) ioctl$UI_SET_SWBIT(r1, 0x4004556d, 0x1) ioctl$VIDIOC_DECODER_CMD(r1, 0xc0485660, &(0x7f0000000100)={0x2, 0x2, @raw_data=[0x4975, 0x7fff, 0x400, 0x9, 0x8001, 0x10001, 0x20, 0xffff, 0xe5, 0x2, 0xfffffffc, 0x3, 0x5, 0x7d, 0x1, 0xd9]}) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x3d1) [ 577.332119][T22391] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 577.364086][T22391] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:16 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xe) 22:09:16 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x8e29bd, 0x0) write$nbd(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0600000000000000000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b7dba59f2bcb13bedfb1f2a0a1cecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef300000000008b728d6abd7c1b7dca45ebdaed0e9ffd6e8802da9b0bde7ba5fc192cabebbb7ef32fc2102960aa90f8f9a2e7f7ae81e6f7027bb32ecd7ae4ebf8f81c91d0d92294fc78e0"], 0x68) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$NBD_DISCONNECT(r1, 0xab08) [ 577.394314][T22391] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 577.398672][T22418] dlm: no locking on control device [ 577.419441][T22420] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 577.427432][T22418] dlm: no locking on control device [ 577.434272][T22420] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 577.504146][T22431] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 577.509867][T22430] dlm: Unknown command passed to DLM device : 239 [ 577.509867][T22430] [ 577.530829][T22436] dlm: Unknown command passed to DLM device : 239 [ 577.530829][T22436] [ 577.538957][T22431] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:16 executing program 5: clone(0x66110900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0600006506ed2aa5a411a70001000000a3ef07749fa55f62d3adff23acc746cb5d5931652fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b29f55dd7d020a724232a8b58e9eb39b4667c5e7bef3f3943660371d4593972616d9c8605c15010c2892ad5f0c7216fca73b202ddcc9ea285fc42c67"], 0x68) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) 22:09:16 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x2, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 577.560674][T22431] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 577.575279][T22431] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:16 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xf) [ 577.629555][ T3784] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 577.655468][T22446] dlm: no locking on control device [ 577.667803][T22452] dlm: no locking on control device [ 577.892733][ T3784] usb 5-1: Using ep0 maxpacket: 8 [ 578.012865][ T3784] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 578.021004][ T3784] usb 5-1: config 0 has no interface number 0 [ 578.028827][ T3784] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 578.040819][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 578.052364][ T3784] usb 5-1: config 0 interface 2 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 578.064137][ T3784] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 578.074141][ T3784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.089032][ T3784] usb 5-1: config 0 descriptor?? [ 578.114269][T22412] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 578.173000][ T3784] usb 5-1: invalid MIDI in EP 0 [ 578.182446][ T3784] snd-usb-audio: probe of 5-1:0.2 failed with error -12 [ 578.337442][ T3784] usb 5-1: USB disconnect, device number 124 22:09:19 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xfe03000000000000, 0x0) 22:09:19 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x10) 22:09:19 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) r1 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x6, 0x189001) r2 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f00000000c0)={r3, 0x8}, 0x8) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000100)={r3, 0x0, 0x20}, 0xc) 22:09:19 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2b000000) 22:09:19 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000140000000000339078ac141400e0000001"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:19 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:19 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000000000000000000001000000c8ef02749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1958b97ba59f2bcb13bedfb1f8cd563e66884b33c61b3927917b2edef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3000000000000000000163c3b841f0ed3557db8aabf9289fd3e089ef22100497f2e8ee78759dfaa73fb7983dbf36499689b213069890b1177e5636c04ed45f129813ac7fb84bd02480bca4c9c1517bf389987db13ee571eb9b3e056fda94c526794d8ffae4dc5de7eb5c27b4cf805b34826b74df35e96779b31df70ac6afddefaee9fb5c25be35debfe2464e5d85e00523d2f2e98a040a292d60c79b7728b657ceb14365356e8fde2891082889fe8d010b1e6b0978111020000003dfe6f16283297d57678f08e96e7c08bac8f7651cfb0ea201de4702a772f0de9cbef3d12aaf1fd0fb27ceaeb32009d89818525b11fc0ff25cfdbf23fcf3729350f721d22301a20cd24cbbbd212e24ae16142afe6a89ee306d8b5542bfd378d2aa171fc755d10f25d101b0f4ba143585c94a2cc540aeacc61abc7f125503a33e8193c30bf47bc4ee23717f58d0b18ce2137dcb70b7ed05e173ddd6ddda38b0e363f62163dc5d65708b6901aac4519bd5a86d505dd589ec636f169f09a1400b0ccfd2bbb1b8e787e0b035a414c62f2706ec5e18a012e6edcd94a90105331ccae"], 0x68) [ 580.360428][T22478] dlm: no locking on control device 22:09:19 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9c5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b392a0eb720aef665ad9b19f55dd7d020a724232a8b58e9eb39b81224667c5e7bef3"], 0x68) 22:09:19 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x11) [ 580.437645][T22498] dlm: no locking on control device 22:09:19 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_usb_connect$hid(0x3, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011001000000ff6a05100040000102030109142d0001060904000901030103840921b7068101866ff490fe9897c258c222fb0909058103ff039900e00905"], &(0x7f0000000240)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x250, 0x0, 0x1, 0x8a, 0x20, 0x6}, 0x59, &(0x7f0000000140)={0x5, 0xf, 0x59, 0x4, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x9, 0x2, 0x40, 0x1}, @generic={0x35, 0x10, 0x1, "e0df12e403098f1241712630412e8206e2b7039097846feaa968df5f8d4dc42b66122311218d1a9f41a57b8c5c6639518175"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x2, 0x2, 0xff, 0x2}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xc, 0x5, 0xff, 0x3f}]}, 0x2, [{0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x459}}, {0xa, &(0x7f0000000200)=@string={0xa, 0x3, "8f659ac057337e7a"}}]}) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000280)={0x1, [0x0]}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000300)={r2, @in6={{0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00', 0x3}}, 0x3c, 0x2400}, 0x90) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r3, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 580.510556][T22511] dlm: no locking on control device 22:09:19 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0xffffffff00000000, 0x0) 22:09:19 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x12) [ 580.622484][ T2469] usb 5-1: new high-speed USB device number 125 using dummy_hcd 22:09:19 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x13) 22:09:19 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000080)={'netdevsim0\x00', 0x7}) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() tkill(r2, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) dup(0xffffffffffffffff) r4 = gettid() perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xa22, 0x800, 0x0, 0x0, 0x100000000000, 0x1}, r2, 0x3, 0xffffffffffffffff, 0x0) tkill(r4, 0x4) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r5, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r5, 0xc1205531, &(0x7f00000000c0)={0x2, 0x6, 0x3, 0x7, [], [], [], 0x7fffffff, 0x4, 0x4, 0x5, "0f4e97f8cefab4ff0e93e6b069345aa3"}) ptrace$setopts(0x4206, r4, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:19 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x48) [ 580.832609][ T35] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 580.865449][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 580.982536][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 580.990586][ T2469] usb 5-1: config 0 has no interface number 0 [ 581.002515][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 581.017992][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 581.029560][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 581.045774][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 0 [ 581.057923][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 581.070546][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.080699][ T35] usb 6-1: Invalid ep0 maxpacket: 512 [ 581.097893][ T2469] usb 5-1: config 0 descriptor?? [ 581.123488][T22477] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 581.193675][ T2469] snd-usb-audio: probe of 5-1:0.2 failed with error -12 [ 581.232475][ T35] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 581.351960][ T2469] usb 5-1: USB disconnect, device number 125 22:09:20 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2c000000) 22:09:20 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) wait4(0x0, 0x0, 0x0, 0x0) [ 581.472412][ T35] usb 6-1: Invalid ep0 maxpacket: 512 [ 581.478062][ T35] usb usb6-port1: attempt power cycle 22:09:20 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:20 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x4c) 22:09:20 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, 0x0, 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:20 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x2c) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) ptrace$cont(0x7, r2, 0x7, 0xfffffffffffff001) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) [ 582.172367][ T2469] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 582.202281][ T35] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 582.293058][ T35] usb 6-1: Invalid ep0 maxpacket: 512 [ 582.416273][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 582.442258][ T35] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 582.532540][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 582.540556][ T2469] usb 5-1: config 0 has no interface number 0 [ 582.548049][ T35] usb 6-1: Invalid ep0 maxpacket: 512 [ 582.553623][ T35] usb usb6-port1: unable to enumerate USB device [ 582.560588][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 582.573609][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 582.584845][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 582.596078][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 0 [ 582.606680][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 582.616307][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.631905][ T2469] usb 5-1: config 0 descriptor?? [ 582.653822][T22596] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 582.712909][ T2469] snd-usb-audio: probe of 5-1:0.2 failed with error -12 [ 582.880994][ T3783] usb 5-1: USB disconnect, device number 126 [ 583.070103][ T0] NOHZ: local_softirq_pending 08 22:09:22 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000040)={'vxcan1\x00'}) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) 22:09:22 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x60) 22:09:22 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() tkill(r1, 0x4) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) fcntl$setown(r2, 0x8, r1) read$usbfs(r2, 0x0, 0x0) sendmsg$IPVS_CMD_DEL_SERVICE(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x74, 0x0, 0x100, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8b}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_virt_wifi\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000000}, 0x45) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:22 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2f000000) 22:09:22 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, 0x0, 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:22 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) [ 583.604354][T22639] __nla_validate_parse: 32 callbacks suppressed [ 583.604364][T22639] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:22 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="060000fc00000000000004000000749fa55f62d3adf77f9d5e823f0e00005a2fdbede515d1978b97ba59f2b9f04a5cfb1f8cd463af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef300b0aab706779bfa0000000000000088afadae7b4f39e6927713f063e6f84bb08fd7243b1b41955a70f694b62eaa867a9eca890a17be190fb07547fe9ed5e5a6e5c10666ef15bd7033c5e43917ed079735485f4d5b3b11331301857234a7a0e974d56b7c1a529df1c597359c0915efc4ea1c1f777d57ee7774046563aa4c3df19cff8c15cd1bd804a6cff6009fd0d20976fbccadb23cd8f8db5fd2ef406accac199a55c488c33bb2ffdd552925f0ce578b37ee81d5b839eee63c94d5855bcc171211260000589652faf5e154b644a7cb5975f0253d93741e64ab37f5c7f628957263391f40d7d32f6d139873e901c947feb080f45e"], 0x68) [ 583.692325][T22649] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 583.714434][T22649] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 583.727090][T22639] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:22 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000002c0)={'veth1_to_bond\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="2d00000003000000b6ee00000000000002000000fe80000000000000000000000000000cfe8000000000000000000000000000234e244e230900000000000000000000000000000000000180c200000e03ff0003fc001800000000130000000000000000000000000000000100000000000000000000000000000001000000083f000000000000000000000000000000000000000000000000090001800000010000197300000000ff07000000000000825200000000000009000000ff0300000600000001000100050000000000000005000000008000000000000007000000"]}) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000000c0)={0x1, 0x2, 0x200, 0x1bc, 0x0}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={r2, 0x6}, &(0x7f0000000180)=0x8) 22:09:22 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x68) [ 583.752925][T22663] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 583.776188][T22663] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 583.848840][T22669] dlm: no locking on control device [ 583.848850][T22672] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 583.866781][T22672] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 583.877936][T22672] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:22 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f00000000c0)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 583.895370][T22672] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 583.932583][ T3785] usb 5-1: new high-speed USB device number 127 using dummy_hcd 22:09:22 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6c) 22:09:22 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="ff000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)=@newlink={0x48, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x3}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r6}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @local}, @IFLA_IPTUN_TTL={0x5}]}}}]}, 0x48}}, 0x0) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f00000000c0)={r3, 0x1, 0x6, @remote}, 0x10) [ 583.984068][T22683] dlm: no locking on control device 22:09:22 executing program 5: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x74, 0x74, 0x9, [@fwd={0xe}, @ptr={0x4, 0x0, 0x0, 0x2, 0x4}, @func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0xb, 0x4}, {0x4, 0x1}]}, @var={0xd, 0x0, 0x0, 0xe, 0x3}, @func={0x8, 0x0, 0x0, 0xc, 0x5}, @volatile={0xc, 0x0, 0x0, 0x9, 0x200}, @const={0x6}, @typedef={0x1, 0x0, 0x0, 0x8, 0x5}]}, {0x0, [0x61, 0x30, 0x30, 0x5f, 0x5f, 0x0, 0x0]}}, &(0x7f0000000180)=""/170, 0x95, 0xaa, 0x1}, 0x20) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/debug/bluetooth/6lowpan_control\x00', 0x2, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000280)={[0x8000, 0x2, 0x2, 0x4, 0x6, 0xfffffffffffffff9, 0x80, 0x4, 0xffffffffffff0001, 0x5, 0x7fff, 0x0, 0xd9, 0xfffffffffffffeff, 0x0, 0xb8], 0x3000, 0x40}) [ 584.038024][T22690] dlm: no locking on control device 22:09:22 executing program 5: clone(0x26940900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1fd73ac08cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5"], 0x68) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x5d1042, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) ioctl$PIO_FONTRESET(r2, 0x4b6d, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vsock\x00', 0x1, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f0000000100)={@fixed={[], 0x10}, 0x1, 0x7, 0xfffe, 0xffff, 0x20, "b40c341f0c9577c1895b30f394495673f38bf926309fa4efc06ed1e426a2f1f8b2b9b9ba5b344130cc43e323ed194491549d59ad7b80a2b1c2b4e2c794c0da23d84d5f0e98426ab2ec2786a741028390f11b0fffa42afaa34d856cef67704e81813fb9a327c95a09e75c0912f0e80594706b2730f5fafececa2afef50867c87c"}) [ 584.090796][T22697] dlm: no locking on control device 22:09:22 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x74) [ 584.132703][T22701] dlm: no locking on control device [ 584.154239][T22705] dlm: no locking on control device [ 584.212050][ T3785] usb 5-1: Using ep0 maxpacket: 8 [ 584.342979][ T3785] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 584.354301][ T3785] usb 5-1: config 0 has no interface number 0 [ 584.370091][ T3785] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 584.381500][ T3785] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 584.392362][ T3785] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 584.405176][ T3785] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 0 [ 584.416175][ T3785] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 584.426259][ T3785] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 584.441523][ T3785] usb 5-1: config 0 descriptor?? [ 584.473492][T22648] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 584.533266][ T3785] snd-usb-audio: probe of 5-1:0.2 failed with error -12 [ 584.718887][ T3783] usb 5-1: USB disconnect, device number 127 22:09:23 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3a000000) 22:09:23 executing program 5: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3965f7a6dde8a8f35525f91b538af0bdf8267d05450d39b57b29dd23df8f937587287817246bfec59e5be7870bba6632862e5bf900412e6b67c9d96727c31868155a188126fecefcace86fcc0e6f10ef8d7f04efcc2a94f03e4c1ac075338ec52593c4859a547974bb493b218447cda0b1e5c61e4511729f3b047b049875db5a444a309cdd5ab78a27ca6cd4578f6164fe75ee28a041aa56b1df9fb"], 0x68) [ 585.224087][T22732] dlm: no locking on control device [ 585.256417][T22739] dlm: no locking on control device 22:09:24 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) 22:09:24 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x7a) 22:09:24 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, 0x0, 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:24 executing program 5: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x10802, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_PORTS(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3, r1, 0x400, 0x70bd2e, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x4000080) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) write$nbd(r2, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1b8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0xfffffffffffffe5c) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f0000000280)={{0x1f, 0xa}, 'port0\x00', 0x82, 0xc0020, 0x7f, 0x81, 0x1, 0x7f, 0x3, 0x0, 0x1, 0x3}) 22:09:24 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xc0) [ 585.647004][ T3784] usb 5-1: new high-speed USB device number 2 using dummy_hcd 22:09:24 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xf0) [ 585.902081][ T3784] usb 5-1: Using ep0 maxpacket: 8 22:09:24 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x300) 22:09:24 executing program 5: prctl$PR_SET_FPEXC(0xc, 0x40000) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) setregid(0x0, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="02000001013e07000000000002000400", @ANYRES32=0x0, @ANYRES64, @ANYRES32=0x0, @ANYBLOB="02000200", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08030100", @ANYRES32=0x0, @ANYBLOB="08000500", @ANYBLOB="68d4b80200b5d506", @ANYRES64, @ANYRES32=0x0, @ANYBLOB="08000100aa1f6a5e6af21de714b842156003110e39808cfc9684c7e0ef8b1ed8046dca9710c0a9615efbc3c269d300c1ec4966fbac5204d86d5ab5d0fb00dbeb5925fb5ce578ce461319b7a926214574f492156d991115d31c84153c1304ff", @ANYRESHEX, @ANYBLOB="08000200", @ANYBLOB="db3042bbbf62755c42cf71297348833cde4adaa27c78459079feb1ce89bd19b5ee2078f517e923d0bc9015a8a8ec22c5d07fb76daf47ecc366", @ANYRES32, @ANYRES32, @ANYBLOB="080005", @ANYRES32, @ANYRESHEX, @ANYRES32], 0x8c, 0x1) r1 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) setregid(0x0, r2) fsetxattr$system_posix_acl(r1, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="02000001013e07000000000002000400", @ANYRES32=0x0, @ANYRES64, @ANYRES32=0x0, @ANYBLOB="02000200", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08030100", @ANYRES32=0x0, @ANYBLOB="08000500", @ANYBLOB="68d4b80200b5d506", @ANYRES64=r2, @ANYRES32=0x0, @ANYBLOB="08000100aa1f6a5e6af21de714b842156003110e39808cfc9684c7e0ef8b1ed8046dca9710c0a9615efbc3c269d300c1ec4966fbac5204d86d5ab5d0fb00dbeb5925fb5ce578ce461319b7a926214574f492156d991115d31c84153c1304ff", @ANYRESHEX, @ANYBLOB="08000200", @ANYBLOB="db3042bbbf62755c42cf71297348833cde4adaa27c78459079feb1ce89bd19b5ee2078f517e923d0bc9015a8a8ec22c5d07fb76daf47ecc366", @ANYRES32, @ANYRES32, @ANYBLOB="080005", @ANYRES32, @ANYRESHEX, @ANYRES32=r2], 0x8c, 0x1) fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) setregid(0x0, r5) fsetxattr$system_posix_acl(r4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="02000001013e07000000000002000400", @ANYRES32=0x0, @ANYRES64, @ANYRES32=0x0, @ANYBLOB="02000200", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08030100", @ANYRES32=0x0, @ANYBLOB="08000500", @ANYBLOB="68d4b80200b5d506", @ANYRES64=r5, @ANYRES32=0x0, @ANYBLOB="08000100aa1f6a5e6af21de714b842156003110e39808cfc9684c7e0ef8b1ed8046dca9710c0a9615efbc3c269d300c1ec4966fbac5204d86d5ab5d0fb00dbeb5925fb5ce578ce461319b7a926214574f492156d991115d31c84153c1304ff", @ANYRESHEX, @ANYBLOB="08000200", @ANYBLOB="db3042bbbf62755c42cf71297348833cde4adaa27c78459079feb1ce89bd19b5ee2078f517e923d0bc9015a8a8ec22c5d07fb76daf47ecc366", @ANYRES32, @ANYRES32, @ANYBLOB="080005", @ANYRES32, @ANYRESHEX, @ANYRES32=r5], 0x8c, 0x1) r6 = perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) setregid(0x0, r7) fsetxattr$system_posix_acl(r6, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="02000001013e07000000000002000400", @ANYRES32=0x0, @ANYRES64, @ANYRES32=0x0, @ANYBLOB="02000200", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08030100", @ANYRES32=0x0, @ANYBLOB="08000500", @ANYBLOB="68d4b80200b5d506", @ANYRES64=r7, @ANYRES32=0x0, @ANYBLOB="08000100aa1f6a5e6af21de714b842156003110e39808cfc9684c7e0ef8b1ed8046dca9710c0a9615efbc3c269d300c1ec4966fbac5204d86d5ab5d0fb00dbeb5925fb5ce578ce461319b7a926214574f492156d991115d31c84153c1304ff", @ANYRESHEX, @ANYBLOB="08000200", @ANYBLOB="db3042bbbf62755c42cf71297348833cde4adaa27c78459079feb1ce89bd19b5ee2078f517e923d0bc9015a8a8ec22c5d07fb76daf47ecc366", @ANYRES32, @ANYRES32, @ANYBLOB="080005", @ANYRES32, @ANYRESHEX, @ANYRES32=r7], 0x8c, 0x1) setgroups(0x9, &(0x7f0000000180)=[0x0, 0x0, 0x0, r2, 0xee00, 0x0, r3, r5, r7]) [ 586.028328][ T3784] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 586.040081][ T3784] usb 5-1: config 0 has no interface number 0 [ 586.065587][ T3784] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 586.093591][T22782] dlm: no locking on control device [ 586.110684][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 586.145071][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 586.182678][ T3784] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 586.211224][ T3784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 586.239689][ T3784] usb 5-1: config 0 descriptor?? 22:09:25 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000440)='/dev/dlm-control\x00', 0x2623f, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vsock\x00', 0x200000, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000000240)={@empty, 0x0}, &(0x7f0000000280)=0x14) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000002c0)={r1, 0x1, 0x6, @remote}, 0x10) gettid() r2 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f00000000c0)={r3, 0x8}, 0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000340)={r3, 0x81}, &(0x7f0000000380)=0x8) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r4, 0x0, 0x0) write$UHID_CREATE(r4, &(0x7f0000000580)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f00000004c0)=""/173, 0xad, 0x1, 0x4, 0x9, 0x9, 0x1}}, 0x120) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000004780)='batadv\x00') sendmsg$BATADV_CMD_SET_HARDIF(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYRES32, @ANYRESHEX, @ANYBLOB="0502000000000000000001000000080003"], 0x24}}, 0x880) ioctl$RTC_VL_READ(r0, 0x80047013, &(0x7f00000001c0)) getcwd(&(0x7f00000006c0)=""/172, 0xac) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, r6, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xc5}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0xfd}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x4000000) [ 586.283224][T22742] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 586.290551][T22742] raw-gadget gadget: fail, usb_ep_enable returned -22 22:09:25 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) socket$isdn_base(0x22, 0x3, 0x0) write$nbd(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a58ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef32b15d50ae9157979018dd86e41a2162662c787cb355b2b1834c2095ae169780ddc0340e20bdb45022589c062ff770fb0598b112cea34dd9fe8aef9644d43d1aece87b1e141377a94f164cbd60c47cdd883b1b7871365c58a51838e4fb08ba64be6b64e6abf15a9185c06a3004144bae75d13d0ff477b204d7610621f9a5f036d5d940e8bc449c70a517f49d2e28cce5fe7e8512e9d5ed190543139c5a5b87255d2a1c73d509bcb13b0ee4684c3e239"], 0x68) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) write$P9_RREADDIR(r2, &(0x7f0000000040)={0x2a, 0x29, 0x2, {0xfff, [{{0x10, 0x0, 0x3}, 0x6, 0x5, 0x7, './file0'}]}}, 0x2a) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340)='nl80211\x00') sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="110725bd7000fbdbdf7a020000004d4f4494868b33e4"], 0x1c}, 0x1, 0x0, 0x0, 0x40010}, 0x84) read$usbfs(r1, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_GET_ADDR(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x10, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4008880) [ 586.450537][T22802] dlm: no locking on control device [ 586.475901][T22802] dlm: non-version read from control device 0 [ 586.505175][T22802] dlm: no locking on control device [ 586.896223][ T2469] usb 5-1: USB disconnect, device number 2 22:09:26 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3c000000) 22:09:26 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd72020a724232a8b58e9eb39b4667c5e7bef3"], 0x68) 22:09:26 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) 22:09:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x500) 22:09:26 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 587.642541][T22851] dlm: no locking on control device 22:09:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x600) 22:09:26 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = syz_open_dev$vcsu(&(0x7f00000000c0)='/dev/vcsu#\x00', 0x4, 0x48000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) keyctl$get_persistent(0x5, r3, 0x0) r4 = syz_open_dev$mouse(&(0x7f00000001c0)='/dev/input/mouse#\x00', 0x0, 0x10001) setsockopt$SO_J1939_PROMISC(r4, 0x6b, 0x2, &(0x7f0000000200), 0x4) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r5, 0x0, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000180)=@int=0xfff, 0x4) r6 = getegid() write$FUSE_ATTR(r1, &(0x7f0000000100)={0x78, 0xfffffffffffffffe, 0x6, {0x2, 0x7, 0x0, {0x2, 0x401, 0xfffffffffffffffd, 0x100000001, 0x7ff, 0xe, 0x3, 0x80000001, 0x9, 0x861b, 0x6, r3, r6, 0x2, 0x9}}}, 0x78) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x2, 0x0, 0x3, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe26884b33a61b3927917b2d8ef660100010055dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x612) [ 587.931693][ T3783] usb 5-1: new high-speed USB device number 3 using dummy_hcd 22:09:26 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) ioctl$KVM_IOEVENTFD(r0, 0x4040ae79, &(0x7f0000000100)={0x100000, &(0x7f00000000c0), 0x8, 0xffffffffffffffff, 0x4}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="06060000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"], 0x68) 22:09:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x700) 22:09:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x900) [ 588.190343][ T3783] usb 5-1: Using ep0 maxpacket: 8 22:09:27 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xa00) [ 588.315632][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 588.331033][ T3783] usb 5-1: config 0 has no interface number 0 [ 588.351255][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 588.389671][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 588.419906][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 588.450459][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 588.469868][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 588.488433][ T3783] usb 5-1: config 0 descriptor?? [ 588.513159][T22852] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 588.520458][T22852] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 588.768946][ T3783] usb 5-1: USB disconnect, device number 3 22:09:28 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3f000000) 22:09:28 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xb00) 22:09:28 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000001280)='/dev/vbi#\x00', 0x3, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000080)={0x3, 0x5, 0x2}) r1 = socket(0x15, 0x5, 0x0) getsockopt(r1, 0x200000000114, 0x2712, &(0x7f0000000040)=""/102400, &(0x7f0000000000)=0x19000) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x4, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x4084) ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x0, 0x5, 0x4, 0x2000, 0x0, {}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x0, "bc4c74c7"}, 0x0, 0x2, @offset=0x480040, 0x401}) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x0, 0x5, 0x2}) r2 = socket(0x15, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x2712, &(0x7f0000000040)=""/102400, &(0x7f0000000000)=0x19000) connect$l2tp(r2, &(0x7f0000019040)={0x2, 0x0, @empty, 0x1}, 0x10) r3 = syz_open_dev$vbi(&(0x7f0000001280)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000080)={0x3, 0x5, 0x2}) ioctl$VIDIOC_S_STD(r3, 0x40085618, &(0x7f0000000000)=0x5b703) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/dlm_plock\x00', 0x200, 0x0) ioctl$VIDIOC_G_OUTPUT(r4, 0x8004562e, &(0x7f0000000700)) read$usbfs(0xffffffffffffffff, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r5, 0x0, 0x0) 22:09:28 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) 22:09:28 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 589.447714][T22962] __nla_validate_parse: 74 callbacks suppressed [ 589.447723][T22962] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:28 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x300000b, 0x50, r0, 0x24586000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)={0x0, 0x0, 0xfffffffd}) r2 = syz_open_pts(r1, 0x0) dup3(r2, r1, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fd/3\x00') r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r3, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 589.537341][T22968] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 589.566171][T22968] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:28 executing program 5: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS3\x00', 0x80000, 0x0) ioctl$TCSETXW(r0, 0x5435, &(0x7f0000000100)={0x6, 0x80, [0x20, 0xce45, 0x9, 0x1, 0x1f], 0x7ff}) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef16f49fa55f5fd3adff7f9d5e82099ce53a5a2fdbede515d1978b97ba59f2bcb13bfffb1f8cd563af1b55edbc013abb872a0a18ecf644b8e66884b33c61b3927917b2d8ef665ad9b19f55dd7d02e7bef300000000000007000000ffffff960a50f97d"], 0x68) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f0000000280)=[@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e23, 0x20000, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x101}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x13}}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x5c) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r3, 0xc0a85352, &(0x7f00000001c0)={{0x7, 0x7}, 'port0\x00', 0x0, 0x42, 0x4, 0x6, 0x4e3ded32, 0x8, 0x3, 0x0, 0x0, 0x2}) [ 589.586946][T22962] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:28 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x3, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:28 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xc00) [ 589.628967][T22982] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 589.643948][T22982] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 589.668326][T22988] dlm: no locking on control device 22:09:28 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x20000, 0x0) vmsplice(r1, &(0x7f0000000300)=[{&(0x7f0000000100)="fb2d30fdf1577162a80ea503bfdd21eafe4642ae54704541304ba2cc6a492dda189ae8679be703c5d633ad2b7ad1a93f1dcf8400902c806618eb98f5f9fd73e0f3aff367cd", 0x45}, {&(0x7f0000000180)="d7f82d70b84b18b44aac98701d4633c61782ddb22c3401929aa80f20a734013ec502d9edc16067d0984d578101bfb330351b4dcaba37b4b9c6a22ddddfac18058f965593672056a11ab4aab712dce73cdbefe3b5dda5302cd944bd9b2fc54d526fa80db9e0b7954e00416b9f9b04411300df6a164e4b684a4af60fb40daeecb07306caa3bf7c40e4755d9e1263e73e06e3dc88078f77c1f9ce79371741806bc3196d387434cd1d9431c0618c7568be02c8549661c58ccd922774ee1d6ae1958f6d5c687d9ea2a39a9ed7d4e5432667e870f503f1910d7a0519684c628866f25f0757449d26b96c72218691df95540e0f797562f5161e", 0xf6}, {&(0x7f0000000280)="b6e07b691035a279a016f45ccf26b8222c35db0ca384b2dedc2d854a39cd784f546ec47554172f49e4757bc3bb6a3edb4a9f6090735089def256a8", 0x3b}, {&(0x7f00000002c0)="c829f654435c208d5c8f48579bd7543297d6abce75f2a24534fabdcf92a921b425328c8fe0104c2eea6bb9be955e59b39460de85df6877a85c2bcb", 0x3b}], 0x4, 0xf) [ 589.712308][ T3783] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 589.720031][T22991] dlm: Unknown command passed to DLM device : 3 [ 589.720031][T22991] 22:09:28 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x301043, 0x0) 22:09:28 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) ioctl$KVM_GET_XCRS(r0, 0x8188aea6, &(0x7f00000000c0)={0x5, 0x58d9, [{0x9, 0x0, 0x6}, {0x9c3a, 0x0, 0x1}, {0x7, 0x0, 0x100000000}, {0x100, 0x0, 0x10001}, {0x5, 0x0, 0x1ff}]}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="06000000000000000000d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66817b2d8ef669eb39b4667c5e7bef3000000000000000000000021000000000000000000000eeb2f3153a9739bb986bcdebce5bb24d14e02e5505485492d3fab7187337a4ced397479a60f9f022e9e129b2a4c00d729d2ffb5dfddec54e782e4853cb0d42adb37286b3a85282c579802d52125b32e5485"], 0x68) [ 589.759690][T22996] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 589.762479][T22998] dlm: no locking on control device [ 589.834988][T23010] dlm: Unknown command passed to DLM device : 255 [ 589.834988][T23010] [ 589.838145][T23008] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 589.869462][T23008] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 589.890186][T22996] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 589.991552][ T3783] usb 5-1: Using ep0 maxpacket: 8 [ 590.121854][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 590.138222][ T3783] usb 5-1: config 0 has no interface number 0 [ 590.160460][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 590.180643][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 590.198707][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 590.210144][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 590.227086][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.248611][ T3783] usb 5-1: config 0 descriptor?? [ 590.272925][T22958] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 590.280207][T22958] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 590.516360][ T2469] usb 5-1: USB disconnect, device number 4 22:09:30 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x40000000) 22:09:30 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x23c, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:30 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xe00) 22:09:30 executing program 4: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x200000000000000, 0x0) 22:09:30 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:30 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000100)='tls\x00', 0x4) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000080)={0x0, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000000c0)=r3, 0x4) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r4, 0x0, 0x0) ioctl$KVM_X86_SETUP_MCE(r4, 0x4008ae9c, &(0x7f0000000140)={0x12, 0x1, 0xa7}) 22:09:30 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, &(0x7f00000000c0)=0x2) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0xc203e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:30 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xec0) 22:09:30 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x4441be, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 591.523423][T23080] dlm: no locking on control device 22:09:30 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xf00) 22:09:30 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000280), 0x12) gettid() r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$vcsu(&(0x7f0000000080)='/dev/vcsu#\x00', 0x7, 0x40000) ioctl$SG_GET_SG_TABLESIZE(r1, 0x227f, &(0x7f00000000c0)) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) openat$md(0xffffffffffffff9c, &(0x7f0000000100)='/dev/md0\x00', 0x128042, 0x0) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000140)={0x140, 0x384, 0x140, 0x800, 0x7fff, 0x7, 0x18, 0x2, {0x0, 0x2}, {0x200, 0x6}, {0x3fc6, 0x3}, {0x4, 0x800, 0x1}, 0x1, 0x10, 0x3, 0x0, 0x0, 0x9, 0x6, 0x6124bad5, 0x9, 0x5, 0x7, 0x232, 0x8, 0x0, 0x1, 0x6}) r3 = syz_open_dev$swradio(&(0x7f0000000200)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_CROPCAP(r3, 0xc02c563a, &(0x7f0000000240)={0x5, {0x3ff, 0x6, 0x4}, {0x1, 0x2ff4, 0x7, 0x8}, {0x7fff, 0x40}}) 22:09:30 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x1100) 22:09:31 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x60000000) 22:09:31 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r2, 0x10f, 0x84, &(0x7f00000002c0), &(0x7f0000000300)=0x4) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, 0x7, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x88}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x32}]}]}, 0x34}}, 0x40000) read$usbfs(r3, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(r0, 0x111, 0x1, 0x8000, 0x4) sendmsg$NL80211_CMD_GET_STATION(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x14, r5, 0xf2b, 0x70bd25, 0x0, {0x67}}, 0x14}}, 0x0) sendmsg$NL80211_CMD_GET_REG(r3, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f0000000540)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="000325bd7000ffdbdf251f08000005009200fb0000000600d3006200000044000000000000000fff00002f142733cc51cbe0088049d702efff030000000400cc000808b1a8456972e226ec9f3d1da22b165f2ff7c88678972af2e13b2701fbe35c601e4d15cd2b9de7cdfe9d29b4c1c8735f3cc7a44446cf3eb3d27be63102d02ecaa16a7cd6e840ce33fc52169280c449b760014b406fc43c6d6dee602a99963f4f3baad9391b1e5c135ddf67f57e00399a723bfe273073a8ffbd1d513767323ebe7cc8f45004be6a22066c03fb9e62d8d143683f79c033bbaaeefbe97a4f4bd6fc23f6bca8b3a599a846db5423428ecea00c7693e5b5c9e4eab54737031208bc1407fcb017f5d91b7f4c60e59414586d74255a8329cd60fee5261d45e8ef91f7664f6832417f28851e077a7b73240a0b2334857c51264494fd1a422aaaaaf7e2b7e498289b9c24580fc221e056104f0749cc1f1edef22624eda048fe993f74239fb07bee824d059b0f8a1b201fde599418a1a7921279ca7b08a4c538c7c554657be2ce9db65f130fb2c3a1ff4ed84b3287199cc30960b06218f478818db4a575f681465196313c6152d116d2"], 0x48}, 0x1, 0x0, 0x0, 0x4040840}, 0x20004090) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x24, 0x0, &(0x7f00000000c0)=[@dead_binder_done, @acquire, @dead_binder_done, @register_looper], 0x5f, 0x0, &(0x7f0000000100)="357147c20b575560f852f9f25d177ccdc17b4242f636eda3876a89c6a40ebf92fc62f00754149f2f6926c0b3f35dd50d46fb63231f90d089c00376af48093844d50c5a0dcb3e386829bb2d5f435b2b861678d172f1e9a700ce4b3429d008e8"}) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r6, &(0x7f0000000040)=ANY=[@ANYBLOB="0600000000000000000000000100000083ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884030061b3927917b2d8ef665a00009f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"], 0x68) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f00000001c0)=""/172, &(0x7f0000000280)=0xac) 22:09:31 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x1200) [ 592.443864][T23145] dlm: no locking on control device [ 592.575738][T23145] dlm: no locking on control device 22:09:33 executing program 4 (fault-call:4 fault-nth:0): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:33 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = getpid() wait4(r2, 0x0, 0x2, &(0x7f0000000080)) 22:09:33 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x1206) 22:09:33 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, &(0x7f0000000040)={0x3, 0x0, 0x1ff}) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="060000000000000000000000ada1f543025669ef6bc5aada9601000002a3ef07749fa55f62dbadff7f9d5e8209a7ba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2fbef665ad9b19f55dd7d020800b9f114"], 0x68) 22:09:33 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:33 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x800e0000) 22:09:33 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f00000000c0)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2bcef665ad9b19f55dd00000000000000008e9eb39b465c24e7bef3"}, 0x68) [ 594.357769][T23170] dlm: Unknown command passed to DLM device : 173 [ 594.357769][T23170] 22:09:33 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000180)=0x8, 0x4) write$nbd(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978bb13bedfb1f8cd563af87b5d40ef47bb5158128809778e2f82a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a5059745a27235b8ed6f7724232a8b500000000008c17c5eabb0b743905ef5e468b82e7c51e062e8842c265cfa05d1093aa4dd56509e1bca8deb61a89adddefc7b5843650b9ccf2db07d6ef148268c180a71015e068ec7e4fd00369db4ae34f029616e934cc0cf6def2879cc77582d8013036075182a782456fbdfa8e57cca670ca89472bf60cec7375ffda037098250d63d4e1f999388e8d7955ee298b5009b020eead4e4ca7505dd2753248870600237456d950500575b3c545a4b659eb3969152be1aa721bc95021cb379c79100431456bdb5d5837b408e88597a29ec0f7611fbfb91dcc3b6745986f9dfceb34e57a451063ce70d1fedb6677991cf91905979e0ff0145fffe68b"], 0x68) r1 = open(&(0x7f0000000040)='./file0\x00', 0x200, 0xa9) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x7, 0x1, 0x401, 0x0, 0x0, {0x7, 0x0, 0x6}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x4000040) 22:09:33 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x1300) [ 594.441571][T23195] dlm: no locking on control device [ 594.516938][T23206] dlm: no locking on control device [ 594.528612][T23209] __nla_validate_parse: 38 callbacks suppressed [ 594.528621][T23209] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 594.540021][T23206] dlm: no locking on control device 22:09:33 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x2c) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) setpgid(r0, r1) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:33 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) ioctl$USBDEVFS_REAPURB(r0, 0x4008550c, &(0x7f00000000c0)) [ 594.563153][T23209] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 594.573655][T23209] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 594.594735][T23209] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:33 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) keyctl$get_persistent(0x5, r2, 0x0) fsetxattr$security_capability(r0, &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000100)=@v3={0x3000000, [{0x2, 0x3ff}, {0x9, 0x4}], r2}, 0x18, 0x3) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 594.618895][T23218] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 594.637245][T23218] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 594.643378][T23221] ptrace attach of "/root/syz-executor.2"[23219] was attempted by "/root/syz-executor.2"[23221] [ 594.655450][T23223] dlm: no locking on control device [ 594.681192][ T17] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 594.734982][T23231] dlm: no locking on control device [ 594.749404][T23234] dlm: no locking on control device [ 594.941040][ T17] usb 5-1: Using ep0 maxpacket: 8 [ 595.061177][ T17] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 595.069291][ T17] usb 5-1: config 0 has no interface number 0 [ 595.076773][ T17] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 595.088703][ T17] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 595.099375][ T17] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 595.109962][ T17] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 595.119722][ T17] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 595.130883][ T17] usb 5-1: config 0 descriptor?? [ 595.152438][T23175] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 595.168630][T23175] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 595.422668][T23175] FAULT_INJECTION: forcing a failure. [ 595.422668][T23175] name failslab, interval 1, probability 0, space 0, times 0 [ 595.485191][T23175] CPU: 1 PID: 23175 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 595.493549][T23175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 595.503606][T23175] Call Trace: [ 595.506910][T23175] dump_stack+0x188/0x20d [ 595.511246][T23175] should_fail.cold+0x5/0xa [ 595.515751][T23175] ? lock_downgrade+0x840/0x840 [ 595.520712][T23175] ? fault_create_debugfs_attr+0x140/0x140 [ 595.526516][T23175] should_failslab+0x5/0xf [ 595.530926][T23175] kmem_cache_alloc+0x29b/0x740 [ 595.535852][T23175] ? ksys_write+0x212/0x250 [ 595.540356][T23175] getname_flags+0xd2/0x5b0 [ 595.544858][T23175] do_sys_openat2+0x3fc/0x7d0 [ 595.549542][T23175] ? file_open_root+0x400/0x400 [ 595.554418][T23175] ? __mutex_unlock_slowpath+0xe2/0x660 [ 595.559977][T23175] ? wait_for_completion+0x270/0x270 [ 595.565266][T23175] ? __this_cpu_preempt_check+0x28/0x190 [ 595.570902][T23175] ? __sb_end_write+0x101/0x1d0 [ 595.575752][T23175] do_sys_open+0xc3/0x140 [ 595.580077][T23175] ? filp_open+0x70/0x70 [ 595.584316][T23175] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 595.590303][T23175] ? do_syscall_64+0x21/0x7d0 [ 595.594982][T23175] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 595.600990][T23175] do_syscall_64+0xf6/0x7d0 [ 595.605505][T23175] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 595.611395][T23175] RIP: 0033:0x45ca59 [ 595.615293][T23175] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 595.634898][T23175] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 595.643326][T23175] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 595.651303][T23175] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 595.659273][T23175] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 595.667357][T23175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 595.675339][T23175] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 595.755634][ T17] usb 5-1: USB disconnect, device number 5 22:09:34 executing program 4 (fault-call:4 fault-nth:1): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:34 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x2000) 22:09:34 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000000c0)=0x0) fcntl$setown(r1, 0x8, r3) tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x1}, r0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r5, 0x0, 0x0) setsockopt$inet_udp_encap(r5, 0x11, 0x64, &(0x7f0000000080)=0x1, 0x4) prctl$PR_GET_THP_DISABLE(0x2a) tkill(r4, 0x4) ptrace$setopts(0x4206, r4, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:34 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x24c4bf, 0x0) prctl$PR_GET_CHILD_SUBREAPER(0x25) write$nbd(r0, &(0x7f0000000100)={0x6000000, 0x0, 0x0, 0x0, 0x4, "a3ef07d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef30b0ef5826e292eaebc0d8b1526208ce4190fd9dcd845cb6fa2eddaa8bc950a6d747338397a7622b6c73f8eace0ebb9f28520587558e72d4392105358fe15c20a8d698c1915f0c00df2ddf796bb6ed41d7413398b1ab935bd0c13554c99fee62d4c8928"}, 0xc6) 22:09:34 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:34 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x89ffffff) 22:09:35 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) unshare(0x24020400) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000180)=0x10) r3 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x10, &(0x7f0000000000)={r4}, 0xc) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r5, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917cdd8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3d9f5bc7081c1e966f1441f99e4c84b506c1aa64d7fd53f1363f4d5a0ce4bd6751b1e5c3e13db4ef32f087bb1ebef4d59991321a284db"], 0x68) [ 596.316743][T23284] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:35 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55762d3adff7f9d5e82099cba335a2fdbede515d1851961000000a9f6449fe66884b33c61b39279ffb2d8ef665ad9a39f55dd7d020a724232a8b58e9eb39b4667c5e700f30000000000000000"], 0x68) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(0xffffffffffffffff, 0x28, 0x1, &(0x7f00000000c0)=0x4, 0x8) [ 596.393563][T23284] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 596.403883][T23284] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 596.420394][T23284] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:35 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x3f00) 22:09:35 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x1, 0xffffffffffffffff, 0x3) tkill(r1, 0x4) ioctl$TIOCGICOUNT(0xffffffffffffffff, 0x545d, 0x0) r2 = gettid() r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) getsockopt$XDP_STATISTICS(r3, 0x11b, 0x7, &(0x7f00000000c0), &(0x7f0000000100)=0x18) ptrace$setopts(0x4206, r2, 0x0, 0x0) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/current\x00', 0x2, 0x0) tkill(r2, 0x2c) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x1, 0x1000a2) wait4(0x0, 0x0, 0x0, 0x0) 22:09:35 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x4, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 596.511829][T23315] dlm: no locking on control device 22:09:35 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000180)=ANY=[@ANYRES16=r0], 0x68) [ 596.554590][T23323] dlm: no locking on control device [ 596.651308][ T3784] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 596.900958][ T3784] usb 5-1: Using ep0 maxpacket: 8 [ 597.020998][ T3784] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 597.029293][ T3784] usb 5-1: config 0 has no interface number 0 [ 597.037745][ T3784] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 597.049645][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 597.060437][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 597.071223][ T3784] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 597.080267][ T3784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 597.094036][ T3784] usb 5-1: config 0 descriptor?? [ 597.112275][T23292] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 597.119591][T23292] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 597.363464][T23292] FAULT_INJECTION: forcing a failure. [ 597.363464][T23292] name failslab, interval 1, probability 0, space 0, times 0 [ 597.395807][T23292] CPU: 0 PID: 23292 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 597.404152][T23292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 597.414200][T23292] Call Trace: [ 597.417499][T23292] dump_stack+0x188/0x20d [ 597.421851][T23292] should_fail.cold+0x5/0xa [ 597.426351][T23292] ? lock_downgrade+0x840/0x840 [ 597.431194][T23292] ? fault_create_debugfs_attr+0x140/0x140 [ 597.436999][T23292] should_failslab+0x5/0xf [ 597.441423][T23292] kmem_cache_alloc+0x29b/0x740 [ 597.446281][T23292] ? mark_lock+0x11f/0xdd0 [ 597.450706][T23292] ? print_usage_bug+0x240/0x240 [ 597.455647][T23292] ? stack_trace_consume_entry+0x160/0x160 [ 597.461602][T23292] __alloc_file+0x21/0x350 [ 597.466039][T23292] alloc_empty_file+0x6d/0x170 [ 597.470804][T23292] path_openat+0xe3/0x27d0 [ 597.475252][T23292] ? path_lookupat.isra.0+0x530/0x530 [ 597.480623][T23292] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 597.486617][T23292] do_filp_open+0x192/0x260 [ 597.491126][T23292] ? may_open_dev+0xf0/0xf0 [ 597.495644][T23292] ? __alloc_fd+0x46d/0x600 [ 597.500513][T23292] ? lock_downgrade+0x840/0x840 [ 597.505372][T23292] ? do_raw_spin_lock+0x129/0x2e0 [ 597.510416][T23292] ? _raw_spin_unlock+0x24/0x40 [ 597.515268][T23292] ? __alloc_fd+0x46d/0x600 [ 597.519790][T23292] do_sys_openat2+0x585/0x7d0 [ 597.524493][T23292] ? file_open_root+0x400/0x400 [ 597.529354][T23292] ? __mutex_unlock_slowpath+0xe2/0x660 [ 597.534919][T23292] ? wait_for_completion+0x270/0x270 [ 597.540301][T23292] ? __this_cpu_preempt_check+0x28/0x190 [ 597.545944][T23292] ? __sb_end_write+0x101/0x1d0 [ 597.550777][T23292] do_sys_open+0xc3/0x140 [ 597.555090][T23292] ? filp_open+0x70/0x70 [ 597.559315][T23292] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 597.565273][T23292] ? do_syscall_64+0x21/0x7d0 [ 597.570026][T23292] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 597.575986][T23292] do_syscall_64+0xf6/0x7d0 [ 597.580480][T23292] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 597.587129][T23292] RIP: 0033:0x45ca59 [ 597.591002][T23292] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 597.610587][T23292] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 597.618975][T23292] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 597.626921][T23292] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 597.634879][T23292] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 597.642835][T23292] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 597.650804][T23292] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 597.679548][T10916] usb 5-1: USB disconnect, device number 6 22:09:36 executing program 4 (fault-call:4 fault-nth:2): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:36 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x11103f, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) write$nbd(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978bc7ba59f2bcb13bedfb1f8cd563af404c7b978aa7f31d08208ff5d069872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4608000000f336167dda4d341a138c2d51f5611731f27d97c9145a8ed7f86ce124b01800e5ec446cdb5cf4a845d2b265cef815241fcfb6a0994d14924fdac127ba6f1f97e698c932947cbb2c686d94f5bf1deb9a196e5155ffc882e26e237a5f3bc7f8e95ce78b197120df22dc1bb1e1936dd431928ddd9d702b6709326df6ce7db2b3c4bfb80035ae6ff97f172cca04b6ebc590092647967fd6d48c1459f76098aaab128202494a96f9ba9f40f20000000000000000000000009d97c3ef36daed4e8d98e0a7b8fd767603d42713eb305d1ba4843096b4bda843b295d682904dd687089e6d35f28133f9f0e1f76447aa54cb4be0f6278c0b"], 0x11e) r2 = open(&(0x7f0000000040)='./file0\x00', 0x10180, 0x100) ioctl$FS_IOC_ENABLE_VERITY(r2, 0x40806685, &(0x7f0000000340)={0x1, 0x2, 0x1000, 0x4e, &(0x7f0000000240)="0f7caff6be0fb177eac7b66d6495ea163fccb6dbab882694052870aa62be7bdce92303b005868d6f4aa80c7403ac157a83ee9a14d4816ad38dcfd02e6cd173e9b247d31603546ddb5acf3eaabd32", 0x5a, 0x0, &(0x7f00000002c0)="408216921df6489e507f0bff4627dd6feead3d8b21c73be1bc380818a379975f5f054c943a25429ee3f52a1bcc7d3fc99b3733a592c4fbc2ad39957014526007223441a95f1d6d00d9f3eafa2a9eb6f62a41c218e4095a4f11af"}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0xa6) 22:09:36 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x4800) 22:09:36 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1, 0x20100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x2400, 0x1000000000000000}, r0, 0x7, r2, 0xb) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:36 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xea0f0000) 22:09:36 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:36 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nvram\x00', 0x2080, 0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x80001d00c0d0) r3 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0xb4, r3, 0x2, 0x0, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x22, 0x8}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1a}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x17, 0x1}}, @IPVS_SVC_ATTR_FLAGS={0xc}]}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x8001}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syzkaller1\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000014}, 0x4080) sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x90, r3, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x311}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x67}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'tunl0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x6}]}]}, 0x90}}, 0x80) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d0206724232a8b58e9eb39b4667c5e7bef3"], 0x68) 22:09:37 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000080)={'filter\x00', 0x4}, 0x68) 22:09:37 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x4c00) 22:09:37 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x1f, 0x480001) openat$autofs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/autofs\x00', 0x200, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, r2, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x810}, 0x4000804) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:37 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) readahead(r0, 0x5, 0x7fff) [ 598.447676][T23426] dlm: no locking on control device 22:09:37 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x5865) [ 598.517957][T23439] dlm: no locking on control device [ 598.590772][ T3783] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 598.830722][ T3783] usb 5-1: Using ep0 maxpacket: 8 [ 598.951411][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 598.959639][ T3783] usb 5-1: config 0 has no interface number 0 [ 598.967571][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 598.980797][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 598.992235][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 599.003322][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 599.015076][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 599.025612][ T3783] usb 5-1: config 0 descriptor?? [ 599.052977][T23401] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 599.060406][T23401] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 599.295510][T23401] FAULT_INJECTION: forcing a failure. [ 599.295510][T23401] name failslab, interval 1, probability 0, space 0, times 0 [ 599.326536][T23401] CPU: 0 PID: 23401 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 599.334892][T23401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 599.344949][T23401] Call Trace: [ 599.348247][T23401] dump_stack+0x188/0x20d [ 599.352680][T23401] should_fail.cold+0x5/0xa [ 599.357194][T23401] ? lock_downgrade+0x840/0x840 [ 599.362056][T23401] ? fault_create_debugfs_attr+0x140/0x140 [ 599.367877][T23401] should_failslab+0x5/0xf [ 599.372400][T23401] kmem_cache_alloc+0x29b/0x740 [ 599.377260][T23401] ? mark_lock+0x11f/0xdd0 [ 599.381681][T23401] ? print_usage_bug+0x240/0x240 [ 599.386622][T23401] ? stack_trace_consume_entry+0x160/0x160 [ 599.392436][T23401] __alloc_file+0x21/0x350 [ 599.396856][T23401] alloc_empty_file+0x6d/0x170 [ 599.401630][T23401] path_openat+0xe3/0x27d0 [ 599.406063][T23401] ? path_lookupat.isra.0+0x530/0x530 [ 599.411458][T23401] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 599.417448][T23401] ? lock_acquire+0x1f2/0x8f0 [ 599.422138][T23401] do_filp_open+0x192/0x260 [ 599.426650][T23401] ? may_open_dev+0xf0/0xf0 [ 599.431173][T23401] ? __alloc_fd+0x46d/0x600 [ 599.435685][T23401] ? lock_downgrade+0x840/0x840 [ 599.440562][T23401] ? do_raw_spin_lock+0x129/0x2e0 [ 599.445619][T23401] ? _raw_spin_unlock+0x24/0x40 [ 599.450477][T23401] ? __alloc_fd+0x46d/0x600 [ 599.454994][T23401] do_sys_openat2+0x585/0x7d0 [ 599.459677][T23401] ? file_open_root+0x400/0x400 [ 599.464539][T23401] ? __mutex_unlock_slowpath+0xe2/0x660 [ 599.470100][T23401] ? wait_for_completion+0x270/0x270 [ 599.475387][T23401] ? __this_cpu_preempt_check+0x28/0x190 [ 599.481024][T23401] ? __sb_end_write+0x101/0x1d0 [ 599.485888][T23401] do_sys_open+0xc3/0x140 [ 599.490223][T23401] ? filp_open+0x70/0x70 [ 599.494471][T23401] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 599.500446][T23401] ? do_syscall_64+0x21/0x7d0 [ 599.505106][T23401] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 599.511083][T23401] do_syscall_64+0xf6/0x7d0 [ 599.515571][T23401] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 599.521437][T23401] RIP: 0033:0x45ca59 [ 599.525312][T23401] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 599.544934][T23401] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 599.553336][T23401] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 599.561292][T23401] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 599.569249][T23401] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 599.577210][T23401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 599.585157][T23401] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 599.607119][ T3784] usb 5-1: USB disconnect, device number 7 22:09:38 executing program 4 (fault-call:4 fault-nth:3): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:38 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) write$FUSE_WRITE(r1, &(0x7f00000000c0)={0x18, 0xfffffffffffffffe, 0x6, {0x100}}, 0x18) 22:09:38 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6000) 22:09:38 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcddd}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:38 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xee0f0000) 22:09:38 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d718100000008"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:38 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) ioctl$VIDIOC_ENUM_FREQ_BANDS(r0, 0xc0405665, &(0x7f00000000c0)={0x5, 0x0, 0x8, 0x192, 0x3, 0x0, 0x6}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r1, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 600.176070][T23505] __nla_validate_parse: 21 callbacks suppressed [ 600.176079][T23505] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 600.206184][T23506] dlm: no locking on control device [ 600.251314][T23515] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 600.273273][T23515] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 600.277803][T23523] dlm: no locking on control device [ 600.295105][T23505] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:39 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f00000000c0)={r4, 0x8}, 0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={r4, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) [ 600.328279][T23529] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:39 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280)='/dev/input/mice\x00', 0x18401) write$nbd(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="6744669800000000000000000100000003f777ee11ea0ed97fd40e2f88667982f4bc72b882e33fb0b37b073b598562234f166c91b80af343436a85212edc72674b417fda27aba0a5ce166d49bad152a968c0f110c2586e0d08b5c402bd3eaf1468f3b7b4f8f275d31a45da1e7547a03f93280179b566b68d96bfab81bc241af0750ca739cc3dcbdd4f8c5320e01f6a7b3633efbb7e12b3b912d832d9998d4f94432df95b8419e1fc488fc8a2fa3b8bcb00042c3137e06014f99a67d3fb8498290383a988ef501d0a0fde2d90f8cf728c0c6b5cbe53bd47f540c005328e46b53630eef4ac064854052107762bc09306f6ea9494"], 0xf3) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0) close(r2) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000080)={0x1, 0x10, 0xfa00, {&(0x7f0000000040), r4}}, 0x18) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) close(r5) r6 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)="5500000018007f5f00fe01b2a4a290930206040000000001020006003900090035000c020b00000019000b4023dc0b00000022dc1338d54404009b84136ef75afb83de4411000500c43ab8220000060ced4f7826de", 0x55}], 0x1}, 0x0) sendmmsg$alg(r6, &(0x7f0000000180)=[{0x2, 0x1000000000000, &(0x7f0000000080), 0x0, &(0x7f0000000100)}], 0x464eb69030a5456, 0x0) r9 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000002c0), 0x2}}, 0x20) 22:09:39 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6558) [ 600.371925][T23529] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:39 executing program 5: openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x1, 0x0) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad97d020a724232a8b58e9eb39b5667c5e7bef300000000"], 0x68) [ 600.463903][ T2469] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 600.477523][T23545] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:39 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x24081, 0x0) ioctl$SNDCTL_DSP_GETFMTS(r1, 0x8004500b, &(0x7f00000000c0)=0xfc) tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000100)={r1, 0x3, 0x76e, "5b84936266a0a585c57cd11fcdde42c92fc3c6a39c2201f3b9f99e05315689cfb29ea927efa853055dfea52ce645be81a235fb07945a34ff937120af62239b"}) [ 600.519722][T23545] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 600.531546][T23545] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 600.554538][T23551] dlm: no locking on control device [ 600.561529][T23545] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 600.730985][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 600.850631][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 600.858785][ T2469] usb 5-1: config 0 has no interface number 0 [ 600.866472][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 600.878562][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 600.889289][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 600.899937][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 600.909870][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 600.923415][ T2469] usb 5-1: config 0 descriptor?? [ 600.942540][T23503] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 600.971670][T23503] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 601.187677][T23503] FAULT_INJECTION: forcing a failure. [ 601.187677][T23503] name failslab, interval 1, probability 0, space 0, times 0 [ 601.220457][T23503] CPU: 1 PID: 23503 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 601.228808][T23503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 601.238865][T23503] Call Trace: [ 601.242171][T23503] dump_stack+0x188/0x20d [ 601.246521][T23503] should_fail.cold+0x5/0xa [ 601.251033][T23503] ? lock_downgrade+0x840/0x840 [ 601.255892][T23503] ? fault_create_debugfs_attr+0x140/0x140 [ 601.261718][T23503] should_failslab+0x5/0xf [ 601.266141][T23503] kmem_cache_alloc+0x29b/0x740 [ 601.270998][T23503] ? kmem_cache_alloc+0x358/0x740 [ 601.276023][T23503] ? mark_lock+0x11f/0xdd0 [ 601.280456][T23503] security_file_alloc+0x34/0x160 [ 601.285485][T23503] __alloc_file+0xd8/0x350 [ 601.289904][T23503] alloc_empty_file+0x6d/0x170 [ 601.294672][T23503] path_openat+0xe3/0x27d0 [ 601.299107][T23503] ? path_lookupat.isra.0+0x530/0x530 [ 601.304490][T23503] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 601.310473][T23503] ? lock_acquire+0x1f2/0x8f0 [ 601.315161][T23503] do_filp_open+0x192/0x260 [ 601.319667][T23503] ? may_open_dev+0xf0/0xf0 [ 601.324171][T23503] ? __alloc_fd+0x46d/0x600 [ 601.328681][T23503] ? lock_downgrade+0x840/0x840 [ 601.333534][T23503] ? do_raw_spin_lock+0x129/0x2e0 [ 601.338572][T23503] ? _raw_spin_unlock+0x24/0x40 [ 601.343429][T23503] ? __alloc_fd+0x46d/0x600 [ 601.347942][T23503] do_sys_openat2+0x585/0x7d0 [ 601.352631][T23503] ? file_open_root+0x400/0x400 [ 601.357484][T23503] ? __mutex_unlock_slowpath+0xe2/0x660 [ 601.363036][T23503] ? wait_for_completion+0x270/0x270 [ 601.368320][T23503] ? __this_cpu_preempt_check+0x28/0x190 [ 601.373956][T23503] ? __sb_end_write+0x101/0x1d0 [ 601.378811][T23503] do_sys_open+0xc3/0x140 [ 601.383141][T23503] ? filp_open+0x70/0x70 [ 601.387375][T23503] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 601.393348][T23503] ? do_syscall_64+0x21/0x7d0 [ 601.398028][T23503] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 601.404003][T23503] do_syscall_64+0xf6/0x7d0 [ 601.408487][T23503] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 601.414363][T23503] RIP: 0033:0x45ca59 [ 601.418268][T23503] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 601.437866][T23503] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 601.446276][T23503] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 601.454238][T23503] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 601.462209][T23503] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 601.470160][T23503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 601.478130][T23503] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 601.502363][ T3783] usb 5-1: USB disconnect, device number 8 22:09:40 executing program 4 (fault-call:4 fault-nth:4): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:40 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) ioctl$RTC_UIE_OFF(r0, 0x7004) set_tid_address(&(0x7f00000000c0)) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-control\x00', 0x226243, 0x0) write$nbd(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef09009fa55f62d3adff7f9d5e82099cba335a2fdbffffffff978b97ba59f2bcb13bedfb1f8cd563af872a0a185a3b1089f1a10670fc8eecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8cc8e9eb39b4667c5e7bef3"], 0x68) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) getsockopt$inet6_tcp_int(r2, 0x6, 0x22, &(0x7f0000000000), &(0x7f00000001c0)=0x4) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000040)={0x0, 0x204, 0x3ff, 0xf309}, 0x10) 22:09:40 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6800) 22:09:40 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4102, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x108}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$IP_VS_SO_GET_VERSION(r2, 0x0, 0x480, &(0x7f0000000080), &(0x7f00000000c0)=0x40) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:40 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xffffff7f) 22:09:40 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d718100000008"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:40 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) ioctl$VFIO_SET_IOMMU(r0, 0x3b66, 0x1) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="0682ac819d0c5eb11cf0fce4000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcc73bedfb1f8cd563af872a0a18ecf6449fe66884b33c6132289d1aa7435fb3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef330385c3589f3197c9cb39e577bc6753e11c2486132b386f12e9cbbe842087d5bf3a7dff581645ab1e1611711f1f41ed893240044ff4158ca0265733133691a0606ff319a"], 0x68) r2 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x2, 0x40) ioctl$HIDIOCGVERSION(r2, 0x80044801, &(0x7f0000000100)) r3 = socket$netlink(0x10, 0x3, 0x7) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r4, 0x0, 0x0) dup3(r3, r4, 0x80000) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r5, 0x0, 0x0) openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.controllers\x00', 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r3, &(0x7f0000001800)={&(0x7f0000001740)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000017c0)={&(0x7f0000001780)={0x20, 0x1411, 0x10, 0x70bd2a, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x5}]}, 0x20}, 0x1, 0x0, 0x0, 0x20015}, 0x40019) 22:09:40 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6c00) 22:09:40 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) r2 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$setperm(0x5, r2, 0x0) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000001200)) r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$setperm(0x5, r3, 0x0) keyctl$reject(0x13, r2, 0x3, 0x0, r3) setsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000000040)=0x5, 0x4) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r4, 0x0, 0x0) ioctl$VT_ACTIVATE(r4, 0x5606, 0x8) write$nbd(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7fa2fa74345cf899fd779d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"], 0x68) r5 = msgget$private(0x0, 0x0) msgctl$MSG_STAT_ANY(r5, 0xd, &(0x7f0000000180)=""/4096) msgctl$IPC_STAT(r5, 0x2, &(0x7f0000001300)=""/253) setxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='trusted.overlay.upper\x00', &(0x7f00000001c0)={0x0, 0xfb, 0x1015, 0x6, 0x9, "81b4cc06cc66adadbca7d34dfea4d5fa", "d22199e113c0d9639a1cc78d439f59442a3ba0e297878ed00eb224c6aa9b27421015b629996040cf212347251b7708cd0d9ae28a779044a6d7b8fde5d2cfa5d7814c086e9918a29cb6037130999136e1b4a94a22f4e9747270060069209e647c4782c02f380dd21836a0b8ceb0583094bffa599ff14680c825542c86cba15b3b73c4c836da565e45833ca6af469a52ef99f3940dda5ef121aaec2a6cbe14cca2edbd68a4806a4c9589e0f17e0df684901cb6ba571a8bfb2c1af810b2d387c1f3009ed1dc2f42dfbf625143b7fce64f7daefa805c1828542e78ff3f2653915f2efd43f1eb6c448b1df334b12fd27dedac1207c8b7f753ef3c8c100ccc667d097114ccd1b5d1e78f70ed59d9fb8cce079e323d404d6797d82f2df92fef827a3cf4d1213a099d3dca9f8ef5b73236e717e5cf846092b4e59ca67858c181c065612e35b007c5b9901c2bd2d774c00b79eddd9a6a2cf25c940a1396651ac0a451959f5ef57d7e8e5620ed9e5cb51c0350b32507594ade6c64dbee482083ec4f148f3fe24ad823a22cb55fadced6652aafb0de8deb353eadfa539ec9a398eed24fcd1cfd94acf4362b37baa26c0e1acde712e324fb8282e908fd4ec09997d51e5a2d1517c9fe039cda7eb1dcab7f62217bf79bbc7f5aa99754403ac0e7b7c82318cb50db0d283211c1b39a69331521f9c86b09e4de2f9ba1fdb016489bad7bef2f949cb02750368d15caf45f39c6f6c536d2fde35e1c6eeb510fc0e8e5739226d1e01d2f908c6cffe579460d980b16c3bd575a189d6cd2ae892b5fcd3cd455ec970d78b4ada196d79ec9be370144e21e421a2d340117b5727637ef78d07c4abbbe20c0ff334c40b236f8a52f5ef35d5ffe96c0dbfed814051d272ea0c32260b72b92c43bbe83e33fad33fd1290459f6457e19cd9c4d44fb3e7d38c18abb3a934cf87312b965acf574f960aa13ad43180093081c647b6a1deaa9da7c0a3d52eb831645966e42bba90bc2133ef7867482e4eefed0f7169f0491ca3a40509314a037cb66b6085b63400f599c3776697fe6376086543701b039003e25e8693a0d435c56b58c64d83b005ee923af73919ba7273c0b1536b7e6ac28942e4ed6fec9a7e872ad39bb53a4cb1cb1171122c9d6f78754e8e17b0eca4955414f2454cbe5fa722eb549e0988d8173aa71e947f6ba7d3da4420807c6599eac7da56cf43cdab6027b42ef905b6e89c02e6244951cb0819c25c52fd3f81b3d88b65269f5e4d76d89cf267e116087552d0bdb62457f55947ce1161489b5137c9db53ab55d3110605c586164de18a8ddfcf12a5648d6bbe2222ac219b5888b66462622d70bbfa788215a88f7744c545f7fe983c0376bfd97e6c566cb2b0c3971e6caa6a537265b65dbe8dd137e8940b1dfe7c5172dc6e5cfab35b435696c4632f539362670f55694d309305faef64512ec7bd85ca95ae6dbc47a98f5349cf6cb9033d52d38f0f3715a089d77b516e1b45413a1f906dd20d167523e753f65fd1a0f106d159caf4c18844c52a9c40e2fe6649ee7d265a6db827132bd033cda52ad5c850efba41fb5bd66877f447d1b3f2aeb4bc3a90963a93e13225978c1674a239abc3cf0abce3f1daf9e08ce28aac809952d172beab7510342ff70a044ee8b6ff7e308bf2f8ade2f15547c60fea3229d5939a8aac99b630481ff3ba176496fd0317bf8a75e1d7267d42e2ab54e7983bec5c07918b63185a7618d5848e5058cb631f2d38ff26d676051130922a359402455169bdfa9912c90e3e5b66960c3848f3f08b94fc2585a32b82e586dab0661bb2c55e359d3b40d5727eb2594db19143fccb6e7e29a0c3669f20a00f747f036028db362ccb3bd73d85048e9948e442b737e9e54029c1b8d689cde1846c092a5fc73ab47e38f0c8583791aa099ab743730149a77510c62fa27e936cf21db67eaa1868034729d3fc6ecf9619ca60c63c767bf098aaa97c30b91a0b06c04cc663256e4a1dd5fba82c5c662888f73dcf2e42d4ad4417bf7d0a1d321f8495148d2600f0a69cc40a5da080bd3575c74274831cf0b0e96ace7a451757fd4eecc0ce4c32ffea3c08dc41eaf1e9d995e0ebd69b71c65283a6f0d8daf1f6697fb79a96c5ab9b20d55190f47f1e441773792d7b6d5dde98fdbe910ca0178f9455a848219a18170595f02268e4a8c5d8a380de6267ca7d14f3cef198b3c3eb1b0e2a9d13f68842950772f4e87942d3f58c53c0381722ccd3458a9f30f234fb13d5c582dcf05fb6b43a581c981eb38ae511371a306c59b35a9d1c8d8e5a1688ca96a4f9ff09713abfce710abe34ebea2722c03bec2337ae56bbd6d7380b110e596e941ccee181b8b61028177c89472f3ef259b7ab980317751c779ff069b5a12c5324381fce948bc32a6a722d3532305ef0b862b9b7fcc84195570606b976e8342abd99f66732d0adea7900090e26497c94da03357186dec2b947c5c032c4ebc966786a985634c398c5415265e80f21ed738406834dc529ccabc74a3ed770738bdd83645fa443f07923aa58473ce937824f6d0cdf1e9e2fd7900bd1fa8f61eba884f868779d542785a67e320af22adbc19f9c7af6de59a86fcd0698cb5e7f540388b789543a5c7335904024b1fa017356796cd2ba25e34f4249367da23b4a356f6cebe8804c1f1f11903a57ce63cc943a24e3558a43053da93df811ce25d30c8b37973f3f4d4b12e4838612ae7591159cf2b6785e86196a9ef639eacf52131410c25e62e10b5f3eccf355676748a1464b36eedc7c93cfde32383b31a1d0b4c59c510d6fe064d064cc89bf2b0374880d02fe8a84d56ce323695794f531c22832503de1a1665be0d1fc97b4eff11c99ed73c1a34799da2be108af84bf5c821b2fa58288112c833e6bc690b625eabe94a6e95320f8e77c95f3d9e3f1259e5e94e6856f103c59121e886be06d4cbceb783b808870ce03e864a6ab2c97570dfbe9935b7939333fa17a7a7dc15efb18e9a396c77db532f7b118f471f4214cc4c98995c9ffc28d6cd23de9e4326b9e624a0123d9ef4b4d504bc93413e081d30b914fe8a264c1f64c13859a441b32e08b11f8c999def7cf5661191f576f22b705e371a4eb62749369be3dcda5f613d10883ddf82547dc8fcf3bbfbadbe881e3c27ed06cdcf030ede5eece8fada443fa668cbadce85c8cfa921812261fa260f7361482e17b961b596656249933916e107e79f16724a9f48c3a6a7355ed7337a459a6bec64098f9c3152e66ee0c7221b2f48fb3791f5ee541c9284c7f011d97bcdf61a7c8d1a7ec165f1a4c42de52e4fa33c4a8117a607245addff0e041b2a52d7f80d641a1f8f2092537acfd6cec7efd401c1cd707df7fbd8105cb4625450c9cd2885d2f744ae115d73aa291181b4d6989ad010be5370ba1ab0a021479f004652ec335a9a8d157c3eba4734edb92128bc6356d11883fdfb8d5a6bbf5684bb4fe3f0a65fc5150684c0ab2d54fb09893d4b10656c81e57342fb84c0d7f17dc74b60c53b84c6510305ddbef5bd04a154050478f120b90c046ba31ea2b77cda5b61120399845137f9bcc47de2af7a9a5b50f6dc82a1fd4310f79df7fc1c2906d7c3e63918d0129830cd69899a83f4942db9fedfaed0afc2e757656e50c982747a4c382a85450cb2ccdc6a5998c1808c0489a31676ea9c75b2cc183433db69a724716bd5cf6f84f5c02d9a18db1ed78f6a2964a196d4a02453f8be45018b4acf0abda805b4bc25a8ff1ac40bf7192d7dc6bf75b672f47839442c9926c2e7c750941ebc81d93877af67365b3c9926ef4e63dc051a6ffb63219a05bac504b1e7a72e91f86afc9c88ac2721f594f2039b6c647cce8e2a12d7a07835ffd22a74743d1e4579e3a9c1fc7e0e5a002f535f2b2837bd6010e76913cb05e80a9a5236fb1cce84be29677b57052b793ceb6857093ff854223180231240b4ff22e60fe8266cc5cbaf2df6c168149c578371d4d66b9a43e85c24089b2490613dc1257548328ca269d1dbe67c9fa2c1c5a642475b93d6a420a4f3d843dad572660deb8c0abbb69b87fafb449e940e2b59218a8dd71470883c68faec31ba243e93c4314e39e60b09bfc3d08dfaee2fc0855b94a3e2527cea3a06933d56a2040d1bad48d3e73b06e994a58032f00ef70aba2e3deaf0dce5a0474b0702e0ee7ed3c2145a4aad3219914bd4128e8a0ae2422c592584db70bf96f293ba387d1a7097ff3242596467fc3631954461115775b1c5a9aa0b4bf62913b6d059f458157d38290aa040aafe2b6e8a99a37b81e63947349251cf4fe01c357af814fa7fff54f0a8c398aabedbb47fdc44d881554828d5759a403afae1afaa10ec148a78b6eb5787ec5459d65422d5a4bd87a8defc37963efcb6e289f99681b6d2c30caf78a41e74d458f9c425ef37c6243e88398bd49246d3f09af695171782547dad31d1b4f5c9411da6b6ddec447e7571db0ec9faf1a81d6ec532ce13c4f88f62a13dcdc57735f3bc6e3656dcb912549be84a096ee06775361a64734f808cab2c6acf65b1b322fe5219549801670c2d0a7697d6aeac6ddaff69123cac3305ed6ae73eae6eeb00715ab0cfaa8b7d3ef848665e16198b5bfb395b76d23eababf81838d95aaba24aec6c91c2ac8a47d038b9826c078ca38355a3d72fe9620773a4f99edea3704ef1f9a703a6f70eae3de5e4b1832c1686e64dc5ac362b40214e6a7eeb58f5b05ed557c4b4af380ff513f485d686e6c53567a74fb374fe8be045c594e0cc99f22fa0c94eeddd96b82b4fd03a4e53b4941d4b604caff3042e3359f7b461aa7a40c3b52cd3d8c1636ae2c6a04b4f05466e1c794b25f4124121d490928e1d0f9f2b28b2dd82b707cf707d96c465df40e09f8b2d784b07f20d0afd6e162cefb31f8bc4ee52f130d61b1ec78b77ffcafecd911ad4ad7c393dc5203dc007193c20cc153260af19294f2d465bf6e67b65c55e7ef446a5254d033c84b573d235af0852132538a4df10867dbbc3512c2b0847d05565d088d75d6eb84cd182d74b9a70eadb4ec7dda05119498abddb863373a9b0f5ac98178e7284568e0131e81e51cc03c415c938972a04225181c682cb8042deb785f87f6300aad84bb6d57df8edfbf42eee4017e7eaa1a06d1679e93116d705d136b1f2889edde9dc331354daba4db8a53cd0d40afb8bb773fa88228919b9c35fc65df567deba710d7bcedb3ac3f5e0adf5f8cd94fc484516d682184b5d0937355a1569c00ca0ae41275069c11557e4ff146f86720f3dd144d121acae567b87a1c2a8eefdf7d5ed32912bf91521acb3c35a6bf25423171a199eb341d218062bbdcd4fdf645be762e23edb6997a9339ad5b4e7f3035b93dff5a71a1fca7fa877328a9a6ebf3393c60e487e8d96fa7e0983785432a22bf5702f58fe9d5dd3711f874919b736b29db58c90ab367d622208abf61df2d84e1d1fd3ccf98a5e6c77d59f2000f2841dfc32de0d79decb94dafe80f272651125bd35102bef8ef064f578a7a243f3ef17d413a7d0bb63880fca4744c33069063f95dc980a2908165dd6643f9b7a96804126dbe8b264f71de21f6a12252e12aa0706ba66217054a1c1babb26159d388119eac4256c9c270917e70b56d62364579da368c991078ab824c9ec024a74ac3675035c14aed8e60e48d0bc5b56ff8cb7bf5b30cff94167482a781ac03c9581f6666438feaa31315ed1b7214460aad2866c1b67e088f34148d889c326032d230b0568aedd53cd46ff7d8f344c20ed9baf955ea29d99c06e5895b81f14682"}, 0x1015, 0x2) 22:09:40 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f00000000c0)) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000000000000000140001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf64496e66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"], 0x68) 22:09:40 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x7400) 22:09:40 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x9, 0xfffffffffffffffc}, r0, 0x4, 0xffffffffffffffff, 0x0) tkill(0x0, 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$DRM_IOCTL_GET_STATS(0xffffffffffffffff, 0x80f86406, &(0x7f0000000200)=""/174) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x228801, 0x0) r3 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f00000000c0)={r4, 0x8}, 0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000100)=ANY=[@ANYRES32=r4, @ANYBLOB="840000001c015a4638afdb20527f1d2f659ee53a22c40ad7973ea15c9120a04b8c79fb34e03b009bb7162b6a94046b3769d8e641b87f3f9abdd6b86523077cd0e14c64ad8dc46a1ba472cf3ecf85979c25f1f4761c3761103eabbee97d54ce43323204c0d2092759331b2aa13cba1108000000afbb9e46377550c89bda326945773001be46e4a95c"], &(0x7f00000001c0)=0x8c) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000080)={0x0, {0x4, 0xff}}) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$IPCTNL_MSG_CT_GET_DYING(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x6, 0x1, 0x201, 0x0, 0x0, {0xc, 0x0, 0xa}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x24040001}, 0x24008840) wait4(0x0, 0x0, 0x0, 0x0) [ 602.306472][T23658] dlm: no locking on control device [ 602.322518][T23659] dlm: no locking on control device [ 602.370485][ T3783] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 602.620352][ T3783] usb 5-1: Using ep0 maxpacket: 8 [ 602.741477][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 602.749474][ T3783] usb 5-1: config 0 has no interface number 0 [ 602.764228][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 602.775267][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 602.789162][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 602.799174][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 602.812822][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 602.830546][ T3783] usb 5-1: config 0 descriptor?? [ 602.851809][T23622] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 602.859119][T23622] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 603.101506][T23622] FAULT_INJECTION: forcing a failure. [ 603.101506][T23622] name failslab, interval 1, probability 0, space 0, times 0 [ 603.123529][T23622] CPU: 1 PID: 23622 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 603.131886][T23622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 603.141943][T23622] Call Trace: [ 603.145247][T23622] dump_stack+0x188/0x20d [ 603.149592][T23622] should_fail.cold+0x5/0xa [ 603.154111][T23622] ? fault_create_debugfs_attr+0x140/0x140 [ 603.159941][T23622] should_failslab+0x5/0xf [ 603.164361][T23622] __kmalloc+0x2d9/0x7a0 [ 603.168620][T23622] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 603.174607][T23622] ? tomoyo_realpath_from_path+0xc2/0x620 [ 603.180336][T23622] ? lock_release+0x800/0x800 [ 603.185020][T23622] ? print_usage_bug+0x240/0x240 [ 603.189969][T23622] tomoyo_realpath_from_path+0xc2/0x620 [ 603.195597][T23622] tomoyo_check_open_permission+0x26d/0x370 [ 603.201508][T23622] ? tomoyo_path_number_perm+0x4d0/0x4d0 [ 603.207139][T23622] ? __lock_acquire+0xc6c/0x48a0 [ 603.212075][T23622] ? lock_downgrade+0x840/0x840 [ 603.216911][T23622] ? do_raw_spin_lock+0x129/0x2e0 [ 603.221981][T23622] tomoyo_file_open+0xa3/0xd0 [ 603.226643][T23622] security_file_open+0x6e/0x410 [ 603.231624][T23622] do_dentry_open+0x3e9/0x1340 [ 603.236379][T23622] ? devcgroup_check_permission+0x1a8/0x420 [ 603.242267][T23622] ? security_inode_permission+0xc4/0xf0 [ 603.247992][T23622] ? chown_common+0x550/0x550 [ 603.252671][T23622] ? inode_permission+0xab/0x500 [ 603.257606][T23622] path_openat+0x1e59/0x27d0 [ 603.262198][T23622] ? path_lookupat.isra.0+0x530/0x530 [ 603.267553][T23622] ? lock_acquire+0x1f2/0x8f0 [ 603.272217][T23622] do_filp_open+0x192/0x260 [ 603.276703][T23622] ? may_open_dev+0xf0/0xf0 [ 603.281206][T23622] ? do_raw_spin_lock+0x129/0x2e0 [ 603.286231][T23622] ? _raw_spin_unlock+0x24/0x40 [ 603.291073][T23622] ? __alloc_fd+0x46d/0x600 [ 603.295559][T23622] do_sys_openat2+0x585/0x7d0 [ 603.300250][T23622] ? file_open_root+0x400/0x400 [ 603.305079][T23622] ? __mutex_unlock_slowpath+0xe2/0x660 [ 603.310604][T23622] ? wait_for_completion+0x270/0x270 [ 603.315884][T23622] ? __this_cpu_preempt_check+0x28/0x190 [ 603.321511][T23622] ? __sb_end_write+0x101/0x1d0 [ 603.326355][T23622] do_sys_open+0xc3/0x140 [ 603.330665][T23622] ? filp_open+0x70/0x70 [ 603.334885][T23622] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 603.340862][T23622] ? do_syscall_64+0x21/0x7d0 [ 603.345517][T23622] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 603.351480][T23622] do_syscall_64+0xf6/0x7d0 [ 603.356065][T23622] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 603.361941][T23622] RIP: 0033:0x45ca59 [ 603.365814][T23622] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 603.385397][T23622] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 603.393801][T23622] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 603.401756][T23622] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 603.409707][T23622] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 603.417657][T23622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 603.425642][T23622] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 603.487909][T23622] ERROR: Out of memory at tomoyo_realpath_from_path. [ 603.505607][ T2469] usb 5-1: USB disconnect, device number 9 22:09:42 executing program 4 (fault-call:4 fault-nth:5): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:42 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x10, 0x0, 0x0, 0x7}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:42 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) write$nbd(r0, &(0x7f00000000c0)=ANY=[@ANYRES32=r1], 0x68) 22:09:42 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x7880) 22:09:42 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d718100000008"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:42 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xffffff89) 22:09:42 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x81}, {0x5, 0x5}]}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r1, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:42 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x22, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:42 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x7a00) 22:09:42 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000f91189fdc0871336b6335a2fdbfbffff00000000000018ece649357a84b33c61b39279717a3a0c01d5f64590f6a2e87f1217b2d8efb58e9eb39b461e2c0cb6d8784cdc565ca1110e67c5e7bef300"], 0x68) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r1, 0x8040ae69, &(0x7f00000000c0)={0x6, 0x8000, 0x101, 0x2, 0x7ff}) [ 604.222343][T23747] dlm: no locking on control device 22:09:43 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x8100) 22:09:43 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) signalfd(r3, &(0x7f0000000500)={[0xfffffffffffffd33]}, 0x8) read$usbfs(r2, 0x0, 0x0) ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000004c0)) read$usbfs(r1, 0x0, 0x0) getsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x4, &(0x7f0000000400), &(0x7f0000000440)=0x4) getsockopt$IP_SET_OP_GET_FNAME(r0, 0x1, 0x53, &(0x7f00000000c0)={0x8, 0x7, 0x0, 'syz1\x00'}, &(0x7f0000000100)=0x2c) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000540)={0x0, 0x1000, 0x8f}, &(0x7f0000000580)={'enc=', 'raw', ' hash=', {'cmac-aes-ce\x00'}}, &(0x7f0000000600)="655c9455d5d3cf827e6e10474db4c7dd373d63dec10f614eb0d3977ca8d3c836ea40afe6487217206b3fe8afd255c34447a671b4b62a9a68c3fe4afa074128935d1c155860bb2fd19f08286b4df64a6241a0f9545ed44b5fdd37ca0b11899c26929d635040b98b88c65e841f3bdfa1c002aa04d77f582322a43d072c025899ec09806a8b93245eb3bac0f9e663c85fff104da27132c432cb015743d804a70849c7c6e773ad26eac34a73095ec236db5b7395d172b37ec47e68497a1ef7ed5b2a3c01433bed9e25375e15a50c3c4ca43b488d165bbbaef482a9351929d13beb2a35f7c903dd49fe61a4bdf63e180d6f15e300c4e18dce629ac4e0971eeb33b6b0ad3f4d0967c0ee6c4baab769d0660cd39d72f9ead655a619a446da7e60a36f5628018bb2d0fda17a98bb0443035a72be9b793f3e5204b5233cb7ce4ddbee964354baa59c74b7a4a83b7dc9721a2faec44fab07dc0a55c6d5693b3dfb652ab2322749e8b6e13d7c63c4959d6a4d87b1b29d8945774e90e2acf394750a9338974ced2e8560cf9e0918981fe6f6cd4cf0fe46ce0ec2fd5d7b36b99815adfe2f94eff2667554d6a64ff341842b402d3578933d4733db2fc242e96420bf478b88b90111b655ae8889f9f0c8a2a0e44e57f70946fc398bb5f7c749673acf01f4e79664f42f5fff7705dd42c844638feccbb872a5ea626a28e35711bd52750b9a4aab89bed3974632320cb3d2a1f5cfbf448e2bd7a604e0f377f092611f5bb00822f8a65339116031ae7e4d3927c929a621d516743a4b8c6fe3ae9970b191f727b8ee4eb90ecb8fd9b67a0d219162dacfb03c9879ae02d8641f67c4087aec03f985921421e300ddb0dad745447a828bb02c08ea6f8a28aac5438c2d375b11463e15bd9bf34c708de966b04eebdb44485f567cdff35ee33b8a6a06cd17e319ed38f5df4e1b5c266f7e2c2f1a3fe10463a34891d590ecbbd42821052d2b0b903cc9c95b0a31a1977494bb4b0947e840fb272d49bbac158dd407abab9d2dcfcea33de7430189b188ccb014ab810a612032ca54e6a6b296a192c3aad1df990b1c6736f4157f388d5d109112a7a184c7b0374275a51f1e8f464bc5f6b175fd4cbfedbc1b6ecb2d1ae2f27e18af4fa8062c98fdac5d41346994cd0f2631278353519a64924b0a0e3d3e28d66e45535667efa90497ced14f7df0585e3b503eeeb9af4d0e8560ead7c6b76a98528bb36fc0e3bd6a065830861acdd63357f47c8b1ef8e32e1f8330ebfb3df8a866bd24e93b9f14a1b1d35914328ac2919f89ed06b9291f36f69ad09998fa57f22f12424ae056341de6ba2efa223931c4440299557cdd698e567ab91e79a29c12a485cac2c976ddc47a7bf9947618e60477673e9dbdf3d333be7a36ea31765d7310c444bc14c69cef2ee689d09874852a2b4b641a1f0e1e625e43d90d27ea7739139d1364c44c499caf8852c66c688cd3d4fc0bc2440e3bc0fb77b6d5743eced5bee679179d310d44b424b5c766a698e9466217897708217f9311517194690cd3ed68f96ce6e23d661d04f1f470a8660c2d7f02a5cb728af3b0218ca5e7c3228a6aef23dfe4886f929db13790dca7aae289e5edd2cb70ecdf62acac69977bff85b1a42da355479f040335f76b3787acdb56002ed67a32c7cd90ff8d68dfc164790bacab7f6894f9cf738e137f9b715f7659f41bbc37e44fb9affadb12fa00e90c9c8a4613d8078e969640ea44462368e09ed2bc25d310b4f282156e450403024cb5c5531ae205532aaf9d6d94cd6c00c879dedb28d602fe92cf7d01e5f608f2b159468a461e83b167f433d4c5c8fc13983f40c91ef4011512f8bab9f35ee0fd471edd44f4023f366909b723cc6348457a805c1448e6416ef587b5ae674f3356ac94c76c78a9aad375663ac3e812262db6a4cd0105884e18327b9c3d7e51803979b3ce04c95503b4ff99cf3f1beb3389193bdfec6f9ed1448a0169de5273ce26c391d88df4ff636d993da3e116fd658b25b7d92881f5f0ac314f0e4434aa605d1a21a95695c524375e9b614f0a58371fa0c9499b642fb6a37f305d66da360609b2010c64db9ff54e5512df81f6dfd13340001816650bbb35ad19c72ce5813fcbcf9dc3bbf7c4e8b265c6dc2aa1d0c694a1d6a2cc0d44013c49c48036068f255e30dbbc28bc7e0b1fe54cfd77241f28cc37b4f39c0624881108e1ae524e68650eb81d09029395d1c5908ef14e2f0b45e574af5d7b01e7d672f4e33fa25442c1bc563ec519280f83309cdb108546dbd55e82f7f9e28c86c80c31b94048ebd289604054b731c551d1ebc8bacd63a9e6de530d75bf9148d891c3b0774fa5b359b90847ffb5f78aa1ac15f8aeb63145f90bb86c25a86205fc20e301aa8f14757f0a38788eb0450f633256c9364103b4dc116c8b9a244f21075017e77f270736ce7bc28a90ec297fed9e48413068ee4281e1e89397eedf2f4c8cd5b002bf481871df56e4e52ebc6badabbf39e31033646d2e1b22cfcc99352a8bb6426554440a62353fa04d812134a13dd1b0d8d8ffd277ef9cb825f67860a0cdc5cfe0280f7124093469c1fa06740db21ea848ccf29972d045ad8ad92fd6a349c448a6fd3752320e919a3a02775d073a00219250d470c0438a36341aedef2a0e15ff1adcf67c4fce86b8c8813f000f382f01658d0511e7e6229f801ed625c767e4e38273c1c28ae32572ebb9b394880efacd679a1c09fc9f3489a314fedecb0fa29cae5c1e807950b74d3492200bafcf954a3b6d77279cacc1dd458fb6ce5d7c64d16673bf5535168a205a9eeda425bb4fb1b7bf43f2695794fe697c5cc750322849aa0fba6111a7a4796b25e3de93ba251254e3d5467dfc050dbd0eafb15b59dc0f482745dec4ca493ccb25615f5962ea51a3b45e9d4282d609eae9e650ea45bc010d3eb236d881a19ec589d21855ef23d7ae611eef4357493582d760122f4360387075b174d83da0e37045d1f4bf55af8b24d09f0819c7af673d060fbc5f4384c5a1c95764961f7365f25cd76bfb4af361fd910015a51b063bab64886488214011afb7dc6e76f69f3fa983b16bf68cf873d5d0a2cd076f58d5cf66bb9b6afa03de0d0aee5ecbb9f5734fbc3c0d61fcac7dad34a3fa56d7d2af46161ea7d3bc014f8a845849b0fced1594765508a049441e9eca1da5338923ffe0ebe7c636e96cc6005c739dac729f93b36107fd74662ad6ffdb54b46dc914ca22cd2adffe77bbcfa169585551b67493be031d12e4b12312504bdc22ef3156e3601a4768af71496a79aaeb2d18050c66f61368d3ee3286ed69fc813417c114398da5b91fa42a9f2597f77a8fcf993c2f643e430dbdef7c4349a4da1fa3f4606faf097bfc80759715df68db013e5968fde95f3bb1f931f35c9da19bce5332d8995c6bbd7739c019d48a0d03251ed985c836b1d99516a7ca89dda2514e3ebca32a19d85a54b5bbd59e710c22d5db990a92d747c4c2d66b1c952ee27aaea155ef298d3cac671c76fcc65aa4b1f2c9dc909b3186172ee003be66dd90954030d29c6e336b9b1c6f852cc691608ca78959fc0fb893806fd531b7d4611d66703ce0fc43a7b140d30d1602d9331e5ccd042516485d42d9daaf94c1f73c1890f5021293ba2375d17b8e48828a860fa012397952b0824ebf6d24ff220129bd9d5585ac0376e253dbb905177c31fc245e92dcbc3a805f70834dd9c93df4096d3ef88cd4a7fa3d13f09e6799fec56b8f829fe9ec312c951169d45e6ac73bc93d051d84146252e6cfaf26f6b633019b50d77450f5d09d222f8312665c98c835a8fd467c680f07a096c309d976e03aff8f172a8cdfa0146febcc19aa6546f96f10143b9c8a004799e70424065a30be5e864610ce15bae18665a8a7b110d8fa585bba560ecf183b00b9eaa05020146d1eb9fe0b36cf1245f1e5d792a967f80197342d9417e12ecc75732fea6ad80fc4de4f7b312931534bffe4bfa1cfb994b00ed618b2a5d7d45d5f7beaad96b1e44b7b946241f2ef272830787d71c4d3672155a3b5d39c5c78329c6915f65690c6235d9c5a49c72440b7d8ea514f1f30ee7c0c51d9cb5cf1875c4e895082c49499de5d61c28fae006866fd5b26d4508aac4f1047b271d040cf9146dd791846a8d440e6b46b1e22917a59654fa39e587da49dfe1c85ef35652e5d43db4e283d06812fc0af38cddfb9987346e3a481f855ba2aded9aeba1eec4e501eebe74c8f427a25614a1252950488eaa6d498fe55fab7ce5ffa559943a6ae164c43dce167cbe462085b80d93093984eedd94f01481aaaf10f6f073dc8dafa2c1e4c398d4d7e066a0eb909082d217405133a360556866e3ea659fe1d86185ae188ac4cdb18cc80ef55bfc8e18f357206e376aacab05417c1dc11d493148e5d5b93cc95ecf6f09af981e14b3e2d986c31c61cd9ea270d642740c30c972ac467e86918bd5e662209219a691fddf07339e49f28630017858cd5f7ee57c4a241bb8bdbcfd6b51dd315325fb05aebeb23f052e0064a9e1868a9fefd8409f0cb26075dad4008a8b6d5aea1c25caf61ab70e58dcec62927f27afa8a9cfea7c4a187b3d68636820b1bf71b25b9617898a74f18e46187bf46b7567e436367689767f7576eba56fa8fb488fc531f366ea58e1444d146d056433dff93190b05a1fd423f9b38e5b1e228772855a981279a931c68ee6917eb65e4f29477767b22f5a6932e690ded175e3c608644ccc4ec6acc3241fae0463054feecf1c6d84b0f15d7b1a77173c0ce16faebc5c2367ada1d0b6327d44f406b5f3f54eff2312daf7663205b64e1a5f50743c237d24376bbf536c87d1067cd28ba8c18fad318f7b21cc5b4c5d099608ad5fab1fbd1086a592f49b4ca69eb0458409a8884f56ad61484f64864568cbbf5fca02fde8b079b58cdd1140cdde047fe8f28d9a451bbf29b280b5232cd34171e48edbc8b5958ec5f8e55c50aedb131ad0bd296c7462b6d6bd349d876e15fc1daa006ef8c9765f8ce868b28e151bcbd5df5530c5826fa6fa425a30abd7287ad94f8934abf2f53c844d281b7dab2e11c8932db7e325334832fe1b8806bb90c55ff38f4276cb9d9c18e758aab1b180fe28515b4361855a4c71a85ad73e15846242311bbc9d054ce33cce8456b49f65e4d0fcf5e1596b7d2a68217e5e55d53f39b7af8adbe5b5a00ea36b8a3849461781cdbfb5dc93075789d75d87b4e235f98131904d25998ea28d7c094abfa27cbb40f0a55864fc9bcad193fed43d71225fdb89a45378b237e764c2253b18eb4951ca895e024ae9405cccba7eff7967cf446f8045cf64be3c5eb241278187e8c176d5c7b1e607348615046432331968095c980086328a6abfaa6dcc757be6dc9c8c2650b79b86e988a95e902be51b1303efefcc606ab28bbf9e8571e06d114f04b404ed6bbeb0e454acb526f0874096ab139189f944dd299570c95fcc88808984f1a931446ef4ba5b01d412925dc82028ad266dd14ca3d336b74da35bf14c1b8b29e177a674fbb5ce95fd4d5ca2a850682db0f303847876a4038f94016334ed4c76bde015feb4136d1d523e0dc4bd1eda14e907b185ce40efd3a6507410bbc4804a6c86717f0c41f713537ed9845536c9b8c832605404b12ff3788364a506bac61666917d99a277e54ab26c285730df3963b12afd8a25b80d77c88c0deb875a6e3c26fb39175f11efbbd9e41d72dde4f2677f73275d05b4450cbaa768dd8fb006c9a22c1a3ecad9b16d1ba61be9f22c35584b862aca896faa026edb7d4", &(0x7f0000001600)=""/143) write(r0, &(0x7f0000000140)="5d5a5f267fab2b5115b5bb2b8d39bf71f39dde356855a7712ad0097a1ad5a20bb888b537b3958fad0ea4abe728327d4f365b693f94cb0a202e181aee5347f580cbb7fea574ee8610363b5d9e4046aa935b74888f834fb0eedd3650da2c79abc4d36fa022ba28c5e2bd907445f051725d7642d84e1c1b0fa57babb456f52c2662e9ac1b0548ecd213c1b7034a7297bbc853ba7f89e34389b226ddfab2f902c55e369f9a4cd5c76277f77db3246e830dce9bdc4c48541d976f9592ac2285afa012bd8f2959e31536b67a156f389b94cc7ff2ca2c93f0f71fb758a601e33378d47d76459e18d157e66193801875044880", 0xef) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000280)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r0, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x9c, r5, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_SECCTX={0x2e, 0x7, 'system_u:object_r:dlm_control_device_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @local}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0_macvtap\x00'}, @NLBL_UNLABEL_A_SECCTX={0x1f, 0x7, 'system_u:object_r:src_t:s0\x00'}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) write$nbd(r4, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000480)=0x8) [ 604.340194][ T3783] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 604.428907][T23774] dlm: no locking on control device [ 604.457840][T23781] dlm: no locking on control device [ 604.600129][ T3783] usb 5-1: Using ep0 maxpacket: 8 [ 604.740278][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 604.748339][ T3783] usb 5-1: config 0 has no interface number 0 [ 604.770115][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 604.790171][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 604.810096][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 604.819921][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 604.850129][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.875175][ T3783] usb 5-1: config 0 descriptor?? [ 604.921639][T23720] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 604.928983][T23720] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 605.214902][T23720] FAULT_INJECTION: forcing a failure. [ 605.214902][T23720] name failslab, interval 1, probability 0, space 0, times 0 [ 605.262330][T23720] CPU: 0 PID: 23720 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 605.270689][T23720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 605.280764][T23720] Call Trace: [ 605.284067][T23720] dump_stack+0x188/0x20d [ 605.288413][T23720] should_fail.cold+0x5/0xa [ 605.292925][T23720] ? fault_create_debugfs_attr+0x140/0x140 [ 605.298748][T23720] should_failslab+0x5/0xf [ 605.303171][T23720] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 605.308549][T23720] ? find_held_lock+0x2d/0x110 [ 605.313320][T23720] ? lock_downgrade+0x840/0x840 [ 605.318363][T23720] snd_seq_oss_open+0x50/0x980 [ 605.323138][T23720] odev_open+0x6c/0x90 [ 605.327208][T23720] ? odev_release+0x70/0x70 [ 605.331813][T23720] soundcore_open+0x446/0x600 [ 605.336503][T23720] ? sound_devnode+0xf0/0xf0 [ 605.341098][T23720] chrdev_open+0x219/0x5c0 [ 605.345520][T23720] ? cdev_put.part.0+0x50/0x50 [ 605.350289][T23720] ? security_file_open+0x84/0x410 [ 605.355406][T23720] do_dentry_open+0x546/0x1340 [ 605.360181][T23720] ? cdev_put.part.0+0x50/0x50 [ 605.364952][T23720] ? security_inode_permission+0xc4/0xf0 [ 605.370593][T23720] ? chown_common+0x550/0x550 [ 605.375274][T23720] ? inode_permission+0xab/0x500 [ 605.380224][T23720] path_openat+0x1e59/0x27d0 [ 605.384829][T23720] ? path_lookupat.isra.0+0x530/0x530 [ 605.390215][T23720] do_filp_open+0x192/0x260 [ 605.394716][T23720] ? may_open_dev+0xf0/0xf0 [ 605.399227][T23720] ? do_raw_spin_lock+0x129/0x2e0 [ 605.404264][T23720] ? _raw_spin_unlock+0x24/0x40 [ 605.409111][T23720] ? __alloc_fd+0x46d/0x600 [ 605.413711][T23720] do_sys_openat2+0x585/0x7d0 [ 605.418400][T23720] ? file_open_root+0x400/0x400 [ 605.423257][T23720] ? __mutex_unlock_slowpath+0xe2/0x660 [ 605.428812][T23720] ? wait_for_completion+0x270/0x270 [ 605.434096][T23720] ? __this_cpu_preempt_check+0x28/0x190 [ 605.441139][T23720] ? __sb_end_write+0x101/0x1d0 [ 605.446000][T23720] do_sys_open+0xc3/0x140 [ 605.450335][T23720] ? filp_open+0x70/0x70 [ 605.454580][T23720] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 605.460564][T23720] ? do_syscall_64+0x21/0x7d0 [ 605.465240][T23720] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 605.471221][T23720] do_syscall_64+0xf6/0x7d0 [ 605.475751][T23720] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 605.481639][T23720] RIP: 0033:0x45ca59 [ 605.485531][T23720] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 605.505137][T23720] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 605.513565][T23720] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 605.521542][T23720] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 605.529521][T23720] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 605.537495][T23720] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 605.545469][T23720] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 606.054804][ T3783] usb 5-1: USB disconnect, device number 10 22:09:45 executing program 4 (fault-call:4 fault-nth:6): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:45 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xc000) 22:09:45 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06070000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82d1978b97ac59f2bcb13bedfb1f8cd563af872af017ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"], 0x68) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000200)={{{@in=@initdev, @in=@multicast2}}, {{@in=@broadcast}, 0x0, @in6=@local}}, &(0x7f0000000140)=0xe8) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f00000000c0), &(0x7f0000000100)=0x4) r3 = syz_open_procfs(0x0, 0x0) r4 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f00000000c0)={r5, 0x8}, 0x8) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000300)=r5, 0x4) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f00000000c0)={r6, 0x8}, 0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000001c0)={r6, 0x0, 0x5, 0x1, 0x3, 0x80000001}, &(0x7f0000000180)=0x14) 22:09:45 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045000014000000000033"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:45 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x100000000000000) 22:09:45 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYRES16=r1], 0x68) [ 606.584310][T23835] __nla_validate_parse: 38 callbacks suppressed [ 606.584321][T23835] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:45 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f72d3adff7f9d5e82099cbabcb13bedfb1f8cd563af87dc0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef300"/104], 0x68) [ 606.668912][T23844] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 606.707210][T23844] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:45 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xc00e) [ 606.733025][T23835] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 606.739294][T23858] dlm: no locking on control device [ 606.753497][T23857] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 606.755145][T23861] dlm: no locking on control device [ 606.763932][T23857] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:45 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$TUNSETVNETBE(r1, 0x400454de, &(0x7f00000000c0)) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c72f15f134ae38361b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb3"], 0x68) 22:09:45 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x14000, 0x0) write$nbd(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="06000000000000000000000001000000a3e707749fa55f62d3adff7f9d5e82099cba335a2fdbede515d19704c027f7249cb1038b97ba59f2bcb13bedfb1f8cd563679830cf18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"], 0x68) 22:09:45 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x0, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x2c, &(0x7f0000000840)={@loopback, 0x0}, &(0x7f0000000880)=0x14) recvfrom$packet(r0, &(0x7f00000000c0)=""/250, 0xfa, 0x2040, &(0x7f00000008c0)={0x11, 0x1a, r1, 0x1, 0xb6, 0x6, @random="5ac242e8b950"}, 0x14) [ 606.857675][T23864] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 606.869658][T23865] dlm: non-version read from control device 0 [ 606.881514][T23866] dlm: no locking on control device [ 606.933245][T23871] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 606.957689][ T3783] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 606.971273][T23871] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:45 executing program 5: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x2, 0x5, "82ef07749fa55f62d3adff7e9d5e82099cba335a2fdbede515d1b7360000000000003bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 606.985878][T23864] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 607.219908][ T3783] usb 5-1: Using ep0 maxpacket: 8 [ 607.350613][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 607.358653][ T3783] usb 5-1: config 0 has no interface number 0 [ 607.375409][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 607.397450][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 607.410105][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 607.426849][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 607.438166][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.458881][ T3783] usb 5-1: config 0 descriptor?? [ 607.491287][T23851] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 607.498490][T23851] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 607.727766][T23840] FAULT_INJECTION: forcing a failure. [ 607.727766][T23840] name failslab, interval 1, probability 0, space 0, times 0 [ 607.766416][T23840] CPU: 0 PID: 23840 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 607.774773][T23840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 607.784827][T23840] Call Trace: [ 607.788128][T23840] dump_stack+0x188/0x20d [ 607.792470][T23840] should_fail.cold+0x5/0xa [ 607.796983][T23840] ? fault_create_debugfs_attr+0x140/0x140 [ 607.802799][T23840] should_failslab+0x5/0xf [ 607.807215][T23840] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 607.812651][T23840] ? pointer+0x7c0/0x7c0 [ 607.816906][T23840] snd_seq_create_port+0xb5/0x590 [ 607.821933][T23840] ? sprintf+0xc0/0x100 [ 607.826085][T23840] ? scnprintf+0x140/0x140 [ 607.830502][T23840] ? do_filp_open+0x192/0x260 [ 607.835246][T23840] snd_seq_ioctl_create_port+0x101/0x6d0 [ 607.840878][T23840] snd_seq_kernel_client_ctl+0xeb/0x130 [ 607.846437][T23840] create_port+0x18b/0x250 [ 607.850852][T23840] ? async_call_lookup_ports+0x10/0x10 [ 607.856314][T23840] ? snd_seq_oss_process_event+0x2590/0x2590 [ 607.862286][T23840] ? create_port+0x250/0x250 [ 607.866875][T23840] ? debug_smp_processor_id+0x2f/0x185 [ 607.872351][T23840] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 607.877891][T23840] ? find_held_lock+0x2d/0x110 [ 607.882657][T23840] snd_seq_oss_open+0x2dc/0x980 [ 607.887508][T23840] odev_open+0x6c/0x90 [ 607.891571][T23840] ? odev_release+0x70/0x70 [ 607.896077][T23840] soundcore_open+0x446/0x600 [ 607.900757][T23840] ? sound_devnode+0xf0/0xf0 [ 607.905352][T23840] chrdev_open+0x219/0x5c0 [ 607.909771][T23840] ? cdev_put.part.0+0x50/0x50 [ 607.915062][T23840] ? security_file_open+0x84/0x410 [ 607.920257][T23840] do_dentry_open+0x546/0x1340 [ 607.925021][T23840] ? cdev_put.part.0+0x50/0x50 [ 607.929782][T23840] ? security_inode_permission+0xc4/0xf0 [ 607.935414][T23840] ? chown_common+0x550/0x550 [ 607.940084][T23840] ? inode_permission+0xab/0x500 [ 607.945023][T23840] path_openat+0x1e59/0x27d0 [ 607.949621][T23840] ? path_lookupat.isra.0+0x530/0x530 [ 607.955002][T23840] do_filp_open+0x192/0x260 [ 607.959506][T23840] ? may_open_dev+0xf0/0xf0 [ 607.964016][T23840] ? do_raw_spin_lock+0x129/0x2e0 [ 607.969051][T23840] ? _raw_spin_unlock+0x24/0x40 [ 607.973930][T23840] ? __alloc_fd+0x46d/0x600 [ 607.978444][T23840] do_sys_openat2+0x585/0x7d0 [ 607.983124][T23840] ? file_open_root+0x400/0x400 [ 607.987981][T23840] ? __mutex_unlock_slowpath+0xe2/0x660 [ 607.993525][T23840] ? wait_for_completion+0x270/0x270 [ 607.998808][T23840] ? __this_cpu_preempt_check+0x28/0x190 [ 608.004439][T23840] ? __sb_end_write+0x101/0x1d0 [ 608.009294][T23840] do_sys_open+0xc3/0x140 [ 608.013625][T23840] ? filp_open+0x70/0x70 [ 608.017879][T23840] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 608.023868][T23840] ? do_syscall_64+0x21/0x7d0 [ 608.028544][T23840] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 608.034545][T23840] do_syscall_64+0xf6/0x7d0 [ 608.039055][T23840] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 608.044958][T23840] RIP: 0033:0x45ca59 [ 608.048846][T23840] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 608.068449][T23840] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 608.076861][T23840] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 608.084838][T23840] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 608.092816][T23840] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 608.100791][T23840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 608.108797][T23840] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 608.144740][T23840] ALSA: seq_oss: can't create port [ 608.153595][ T3783] usb 5-1: USB disconnect, device number 11 22:09:47 executing program 4 (fault-call:4 fault-nth:7): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:47 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xf000) 22:09:47 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x10002, 0x0) r4 = syz_genetlink_get_family_id$gtp(&(0x7f00000001c0)='gtp\x00') sendmsg$GTP_CMD_NEWPDP(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f00000007c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00042bbd7000fcdbdf25000000000c00030000000000000000000600060000000000060006000000000008000700", @ANYRES32=r2, @ANYBLOB="0c02030004385de3f63e497e91"], 0x44}, 0x1, 0x0, 0x0, 0x4000030}, 0x2000) sched_setparam(r0, &(0x7f0000000100)=0x6) read$usbfs(r2, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000080), &(0x7f00000000c0)=0x4) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r5, 0x0, 0x0) write$binfmt_elf64(r5, &(0x7f0000000300)={{0x7f, 0x45, 0x4c, 0x46, 0x8, 0xff, 0xc3, 0x40, 0x2, 0x3, 0x3, 0x2, 0x37e, 0x40, 0x351, 0x7, 0x2, 0x38, 0x1, 0x100, 0x4, 0x5}, [{0x70000000, 0x8, 0x7, 0x8, 0x7, 0x2, 0x6, 0x101}, {0x3, 0x6, 0x7fffffff, 0x2, 0x3, 0x1, 0x1000, 0x492}], "0a919b90086a64dbeb38278c11f5559768fefdc611522db654b5b4e06cbb4a43c0bfd3067e61122bced77d12b39c61c55670640010500b5ccc97d4eeb8d715a210c99fd1c50778785f5442607a4fcf7bd2215b1ca649533dd7b25b231f55f560d706539ba080f0ce50d9fe50c022b5954be9fd4d3c41628c336f84e9586680e8850452165e6a874786091d6f7d64473b27992059037d1ad9384f88f0825feffaa067b26ff2b3aea63580cabfe6bcab3382aab93d996b24f932cabd44b4dc015a3dcb7bea659aa40d9550c4ea25990c566ae7f9cb980d55e04ac0042e300e212bbe1bb61f1362d7de88a085b4f2e4367fa8bf008f811f3f", [[], [], []]}, 0x4a7) wait4(0x0, 0x0, 0x0, 0x0) 22:09:47 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x200000000000000) 22:09:47 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:47 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@timestamp, @timestamp], 0x2) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="060000000000000001000000a3ef07749fa55f62d3baff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb4d1c5994af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a897942fe83f80decee7bef300000000"], 0x68) 22:09:47 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) setsockopt$CAN_RAW_LOOPBACK(r0, 0x65, 0x3, &(0x7f00000000c0)=0x8000001, 0xfffffffffffffd6c) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$nbd(0xffffffffffffffff, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) [ 608.719224][T23936] dlm: Unknown command passed to DLM device : 163 [ 608.719224][T23936] 22:09:47 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xff03) 22:09:47 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f00000000c0)={r2, 0xa}, 0x8) r3 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$kcm(0x29, 0x2, 0x0) close(r4) r5 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r5, &(0x7f0000000240)={&(0x7f0000000400)=@in6={0xa, 0x0, 0x0, @dev, 0x5}, 0x80, 0x0}, 0x200088c4) setsockopt$sock_attach_bpf(r4, 0x1, 0xd, &(0x7f0000000080), 0x2cb) close(r5) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r6, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000080000000000010002000000a3ef07749fa55f62d3adff7f9d5e82099cba335a00d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"], 0x68) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000100), &(0x7f0000000140)=0x4) 22:09:47 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nvram\x00', 0x242, 0x0) connect$l2tp(r1, &(0x7f0000000100)={0x2, 0x0, @remote, 0x2}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000140)='tunl0\x00') ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) 22:09:47 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$setperm(0x5, r2, 0x0) r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$setperm(0x5, r3, 0x0) r4 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x1}, 0x0, 0x0, r3) keyctl$instantiate(0xc, r2, &(0x7f0000000080)=@encrypted_new={'new ', 'ecryptfs', 0x20, 'trusted:', ']', 0x20, 0x499}, 0x2c, r4) 22:09:47 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x33fe0) [ 608.969554][T23983] dlm: no locking on control device [ 609.059771][ T35] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 609.300449][ T35] usb 5-1: Using ep0 maxpacket: 8 [ 609.420261][ T35] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 609.428354][ T35] usb 5-1: config 0 has no interface number 0 [ 609.440199][ T35] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 609.452201][ T35] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 609.463084][ T35] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 609.473660][ T35] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 609.483527][ T35] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.497392][ T35] usb 5-1: config 0 descriptor?? [ 609.541388][T23951] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 609.548612][T23951] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 609.767006][T23951] FAULT_INJECTION: forcing a failure. [ 609.767006][T23951] name failslab, interval 1, probability 0, space 0, times 0 [ 609.799554][T23951] CPU: 1 PID: 23951 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 609.807895][T23951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 609.817940][T23951] Call Trace: [ 609.821216][T23951] dump_stack+0x188/0x20d [ 609.827797][T23951] should_fail.cold+0x5/0xa [ 609.832280][T23951] ? fault_create_debugfs_attr+0x140/0x140 [ 609.838065][T23951] should_failslab+0x5/0xf [ 609.842467][T23951] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 609.847815][T23951] ? find_held_lock+0x2d/0x110 [ 609.852554][T23951] ? lock_downgrade+0x840/0x840 [ 609.857395][T23951] snd_seq_oss_open+0x50/0x980 [ 609.862148][T23951] odev_open+0x6c/0x90 [ 609.866190][T23951] ? odev_release+0x70/0x70 [ 609.870666][T23951] soundcore_open+0x446/0x600 [ 609.875333][T23951] ? sound_devnode+0xf0/0xf0 [ 609.879899][T23951] chrdev_open+0x219/0x5c0 [ 609.884290][T23951] ? cdev_put.part.0+0x50/0x50 [ 609.889030][T23951] ? security_file_open+0x84/0x410 [ 609.894117][T23951] do_dentry_open+0x546/0x1340 [ 609.898859][T23951] ? cdev_put.part.0+0x50/0x50 [ 609.903599][T23951] ? security_inode_permission+0xc4/0xf0 [ 609.909211][T23951] ? chown_common+0x550/0x550 [ 609.913862][T23951] ? inode_permission+0xab/0x500 [ 609.918792][T23951] path_openat+0x1e59/0x27d0 [ 609.923362][T23951] ? path_lookupat.isra.0+0x530/0x530 [ 609.928708][T23951] ? lock_acquire+0x1f2/0x8f0 [ 609.933379][T23951] do_filp_open+0x192/0x260 [ 609.937880][T23951] ? may_open_dev+0xf0/0xf0 [ 609.942360][T23951] ? do_raw_spin_lock+0x129/0x2e0 [ 609.947367][T23951] ? _raw_spin_unlock+0x24/0x40 [ 609.952205][T23951] ? __alloc_fd+0x46d/0x600 [ 609.956699][T23951] do_sys_openat2+0x585/0x7d0 [ 609.961354][T23951] ? file_open_root+0x400/0x400 [ 609.966177][T23951] ? __mutex_unlock_slowpath+0xe2/0x660 [ 609.971713][T23951] ? wait_for_completion+0x270/0x270 [ 609.976984][T23951] ? __this_cpu_preempt_check+0x28/0x190 [ 609.982606][T23951] ? __sb_end_write+0x101/0x1d0 [ 609.987435][T23951] do_sys_open+0xc3/0x140 [ 609.991738][T23951] ? filp_open+0x70/0x70 [ 609.995967][T23951] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 610.002025][T23951] ? do_syscall_64+0x21/0x7d0 [ 610.006678][T23951] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 610.012637][T23951] do_syscall_64+0xf6/0x7d0 [ 610.017125][T23951] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 610.022988][T23951] RIP: 0033:0x45ca59 [ 610.026858][T23951] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 610.046431][T23951] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 610.054814][T23951] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 610.062760][T23951] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 610.070705][T23951] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 610.078662][T23951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 610.086628][T23951] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 610.159961][ T35] usb 5-1: USB disconnect, device number 12 22:09:49 executing program 4 (fault-call:4 fault-nth:8): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:49 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x34000) 22:09:49 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$KDDELIO(r1, 0x4b35, 0x5) 22:09:49 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x400000000000000) 22:09:49 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(0xffffffffffffffff, 0x0, 0x76) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000001280)={r2, &(0x7f00000001c0)="abff9f4b38ddf08d28337c41e71a13bec945ef9a474401303c4dfcd07ff25dcd5dc88d6f6e27b209fdb2ddcd03799de41c8e1d4efa34726c1781f5c09004c06c654726996c47411cb00cb41a26ef6f238fa85d4cd6894d7b82344cfbbeff6d9f7e2f81cd7d7e778dd8a6926926a757e44b999ffc398f8a1912c666060f999693fa5f47b530340f60fbbcec8ff6e6cb14345e14f0c2628b75efdb49792aa0ea1edd6be794f40c5d5befa730c1a6d98a3e01068065d30f732636190238bb9648676128d562785baeb0688c6aefa45cecd9cf471863e5f578d4847905f046a60ec568de337cc8ebe028256c7c625c9dd9d7a03c7ac65401c4db2f8b7ce3527b69fa2d80a50f4a3411337c5c3208171438d3fc20b70d51d0e088486f01cf38430fbbb1764f1ece0cae76ce6e0c6170b8db4a143698299146076aa6c51598646d0b3651e035f91b038a234feaebad467e7a50c18c49c62cc44ad5e780c9db69aef51971af5f55dc15890e11c0371ddd8833f3b3fae86342d1ac616a9c29a2f81c3d9e4648cee25b6aa26462083b93bf0eb096987c4535151f082396c26914c6d6c7efe1c45137d0c5fbe7c19a9a0e8f01556e9c9b661d5ae25ea2237e4fbadfba538bcf231ca258fc4a720edb24b2537c4613003b9f0e383517a4ee982ac4cfc83b5e0695cc9b76f14ce291ef8dc1104d4bb610baac3e30679ebcee838fdff441be7c26c88eb8494d9685e8fd79784b56e706047552447d6b1edac5c414be38ca7b25ac5803a73d0ef1ad34b4903a51985cb448251f3f0b372deb3219db5a339ad1d5e3773018e5ef1b8fcee61892e1afd7ace19be40fb7222b048feb84dde3b2ec254f61d782a31d51720863c1b1f57d6cbe5f614aa69ade45c55b0e91b70f3a5690bc406a568bf4daa91348692d1c96005a2c6497c916ced7bae558c8cb977f7b15ddbf15b17c563bb82f4bdd900436f956973f1128c11e417e1c0d96590efca1d49e1d69e49cd26f3648b6e87662369e9e256f1f5632e3155c3974e1344cea10407248f0d04348951261da2720aa9bdc6fbd1b868efe01663cbddb68b862fb6c2921f84fa14a8ec38e631e4536b97e80bf83a72d62c7bd74cd9feb35340f93bd492ed9d7ca9f2c1b876730b4b81b24a44a6dc4bbe89cb5e2762639a5d7e15f5dc4927ca1e72aeb605257ae7b37f70d7272125e3e8519aacb4b1a4bc96a0e4ba9042c86ab2e44c856a861c1f39bf11b85e845076f295284a59ae20a33faf504381e34ae7f18b2485414346770016feb856bc7546afb9c925f816f29e1ce9a27cc523a625db2cda0f126a5d1050e4a11d03ca226864275c72b2339f926473ff94f6b06f695ed3d4a2c533e532b73e241f054ce8681abb54833d9d27158e0939fd5e5e7f4517bc0d54878657507a143fc80a8bcb87d06ef4b6b2cd5cbeeeef7718abd340e535654f9e928d658eaf8b9b76908c48816aa83a830e70db2d924f00c0a4fe29f49865e122f82a9c49e89b055a7be84cee810ffb7d1091f91f484805783aae0396032dae9987465b4fab5252c166e7f3fbad24fc9a74ed6e68e6f78b58a983aa11687d2b02fb44894c315c0f552ad797fcb299962a31b6d76802c656d41314048afad374432d94f7345849251b9814354ee8a50e033872d0fc1a49c41c169e2f76d50ebb8222d6887bbc27d71d3aeee1f7214d5f9a5801129afe9c13637209e7aa9295fc73a3487fbab1bc4acb7aecc519c2fcb83108761cf0b3aae39d1ad9539dc0ca090f247223c9e757693fa01497fbe6849978f2ed02e409f21be125e68d269f95c2b049b77b25bf224f1c821fd45361474957705366db2f8f55b8c07262e6db27cf3df799df5293b5b8fab2fbf02f67c69736f69f68bf8ea73c0951a06759e2c5894ca32e347b29e205cc640c666c85e334125564fce6c5db191563866cee0056013570b6c1b1c47eef8740d406803de45467dcfa07ec8d3a97e3f808751496b55b5ea0b4b222e9c510ab8aef6fc314b6319ba5813f44a26e4f0164bfee43c1976b1328b35a946b9b10eb4d3c7207c86fab6033c7832f1c90e27760035994eb6dd2ba1074205c5a105461f7d270ea3fcae05621c3fbbf5a020fccaec5d4c6a4f771f9744efd1d17b2633a498010035799eff116170030a399d43e63463a6328b093bbe34ffd63d8bb1f1fbb485ee15dfc1884f3e959ef99beb735ccf179233735ea0e9b55861e0943ae5af5a8da7da22fab0cdb2eaf5d6bcdb30749323117eb751b2ebd4defe2c3ce7f46952d2837b8e77c4c09ffdd235a910aa1afb4f19bc1c571c69fcaf3ac626151a991ac17c7864ae91fa65be45400d54f84857ad89ee61f074c826933e077928503cc44f6f61482327be0a9d3fa6aff3d4b498e7562e0c35fb8e200d0daa6f53fb5e958ab9b68be21dff0971c419bf6e3ca7ee75dda84f372a6a4cd13c47b2bf60d4f07f00c3e81980470f7dc3322a0e46775fc6d6bbda40e0dfb18f844088f2d97e0d404bd7ba2faba6c554b1756dbce79c86906f502032c02d79e92cc588ab70f1d453d6bb0784aebbd05eaebffec1e9119a2e2e1874a6fbbdd73a40babd47a3222921b4c1fef76f284a85649c8ecd0b9344946ab37ab3edf7efee896b4d50d531be12e179c84ee0e0bc031e9e4dfaf952d1253c7dd8ba7c5f385259c55a9ad9cc1841852d30b2cf219f696132bc81a122c0492e2ef5578d0a975ae7819b9c0028075aa40558d560ddbfb28b297a3abe6b4339ed9bbadded59a2524fdec60cba157bffafb4614d5a52deef7a6a5b00a933c4646bbe169e3a286c248e0c08b7e34ae75778bced95b4f90aca9a0ff030ffe15c41c96c199d048c9231ac5f8334c6f56d5cf7221ef4fb39f2a6daaa257808257cf17c644d6c6236dc6f9a6a277b70bb63a60df54bd636fda6abdbf6d4af2171276ea28c983326b5fed5234fc544e06639a8d12ac67a0917fc9230e1daba119080758b04381e8eb3171c56dfc2c172a49545c9e4527ac44f68f2f8c2089036099564446d82030d15df9340aa4f3ff6add7c03a1b3e6009bbf4d64bf4b1cef7a9e4aa74f98cd19b857a0049f66ca231fcaf67235129a5243ff58d30a35ccb10934c18d95b560bc134bbbddec7106ea3113ec6b57b137e9e8d577487f9ef7127b66494bbcc0c7eb6560118b5a180769ac4f540ddcf6ca8999fe6b2659b6101003bf87146daac615edb8c49d11338416dc330cba3118f405c0e29d2d85b5357e95fddc48a035719821c46005149fe20d79db035a808476b6b6ba8a18959d864225f30414e5c2c754182cfe2f28db5348412f127318aa6187a3533c1074e5d0bbc402c1063ac6ba659bba780d2b8d3b4381ed0cb4d4633e4c55407c891c39baa5ef8350495e91713a83e3894b8816e79820b5d6b204cf131bfdd738d533f6b395090dc06d8aec2391de0f53590083c54f020ca996b72f0fbf9e50ade9cd8c4783576901a1a9e04169c142d7ff87df431fdcfa52e92a1aa37eb7e38da5c2cc209c175367a448d3590ddd6dfb03ae294c93d3ff7eac1ec7edba056c0624a722221985a0d236fd227fab230face330037612907959c769faf0c3f1d8d18724c4df6acb1fc1d675def7d99ff6078b19f680e6d645e8d78ec50b26c610bc16bac4aa7549b021bf3bea78293d89037ad9111bcaf09b7a9fd3bf2e16f4c4c69f2e3beb515e053ba944b27aaa40d67df218b8224002a9c233281a067df4c61812bf831dbd9b4104d309ab2961aa2c3a232b93f0c66c19e42f9e1c04d114eea138b8c308feaa97afff8b87f18e7bdb397dd18844c9f8a38ad309e29cb51197325166bc24de47096559da4917faf110161be5f9a361ccabb59ff6c18c96605062641000e2a3b9234ea9b15a5b74dca117985ac6bb8b79935709682ed3f4bd2ac2aa5ebb08b7222e96be44ebe19601a570a59b714541d47c1317598774c39a8bd2b728fcb48f575206ef7cdaa7141fbdb6ce082baf108eb77b1997adc8d0af174e871a0118fc4d2f91959846b07086d79c162eb23e56c49dcdfeb606741227a8af5d20e9211f7a77afd83aa9d50bdfb951e7c2a242c7846acf7cc238b84b9cddf403a74e36c83deee27278a9b2383264cb2cb2918087989e9b85678051e01c3434cfc0b1e616c9603ed9f265601cfe031dca141c1b5a1dbd1ab8a9fd1fa4e1a7fbbe53b23408dcb9a9b5a9c448286f99a45dee91ffb6cb53ce39cd08856d4b6da93255a09f82e51ce51431680c0089f9abfa7b07a903699fe54368d466494c15864b8f0e5bc49939f0e1f58bc0b2040073d33e13fa0ab3dbb55ded549b8ff6bf9f4e21d2f49caad62dccf7aaf14606727b6a866c1c8189ba4b210a10595ef7ad63799a38c7c663e66bc3fcf0bba63e9a2aeca056a4fcfbbbdba06d8600b5ec9d0c433850cbb407a6d4cb2125a1a711c48bdf50a70bb198d43f19c32b7dd6d4b14076aca21d1dd75641455bba025831a4690e0a38250d1e16b6713783c07848fe7b85f16d16da47ba5dd77fefa99f692faf0de0dc7cd6b233f01289108c54d1c4923bf60f6d796f59666f6b1497507b6f9a046685f246b29efcc1cfa0324cfe87ac53e10c5f8af7d036d7d4e67a3f898590d4d646770bacd94c8320363910ff2b2254cd83f643ab099f60cb6a52e224858367c3c3d84468141d0ac48230d2593661ea8f62f2411419358f96f55f8c901ccb8537c544c1485066149e743151a678d69b7b791fd5b4c853fc7b559536000f35be3045c43159caefc3e2c0e568d101448997a91dc71b827a109c4f2c026b5d3297b48d9290302abe3e4295e94c22f47bb4dc153653139fc3bbf46a4f9d849b8f58a25bb29bc5527fd8e3148ab16f703b831f1324622cafbc4eb7e804574fe504aa382fb3db7815b903dde3f1c148087cdff701fbe74e520c3abc6e1c5c1e33ac64de48c6e1d42ed628982360343e7f6341429d4e2025a501757b81e874a1b9b46ee57183e82993559e5836c68663be555186bc5d306bdba33ef8804337140ce54660d8ee1400c5c2395ddb0f448a1033d719f7dca50e11d9b6cf1cbaa06bfd94408c8f19cda4e242f2982c529afa495f2125d75829ee3d64a77c9a84bb4b42635193148c79659a0bbcd0e1aee14b964ab4cc8c1a5d6b4aace54fb372f97944e4729d91b3c1a2c0d0577527cf22c20aab647ab91a3d665de7a5d943ebffbe9e6f0210e8a6b01d6eb0cddc5dc9373af80519816a12267221166cd9aecac94b8a5cdbe9b410102df85019d4c8ade0e45c284d0af3e3cb725cd0da298f8b1385d3d7dd7702c384cb8d7bdf663a34f11d6eba4916fb56ae38256421d2aa7b91d8a78d7d7977aa6c46dc1648f93bfa31632d4fb5cbfc4bdba2776ad58df1d62fb612cc363e03831f646bfe3c4f74e524fbb648eb45ce424d7d67253d5df53b8aa42424aa6d0c4e8f43fad3a9670159a9381841755cdc0a119ddbba27e9025bec108b1e35679cd2f5032ab084ddb5ab73d67d9720e599682783050ad72733c3d366defe0e7894d08271885571678095cc2fdb3f63d59fd2d7dad840775cc4b46f3f9d8fd339bf8a629ddc72761a1aa582688529da7b20ce5b88616b3c236183d93660b6456f45ab6be161e5092dcf079bca8003e484f78b2ba29818ec68f0db094e26f3ecca9d9413e6208b236012cbbe080188b3f2bd65d7248f497049a5c7c98c9cb75c94c9871c00a7fe57466d5bdb02042a9c90ade9c71bf32ade30fd934a1667c777e58fc7c3e15b7b48c97fb31e3832e2c33829ead16170a", &(0x7f00000011c0)=@buf="10358a82b27341ca0267c438fbd50be297a0a07657737bb3c742445605f2b4f760b62fc8736e6e0c423a4f37a025eaf98cf9a65ec94e1c4cd4ed0a669b91520eccf80cbc40809c3bd68ed453e68a226785de39ab608065549de944b3f248e1230f1c9b42bbbf2ff5d77ba2ddae893af5fbea89ebea5ba81e9689ff273ff10aed5f0d4cbe6ccfef7aa33e5842e3c2dc242df6f711572d1799316b68e5724cca0b870e0af02a17648b92dfc82ff8e1438139d03e98b6ea5d4db0a71ddc65", 0x4}, 0x20) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x280, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r3, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x18, 0x1412, 0x400, 0x70bd27, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}, 0x1, 0x0, 0x0, 0x50}, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x2c) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) ioprio_get$pid(0x2, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:49 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 610.716813][T24042] dlm: no locking on control device 22:09:49 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r2) read$usbfs(r1, 0x0, 0x0) write$nbd(r0, &(0x7f0000000100)=ANY=[@ANYRESDEC=r1], 0x68) 22:09:49 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x40000) 22:09:49 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x4, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:49 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x400300) 22:09:49 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write(0xffffffffffffffff, &(0x7f00000000c0)="9acf2937a84795992ba5205071abf78064325e0f40e99999dcc0e77f315bef399f60d5487534e3385b9d8826351c8eac2b6e1bb696409485e7d0f8742b98b37a6d40f77e60d1", 0x46) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07759fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef55dd7d020a724232a8b58e9eb39b4667c5e7bef30000000000"], 0x68) 22:09:49 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() process_vm_writev(0x0, &(0x7f0000000180)=[{&(0x7f0000000080)=""/240, 0xf0}], 0x1, &(0x7f0000003480)=[{&(0x7f00000001c0)=""/153, 0x99}, {&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/53, 0x35}, {&(0x7f00000012c0)=""/4096, 0x1000}, {&(0x7f00000022c0)=""/161, 0xa1}, {&(0x7f0000002380)=""/42, 0x2a}, {&(0x7f00000023c0)=""/4096, 0x1000}, {&(0x7f00000033c0)=""/136, 0x88}], 0x8, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') read$usbfs(0xffffffffffffffff, 0x0, 0x0) accept4(0xffffffffffffffff, &(0x7f0000003840)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000003700)=0x80, 0x800) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000003800)={&(0x7f0000003600)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000037c0)={&(0x7f0000003740)={0x44, 0x0, 0x200, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x51}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xffffffff}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000810}, 0x4000004) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)={0x14, r4, 0x917, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f00000035c0)={&(0x7f0000003500)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000003580)={&(0x7f0000003540)={0x34, r4, 0x100, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x3f}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x3f}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) [ 610.934384][T24083] dlm: no locking on control device [ 610.959584][T10916] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 610.991615][T24094] dlm: no locking on control device [ 611.219597][T10916] usb 5-1: Using ep0 maxpacket: 8 [ 611.339723][T10916] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 611.347734][T10916] usb 5-1: config 0 has no interface number 0 [ 611.353963][T10916] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 611.365043][T10916] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 611.375211][T10916] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 611.385159][T10916] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 611.394312][T10916] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 611.411396][T10916] usb 5-1: config 0 descriptor?? [ 611.430982][T24038] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 611.438279][T24038] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 611.663095][T24038] FAULT_INJECTION: forcing a failure. [ 611.663095][T24038] name failslab, interval 1, probability 0, space 0, times 0 [ 611.689526][T24038] CPU: 1 PID: 24038 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 611.697874][T24038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 611.707931][T24038] Call Trace: [ 611.711234][T24038] dump_stack+0x188/0x20d [ 611.715568][T24038] should_fail.cold+0x5/0xa [ 611.720079][T24038] ? fault_create_debugfs_attr+0x140/0x140 [ 611.725896][T24038] should_failslab+0x5/0xf [ 611.730312][T24038] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 611.735693][T24038] ? pointer+0x7c0/0x7c0 [ 611.739940][T24038] snd_seq_create_port+0xb5/0x590 [ 611.744961][T24038] ? sprintf+0xc0/0x100 [ 611.749113][T24038] ? scnprintf+0x140/0x140 [ 611.753527][T24038] ? do_filp_open+0x192/0x260 [ 611.758211][T24038] snd_seq_ioctl_create_port+0x101/0x6d0 [ 611.763846][T24038] snd_seq_kernel_client_ctl+0xeb/0x130 [ 611.769393][T24038] create_port+0x18b/0x250 [ 611.773807][T24038] ? async_call_lookup_ports+0x10/0x10 [ 611.779268][T24038] ? snd_seq_oss_process_event+0x2590/0x2590 [ 611.785245][T24038] ? create_port+0x250/0x250 [ 611.789841][T24038] ? debug_smp_processor_id+0x2f/0x185 [ 611.795318][T24038] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 611.800869][T24038] ? find_held_lock+0x2d/0x110 [ 611.805642][T24038] snd_seq_oss_open+0x2dc/0x980 [ 611.810503][T24038] odev_open+0x6c/0x90 [ 611.814577][T24038] ? odev_release+0x70/0x70 [ 611.819084][T24038] soundcore_open+0x446/0x600 [ 611.823789][T24038] ? sound_devnode+0xf0/0xf0 [ 611.828389][T24038] chrdev_open+0x219/0x5c0 [ 611.832810][T24038] ? cdev_put.part.0+0x50/0x50 [ 611.837585][T24038] ? security_file_open+0x84/0x410 [ 611.842704][T24038] do_dentry_open+0x546/0x1340 [ 611.847478][T24038] ? cdev_put.part.0+0x50/0x50 [ 611.852236][T24038] ? security_inode_permission+0xc4/0xf0 [ 611.857850][T24038] ? chown_common+0x550/0x550 [ 611.862511][T24038] ? inode_permission+0xab/0x500 [ 611.867430][T24038] path_openat+0x1e59/0x27d0 [ 611.872005][T24038] ? path_lookupat.isra.0+0x530/0x530 [ 611.877408][T24038] ? lock_acquire+0x1f2/0x8f0 [ 611.882078][T24038] do_filp_open+0x192/0x260 [ 611.886559][T24038] ? may_open_dev+0xf0/0xf0 [ 611.891042][T24038] ? do_raw_spin_lock+0x129/0x2e0 [ 611.896050][T24038] ? _raw_spin_unlock+0x24/0x40 [ 611.900876][T24038] ? __alloc_fd+0x46d/0x600 [ 611.905360][T24038] do_sys_openat2+0x585/0x7d0 [ 611.910032][T24038] ? file_open_root+0x400/0x400 [ 611.914862][T24038] ? __mutex_unlock_slowpath+0xe2/0x660 [ 611.920387][T24038] ? wait_for_completion+0x270/0x270 [ 611.925656][T24038] ? __this_cpu_preempt_check+0x28/0x190 [ 611.931440][T24038] ? __sb_end_write+0x101/0x1d0 [ 611.936285][T24038] do_sys_open+0xc3/0x140 [ 611.940600][T24038] ? filp_open+0x70/0x70 [ 611.944824][T24038] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 611.950829][T24038] ? do_syscall_64+0x21/0x7d0 [ 611.955505][T24038] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 611.961467][T24038] do_syscall_64+0xf6/0x7d0 [ 611.965953][T24038] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 611.971855][T24038] RIP: 0033:0x45ca59 [ 611.975728][T24038] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 611.995322][T24038] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 612.003711][T24038] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 612.011660][T24038] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 612.019607][T24038] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 612.027554][T24038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 612.035504][T24038] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 612.048699][T24038] ALSA: seq_oss: can't create port [ 612.060875][ T17] usb 5-1: USB disconnect, device number 13 22:09:51 executing program 4 (fault-call:4 fault-nth:9): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:51 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x48, r2, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_PROTOCOL={0x6}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x24000000}, 0x40801) openat$cgroup_procs(r1, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x30, r3, 0x0, 0x70bd27, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0x6, 0x81, 0x80000001, 0xfffffffd}}}, ["", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x88a0}, 0x40000) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="00082abd7000fbdbdf25010000d3789400000000000c410000000c001473797a3100000000"], 0x28}, 0x1, 0x0, 0x0, 0x20040081}, 0x408c0) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r4, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x101, 0x0, 0x17, 0x8, "3350a901100f7b3d1b1b5d5698b6c286f10c09c321d4b4e6df969e201207b591e6443f003492991977cade84af91c65145ddf78474377c4e22cb2aeca109cb32", "62b5c589d62c718376bf2af095ddfdd8cfa3d3196d9e448e74309880e28ac016", [0x8000, 0xfffffffffffffffb]}) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r5, &(0x7f0000000280)=ANY=[@ANYBLOB="0600000000000e00000000006bbcc070a3ef07749fa55f62d3adff7f9dde82099cba335a2fd9ede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe60ce90dfc92608c3117b2d8ef665a9f55dd7d020a724232a8b58e9eb39b467bc5e7bef300003da9a67caf3b81f9216d731450f4e442cb4549e85215c5a82058ec1655f451b29869cee5e97897"], 0x68) 22:09:51 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xf0ffff) 22:09:51 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:51 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x500000000000000) 22:09:51 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:51 executing program 5: clone(0x902040, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) getsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) [ 612.619787][T24154] __nla_validate_parse: 34 callbacks suppressed [ 612.619795][T24154] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 612.676183][T24154] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:51 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x1000000) [ 612.724440][T24182] dlm: no locking on control device 22:09:51 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b392794345e6372a3cc0498df1739517acd8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3a8436912a9ec2c29bdbd54f9b9e6c421925726dd7666070551f805155df5a15f1cde1e0044902283addc28931f0ed91fd7cf98613693440df943328acc3daf46764469f0a5d8fc"], 0xb2) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5f6d, 0x440000) setsockopt$inet_tcp_int(r1, 0x6, 0xa, &(0x7f0000000080)=0x3f, 0x4) 22:09:51 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) r1 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x3, 0x200) write$FUSE_INIT(r1, &(0x7f00000000c0)={0x50, 0x0, 0x5, {0x7, 0x1f, 0x401, 0x810, 0x7fff, 0x1, 0x11, 0xf3e}}, 0x50) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f0000000200)={0x6, 0x81, 0x81, &(0x7f0000000140)="11c91f299d389d701c046b66ba59f10cd03151711378560cefb9736ab5f635a8f69a84af72de3a299a10941573774067929a47b4050abbb99138c9df44abac163760325033094503427ef7984c2c6ec5d75e5f21f40c03790de21c980b0db2c94e79ff875c070bb4443af054d7f87c8ceeafe2a8afc0b106d3e99d9778d0c8f1d6"}) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) [ 612.767989][T24189] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 612.795548][T24191] dlm: no locking on control device 22:09:51 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) write$nbd(r0, &(0x7f00000002c0)=ANY=[], 0x68) [ 612.822828][T24198] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 612.843958][T24198] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:51 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0x297, 0x400000) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x3) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) r2 = request_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)='cpu.stat\x00', 0xfffffffffffffffd) keyctl$describe(0x6, r2, &(0x7f00000002c0)=""/225, 0xe1) write$nbd(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="06000000000000000000000001000000a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef356d5717b04eaa356f3841e0631f4c7ef65ac0874911cb3d6fd86db345b140c47b61c625f37ff61fd92b00b5ff5af5e68e98ad7d8712c349d2fde58e4507f37b617dadf49b78998582f0c1919ec7a66afca13c5e93afaf6f8bd721e912ffb3ee7be3ad773b03988a65d9e4906f2e22cb2fd2e3bd73e687e9bcea685a21734070064bcf78c76c941b0e7614b415cf5488e127f6de92c4ec4f8a6376ffaedb9181951"], 0x68) [ 612.867397][T24189] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 612.883546][T24209] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 612.903927][T24209] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 612.939599][ T2469] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 613.189417][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 613.309409][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 613.317547][ T2469] usb 5-1: config 0 has no interface number 0 [ 613.323913][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 613.334975][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 613.345341][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 613.355287][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 613.364716][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 613.376964][ T2469] usb 5-1: config 0 descriptor?? [ 613.400752][T24168] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 613.408145][T24168] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 613.644231][T24168] FAULT_INJECTION: forcing a failure. [ 613.644231][T24168] name failslab, interval 1, probability 0, space 0, times 0 [ 613.683072][T24168] CPU: 0 PID: 24168 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 613.691423][T24168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 613.701476][T24168] Call Trace: [ 613.704770][T24168] dump_stack+0x188/0x20d [ 613.709106][T24168] should_fail.cold+0x5/0xa [ 613.713614][T24168] ? fault_create_debugfs_attr+0x140/0x140 [ 613.719545][T24168] should_failslab+0x5/0xf [ 613.723960][T24168] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 613.729328][T24168] ? pointer+0x7c0/0x7c0 [ 613.733577][T24168] snd_seq_create_port+0xb5/0x590 [ 613.738598][T24168] ? sprintf+0xc0/0x100 [ 613.742750][T24168] ? scnprintf+0x140/0x140 [ 613.747161][T24168] ? do_filp_open+0x192/0x260 [ 613.751841][T24168] snd_seq_ioctl_create_port+0x101/0x6d0 [ 613.757475][T24168] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 613.763462][T24168] snd_seq_kernel_client_ctl+0xeb/0x130 [ 613.769018][T24168] create_port+0x18b/0x250 [ 613.773438][T24168] ? async_call_lookup_ports+0x10/0x10 [ 613.778901][T24168] ? find_held_lock+0x2d/0x110 [ 613.783675][T24168] ? snd_seq_oss_process_event+0x2590/0x2590 [ 613.789651][T24168] ? create_port+0x250/0x250 [ 613.794239][T24168] ? debug_smp_processor_id+0x2f/0x185 [ 613.799713][T24168] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 613.805263][T24168] snd_seq_oss_open+0x2dc/0x980 [ 613.810115][T24168] odev_open+0x6c/0x90 [ 613.814177][T24168] ? odev_release+0x70/0x70 [ 613.818680][T24168] soundcore_open+0x446/0x600 [ 613.823357][T24168] ? sound_devnode+0xf0/0xf0 [ 613.827942][T24168] chrdev_open+0x219/0x5c0 [ 613.832360][T24168] ? cdev_put.part.0+0x50/0x50 [ 613.837126][T24168] ? security_file_open+0x84/0x410 [ 613.842239][T24168] do_dentry_open+0x546/0x1340 [ 613.847002][T24168] ? cdev_put.part.0+0x50/0x50 [ 613.851763][T24168] ? security_inode_permission+0xc4/0xf0 [ 613.857387][T24168] ? chown_common+0x550/0x550 [ 613.862064][T24168] ? inode_permission+0xab/0x500 [ 613.867008][T24168] path_openat+0x1e59/0x27d0 [ 613.871603][T24168] ? path_lookupat.isra.0+0x530/0x530 [ 613.876976][T24168] ? lock_acquire+0x1f2/0x8f0 [ 613.881658][T24168] do_filp_open+0x192/0x260 [ 613.886156][T24168] ? may_open_dev+0xf0/0xf0 [ 613.890668][T24168] ? do_raw_spin_lock+0x129/0x2e0 [ 613.895698][T24168] ? _raw_spin_unlock+0x24/0x40 [ 613.900544][T24168] ? __alloc_fd+0x46d/0x600 [ 613.905057][T24168] do_sys_openat2+0x585/0x7d0 [ 613.909735][T24168] ? file_open_root+0x400/0x400 [ 613.914581][T24168] ? __mutex_unlock_slowpath+0xe2/0x660 [ 613.920128][T24168] ? wait_for_completion+0x270/0x270 [ 613.925406][T24168] ? __this_cpu_preempt_check+0x28/0x190 [ 613.931041][T24168] ? __sb_end_write+0x101/0x1d0 [ 613.935895][T24168] do_sys_open+0xc3/0x140 [ 613.940229][T24168] ? filp_open+0x70/0x70 [ 613.944480][T24168] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 613.950461][T24168] ? do_syscall_64+0x21/0x7d0 [ 613.955138][T24168] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 613.961128][T24168] do_syscall_64+0xf6/0x7d0 [ 613.965633][T24168] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 613.971518][T24168] RIP: 0033:0x45ca59 [ 613.975409][T24168] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 613.995010][T24168] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 614.003423][T24168] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 614.011407][T24168] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 614.019436][T24168] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 614.027408][T24168] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 614.035378][T24168] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 614.108412][T24168] ALSA: seq_oss: can't create port [ 614.117608][ T3783] usb 5-1: USB disconnect, device number 14 22:09:53 executing program 4 (fault-call:4 fault-nth:10): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:53 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x2000000) 22:09:53 executing program 5: r0 = semget$private(0x0, 0x8, 0x0) semop(r0, &(0x7f0000000240)=[{}, {0x0, 0xffff}], 0x2) semop(r0, &(0x7f0000000080)=[{0x0, 0xfffc}], 0x1) semop(r0, &(0x7f0000000000)=[{0x0, 0x9}], 0x1) semctl$SETALL(r0, 0x0, 0x11, &(0x7f00000000c0)=[0xb3]) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x1a8b187d56fdc632, 0x0) write$nbd(r1, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:53 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d718100000008004500001400"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:53 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) socket$inet6_udplite(0xa, 0x2, 0x88) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) read$usbmon(r2, &(0x7f0000000080)=""/149, 0x95) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:53 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x600000000000000) 22:09:53 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() bpf$ENABLE_STATS(0x20, &(0x7f0000000080), 0x4) perf_event_open(&(0x7f0000000000)={0x3, 0x70, 0x40, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1, 0x0, 0x9}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r0, 0x8000000, 0x100004) wait4(0x0, 0x0, 0x0, 0x0) [ 614.682519][T24269] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 614.715148][T24269] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:53 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x3000000) 22:09:53 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0xbaf}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:53 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x4000000) 22:09:53 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x5000000) 22:09:53 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6000000) [ 614.989521][ T2469] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 615.229173][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 615.350531][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 615.358586][ T2469] usb 5-1: config 0 has no interface number 0 [ 615.366688][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 615.378048][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 615.388311][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 615.398475][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 615.407807][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 615.421105][ T2469] usb 5-1: config 0 descriptor?? [ 615.441505][T24276] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 615.448814][T24276] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 615.692229][T24276] FAULT_INJECTION: forcing a failure. [ 615.692229][T24276] name failslab, interval 1, probability 0, space 0, times 0 [ 615.721253][T24276] CPU: 1 PID: 24276 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 615.729600][T24276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 615.739659][T24276] Call Trace: [ 615.743486][T24276] dump_stack+0x188/0x20d [ 615.747818][T24276] should_fail.cold+0x5/0xa [ 615.752320][T24276] ? fault_create_debugfs_attr+0x140/0x140 [ 615.758131][T24276] should_failslab+0x5/0xf [ 615.762545][T24276] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 615.767910][T24276] ? lockdep_init_map_waits+0x26a/0x890 [ 615.773482][T24276] snd_seq_prioq_new+0x3c/0x120 [ 615.778311][T24276] snd_seq_queue_alloc+0x159/0x4d0 [ 615.783405][T24276] snd_seq_ioctl_create_queue+0xab/0x320 [ 615.789032][T24276] ? async_call_lookup_ports+0x10/0x10 [ 615.794475][T24276] snd_seq_kernel_client_ctl+0xeb/0x130 [ 615.800013][T24276] alloc_seq_queue.isra.0+0xf9/0x1a0 [ 615.805270][T24276] ? delete_port+0xc0/0xc0 [ 615.809671][T24276] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 615.815276][T24276] ? find_held_lock+0x2d/0x110 [ 615.820023][T24276] snd_seq_oss_open+0x2fe/0x980 [ 615.824949][T24276] odev_open+0x6c/0x90 [ 615.828990][T24276] ? odev_release+0x70/0x70 [ 615.833472][T24276] soundcore_open+0x446/0x600 [ 615.838140][T24276] ? sound_devnode+0xf0/0xf0 [ 615.842703][T24276] chrdev_open+0x219/0x5c0 [ 615.847095][T24276] ? cdev_put.part.0+0x50/0x50 [ 615.851856][T24276] ? security_file_open+0x84/0x410 [ 615.856944][T24276] do_dentry_open+0x546/0x1340 [ 615.861700][T24276] ? cdev_put.part.0+0x50/0x50 [ 615.866441][T24276] ? security_inode_permission+0xc4/0xf0 [ 615.872061][T24276] ? chown_common+0x550/0x550 [ 615.876709][T24276] ? inode_permission+0xab/0x500 [ 615.881712][T24276] path_openat+0x1e59/0x27d0 [ 615.886295][T24276] ? path_lookupat.isra.0+0x530/0x530 [ 615.891649][T24276] do_filp_open+0x192/0x260 [ 615.896148][T24276] ? may_open_dev+0xf0/0xf0 [ 615.900631][T24276] ? do_raw_spin_lock+0x129/0x2e0 [ 615.905653][T24276] ? _raw_spin_unlock+0x24/0x40 [ 615.910475][T24276] ? __alloc_fd+0x46d/0x600 [ 615.914956][T24276] do_sys_openat2+0x585/0x7d0 [ 615.919617][T24276] ? file_open_root+0x400/0x400 [ 615.924531][T24276] ? __mutex_unlock_slowpath+0xe2/0x660 [ 615.930066][T24276] ? wait_for_completion+0x270/0x270 [ 615.935322][T24276] ? __this_cpu_preempt_check+0x28/0x190 [ 615.940940][T24276] ? __sb_end_write+0x101/0x1d0 [ 615.945767][T24276] do_sys_open+0xc3/0x140 [ 615.950087][T24276] ? filp_open+0x70/0x70 [ 615.954317][T24276] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 615.960271][T24276] ? do_syscall_64+0x21/0x7d0 [ 615.964921][T24276] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 615.970965][T24276] do_syscall_64+0xf6/0x7d0 [ 615.975444][T24276] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 615.981320][T24276] RIP: 0033:0x45ca59 [ 615.985207][T24276] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 616.004870][T24276] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 616.013255][T24276] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 616.021212][T24276] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 616.029155][T24276] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 616.037113][T24276] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 616.045056][T24276] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 616.104722][T10916] usb 5-1: USB disconnect, device number 15 22:09:55 executing program 4 (fault-call:4 fault-nth:11): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:55 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x7000000) 22:09:55 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0xfffd, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:55 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:55 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1000000000000000) 22:09:55 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r1, 0x891a, &(0x7f00000000c0)={'sit0\x00', {0x2, 0x4e23, @remote}}) [ 616.649910][T24387] dlm: no locking on control device [ 616.664603][T24391] dlm: no locking on control device 22:09:55 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x8000000) [ 616.769161][T24408] dlm: no locking on control device 22:09:55 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x800042, 0x0) write$nbd(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="06000000000000860000000001000000a3ef07749fa50062d3adff7f9d5e82099cba335a2fdbede515d159f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667f30000000007799d8d3e7c7b812f4ba76fe205029c37214bcd3f347d7262d8141909"], 0x68) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ioctl$VFIO_CHECK_EXTENSION(r1, 0x3b65, 0x3) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) recvfrom$phonet(r2, &(0x7f0000000180)=""/109, 0x6d, 0x40002102, &(0x7f0000000200)={0x23, 0x40, 0x80, 0x4}, 0x10) read$usbfs(r1, 0x0, 0x0) getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00'}, &(0x7f0000000140)=0x44) [ 616.999032][ T3787] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 617.248993][ T3787] usb 5-1: Using ep0 maxpacket: 8 [ 617.389765][ T3787] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 617.397983][ T3787] usb 5-1: config 0 has no interface number 0 [ 617.405321][ T3787] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 617.417139][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 617.428026][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 617.438458][ T3787] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 617.448821][ T3787] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 617.461237][ T3787] usb 5-1: config 0 descriptor?? [ 617.480584][T24397] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 617.487938][T24397] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 617.737589][T24397] FAULT_INJECTION: forcing a failure. [ 617.737589][T24397] name failslab, interval 1, probability 0, space 0, times 0 [ 617.751963][T24397] CPU: 0 PID: 24397 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 617.760302][T24397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 617.770359][T24397] Call Trace: [ 617.773658][T24397] dump_stack+0x188/0x20d [ 617.778008][T24397] should_fail.cold+0x5/0xa [ 617.782526][T24397] ? fault_create_debugfs_attr+0x140/0x140 [ 617.788344][T24397] should_failslab+0x5/0xf [ 617.792768][T24397] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 617.798157][T24397] ? lockdep_init_map_waits+0x26a/0x890 [ 617.803715][T24397] snd_seq_prioq_new+0x3c/0x120 [ 617.808568][T24397] snd_seq_queue_alloc+0x159/0x4d0 [ 617.813692][T24397] snd_seq_ioctl_create_queue+0xab/0x320 [ 617.819440][T24397] ? async_call_lookup_ports+0x10/0x10 [ 617.824905][T24397] snd_seq_kernel_client_ctl+0xeb/0x130 [ 617.830458][T24397] alloc_seq_queue.isra.0+0xf9/0x1a0 [ 617.835743][T24397] ? delete_port+0xc0/0xc0 [ 617.840185][T24397] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 617.845734][T24397] ? find_held_lock+0x2d/0x110 [ 617.850508][T24397] snd_seq_oss_open+0x2fe/0x980 [ 617.855359][T24397] odev_open+0x6c/0x90 [ 617.859426][T24397] ? odev_release+0x70/0x70 [ 617.863992][T24397] soundcore_open+0x446/0x600 [ 617.868654][T24397] ? sound_devnode+0xf0/0xf0 [ 617.873226][T24397] chrdev_open+0x219/0x5c0 [ 617.877623][T24397] ? cdev_put.part.0+0x50/0x50 [ 617.882425][T24397] ? security_file_open+0x84/0x410 [ 617.887559][T24397] do_dentry_open+0x546/0x1340 [ 617.892314][T24397] ? cdev_put.part.0+0x50/0x50 [ 617.897076][T24397] ? security_inode_permission+0xc4/0xf0 [ 617.902712][T24397] ? chown_common+0x550/0x550 [ 617.907394][T24397] ? inode_permission+0xab/0x500 [ 617.912344][T24397] path_openat+0x1e59/0x27d0 [ 617.916947][T24397] ? path_lookupat.isra.0+0x530/0x530 [ 617.922325][T24397] ? lock_acquire+0x1f2/0x8f0 [ 617.927017][T24397] do_filp_open+0x192/0x260 [ 617.931524][T24397] ? may_open_dev+0xf0/0xf0 [ 617.936037][T24397] ? do_raw_spin_lock+0x129/0x2e0 [ 617.941078][T24397] ? _raw_spin_unlock+0x24/0x40 [ 617.945930][T24397] ? __alloc_fd+0x46d/0x600 [ 617.950447][T24397] do_sys_openat2+0x585/0x7d0 [ 617.955134][T24397] ? file_open_root+0x400/0x400 [ 617.959982][T24397] ? __mutex_unlock_slowpath+0xe2/0x660 [ 617.965535][T24397] ? wait_for_completion+0x270/0x270 [ 617.970822][T24397] ? __this_cpu_preempt_check+0x28/0x190 [ 617.976456][T24397] ? __sb_end_write+0x101/0x1d0 [ 617.981314][T24397] do_sys_open+0xc3/0x140 [ 617.985637][T24397] ? filp_open+0x70/0x70 [ 617.989873][T24397] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 617.996883][T24397] ? do_syscall_64+0x21/0x7d0 [ 618.001537][T24397] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 618.009789][T24397] do_syscall_64+0xf6/0x7d0 [ 618.014298][T24397] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 618.020178][T24397] RIP: 0033:0x45ca59 [ 618.024051][T24397] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 618.043687][T24397] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 618.052084][T24397] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 618.060096][T24397] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 618.068086][T24397] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 618.076045][T24397] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 618.084007][T24397] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 618.105979][ T3787] usb 5-1: USB disconnect, device number 16 22:09:56 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x9000000) 22:09:56 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, 0x140b, 0x400, 0x70bd29, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x2000800}, 0x4004) 22:09:56 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x66b50baf7b96bd16}, 0x0, 0x0, 0x0, 0x4, 0x7c4}, r0, 0x0, 0xffffffffffffffff, 0xa) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000080), 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) accept4$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev}, &(0x7f0000000140)=0x10, 0x80000) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f0000000180)) wait4(0x0, 0x0, 0x0, 0x0) [ 618.213797][T24466] dlm: no locking on control device 22:09:56 executing program 5: clone(0x2c303900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x20c800, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000100)={&(0x7f00000000c0)=[0x200, 0x10000, 0xfffffffd, 0x0, 0x40, 0x7fff, 0x8000, 0x6, 0x4, 0x80000000], 0xa, 0x800, 0x0, r1}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nvme-fabrics\x00', 0x400000, 0x0) ioctl$SNDCTL_DSP_NONBLOCK(r2, 0x500e, 0x0) [ 618.508749][T24464] __nla_validate_parse: 41 callbacks suppressed [ 618.508756][T24464] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 618.537284][T24475] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 618.547810][T24475] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:57 executing program 4 (fault-call:4 fault-nth:12): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:57 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x54608}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:57 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x10242, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x15) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') sendmsg$DEVLINK_CMD_PORT_SET(r3, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0xf8, r4, 0x1}, 0xf8}}, 0x0) sendmsg$DEVLINK_CMD_PORT_GET(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x5c, r4, 0x300, 0x70bd29, 0x25dfdbfe, {}, [{{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8}}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4040}, 0x20000000) ioctl$PPPOEIOCSFWD(r1, 0x4008b100, &(0x7f0000000100)={0x18, 0x0, {0x4, @remote, 'veth0\x00'}}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_all\x00', 0x275a, 0x0) read$usbfs(r5, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='smaps\x00') ioctl$HIDIOCGFIELDINFO(r6, 0xc038480a, &(0x7f00000001c0)={0x3, 0x100, 0x7fffffff, 0x7ff, 0x6f304c5b, 0x1, 0x94, 0x1, 0xf29a, 0x8, 0xa2d7, 0x4, 0x7, 0x9}) ioctl$PPPIOCSDEBUG(r5, 0x40047440, &(0x7f0000000140)=0x9) write$nbd(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000ef07749fa55f621500ff7f9d5e82099cba335a2fdbedd015d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb37b4667c5e7bef300"/104], 0x68) 22:09:57 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 618.564535][T24464] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 618.594594][T24491] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 618.604171][T24491] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:57 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x1100000000000000) 22:09:57 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xa000000) [ 618.660113][T24498] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 618.730090][T24513] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:57 executing program 5: clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0xbf, 0x0) write$nbd(r0, &(0x7f0000000040)={0x6000000, 0x0, 0x0, 0x0, 0x1, "a3ef07749fa55f62d3adff7f9d5e82099cba335a2fdbede515d1978b97ba59f2bcb13bedfb1f8cd563af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b4667c5e7bef3"}, 0x68) 22:09:57 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpgrp(r0) r2 = gettid() tgkill(r1, r2, 0x1c) r3 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r3, 0x4) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x2c) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r4, 0x0, 0x0) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) ptrace$setopts(0x4200, 0x0, 0x200000002, 0x100043) wait4(0x0, 0x0, 0x0, 0x0) [ 618.793392][T24513] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 618.824378][T24513] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:09:57 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xb000000) 22:09:57 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f00000000c0)={r4, 0x8}, 0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={r4, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:09:57 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xc000000) 22:09:57 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f00000000c0)={r4, 0x8}, 0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={r4, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) [ 619.029098][ T2469] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 619.268898][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 619.390387][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 619.398507][ T2469] usb 5-1: config 0 has no interface number 0 [ 619.406460][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 619.417745][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 619.427911][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 619.438639][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 619.448464][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 619.458060][ T2469] usb 5-1: config 0 descriptor?? [ 619.480250][T24514] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 619.494370][T24514] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 619.726937][T24514] FAULT_INJECTION: forcing a failure. [ 619.726937][T24514] name failslab, interval 1, probability 0, space 0, times 0 [ 619.761457][T24514] CPU: 0 PID: 24514 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 619.769812][T24514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 619.779870][T24514] Call Trace: [ 619.783168][T24514] dump_stack+0x188/0x20d [ 619.787512][T24514] should_fail.cold+0x5/0xa [ 619.792027][T24514] ? fault_create_debugfs_attr+0x140/0x140 [ 619.797849][T24514] should_failslab+0x5/0xf [ 619.802272][T24514] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 619.807658][T24514] ? lockdep_init_map_waits+0x26a/0x890 [ 619.813217][T24514] snd_seq_timer_new+0x38/0x90 [ 619.817993][T24514] snd_seq_queue_alloc+0x17e/0x4d0 [ 619.823121][T24514] snd_seq_ioctl_create_queue+0xab/0x320 [ 619.828759][T24514] ? async_call_lookup_ports+0x10/0x10 [ 619.834225][T24514] snd_seq_kernel_client_ctl+0xeb/0x130 [ 619.839782][T24514] alloc_seq_queue.isra.0+0xf9/0x1a0 [ 619.845057][T24514] ? delete_port+0xc0/0xc0 [ 619.849481][T24514] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 619.855017][T24514] ? find_held_lock+0x2d/0x110 [ 619.859784][T24514] snd_seq_oss_open+0x2fe/0x980 [ 619.864632][T24514] odev_open+0x6c/0x90 [ 619.868688][T24514] ? odev_release+0x70/0x70 [ 619.873186][T24514] soundcore_open+0x446/0x600 [ 619.877868][T24514] ? sound_devnode+0xf0/0xf0 [ 619.882457][T24514] chrdev_open+0x219/0x5c0 [ 619.886879][T24514] ? cdev_put.part.0+0x50/0x50 [ 619.891652][T24514] ? security_file_open+0x84/0x410 [ 619.896764][T24514] do_dentry_open+0x546/0x1340 [ 619.901535][T24514] ? cdev_put.part.0+0x50/0x50 [ 619.906304][T24514] ? security_inode_permission+0xc4/0xf0 [ 619.911938][T24514] ? chown_common+0x550/0x550 [ 619.916625][T24514] ? inode_permission+0xab/0x500 [ 619.921578][T24514] path_openat+0x1e59/0x27d0 [ 619.926182][T24514] ? path_lookupat.isra.0+0x530/0x530 [ 619.931561][T24514] ? lock_acquire+0x1f2/0x8f0 [ 619.936253][T24514] do_filp_open+0x192/0x260 [ 619.940765][T24514] ? may_open_dev+0xf0/0xf0 [ 619.945283][T24514] ? do_raw_spin_lock+0x129/0x2e0 [ 619.950322][T24514] ? _raw_spin_unlock+0x24/0x40 [ 619.955174][T24514] ? __alloc_fd+0x46d/0x600 [ 619.959691][T24514] do_sys_openat2+0x585/0x7d0 [ 619.964371][T24514] ? file_open_root+0x400/0x400 [ 619.969222][T24514] ? __mutex_unlock_slowpath+0xe2/0x660 [ 619.974942][T24514] ? wait_for_completion+0x270/0x270 [ 619.980224][T24514] ? __this_cpu_preempt_check+0x28/0x190 [ 619.985873][T24514] ? __sb_end_write+0x101/0x1d0 [ 619.990738][T24514] do_sys_open+0xc3/0x140 [ 619.995088][T24514] ? filp_open+0x70/0x70 [ 619.999346][T24514] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 620.005333][T24514] ? do_syscall_64+0x21/0x7d0 [ 620.010018][T24514] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 620.016178][T24514] do_syscall_64+0xf6/0x7d0 [ 620.020694][T24514] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 620.026657][T24514] RIP: 0033:0x45ca59 [ 620.030541][T24514] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 620.050143][T24514] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 620.058657][T24514] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 620.066626][T24514] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 620.074614][T24514] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 620.082581][T24514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 620.090550][T24514] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 620.176855][T10916] usb 5-1: USB disconnect, device number 17 22:09:59 executing program 4 (fault-call:4 fault-nth:13): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:09:59 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(r1, &(0x7f0000000080), 0x2, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x2c) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) ptrace$getregset(0x4204, r2, 0x6, &(0x7f00000001c0)={&(0x7f00000000c0)=""/196, 0xc4}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) bind$unix(r3, &(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e) wait4(0x0, 0x0, 0x0, 0x0) 22:09:59 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:09:59 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2900000000000000) 22:09:59 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xe000000) 22:09:59 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xf000000) 22:09:59 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x80000001, 0x5}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9, 0x4}, r0, 0x3, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:59 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x2c) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) ptrace$cont(0x18, r1, 0x10001, 0x8001) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="cc000000090603000000000000000000070000070900020073797a300000000005000100070000000500010007000000600008801c0007801800168014000240fc0100000000000000000000000000e7100007800c001b40000000f1ff000003100007800c00184000000000000007ff100007800900120073797a3000000000100007800900120073797a31000000003c000780060005404e2300001800018014000240fe8000000000000000000000000000aa1800168014000240fe8000000000000000000000000000aa"], 0xcc}, 0x1, 0x0, 0x0, 0x10}, 0x4) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() read(0xffffffffffffffff, &(0x7f0000000240)=""/235, 0xeb) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x1}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r3, 0x4) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:59 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x10000000) [ 621.018685][ T3783] usb 5-1: new high-speed USB device number 18 using dummy_hcd 22:09:59 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() clock_nanosleep(0x6, 0x1, &(0x7f0000000080)={0x0, 0x3938700}, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000480)={0x53, 0xfffffffffffffffc, 0x43, 0x2, @buffer={0x0, 0xd4, &(0x7f0000000240)=""/212}, &(0x7f0000000340)="21bd2ef1fd3255229df56228c6f6c92cd9c99b77b48b26226044f8c3b280e1fb0190b139dd6cf9beb3bb080be964b5622e821de9dba0d3979ec860cb806c8fcee9e5d5", &(0x7f00000003c0)=""/97, 0x1f, 0x24, 0x2, &(0x7f0000000440)}) tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) r4 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f00000000c0)={r5, 0x8}, 0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000100)={r5, @in={{0x2, 0x4e21, @rand_addr=0x64010101}}, [0x1, 0x1, 0xa19d, 0x8000, 0x5, 0x100000000, 0x2, 0xab95, 0x1, 0x7, 0x6, 0x100, 0x8, 0x9, 0x5]}, &(0x7f0000000200)=0x100) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x2, 0xfc, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x648}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:09:59 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x11000000) [ 621.314980][ T3783] usb 5-1: Using ep0 maxpacket: 8 [ 621.448701][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 621.460607][ T3783] usb 5-1: config 0 has no interface number 0 [ 621.476463][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 621.502999][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 621.531376][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 621.554512][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 621.575237][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.609506][ T3783] usb 5-1: config 0 descriptor?? [ 621.650070][T24617] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 621.657358][T24617] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 621.916503][T24617] FAULT_INJECTION: forcing a failure. [ 621.916503][T24617] name failslab, interval 1, probability 0, space 0, times 0 [ 621.940366][T24617] CPU: 0 PID: 24617 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 621.948723][T24617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 621.958780][T24617] Call Trace: [ 621.962078][T24617] dump_stack+0x188/0x20d [ 621.966421][T24617] should_fail.cold+0x5/0xa [ 621.970937][T24617] ? fault_create_debugfs_attr+0x140/0x140 [ 621.976758][T24617] should_failslab+0x5/0xf [ 621.981183][T24617] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 621.986560][T24617] ? mark_lock+0x11f/0xdd0 [ 621.991068][T24617] snd_timer_instance_new+0x44/0x2f0 [ 621.996361][T24617] snd_seq_timer_open+0x1a5/0x530 [ 622.001394][T24617] ? snd_seq_timer_set_skew+0xc0/0xc0 [ 622.007252][T24617] ? mark_held_locks+0x9f/0xe0 [ 622.012031][T24617] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 622.017846][T24617] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 622.023838][T24617] queue_use+0xe6/0x250 [ 622.028011][T24617] snd_seq_queue_alloc+0x2c6/0x4d0 [ 622.033135][T24617] snd_seq_ioctl_create_queue+0xab/0x320 [ 622.038772][T24617] ? async_call_lookup_ports+0x10/0x10 [ 622.044239][T24617] snd_seq_kernel_client_ctl+0xeb/0x130 [ 622.049799][T24617] alloc_seq_queue.isra.0+0xf9/0x1a0 [ 622.055082][T24617] ? delete_port+0xc0/0xc0 [ 622.059516][T24617] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 622.065062][T24617] ? find_held_lock+0x2d/0x110 [ 622.069838][T24617] snd_seq_oss_open+0x2fe/0x980 [ 622.074714][T24617] odev_open+0x6c/0x90 [ 622.078782][T24617] ? odev_release+0x70/0x70 [ 622.083274][T24617] soundcore_open+0x446/0x600 [ 622.087934][T24617] ? sound_devnode+0xf0/0xf0 [ 622.092514][T24617] chrdev_open+0x219/0x5c0 [ 622.096934][T24617] ? cdev_put.part.0+0x50/0x50 [ 622.101692][T24617] ? security_file_open+0x84/0x410 [ 622.106839][T24617] do_dentry_open+0x546/0x1340 [ 622.111595][T24617] ? cdev_put.part.0+0x50/0x50 [ 622.116350][T24617] ? security_inode_permission+0xc4/0xf0 [ 622.121960][T24617] ? chown_common+0x550/0x550 [ 622.126642][T24617] ? inode_permission+0xab/0x500 [ 622.131588][T24617] path_openat+0x1e59/0x27d0 [ 622.136180][T24617] ? path_lookupat.isra.0+0x530/0x530 [ 622.141542][T24617] ? lock_acquire+0x1f2/0x8f0 [ 622.146213][T24617] do_filp_open+0x192/0x260 [ 622.150714][T24617] ? may_open_dev+0xf0/0xf0 [ 622.155217][T24617] ? do_raw_spin_lock+0x129/0x2e0 [ 622.160250][T24617] ? _raw_spin_unlock+0x24/0x40 [ 622.165090][T24617] ? __alloc_fd+0x46d/0x600 [ 622.169594][T24617] do_sys_openat2+0x585/0x7d0 [ 622.174262][T24617] ? file_open_root+0x400/0x400 [ 622.179104][T24617] ? __mutex_unlock_slowpath+0xe2/0x660 [ 622.184656][T24617] ? wait_for_completion+0x270/0x270 [ 622.189944][T24617] ? __this_cpu_preempt_check+0x28/0x190 [ 622.195562][T24617] ? __sb_end_write+0x101/0x1d0 [ 622.200408][T24617] do_sys_open+0xc3/0x140 [ 622.204730][T24617] ? filp_open+0x70/0x70 [ 622.209000][T24617] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 622.214971][T24617] ? do_syscall_64+0x21/0x7d0 [ 622.219640][T24617] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 622.225623][T24617] do_syscall_64+0xf6/0x7d0 [ 622.230139][T24617] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 622.236023][T24617] RIP: 0033:0x45ca59 [ 622.239922][T24617] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 622.259614][T24617] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 22:10:01 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f00000000c0)={r4, 0x8}, 0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={r4, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) [ 622.268022][T24617] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 622.275988][T24617] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 622.283954][T24617] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 622.291914][T24617] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 622.299883][T24617] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 622.359097][ T35] usb 5-1: USB disconnect, device number 18 22:10:01 executing program 4 (fault-call:4 fault-nth:14): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:01 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x12000000) 22:10:01 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800450000"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:01 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2b00000000000000) 22:10:01 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x2c) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) wait4(r2, 0x0, 0x4, 0x0) 22:10:01 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x4, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ioctl$RTC_ALM_READ(0xffffffffffffffff, 0x80247008, &(0x7f00000000c0)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(r2, 0x10f, 0x88) wait4(0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$video(&(0x7f0000000100)='/dev/video#\x00', 0x0, 0x58000) ioctl$VIDIOC_ENCODER_CMD(r3, 0xc028564d, &(0x7f0000000140)={0x0, 0x0, [0x4, 0x5, 0x8, 0x20, 0x5, 0x1, 0x7fff, 0xffff]}) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000080)=0x9, 0x2) 22:10:01 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x12060000) 22:10:01 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x13000000) 22:10:01 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="ff000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)=@newlink={0x48, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x3}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r5}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @local}, @IFLA_IPTUN_TTL={0x5}]}}}]}, 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)=@can_newroute={0x70, 0x18, 0x1, 0x70bd25, 0x25dfdbfd, {0x1d, 0x1, 0x6}, [@CGW_DST_IF={0x8}, @CGW_FILTER={0xc, 0xb, {{0x0, 0x1}, {0x2, 0x0, 0x1, 0x1}}}, @CGW_MOD_SET={0x15, 0x4, {{{0x1, 0x0, 0x1}, 0x6, 0x3, 0x0, 0x0, "6d3dc6404fde019f"}, 0x2}}, @CGW_LIM_HOPS={0x5, 0xd, 0x6a}, @CGW_DST_IF={0x8}, @CGW_MOD_OR={0x15, 0x2, {{{0x4, 0x1, 0x1, 0x1}, 0x8, 0x2, 0x0, 0x0, "2ef9ecad3ba7c48f"}, 0x2}}, @CGW_SRC_IF={0x8, 0x9, r2}]}, 0x70}, 0x1, 0x0, 0x0, 0x8040}, 0x44000) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='pids.current\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r6, 0xc4c85512, &(0x7f00000000c0)={{0x6, 0xc, 0x1f1, 0x6, '\x00', 0x400}, 0x0, [0xffffffffffffff00, 0x9, 0x6, 0x1ff, 0x0, 0x3ff, 0x4, 0x0, 0x83, 0x7ff, 0xffffffff, 0x101, 0x5, 0x6, 0x7fffffff, 0x5, 0x2, 0x7, 0x2, 0xf33d, 0x7, 0x9e10, 0x3, 0x2, 0x1f, 0x2, 0xff, 0x2, 0x5, 0x5, 0x7, 0x4, 0x448ece00, 0xed, 0x73f1, 0x2, 0x37, 0x4, 0x7, 0x6, 0x2df2, 0x1, 0x1f, 0xfffffffffffffffa, 0xbd63, 0x3, 0x200, 0x0, 0x2, 0x5, 0x8, 0x6, 0x3, 0x0, 0x8, 0x6, 0x2, 0x0, 0x1f, 0x8, 0x7f, 0x1, 0x8001, 0x8, 0x7f, 0x100, 0x3, 0x1, 0x1, 0x6, 0x4394, 0xffffffff, 0x7, 0xffffffff, 0x0, 0x9c, 0x8001, 0x80000001, 0xffff, 0x7, 0x1, 0x7, 0x1ff, 0x200, 0x400, 0xff, 0x9a7, 0x5f1, 0x7ff, 0xffffffffffffffff, 0x10000, 0x100000001, 0x9, 0x3, 0x2a466622, 0x2, 0x7, 0x3, 0x3, 0xe1e, 0x6efe, 0x2, 0x5, 0x20, 0x200, 0x400, 0xff, 0x79, 0x101, 0x9, 0xbc77, 0x6, 0xdb00, 0xfffffffffffffe01, 0x1, 0x5, 0x8, 0x7, 0x7, 0xbe26, 0x1, 0x6, 0x3ff800, 0x8, 0x8, 0x800, 0xe4d5, 0x7]}) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:01 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x20000000) [ 623.130720][T24757] 8021q: adding VLAN 0 to HW filter on device bond2 22:10:01 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x3f000000) [ 623.208544][ T35] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 623.448619][ T35] usb 5-1: Using ep0 maxpacket: 8 [ 623.570244][ T35] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 623.578268][ T35] usb 5-1: config 0 has no interface number 0 [ 623.594311][ T35] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 623.607550][ T35] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 623.625690][ T35] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 623.636700][ T35] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 623.646666][ T35] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 623.659542][ T35] usb 5-1: config 0 descriptor?? [ 623.679902][T24732] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 623.687219][T24732] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 623.928590][T24732] FAULT_INJECTION: forcing a failure. [ 623.928590][T24732] name failslab, interval 1, probability 0, space 0, times 0 [ 623.952689][T24732] CPU: 0 PID: 24732 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 623.961039][T24732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 623.971090][T24732] Call Trace: [ 623.974387][T24732] dump_stack+0x188/0x20d [ 623.978721][T24732] should_fail.cold+0x5/0xa [ 623.983224][T24732] ? fault_create_debugfs_attr+0x140/0x140 [ 623.989056][T24732] should_failslab+0x5/0xf [ 623.993470][T24732] __kmalloc_track_caller+0x2d1/0x7a0 [ 623.998845][T24732] ? snd_timer_instance_new+0x62/0x2f0 [ 624.004307][T24732] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 624.009863][T24732] kstrdup+0x36/0x70 [ 624.013764][T24732] snd_timer_instance_new+0x62/0x2f0 [ 624.019055][T24732] snd_seq_timer_open+0x1a5/0x530 [ 624.024101][T24732] ? snd_seq_timer_set_skew+0xc0/0xc0 [ 624.029474][T24732] ? mark_held_locks+0x9f/0xe0 [ 624.034233][T24732] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 624.040037][T24732] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 624.046022][T24732] queue_use+0xe6/0x250 [ 624.050186][T24732] snd_seq_queue_alloc+0x2c6/0x4d0 [ 624.055300][T24732] snd_seq_ioctl_create_queue+0xab/0x320 [ 624.060924][T24732] ? async_call_lookup_ports+0x10/0x10 [ 624.066392][T24732] snd_seq_kernel_client_ctl+0xeb/0x130 [ 624.071940][T24732] alloc_seq_queue.isra.0+0xf9/0x1a0 [ 624.077217][T24732] ? delete_port+0xc0/0xc0 [ 624.081650][T24732] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 624.087196][T24732] ? find_held_lock+0x2d/0x110 [ 624.091970][T24732] snd_seq_oss_open+0x2fe/0x980 [ 624.096828][T24732] odev_open+0x6c/0x90 [ 624.100897][T24732] ? odev_release+0x70/0x70 [ 624.105398][T24732] soundcore_open+0x446/0x600 [ 624.110082][T24732] ? sound_devnode+0xf0/0xf0 [ 624.114682][T24732] chrdev_open+0x219/0x5c0 [ 624.119101][T24732] ? cdev_put.part.0+0x50/0x50 [ 624.123871][T24732] ? security_file_open+0x84/0x410 [ 624.128989][T24732] do_dentry_open+0x546/0x1340 [ 624.133767][T24732] ? cdev_put.part.0+0x50/0x50 [ 624.138538][T24732] ? security_inode_permission+0xc4/0xf0 [ 624.144174][T24732] ? chown_common+0x550/0x550 [ 624.148857][T24732] ? inode_permission+0xab/0x500 [ 624.153804][T24732] path_openat+0x1e59/0x27d0 [ 624.158405][T24732] ? path_lookupat.isra.0+0x530/0x530 [ 624.163780][T24732] ? lock_acquire+0x1f2/0x8f0 [ 624.168466][T24732] do_filp_open+0x192/0x260 [ 624.172960][T24732] ? may_open_dev+0xf0/0xf0 [ 624.177443][T24732] ? do_raw_spin_lock+0x129/0x2e0 [ 624.182469][T24732] ? _raw_spin_unlock+0x24/0x40 [ 624.187318][T24732] ? __alloc_fd+0x46d/0x600 [ 624.191819][T24732] do_sys_openat2+0x585/0x7d0 [ 624.196484][T24732] ? file_open_root+0x400/0x400 [ 624.201319][T24732] ? __mutex_unlock_slowpath+0xe2/0x660 [ 624.206851][T24732] ? wait_for_completion+0x270/0x270 [ 624.212110][T24732] ? __this_cpu_preempt_check+0x28/0x190 [ 624.217717][T24732] ? __sb_end_write+0x101/0x1d0 [ 624.222563][T24732] do_sys_open+0xc3/0x140 [ 624.226880][T24732] ? filp_open+0x70/0x70 [ 624.231100][T24732] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 624.237062][T24732] ? do_syscall_64+0x21/0x7d0 [ 624.241728][T24732] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 624.247721][T24732] do_syscall_64+0xf6/0x7d0 [ 624.252209][T24732] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 624.258120][T24732] RIP: 0033:0x45ca59 [ 624.262015][T24732] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 624.281633][T24732] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 624.290036][T24732] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 624.297989][T24732] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 624.305952][T24732] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 624.313931][T24732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 624.321886][T24732] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 624.343941][ T3787] usb 5-1: USB disconnect, device number 19 22:10:04 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f00000000c0)={r4, 0x8}, 0x8) 22:10:04 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x6}, r0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x4c041, 0x0) ioctl$RTC_PIE_OFF(r2, 0x7006) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f00000000c0)=0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) r4 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r4, 0x0, 0x80001d00c0d0) r5 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0xb4, r5, 0x2, 0x0, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x22, 0x8}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1a}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x17, 0x1}}, @IPVS_SVC_ATTR_FLAGS={0xc}]}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x8001}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syzkaller1\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000014}, 0x4080) sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0xf0, r5, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0xe}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x9fa9cf05463bb47a, 0x8}}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8001}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1e4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5e}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@private=0xa010101}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffff00}]}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xa, 0x1}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x3196291b5572f39}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0xa}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x9, 0x10}}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xffff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7ff}]}, 0xf0}, 0x1, 0x0, 0x0, 0x9}, 0x80) 22:10:04 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x48000000) 22:10:04 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:04 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2c00000000000000) 22:10:04 executing program 4 (fault-call:4 fault-nth:15): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) [ 625.472364][T24858] __nla_validate_parse: 70 callbacks suppressed [ 625.472374][T24858] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 625.512866][T24858] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 625.542240][T24858] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:04 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x4c000000) [ 625.571581][T24858] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 625.585808][T24884] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 625.600404][T24884] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:04 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000240)=ANY=[@ANYRESHEX, @ANYRES32=r5, @ANYBLOB="ff000000000000001c001200abccee33000000000000000000e1686599ac9b26cf7503aefa32cc63", @ANYRESDEC=r5], 0x3c}}, 0x44) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="480000001000390400"/20, @ANYRES32=r2, @ANYBLOB="03000000000000002800128008000100736974001c000280080001005abf09b77a0867044d999a27f03f06da13caa660695f8f8035c0c77953417d3162e227f6c0428721fa4c121c2181cfd431922f6e10d671f5837af4226caf2a07099d0ab9167d5ef81406455fd4b3d81cf6edab99311c5ee0b8ffa0f4505da1b2d20f61d1efa4a5124ae169079e1f5b50e0382f03", @ANYRES32=r5, @ANYBLOB="08000300ac1414aa0500040000000000"], 0x48}}, 0x0) connect$can_j1939(0xffffffffffffffff, &(0x7f0000000080)={0x1d, r2, 0x2, {0x0, 0x0, 0x1}, 0x2}, 0x18) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) [ 625.656728][T24887] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 625.684498][T24887] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 625.694313][T24887] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:04 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x60000000) [ 625.734269][T24887] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 625.749871][T24897] ptrace attach of "/root/syz-executor.2"[24895] was attempted by "/root/syz-executor.2"[24897] 22:10:04 executing program 2: r0 = syz_open_dev$vcsu(&(0x7f0000000080)='/dev/vcsu#\x00', 0x0, 0x2) ioctl$USBDEVFS_DROP_PRIVILEGES(r0, 0x4004551e, &(0x7f00000000c0)=0x7fffffff) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() tkill(r1, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x2}, r1, 0x4, 0xffffffffffffffff, 0x0) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:04 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0xfffffffffffffffc}, r0, 0x0, 0xffffffffffffffff, 0x2) tkill(r1, 0x4) ptrace$setregs(0xd, r1, 0x5, &(0x7f0000000080)="c5c1893dca8d90d51698c312c5e694f9b45a8d4742e3d1a794a9f878cc403ae407ef7c325ba985a5076d23007a03adbfe60dc2d63acfaa97320714906be17b410421f3815b06011c80983572bc23c28b93475d672d157646c008793424c3c59ef157cfee25cf875f927fb044d60ec3fd36a7fc2fc2") ptrace$setopts(0x4206, r1, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) fstatfs(r2, &(0x7f0000000100)=""/60) wait4(0x0, 0x0, 0x0, 0x0) [ 625.798287][ T3787] usb 5-1: new high-speed USB device number 20 using dummy_hcd 22:10:04 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x65580000) [ 626.038279][ T3787] usb 5-1: Using ep0 maxpacket: 8 [ 626.159339][ T3787] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 626.167418][ T3787] usb 5-1: config 0 has no interface number 0 [ 626.174070][ T3787] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 626.185613][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 626.196483][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 626.207196][ T3787] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 626.216439][ T3787] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 626.229275][ T3787] usb 5-1: config 0 descriptor?? [ 626.249329][T24860] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 626.256590][T24860] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 626.507830][T24860] FAULT_INJECTION: forcing a failure. [ 626.507830][T24860] name failslab, interval 1, probability 0, space 0, times 0 [ 626.558196][T24860] CPU: 0 PID: 24860 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 626.566553][T24860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 626.576607][T24860] Call Trace: [ 626.579900][T24860] dump_stack+0x188/0x20d [ 626.584348][T24860] should_fail.cold+0x5/0xa [ 626.588864][T24860] ? fault_create_debugfs_attr+0x140/0x140 [ 626.594673][T24860] should_failslab+0x5/0xf [ 626.599167][T24860] __kmalloc+0x2d9/0x7a0 [ 626.603405][T24860] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 626.608942][T24860] ? snd_seq_oss_readq_new+0x94/0x2d0 [ 626.614306][T24860] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 626.619850][T24860] snd_seq_oss_readq_new+0x94/0x2d0 [ 626.625055][T24860] snd_seq_oss_open+0x4ce/0x980 [ 626.629915][T24860] odev_open+0x6c/0x90 [ 626.633984][T24860] ? odev_release+0x70/0x70 [ 626.638496][T24860] soundcore_open+0x446/0x600 [ 626.643200][T24860] ? sound_devnode+0xf0/0xf0 [ 626.647796][T24860] chrdev_open+0x219/0x5c0 [ 626.652219][T24860] ? cdev_put.part.0+0x50/0x50 [ 626.656995][T24860] ? security_file_open+0x84/0x410 [ 626.662112][T24860] do_dentry_open+0x546/0x1340 [ 626.666880][T24860] ? cdev_put.part.0+0x50/0x50 [ 626.671650][T24860] ? security_inode_permission+0xc4/0xf0 [ 626.677286][T24860] ? chown_common+0x550/0x550 [ 626.681968][T24860] ? inode_permission+0xab/0x500 [ 626.686920][T24860] path_openat+0x1e59/0x27d0 [ 626.691556][T24860] ? path_lookupat.isra.0+0x530/0x530 [ 626.696927][T24860] do_filp_open+0x192/0x260 [ 626.701434][T24860] ? may_open_dev+0xf0/0xf0 [ 626.705922][T24860] ? do_raw_spin_lock+0x129/0x2e0 [ 626.710952][T24860] ? _raw_spin_unlock+0x24/0x40 [ 626.715791][T24860] ? __alloc_fd+0x46d/0x600 [ 626.720294][T24860] do_sys_openat2+0x585/0x7d0 [ 626.724964][T24860] ? file_open_root+0x400/0x400 [ 626.729796][T24860] ? __mutex_unlock_slowpath+0xe2/0x660 [ 626.735322][T24860] ? wait_for_completion+0x270/0x270 [ 626.740586][T24860] ? __this_cpu_preempt_check+0x28/0x190 [ 626.746205][T24860] ? __sb_end_write+0x101/0x1d0 [ 626.751053][T24860] do_sys_open+0xc3/0x140 [ 626.755360][T24860] ? filp_open+0x70/0x70 [ 626.759584][T24860] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 626.765545][T24860] ? do_syscall_64+0x21/0x7d0 [ 626.770213][T24860] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 626.776186][T24860] do_syscall_64+0xf6/0x7d0 [ 626.780741][T24860] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 626.786616][T24860] RIP: 0033:0x45ca59 [ 626.790501][T24860] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 626.810100][T24860] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 626.818532][T24860] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 626.826504][T24860] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 626.834471][T24860] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 626.842439][T24860] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 626.850405][T24860] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 626.935141][ T3787] usb 5-1: USB disconnect, device number 20 22:10:07 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f00000000c0)={r4, 0x8}, 0x8) 22:10:07 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0xf) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:07 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x677c0dd7) 22:10:07 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x2f00000000000000) 22:10:07 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d718100000008"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:07 executing program 4 (fault-call:4 fault-nth:16): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:07 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180)='batadv\x00') sendmsg$BATADV_CMD_GET_GATEWAYS(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r2, 0x2, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x90}, 0x44) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r3, 0xc0884123, &(0x7f0000000080)={0x6, "9d7e46d707e6ecaba33b04ce395cd49b3a191cf6477a9509440c22f8e8a70dc8fd972e717850acd80c5a9e1ea2adacd30a6f60ba8aa21ff768a8e35a80cc7157", {0x5}}) r4 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r4, 0x4) ptrace$setopts(0x4206, r4, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:07 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x68000000) 22:10:07 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6c000000) 22:10:07 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x74000000) 22:10:07 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x7a000000) 22:10:07 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x80780000) [ 628.864563][ T35] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 629.108058][ T35] usb 5-1: Using ep0 maxpacket: 8 [ 629.228091][ T35] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 629.236252][ T35] usb 5-1: config 0 has no interface number 0 [ 629.242859][ T35] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 629.254208][ T35] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 629.265417][ T35] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 629.276097][ T35] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 629.286085][ T35] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.303849][ T35] usb 5-1: config 0 descriptor?? [ 629.339435][T24975] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 629.346593][T24975] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 629.563173][T24975] FAULT_INJECTION: forcing a failure. [ 629.563173][T24975] name failslab, interval 1, probability 0, space 0, times 0 [ 629.602610][T24975] CPU: 1 PID: 24975 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 629.610965][T24975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 629.621069][T24975] Call Trace: [ 629.624349][T24975] dump_stack+0x188/0x20d [ 629.628685][T24975] should_fail.cold+0x5/0xa [ 629.633196][T24975] ? fault_create_debugfs_attr+0x140/0x140 [ 629.638995][T24975] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 629.644972][T24975] should_failslab+0x5/0xf [ 629.649433][T24975] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 629.654796][T24975] ? lockdep_init_map_waits+0x26a/0x890 [ 629.660379][T24975] ? __raw_spin_lock_init+0x34/0x100 [ 629.665648][T24975] snd_seq_oss_timer_new+0x40/0x240 [ 629.670828][T24975] snd_seq_oss_open+0x553/0x980 [ 629.675663][T24975] odev_open+0x6c/0x90 [ 629.679721][T24975] ? odev_release+0x70/0x70 [ 629.684230][T24975] soundcore_open+0x446/0x600 [ 629.688911][T24975] ? sound_devnode+0xf0/0xf0 [ 629.693504][T24975] chrdev_open+0x219/0x5c0 [ 629.697925][T24975] ? cdev_put.part.0+0x50/0x50 [ 629.702700][T24975] ? security_file_open+0x84/0x410 [ 629.707818][T24975] do_dentry_open+0x546/0x1340 [ 629.712588][T24975] ? cdev_put.part.0+0x50/0x50 [ 629.717332][T24975] ? security_inode_permission+0xc4/0xf0 [ 629.722943][T24975] ? chown_common+0x550/0x550 [ 629.727596][T24975] ? inode_permission+0xab/0x500 [ 629.732519][T24975] path_openat+0x1e59/0x27d0 [ 629.737092][T24975] ? path_lookupat.isra.0+0x530/0x530 [ 629.742468][T24975] do_filp_open+0x192/0x260 [ 629.746992][T24975] ? may_open_dev+0xf0/0xf0 [ 629.751479][T24975] ? do_raw_spin_lock+0x129/0x2e0 [ 629.756487][T24975] ? _raw_spin_unlock+0x24/0x40 [ 629.761409][T24975] ? __alloc_fd+0x46d/0x600 [ 629.765916][T24975] do_sys_openat2+0x585/0x7d0 [ 629.770576][T24975] ? file_open_root+0x400/0x400 [ 629.775409][T24975] ? __mutex_unlock_slowpath+0xe2/0x660 [ 629.780939][T24975] ? wait_for_completion+0x270/0x270 [ 629.786219][T24975] ? __this_cpu_preempt_check+0x28/0x190 [ 629.791837][T24975] ? __sb_end_write+0x101/0x1d0 [ 629.796672][T24975] do_sys_open+0xc3/0x140 [ 629.800993][T24975] ? filp_open+0x70/0x70 [ 629.805218][T24975] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 629.811198][T24975] ? do_syscall_64+0x21/0x7d0 [ 629.815873][T24975] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 629.821851][T24975] do_syscall_64+0xf6/0x7d0 [ 629.826363][T24975] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 629.832371][T24975] RIP: 0033:0x45ca59 [ 629.836256][T24975] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 629.855835][T24975] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 629.864236][T24975] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 629.872192][T24975] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 629.880151][T24975] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 629.888161][T24975] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 629.896162][T24975] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 630.029024][T24975] ALSA: seq_oss: can't alloc timer [ 630.048092][ T3784] usb 5-1: USB disconnect, device number 21 22:10:10 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f00000000c0)={r4, 0x8}, 0x8) 22:10:10 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x81000000) 22:10:10 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3a00000000000000) 22:10:10 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d718100000008"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:10 executing program 4 (fault-call:4 fault-nth:17): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:10 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x2c) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r3, 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000080)={0x1, 0x9, {r3}, {0xee00}, 0x7, 0x3bb1}) fcntl$setownex(r2, 0xf, &(0x7f00000000c0)={0x1, r4}) [ 631.691194][T25088] __nla_validate_parse: 42 callbacks suppressed [ 631.691204][T25088] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:10 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x88a8ffff) [ 631.764435][T25088] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 631.826022][T25120] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:10 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x9effffff) [ 631.871180][T25120] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:10 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f0000000100)=[@in6={0xa, 0x4e22, 0x400, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4}, @in={0x2, 0x4e24, @private=0xa010102}, @in6={0xa, 0x4e21, 0x5, @remote, 0x3ff}], 0x48) ptrace$setopts(0x4206, r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(r3, 0x113, 0x1, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$KVM_GET_XCRS(r3, 0x8188aea6, &(0x7f0000000180)={0x7, 0x9, [{0x3, 0x0, 0x20}, {0x6, 0x0, 0x2}, {0x9, 0x0, 0x9}, {0xfffffff7, 0x0, 0x800}, {0x6, 0x0, 0x7}, {0x494, 0x0, 0x92}, {0x8, 0x0, 0x4}]}) wait4(0x0, 0x0, 0x0, 0x0) [ 631.917210][T25128] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:10 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xc0000000) [ 631.959646][T25128] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 631.999586][T25140] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:10 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xc00e0000) [ 632.009436][ T3784] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 632.035620][T25140] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:10 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xd70d7c67) [ 632.083018][T25152] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 632.112675][T25152] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 632.277739][ T3784] usb 5-1: Using ep0 maxpacket: 8 [ 632.417829][ T3784] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 632.428193][ T3784] usb 5-1: config 0 has no interface number 0 [ 632.436711][ T3784] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 632.454928][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 632.466234][ T3784] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 632.484123][ T3784] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 632.494266][ T3784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 632.518124][ T3784] usb 5-1: config 0 descriptor?? [ 632.538753][T25096] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 632.545966][T25096] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 632.786650][T25087] FAULT_INJECTION: forcing a failure. [ 632.786650][T25087] name failslab, interval 1, probability 0, space 0, times 0 [ 632.832915][T25087] CPU: 0 PID: 25087 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 632.841269][T25087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 632.851327][T25087] Call Trace: [ 632.854627][T25087] dump_stack+0x188/0x20d [ 632.858972][T25087] should_fail.cold+0x5/0xa [ 632.863486][T25087] ? fault_create_debugfs_attr+0x140/0x140 [ 632.869308][T25087] should_failslab+0x5/0xf [ 632.873727][T25087] __kmalloc+0x2d9/0x7a0 [ 632.877981][T25087] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 632.883531][T25087] ? snd_seq_oss_readq_new+0x94/0x2d0 [ 632.888909][T25087] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 632.894468][T25087] snd_seq_oss_readq_new+0x94/0x2d0 [ 632.899672][T25087] snd_seq_oss_open+0x4ce/0x980 [ 632.904530][T25087] odev_open+0x6c/0x90 [ 632.908595][T25087] ? odev_release+0x70/0x70 [ 632.913102][T25087] soundcore_open+0x446/0x600 [ 632.917783][T25087] ? sound_devnode+0xf0/0xf0 [ 632.922379][T25087] chrdev_open+0x219/0x5c0 [ 632.926804][T25087] ? cdev_put.part.0+0x50/0x50 [ 632.931574][T25087] ? security_file_open+0x84/0x410 [ 632.936699][T25087] do_dentry_open+0x546/0x1340 [ 632.941470][T25087] ? cdev_put.part.0+0x50/0x50 [ 632.946238][T25087] ? security_inode_permission+0xc4/0xf0 [ 632.951871][T25087] ? chown_common+0x550/0x550 [ 632.956552][T25087] ? inode_permission+0xab/0x500 [ 632.961497][T25087] path_openat+0x1e59/0x27d0 [ 632.966099][T25087] ? path_lookupat.isra.0+0x530/0x530 [ 632.971479][T25087] ? lock_acquire+0x1f2/0x8f0 [ 632.976167][T25087] do_filp_open+0x192/0x260 [ 632.980673][T25087] ? may_open_dev+0xf0/0xf0 [ 632.985188][T25087] ? do_raw_spin_lock+0x129/0x2e0 [ 632.990229][T25087] ? _raw_spin_unlock+0x24/0x40 [ 632.995079][T25087] ? __alloc_fd+0x46d/0x600 [ 632.999597][T25087] do_sys_openat2+0x585/0x7d0 [ 633.004283][T25087] ? file_open_root+0x400/0x400 [ 633.009132][T25087] ? __mutex_unlock_slowpath+0xe2/0x660 [ 633.014682][T25087] ? wait_for_completion+0x270/0x270 [ 633.019963][T25087] ? __this_cpu_preempt_check+0x28/0x190 [ 633.025592][T25087] ? __sb_end_write+0x101/0x1d0 [ 633.030443][T25087] do_sys_open+0xc3/0x140 [ 633.034772][T25087] ? filp_open+0x70/0x70 [ 633.039014][T25087] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 633.044994][T25087] ? do_syscall_64+0x21/0x7d0 [ 633.049668][T25087] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 633.055650][T25087] do_syscall_64+0xf6/0x7d0 [ 633.060153][T25087] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 633.066039][T25087] RIP: 0033:0x45ca59 [ 633.069932][T25087] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 633.089528][T25087] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 633.097938][T25087] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 633.105916][T25087] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 633.113889][T25087] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 633.121859][T25087] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 633.129827][T25087] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 633.252448][ T35] usb 5-1: USB disconnect, device number 22 22:10:13 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={r3, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xe03f0300) 22:10:13 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d718100000008"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:13 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3c00000000000000) 22:10:13 executing program 4 (fault-call:4 fault-nth:18): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xeffdffff) 22:10:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xf0ffffff) 22:10:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xf1ffffff) 22:10:13 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) close(r0) clone(0x20002804bfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() tkill(r1, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0x0, 0xffffffffffffffff, 0x0) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) socketpair(0x10, 0x1, 0xb2200000, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f00000000c0)={0x2c, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e22, 0x4, 'sed\x00', 0xa, 0xad2, 0x3d}, 0x2c) r5 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x80001d00c0d0) r6 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_GET_SERVICE(r5, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0xb4, r6, 0x2, 0x0, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x22, 0x8}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1a}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x17, 0x1}}, @IPVS_SVC_ATTR_FLAGS={0xc}]}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x8001}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syzkaller1\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000014}, 0x4080) sendmsg$IPVS_CMD_SET_SERVICE(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x74, r6, 0x20, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x800}, @IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8e}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xffffffff}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x44000}, 0x52884) 22:10:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xfcffffff) [ 635.017579][ T35] usb 5-1: new high-speed USB device number 23 using dummy_hcd 22:10:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xff030000) 22:10:13 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xffffa888) [ 635.297661][ T35] usb 5-1: Using ep0 maxpacket: 8 [ 635.428145][ T35] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 635.437002][ T35] usb 5-1: config 0 has no interface number 0 [ 635.447543][ T35] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 635.462775][ T35] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 635.474108][ T35] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 635.487902][ T35] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 635.496947][ T35] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 635.517270][ T35] usb 5-1: config 0 descriptor?? [ 635.539552][T25214] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 635.546862][T25214] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 635.782514][T25214] FAULT_INJECTION: forcing a failure. [ 635.782514][T25214] name failslab, interval 1, probability 0, space 0, times 0 [ 635.822510][T25214] CPU: 1 PID: 25214 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 635.830863][T25214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 635.841006][T25214] Call Trace: [ 635.844310][T25214] dump_stack+0x188/0x20d [ 635.848655][T25214] should_fail.cold+0x5/0xa [ 635.853160][T25214] ? fault_create_debugfs_attr+0x140/0x140 [ 635.858965][T25214] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 635.864957][T25214] should_failslab+0x5/0xf [ 635.869382][T25214] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 635.874761][T25214] ? lockdep_init_map_waits+0x26a/0x890 [ 635.880314][T25214] ? __raw_spin_lock_init+0x34/0x100 [ 635.885609][T25214] snd_seq_oss_timer_new+0x40/0x240 [ 635.890809][T25214] snd_seq_oss_open+0x553/0x980 [ 635.895670][T25214] odev_open+0x6c/0x90 [ 635.899747][T25214] ? odev_release+0x70/0x70 [ 635.904258][T25214] soundcore_open+0x446/0x600 [ 635.908944][T25214] ? sound_devnode+0xf0/0xf0 [ 635.913625][T25214] chrdev_open+0x219/0x5c0 [ 635.918050][T25214] ? cdev_put.part.0+0x50/0x50 [ 635.922823][T25214] ? security_file_open+0x84/0x410 [ 635.927942][T25214] do_dentry_open+0x546/0x1340 [ 635.932726][T25214] ? cdev_put.part.0+0x50/0x50 [ 635.937499][T25214] ? security_inode_permission+0xc4/0xf0 [ 635.943181][T25214] ? chown_common+0x550/0x550 [ 635.947849][T25214] ? inode_permission+0xab/0x500 [ 635.952785][T25214] path_openat+0x1e59/0x27d0 [ 635.957374][T25214] ? path_lookupat.isra.0+0x530/0x530 [ 635.962753][T25214] ? lock_acquire+0x1f2/0x8f0 [ 635.967450][T25214] do_filp_open+0x192/0x260 [ 635.971959][T25214] ? may_open_dev+0xf0/0xf0 [ 635.976455][T25214] ? do_raw_spin_lock+0x129/0x2e0 [ 635.981465][T25214] ? _raw_spin_unlock+0x24/0x40 [ 635.986292][T25214] ? __alloc_fd+0x46d/0x600 [ 635.990882][T25214] do_sys_openat2+0x585/0x7d0 [ 635.995541][T25214] ? file_open_root+0x400/0x400 [ 636.000389][T25214] ? __mutex_unlock_slowpath+0xe2/0x660 [ 636.005924][T25214] ? wait_for_completion+0x270/0x270 [ 636.011190][T25214] ? __this_cpu_preempt_check+0x28/0x190 [ 636.016816][T25214] ? __sb_end_write+0x101/0x1d0 [ 636.021648][T25214] do_sys_open+0xc3/0x140 [ 636.025956][T25214] ? filp_open+0x70/0x70 [ 636.030178][T25214] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 636.036138][T25214] ? do_syscall_64+0x21/0x7d0 [ 636.040808][T25214] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 636.046784][T25214] do_syscall_64+0xf6/0x7d0 [ 636.051319][T25214] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 636.057200][T25214] RIP: 0033:0x45ca59 [ 636.061092][T25214] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 636.080675][T25214] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 636.089068][T25214] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 636.097017][T25214] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 636.104973][T25214] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 636.112946][T25214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 636.120909][T25214] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 636.165639][T25214] ALSA: seq_oss: can't alloc timer [ 636.176320][ T17] usb 5-1: USB disconnect, device number 23 22:10:16 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={0x0, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:16 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xfffff000) 22:10:16 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x3f00000000000000) 22:10:16 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:16 executing program 4 (fault-call:4 fault-nth:19): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) [ 637.802849][T25343] __nla_validate_parse: 16 callbacks suppressed [ 637.802863][T25343] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:16 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={0x0, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:16 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xfffffdef) [ 637.881587][T25343] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:16 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) syz_open_procfs(0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={0x0, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) [ 637.937409][T25368] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:16 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={r3, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:16 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x2c) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) process_vm_readv(r2, &(0x7f0000000280)=[{&(0x7f0000000080)=""/218, 0xda}, {&(0x7f0000000180)=""/207, 0xcf}], 0x2, &(0x7f0000000440)=[{&(0x7f00000002c0)=""/198, 0xc6}, {&(0x7f00000003c0)=""/89, 0x59}], 0x2, 0x0) wait4(0x0, 0x0, 0x0, 0x0) [ 637.989374][T25368] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:16 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xffffff7f) [ 638.082578][T25388] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 638.092371][ T3787] usb 5-1: new high-speed USB device number 24 using dummy_hcd 22:10:16 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={r3, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:16 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xffffff9e) [ 638.123297][T25388] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:16 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000000100)={0x9c0000, 0x4, 0x2, r2, 0x0, &(0x7f00000000c0)={0x9909ce, 0x7f, [], @p_u16=&(0x7f0000000080)=0x8}}) ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f0000000140)={0x1, 0x1, [@broadcast]}) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) [ 638.194032][T25401] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 638.226386][T25401] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 638.337409][ T3787] usb 5-1: Using ep0 maxpacket: 8 [ 638.457287][ T3787] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 638.467028][ T3787] usb 5-1: config 0 has no interface number 0 [ 638.474591][ T3787] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 638.486409][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 638.497235][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 638.506981][ T3787] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 638.517589][ T3787] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 638.534452][ T3787] usb 5-1: config 0 descriptor?? [ 638.558823][T25341] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 638.566736][T25341] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 638.786225][T25341] FAULT_INJECTION: forcing a failure. [ 638.786225][T25341] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 638.799451][T25341] CPU: 0 PID: 25341 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 638.807782][T25341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 638.817835][T25341] Call Trace: [ 638.821127][T25341] dump_stack+0x188/0x20d [ 638.825456][T25341] should_fail.cold+0x5/0xa [ 638.829953][T25341] ? do_filp_open+0x192/0x260 [ 638.834624][T25341] ? fault_create_debugfs_attr+0x140/0x140 [ 638.840427][T25341] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 638.846407][T25341] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 638.852381][T25341] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 638.858199][T25341] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 638.864187][T25341] __alloc_pages_nodemask+0x17a/0x810 [ 638.869550][T25341] ? __alloc_pages_slowpath.constprop.0+0x2640/0x2640 [ 638.876285][T25341] ? find_held_lock+0x2d/0x110 [ 638.881031][T25341] cache_grow_begin+0x8c/0xc10 [ 638.885774][T25341] ? cache_alloc_pfmemalloc+0x1e/0x140 [ 638.900427][T25341] __kmalloc+0x6dc/0x7a0 [ 638.904685][T25341] ? snd_seq_oss_readq_new+0x94/0x2d0 [ 638.910033][T25341] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 638.915588][T25341] snd_seq_oss_readq_new+0x94/0x2d0 [ 638.920765][T25341] snd_seq_oss_open+0x4ce/0x980 [ 638.925591][T25341] odev_open+0x6c/0x90 [ 638.929632][T25341] ? odev_release+0x70/0x70 [ 638.934126][T25341] soundcore_open+0x446/0x600 [ 638.938794][T25341] ? sound_devnode+0xf0/0xf0 [ 638.943368][T25341] chrdev_open+0x219/0x5c0 [ 638.947772][T25341] ? cdev_put.part.0+0x50/0x50 [ 638.952517][T25341] ? security_file_open+0x84/0x410 [ 638.957606][T25341] do_dentry_open+0x546/0x1340 [ 638.962345][T25341] ? cdev_put.part.0+0x50/0x50 [ 638.967086][T25341] ? security_inode_permission+0xc4/0xf0 [ 638.972689][T25341] ? chown_common+0x550/0x550 [ 638.977340][T25341] ? inode_permission+0xab/0x500 [ 638.982271][T25341] path_openat+0x1e59/0x27d0 [ 638.986838][T25341] ? path_lookupat.isra.0+0x530/0x530 [ 638.992185][T25341] ? lock_acquire+0x1f2/0x8f0 [ 638.996850][T25341] do_filp_open+0x192/0x260 [ 639.001327][T25341] ? may_open_dev+0xf0/0xf0 [ 639.005808][T25341] ? do_raw_spin_lock+0x129/0x2e0 [ 639.010823][T25341] ? _raw_spin_unlock+0x24/0x40 [ 639.015654][T25341] ? __alloc_fd+0x46d/0x600 [ 639.020137][T25341] do_sys_openat2+0x585/0x7d0 [ 639.024787][T25341] ? file_open_root+0x400/0x400 [ 639.029612][T25341] ? __mutex_unlock_slowpath+0xe2/0x660 [ 639.035143][T25341] ? wait_for_completion+0x270/0x270 [ 639.040399][T25341] ? __this_cpu_preempt_check+0x28/0x190 [ 639.046004][T25341] ? __sb_end_write+0x101/0x1d0 [ 639.050830][T25341] do_sys_open+0xc3/0x140 [ 639.055134][T25341] ? filp_open+0x70/0x70 [ 639.059352][T25341] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 639.065315][T25341] ? do_syscall_64+0x21/0x7d0 [ 639.069966][T25341] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 639.075919][T25341] do_syscall_64+0xf6/0x7d0 [ 639.080398][T25341] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 639.086267][T25341] RIP: 0033:0x45ca59 [ 639.090137][T25341] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 639.109712][T25341] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 639.118106][T25341] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 639.126073][T25341] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 639.134030][T25341] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 639.141979][T25341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 639.149921][T25341] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 639.411479][ T3787] usb 5-1: USB disconnect, device number 24 22:10:18 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x4000000000000000) 22:10:18 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xfffffff0) [ 639.574065][T25460] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 639.600977][T25460] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:18 executing program 4 (fault-call:4 fault-nth:20): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:18 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000080)) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x2c) ptrace$setregs(0xf, 0x0, 0x0, &(0x7f00000000c0)="2e83b88e3cf7c49744e2197b614d598ebeab3ca51c1d09c6a913a85b27bd7e79096c182ee4e9321af209a173f3e2230c9626942033421a13db88b01c623561fb2b0d2371180000000000000000000000000000bca591fccf0e777a1eae90ca2921a61ec5c75691e721cba86a22b21582ed5d7687aa095d0f6bbc6359cf99") ptrace$cont(0x7, r2, 0x0, 0x0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r4, 0x4) ptrace$setopts(0x4206, r4, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:18 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:18 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xfffffff1) 22:10:18 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) ioctl$sock_SIOCINQ(r3, 0x541b, &(0x7f0000000240)) sendmsg$NFNL_MSG_ACCT_DEL(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xdc, 0x3, 0x7, 0x201, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFACCT_FILTER={0xc, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x7953}]}, @NFACCT_FILTER={0x1c, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x200}, @NFACCT_FILTER_VALUE={0x8}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xffffeaa1}]}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x4}, @NFACCT_FILTER={0x4c, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x6}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x5}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xfffffffd}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x1}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x3ff}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xffffff91}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x3f}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x6}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xff}]}, @NFACCT_FILTER={0x24, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x2}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x1}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x3}]}, @NFACCT_FILTER={0xc, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x401}]}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x800}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40001}, 0x900) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:18 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xfffffffc) 22:10:18 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x788000000000) [ 640.287092][ T3787] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 640.527037][ T3787] usb 5-1: Using ep0 maxpacket: 8 [ 640.647648][ T3787] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 640.655718][ T3787] usb 5-1: config 0 has no interface number 0 [ 640.669441][ T3787] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 640.681438][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 640.692861][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 640.703557][ T3787] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 640.713563][ T3787] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 640.723254][ T3787] usb 5-1: config 0 descriptor?? [ 640.748547][T25485] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 640.756285][T25485] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 640.985618][T25485] FAULT_INJECTION: forcing a failure. [ 640.985618][T25485] name failslab, interval 1, probability 0, space 0, times 0 [ 641.011717][T25485] CPU: 1 PID: 25485 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 641.020065][T25485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 641.030127][T25485] Call Trace: [ 641.033418][T25485] dump_stack+0x188/0x20d [ 641.037755][T25485] should_fail.cold+0x5/0xa [ 641.042272][T25485] ? fault_create_debugfs_attr+0x140/0x140 [ 641.048094][T25485] should_failslab+0x5/0xf [ 641.052515][T25485] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 641.057893][T25485] ? mark_held_locks+0x9f/0xe0 [ 641.062655][T25485] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 641.068461][T25485] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 641.075840][T25485] snd_seq_port_connect+0x5d/0x510 [ 641.080952][T25485] ? _raw_read_unlock+0x24/0x40 [ 641.085802][T25485] ? snd_seq_port_use_ptr+0x136/0x1a0 [ 641.091178][T25485] snd_seq_ioctl_subscribe_port+0x1df/0x310 [ 641.097082][T25485] snd_seq_kernel_client_ctl+0xeb/0x130 [ 641.102640][T25485] snd_seq_oss_midi_open+0x3ee/0x670 [ 641.108306][T25485] ? snd_seq_oss_midi_setup+0x50/0x50 [ 641.113691][T25485] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 641.119509][T25485] ? get_mdev+0x75/0x90 [ 641.123670][T25485] ? get_mididev.isra.0+0x76/0xa0 [ 641.128719][T25485] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 641.134655][T25485] snd_seq_oss_open+0x7fa/0x980 [ 641.139502][T25485] odev_open+0x6c/0x90 [ 641.143614][T25485] ? odev_release+0x70/0x70 [ 641.148150][T25485] soundcore_open+0x446/0x600 [ 641.152804][T25485] ? sound_devnode+0xf0/0xf0 [ 641.157371][T25485] chrdev_open+0x219/0x5c0 [ 641.161775][T25485] ? cdev_put.part.0+0x50/0x50 [ 641.166531][T25485] ? security_file_open+0x84/0x410 [ 641.171631][T25485] do_dentry_open+0x546/0x1340 [ 641.176374][T25485] ? cdev_put.part.0+0x50/0x50 [ 641.181119][T25485] ? security_inode_permission+0xc4/0xf0 [ 641.186724][T25485] ? chown_common+0x550/0x550 [ 641.191398][T25485] ? inode_permission+0xab/0x500 [ 641.196322][T25485] path_openat+0x1e59/0x27d0 [ 641.200893][T25485] ? path_lookupat.isra.0+0x530/0x530 [ 641.206245][T25485] do_filp_open+0x192/0x260 [ 641.210728][T25485] ? may_open_dev+0xf0/0xf0 [ 641.215212][T25485] ? do_raw_spin_lock+0x129/0x2e0 [ 641.220222][T25485] ? _raw_spin_unlock+0x24/0x40 [ 641.225046][T25485] ? __alloc_fd+0x46d/0x600 [ 641.229546][T25485] do_sys_openat2+0x585/0x7d0 [ 641.234204][T25485] ? file_open_root+0x400/0x400 [ 641.239032][T25485] ? __mutex_unlock_slowpath+0xe2/0x660 [ 641.244568][T25485] ? wait_for_completion+0x270/0x270 [ 641.249832][T25485] ? __this_cpu_preempt_check+0x28/0x190 [ 641.255444][T25485] ? __sb_end_write+0x101/0x1d0 [ 641.260279][T25485] do_sys_open+0xc3/0x140 [ 641.264710][T25485] ? filp_open+0x70/0x70 [ 641.268937][T25485] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 641.274906][T25485] ? do_syscall_64+0x21/0x7d0 [ 641.279561][T25485] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 641.285528][T25485] do_syscall_64+0xf6/0x7d0 [ 641.290010][T25485] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 641.295876][T25485] RIP: 0033:0x45ca59 [ 641.299751][T25485] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 641.319333][T25485] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 641.327735][T25485] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 641.335691][T25485] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 641.343650][T25485] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 641.351608][T25485] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 641.359569][T25485] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 641.378960][ T2469] usb 5-1: USB disconnect, device number 25 22:10:20 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={r3, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:20 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = perf_event_open(&(0x7f0000000400)={0x2, 0x70, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0xfffffffffffffffc, 0xffffffffffffffff, 0xa) tkill(r1, 0x4) r3 = fcntl$getown(r2, 0x9) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r4, 0x0, 0x0) clone3(&(0x7f0000000380)={0x4000000, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), {0x36}, &(0x7f0000000140)=""/204, 0xcc, &(0x7f0000000240)=""/195, &(0x7f0000000340)=[r3], 0x1, {r4}}, 0x58) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:20 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x4000000000000) 22:10:20 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x6000000000000000) 22:10:20 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d71810000000800"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:20 executing program 4 (fault-call:4 fault-nth:21): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:20 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x40030000000000) 22:10:20 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) read$usbfs(0xffffffffffffffff, 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) r0 = inotify_init1(0x0) r1 = inotify_add_watch(r0, 0x0, 0x0) readv(r0, &(0x7f0000000140)=[{&(0x7f00000038c0)=""/180, 0xb4}], 0x1) inotify_rm_watch(r0, r1) inotify_rm_watch(0xffffffffffffffff, r1) inotify_rm_watch(0xffffffffffffffff, r1) inotify_rm_watch(0xffffffffffffffff, r1) r2 = gettid() tkill(0x0, 0x3) ioctl$HIDIOCGVERSION(0xffffffffffffffff, 0x80044801, &(0x7f0000000080)) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x845f, 0x0, @perf_bp={0x0}, 0x0, 0x400000000, 0x0, 0x1, 0x101}, r2, 0x0, 0xffffffffffffffff, 0x0) tkill(r3, 0x4) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:20 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xf0ffffffffffff) 22:10:20 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) read$usbfs(r0, 0x0, 0x0) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000080)=0x10000, 0x4) r1 = gettid() tkill(r1, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x2c) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r3, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, @perf_bp={0x0, 0xb}, 0x5c1a42400afe8247}, r3, 0x0, 0xffffffffffffffff, 0x2) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) read$usbfs(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000000c0)) wait4(0x0, 0x0, 0x0, 0x0) 22:10:20 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0xfc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:20 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x100000000000000) [ 642.246986][ T2469] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 642.486938][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 642.617485][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 642.625594][ T2469] usb 5-1: config 0 has no interface number 0 [ 642.636668][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 642.648717][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 642.660130][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 642.671052][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 642.681059][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 642.691629][ T2469] usb 5-1: config 0 descriptor?? [ 642.718308][T25587] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 642.725635][T25587] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 642.954848][T25587] FAULT_INJECTION: forcing a failure. [ 642.954848][T25587] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 642.968076][T25587] CPU: 0 PID: 25587 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 642.976400][T25587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 642.986459][T25587] Call Trace: [ 642.989765][T25587] dump_stack+0x188/0x20d [ 642.994114][T25587] should_fail.cold+0x5/0xa [ 642.998630][T25587] ? fault_create_debugfs_attr+0x140/0x140 [ 643.004449][T25587] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 643.010483][T25587] __alloc_pages_nodemask+0x17a/0x810 [ 643.015859][T25587] ? __alloc_pages_slowpath.constprop.0+0x2640/0x2640 [ 643.022628][T25587] ? find_held_lock+0x2d/0x110 [ 643.027387][T25587] cache_grow_begin+0x8c/0xc10 [ 643.032150][T25587] ? cache_alloc_pfmemalloc+0x1e/0x140 [ 643.037608][T25587] kmem_cache_alloc_trace+0x6ed/0x7d0 [ 643.043050][T25587] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 643.048851][T25587] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 643.054813][T25587] snd_seq_port_connect+0x5d/0x510 [ 643.059903][T25587] ? _raw_read_unlock+0x24/0x40 [ 643.064732][T25587] ? snd_seq_port_use_ptr+0x136/0x1a0 [ 643.070098][T25587] snd_seq_ioctl_subscribe_port+0x1df/0x310 [ 643.075979][T25587] snd_seq_kernel_client_ctl+0xeb/0x130 [ 643.081511][T25587] snd_seq_oss_midi_open+0x3ee/0x670 [ 643.086943][T25587] ? snd_seq_oss_midi_setup+0x50/0x50 [ 643.092311][T25587] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 643.098149][T25587] ? get_mdev+0x75/0x90 [ 643.102285][T25587] ? get_mididev.isra.0+0x76/0xa0 [ 643.107304][T25587] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 643.113191][T25587] snd_seq_oss_open+0x7fa/0x980 [ 643.118034][T25587] odev_open+0x6c/0x90 [ 643.122095][T25587] ? odev_release+0x70/0x70 [ 643.126577][T25587] soundcore_open+0x446/0x600 [ 643.131276][T25587] ? sound_devnode+0xf0/0xf0 [ 643.135847][T25587] chrdev_open+0x219/0x5c0 [ 643.140264][T25587] ? cdev_put.part.0+0x50/0x50 [ 643.145024][T25587] ? security_file_open+0x84/0x410 [ 643.150128][T25587] do_dentry_open+0x546/0x1340 [ 643.154886][T25587] ? cdev_put.part.0+0x50/0x50 [ 643.159639][T25587] ? security_inode_permission+0xc4/0xf0 [ 643.165247][T25587] ? chown_common+0x550/0x550 [ 643.169906][T25587] ? inode_permission+0xab/0x500 [ 643.174826][T25587] path_openat+0x1e59/0x27d0 [ 643.179402][T25587] ? path_lookupat.isra.0+0x530/0x530 [ 643.184766][T25587] ? lock_acquire+0x1f2/0x8f0 [ 643.189449][T25587] do_filp_open+0x192/0x260 [ 643.193934][T25587] ? may_open_dev+0xf0/0xf0 [ 643.198431][T25587] ? do_raw_spin_lock+0x129/0x2e0 [ 643.203468][T25587] ? _raw_spin_unlock+0x24/0x40 [ 643.208297][T25587] ? __alloc_fd+0x46d/0x600 [ 643.212797][T25587] do_sys_openat2+0x585/0x7d0 [ 643.217455][T25587] ? file_open_root+0x400/0x400 [ 643.222304][T25587] ? __mutex_unlock_slowpath+0xe2/0x660 [ 643.227844][T25587] ? wait_for_completion+0x270/0x270 [ 643.233126][T25587] ? __this_cpu_preempt_check+0x28/0x190 [ 643.238737][T25587] ? __sb_end_write+0x101/0x1d0 [ 643.243589][T25587] do_sys_open+0xc3/0x140 [ 643.247907][T25587] ? filp_open+0x70/0x70 [ 643.252146][T25587] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 643.258109][T25587] ? do_syscall_64+0x21/0x7d0 [ 643.262770][T25587] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 643.268784][T25587] do_syscall_64+0xf6/0x7d0 [ 643.273270][T25587] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 643.279149][T25587] RIP: 0033:0x45ca59 [ 643.283030][T25587] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 643.302612][T25587] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 643.311000][T25587] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 643.318950][T25587] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 643.326917][T25587] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 643.334878][T25587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 643.342832][T25587] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 643.369412][ T2469] usb 5-1: USB disconnect, device number 26 22:10:23 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x200000000000000) 22:10:23 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x800e000000000000) 22:10:23 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x68, 0x6}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) pidfd_open(r0, 0x0) 22:10:23 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={r3, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:23 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) 22:10:23 executing program 4 (fault-call:4 fault-nth:22): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:23 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) recvfrom(r2, &(0x7f0000000100)=""/4096, 0x1000, 0x1, 0x0, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x40, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r3, 0xc028ae92, &(0x7f00000000c0)) [ 644.571853][T25678] __nla_validate_parse: 30 callbacks suppressed [ 644.571863][T25678] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 644.631467][T25692] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 644.649861][T25692] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:23 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x300000000000000) [ 644.672994][T25678] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 644.686209][T25700] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 644.702533][T25700] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:23 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x2c) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) sched_setattr(r1, &(0x7f0000000080)={0x38, 0x6, 0x0, 0x9, 0x2, 0x9, 0x6, 0x0, 0x3, 0x2}, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) ioctl$sock_TIOCOUTQ(r3, 0x5411, &(0x7f00000000c0)) wait4(0x0, 0x0, 0x0, 0x0) 22:10:23 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0x20000, 0x0) ioctl$EVIOCGEFFECTS(r2, 0x80044584, &(0x7f0000000100)=""/146) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000080), 0x2) [ 644.776983][T25706] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 644.826646][ T3783] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 644.843041][T25706] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 644.861362][T25706] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:23 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x400000000000000) [ 644.874901][T25713] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:23 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x500000000000000) 22:10:23 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) setsockopt$RDS_FREE_MR(r1, 0x114, 0x3, &(0x7f00000000c0)={{0x1be5b8d9, 0x7}, 0x2}, 0x10) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) [ 645.076842][ T3783] usb 5-1: Using ep0 maxpacket: 8 [ 645.196755][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 645.204767][ T3783] usb 5-1: config 0 has no interface number 0 [ 645.217905][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 645.233277][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 645.245887][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 645.261245][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 645.271205][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.286869][ T3783] usb 5-1: config 0 descriptor?? [ 645.308130][T25673] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 645.315462][T25673] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 645.532545][T25673] FAULT_INJECTION: forcing a failure. [ 645.532545][T25673] name failslab, interval 1, probability 0, space 0, times 0 [ 645.571618][T25673] CPU: 0 PID: 25673 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 645.579979][T25673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 645.590029][T25673] Call Trace: [ 645.593324][T25673] dump_stack+0x188/0x20d [ 645.597654][T25673] should_fail.cold+0x5/0xa [ 645.602155][T25673] ? fault_create_debugfs_attr+0x140/0x140 [ 645.607972][T25673] should_failslab+0x5/0xf [ 645.612384][T25673] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 645.617753][T25673] ? mark_held_locks+0x9f/0xe0 [ 645.622512][T25673] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 645.628297][T25673] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 645.634251][T25673] snd_seq_port_connect+0x5d/0x510 [ 645.639461][T25673] ? _raw_read_unlock+0x24/0x40 [ 645.644309][T25673] ? snd_seq_port_use_ptr+0x136/0x1a0 [ 645.649667][T25673] snd_seq_ioctl_subscribe_port+0x1df/0x310 [ 645.655545][T25673] snd_seq_kernel_client_ctl+0xeb/0x130 [ 645.661081][T25673] snd_seq_oss_midi_open+0x3ee/0x670 [ 645.666344][T25673] ? snd_seq_oss_midi_setup+0x50/0x50 [ 645.671694][T25673] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 645.677481][T25673] ? get_mdev+0x75/0x90 [ 645.681623][T25673] ? get_mididev.isra.0+0x76/0xa0 [ 645.686625][T25673] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 645.692509][T25673] snd_seq_oss_open+0x7fa/0x980 [ 645.697336][T25673] odev_open+0x6c/0x90 [ 645.701390][T25673] ? odev_release+0x70/0x70 [ 645.705868][T25673] soundcore_open+0x446/0x600 [ 645.710536][T25673] ? sound_devnode+0xf0/0xf0 [ 645.715101][T25673] chrdev_open+0x219/0x5c0 [ 645.719508][T25673] ? cdev_put.part.0+0x50/0x50 [ 645.724261][T25673] ? security_file_open+0x84/0x410 [ 645.729348][T25673] do_dentry_open+0x546/0x1340 [ 645.734084][T25673] ? cdev_put.part.0+0x50/0x50 [ 645.738824][T25673] ? security_inode_permission+0xc4/0xf0 [ 645.744428][T25673] ? chown_common+0x550/0x550 [ 645.749079][T25673] ? inode_permission+0xab/0x500 [ 645.754100][T25673] path_openat+0x1e59/0x27d0 [ 645.758671][T25673] ? path_lookupat.isra.0+0x530/0x530 [ 645.764024][T25673] do_filp_open+0x192/0x260 [ 645.768504][T25673] ? may_open_dev+0xf0/0xf0 [ 645.772985][T25673] ? do_raw_spin_lock+0x129/0x2e0 [ 645.777999][T25673] ? _raw_spin_unlock+0x24/0x40 [ 645.782821][T25673] ? __alloc_fd+0x46d/0x600 [ 645.787305][T25673] do_sys_openat2+0x585/0x7d0 [ 645.791958][T25673] ? file_open_root+0x400/0x400 [ 645.796781][T25673] ? __mutex_unlock_slowpath+0xe2/0x660 [ 645.802391][T25673] ? wait_for_completion+0x270/0x270 [ 645.807661][T25673] ? __this_cpu_preempt_check+0x28/0x190 [ 645.813267][T25673] ? __sb_end_write+0x101/0x1d0 [ 645.818095][T25673] do_sys_open+0xc3/0x140 [ 645.822398][T25673] ? filp_open+0x70/0x70 [ 645.826619][T25673] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 645.832574][T25673] ? do_syscall_64+0x21/0x7d0 [ 645.837242][T25673] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 645.843218][T25673] do_syscall_64+0xf6/0x7d0 [ 645.847715][T25673] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 645.853590][T25673] RIP: 0033:0x45ca59 [ 645.857760][T25673] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 645.877519][T25673] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 645.885910][T25673] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 645.893857][T25673] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 645.901805][T25673] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 645.909754][T25673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 645.917702][T25673] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 645.943831][ T3787] usb 5-1: USB disconnect, device number 27 22:10:24 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x89ffffff00000000) 22:10:24 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x600000000000000) 22:10:26 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:26 executing program 2: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nvram\x00', 0x208000, 0x0) getsockopt$inet_dccp_int(r0, 0x21, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() tkill(r1, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r3, 0x111, 0x2, 0x1, 0x4) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r4, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x16}}], 0x10) wait4(0x0, 0x0, 0x0, 0x0) 22:10:26 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) 22:10:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x700000000000000) 22:10:26 executing program 4 (fault-call:4 fault-nth:23): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:26 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xea0f000000000000) 22:10:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x800000000000000) 22:10:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x900000000000000) [ 647.986554][ T3783] usb 5-1: new high-speed USB device number 28 using dummy_hcd 22:10:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xa00000000000000) 22:10:26 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xb00000000000000) [ 648.256421][ T3783] usb 5-1: Using ep0 maxpacket: 8 22:10:27 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xc00000000000000) [ 648.381421][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 648.393010][ T3783] usb 5-1: config 0 has no interface number 0 [ 648.406161][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 22:10:27 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xe00000000000000) [ 648.452274][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 648.484422][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 648.503518][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 648.513917][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 648.536119][ T3783] usb 5-1: config 0 descriptor?? [ 648.567862][T25812] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 648.575274][T25812] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 648.812743][T25812] FAULT_INJECTION: forcing a failure. [ 648.812743][T25812] name failslab, interval 1, probability 0, space 0, times 0 [ 648.865640][T25812] CPU: 1 PID: 25812 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 648.873997][T25812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 648.884287][T25812] Call Trace: [ 648.887589][T25812] dump_stack+0x188/0x20d [ 648.891940][T25812] should_fail.cold+0x5/0xa [ 648.896451][T25812] ? fault_create_debugfs_attr+0x140/0x140 [ 648.902287][T25812] should_failslab+0x5/0xf [ 648.906703][T25812] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 648.912075][T25812] ? mark_held_locks+0x9f/0xe0 [ 648.916839][T25812] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 648.922642][T25812] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 648.928623][T25812] snd_seq_port_connect+0x5d/0x510 [ 648.933733][T25812] ? _raw_read_unlock+0x24/0x40 [ 648.938581][T25812] ? snd_seq_port_use_ptr+0x136/0x1a0 [ 648.943957][T25812] snd_seq_ioctl_subscribe_port+0x1df/0x310 [ 648.949847][T25812] snd_seq_kernel_client_ctl+0xeb/0x130 [ 648.955377][T25812] snd_seq_oss_midi_open+0x3ee/0x670 [ 648.960657][T25812] ? snd_seq_oss_midi_setup+0x50/0x50 [ 648.966035][T25812] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 648.971843][T25812] ? get_mdev+0x75/0x90 [ 648.975998][T25812] ? get_mididev.isra.0+0x76/0xa0 [ 648.981046][T25812] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 648.986951][T25812] snd_seq_oss_open+0x7fa/0x980 [ 648.991813][T25812] odev_open+0x6c/0x90 [ 648.995909][T25812] ? odev_release+0x70/0x70 [ 649.000421][T25812] soundcore_open+0x446/0x600 [ 649.005110][T25812] ? sound_devnode+0xf0/0xf0 [ 649.009708][T25812] chrdev_open+0x219/0x5c0 [ 649.014135][T25812] ? cdev_put.part.0+0x50/0x50 [ 649.018897][T25812] ? security_file_open+0x84/0x410 [ 649.024010][T25812] do_dentry_open+0x546/0x1340 [ 649.028754][T25812] ? cdev_put.part.0+0x50/0x50 [ 649.033506][T25812] ? security_inode_permission+0xc4/0xf0 [ 649.039186][T25812] ? chown_common+0x550/0x550 [ 649.043844][T25812] ? inode_permission+0xab/0x500 [ 649.048782][T25812] path_openat+0x1e59/0x27d0 [ 649.053375][T25812] ? path_lookupat.isra.0+0x530/0x530 [ 649.058739][T25812] do_filp_open+0x192/0x260 [ 649.063225][T25812] ? may_open_dev+0xf0/0xf0 [ 649.067727][T25812] ? do_raw_spin_lock+0x129/0x2e0 [ 649.072767][T25812] ? _raw_spin_unlock+0x24/0x40 [ 649.077618][T25812] ? __alloc_fd+0x46d/0x600 [ 649.082135][T25812] do_sys_openat2+0x585/0x7d0 [ 649.086820][T25812] ? file_open_root+0x400/0x400 [ 649.091680][T25812] ? __mutex_unlock_slowpath+0xe2/0x660 [ 649.097234][T25812] ? wait_for_completion+0x270/0x270 [ 649.102522][T25812] ? __this_cpu_preempt_check+0x28/0x190 [ 649.108162][T25812] ? __sb_end_write+0x101/0x1d0 [ 649.113023][T25812] do_sys_open+0xc3/0x140 [ 649.117365][T25812] ? filp_open+0x70/0x70 [ 649.121617][T25812] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 649.127601][T25812] ? do_syscall_64+0x21/0x7d0 [ 649.132283][T25812] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 649.138286][T25812] do_syscall_64+0xf6/0x7d0 [ 649.142803][T25812] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 649.148700][T25812] RIP: 0033:0x45ca59 [ 649.152598][T25812] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 649.172204][T25812] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 649.180622][T25812] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 649.188599][T25812] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 649.196574][T25812] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 649.204642][T25812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 649.212726][T25812] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 649.732959][T25879] __nla_validate_parse: 56 callbacks suppressed [ 649.732970][T25879] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 649.797016][T25882] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 649.802508][ T3785] usb 5-1: USB disconnect, device number 28 [ 649.812562][T25903] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 649.865157][T25905] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 649.865459][T25882] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 649.923844][T25905] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:29 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:29 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) 22:10:29 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0xf00000000000000) 22:10:29 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xee0f000000000000) 22:10:29 executing program 4 (fault-call:4 fault-nth:24): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) [ 650.726212][T25934] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 650.781015][T25942] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 650.828310][T25942] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 650.856270][T25934] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:29 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x1000000000000000) 22:10:29 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x1100000000000000) [ 651.066263][ T17] usb 5-1: new high-speed USB device number 29 using dummy_hcd 22:10:29 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x1200000000000000) 22:10:30 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x1206000000000000) [ 651.306235][ T17] usb 5-1: Using ep0 maxpacket: 8 22:10:30 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x1300000000000000) [ 651.426876][ T17] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 651.434909][ T17] usb 5-1: config 0 has no interface number 0 [ 651.442988][ T17] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 651.476135][ T17] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 651.496506][ T17] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 651.516118][ T17] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 651.538854][ T17] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 651.556631][ T17] usb 5-1: config 0 descriptor?? [ 651.577478][T25937] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 651.584783][T25937] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 651.821819][T25937] FAULT_INJECTION: forcing a failure. [ 651.821819][T25937] name failslab, interval 1, probability 0, space 0, times 0 [ 651.921382][T25937] CPU: 0 PID: 25937 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 651.929770][T25937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 651.939870][T25937] Call Trace: [ 651.943172][T25937] dump_stack+0x188/0x20d [ 651.947519][T25937] should_fail.cold+0x5/0xa [ 651.952053][T25937] ? fault_create_debugfs_attr+0x140/0x140 [ 651.957878][T25937] should_failslab+0x5/0xf [ 651.962306][T25937] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 651.967694][T25937] ? mutex_trylock+0x2c0/0x2c0 [ 651.972463][T25937] ? snd_seq_oss_midi_open+0x3ee/0x670 [ 651.977925][T25937] ? snd_seq_oss_synth_setup_midi+0x123/0x520 [ 651.984083][T25937] ? snd_seq_oss_open+0x7fa/0x980 [ 651.989122][T25937] open_substream+0xe9/0x880 [ 651.994018][T25937] rawmidi_open_priv+0x2e8/0x6e0 [ 651.998969][T25937] snd_rawmidi_kernel_open+0x1b5/0x270 [ 652.004505][T25937] midisynth_subscribe+0xf2/0x350 [ 652.009540][T25937] ? midisynth_use+0x250/0x250 [ 652.014310][T25937] ? down_write+0xdb/0x150 [ 652.018730][T25937] ? __down_timeout+0x2d0/0x2d0 [ 652.023586][T25937] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 652.029571][T25937] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 652.035391][T25937] check_and_subscribe_port+0x5b5/0x800 [ 652.040943][T25937] ? midisynth_use+0x250/0x250 [ 652.045711][T25937] snd_seq_port_connect+0x2e4/0x510 [ 652.050921][T25937] snd_seq_ioctl_subscribe_port+0x1df/0x310 [ 652.056828][T25937] snd_seq_kernel_client_ctl+0xeb/0x130 [ 652.062386][T25937] snd_seq_oss_midi_open+0x3ee/0x670 [ 652.067680][T25937] ? snd_seq_oss_midi_setup+0x50/0x50 [ 652.073055][T25937] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 652.078876][T25937] ? get_mdev+0x75/0x90 [ 652.083041][T25937] ? get_mididev.isra.0+0x76/0xa0 [ 652.088074][T25937] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 652.093984][T25937] snd_seq_oss_open+0x7fa/0x980 [ 652.098852][T25937] odev_open+0x6c/0x90 [ 652.102932][T25937] ? odev_release+0x70/0x70 [ 652.107443][T25937] soundcore_open+0x446/0x600 [ 652.112133][T25937] ? sound_devnode+0xf0/0xf0 [ 652.116733][T25937] chrdev_open+0x219/0x5c0 [ 652.121165][T25937] ? cdev_put.part.0+0x50/0x50 [ 652.125938][T25937] ? security_file_open+0x84/0x410 [ 652.131059][T25937] do_dentry_open+0x546/0x1340 [ 652.135847][T25937] ? cdev_put.part.0+0x50/0x50 [ 652.140647][T25937] ? security_inode_permission+0xc4/0xf0 [ 652.146285][T25937] ? chown_common+0x550/0x550 [ 652.150967][T25937] ? inode_permission+0xab/0x500 [ 652.155915][T25937] path_openat+0x1e59/0x27d0 [ 652.160523][T25937] ? path_lookupat.isra.0+0x530/0x530 [ 652.166002][T25937] do_filp_open+0x192/0x260 [ 652.170512][T25937] ? may_open_dev+0xf0/0xf0 [ 652.175029][T25937] ? do_raw_spin_lock+0x129/0x2e0 [ 652.180073][T25937] ? _raw_spin_unlock+0x24/0x40 [ 652.184926][T25937] ? __alloc_fd+0x46d/0x600 [ 652.189444][T25937] do_sys_openat2+0x585/0x7d0 [ 652.194130][T25937] ? file_open_root+0x400/0x400 [ 652.198992][T25937] ? __mutex_unlock_slowpath+0xe2/0x660 [ 652.204553][T25937] ? wait_for_completion+0x270/0x270 [ 652.209846][T25937] ? __this_cpu_preempt_check+0x28/0x190 [ 652.215491][T25937] ? __sb_end_write+0x101/0x1d0 [ 652.220353][T25937] do_sys_open+0xc3/0x140 [ 652.224688][T25937] ? filp_open+0x70/0x70 [ 652.228943][T25937] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 652.234932][T25937] ? do_syscall_64+0x21/0x7d0 [ 652.239618][T25937] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 652.245622][T25937] do_syscall_64+0xf6/0x7d0 [ 652.250138][T25937] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 652.256028][T25937] RIP: 0033:0x45ca59 [ 652.259926][T25937] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 652.279568][T25937] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 652.287991][T25937] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 652.295967][T25937] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 652.303941][T25937] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 652.311914][T25937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 652.319890][T25937] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 652.412611][ T17] usb 5-1: USB disconnect, device number 29 22:10:31 executing program 4 (fault-call:4 fault-nth:25): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:31 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x2000000000000000) [ 653.306040][ T2469] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 653.545954][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 653.666596][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 653.674647][ T2469] usb 5-1: config 0 has no interface number 0 [ 653.695918][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 653.708354][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 653.718369][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 653.728236][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 653.737369][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 22:10:32 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:32 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xffffff7f00000000) 22:10:32 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, 0x0, 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:32 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x3f00000000000000) [ 653.766294][ T2469] usb 5-1: config 0 descriptor?? [ 653.792486][T26049] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 653.803315][T26049] raw-gadget gadget: fail, usb_ep_enable returned -22 22:10:32 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:32 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000180)='/dev/input/mice\x00', 0x100) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002340)={r1, 0x0, 0x1000, 0x5e, &(0x7f00000001c0)="6c38da387c3c3edd837fa5831198b9049517997b82f7f685801f7f78a3460f7249af6e8b4780cfc0c200ade077d4776a4ff4022728f30fe328628fa3d927854a61df9cae29b14bdb9a1a9ade66441f59d79977c8122de7ca51a1aca6ea458fcbe00dded033668bf0c02551684a8ee1fd941272395ab8f278477643d3b3f02322b4a660a6a25d4ba44521f99ba5b8b7f5f83d68b20990ba6a21f7cf20ded4490a834999c9e44641ab3b8f85e468fc2ec7c848c5cb726ee833bfdf1874aac9b8f9fd0d27c6516df09f39dbed61aa76a36fea7f3d3f4f182e00ef23661da606ba3e75ead7459bd43139c3802f4bb21509eb17a611298be3dd59488a9de33357e7b6270545938c913d9b308d862b887d360c26ec6f768e8037cc14bb771f928a81023d8cbdb4fc910e9286cf3651526f0a007d59d3f716821bdbe8cc4c558dd186e74a1f33f48988764e100f1f71c14585873f65fccc46e6f1b76fe1fadbd143249476025b971741db9d9dc8b507b5fc7fa7ae2f29ad08bf50f15ee1d2ffa3853e52b83640826e9f7d5950fcc57da0fab82d02289459a934825f9b07b945865e337742e215ca2c955671cf848f1c003f70e2f248f13fc7ee1023b9620d14522347dae09bab77ac9fd633c23a86fd627cebe942457895478d3c15195f05ec25e46b4883d6d743379b2797b9b17967c0ee3939f38f436db7aa89d83137f6c8d9e61bc2046029a67fd2fb3af49962c578041991575b4bcb06a30c848456ac9dfc040c1394e4af4c6abf77fd48a850405d7533d16fe9bbcb98fc27fbe0f8b6a719531ed0d0700fef8e1025015b5c8ad27cc06d0e3df4822a85234352ef14b6a1cfe543f1bf1a9d790985c3743715640b748b48baac107dde8e0ec75bbc1d41584ec46fc8571dba712ed77f13f20cc14ad31af08e46ba5d69757d82a5bbdfa09ea525451a0c9fd7bd0bf4101c7a36e61f8aa5b70b11baaa28f8135fa7137b2a7961900b51f0d01825a553dfd1480bcb57a33320dbec52d506309f171eaa050e3aee859e9f8fa3eb1bf29231823712faaaa5ddda6486ec89e1d3f205488e89d1583c0af9bd828c5827b3f956c568b61c5fc408aee30bc92c9c156806bb190c0e0c8e31fd179f7f219c39f643456071b85614a074f693d123fe6498c06720aec6f74618b3a8bc462f57a0c936eb7c0f4469bd223f3576e2999ad26b696d8cf93fbd296377941382870ebcc2be73df75403f1e06f26add2e902cf94052d830af34f796f58d86476ac47a709ca14d2bf36f94c858c5ed222b14d0f34ab268df3e614e1b5a013aad7aafe7f1eccc92b4db5161e32aac8480096c1ea4fdac7ffe7412b763af3a2e0d6c51c269d3b0fd70c883df76e037ba801a7e20e4f5453eb21a0a6fdde286d9112dd443a5adf8671a6f83ae35a7b2a1c824fd955074f2cd89f0588009d9541d479bb6b5762963d5cc1ea6d298acedec0574cb2016c41c102876cb6e830ce28e7fb740d93beb9cc8f5a00a70897a1b405d18146929750c5ca4655ede3b80e8f8cd6a145b998b2f79189a1686e68051a738ffb4e7022aa2672273d81d50d8e54396a088196dcea55e07efbeb8c242f5cef05f4e8eb2c94742c98c133d442b19864e8c7afaeb713e9a8180ef926ccac7fd6f03355c7697988246e29a88e7e728955d311aa3e0184b0ec56910de0f89683f2e2fa5340b343ebba76a7c2046271b6b9e1e8275a46872e39562808642ab6ae63e8b4be0d1312f6d1ab221d2a3e6a98fd73a8badf86408374a7364dd8acd70cd936f964ac02852b447ba0e28d47ac2bf41a0e1098a60916c047010e326c0e466d7f1c3aec9d6d17651f6980762a3fedebd1d997173f595641bf4cd6ea2a3e7cfe154bd7078520a46ce04daf8f6281aabe4493307fb5bf8436f9f1003bb15e46fe4574be84e9fd3be03eaf25291df3dd433902768e058ef0a1d3ed29d26ffbbf00cc33c9d817389bf6a15fb4deac05a944d12fb8785f50ea7b481e227ddb822ad58728bde92abd95f49477836aa1f7383449f5bd526ad8315918a4c57aa271c9f77f7cbed0e4a86d80805273941861e7cc1b63e61f6caa71e31e7aa9b263891f99a2f4a7cb6f640a292c95a177bd031b2500205bb7d727f5a608a46ea2a68d3cbbaec0b7ff7abcce775acc280388b071e47425787368dbb0690991cf25280fe42c8adbe850636e08fe11627749360eff2d329b42d827ad4413fd5d60fe89a5e7ef83b3e7d66b833477f2663ab50297cf9fdb697631d71ba24b652b20fa0a9cae2cfe2de847cee288134c81f19dc10322b0b9a0dc211b175a0dda9bd8bff7ecb4249ffb03d2cfc681880e8ad55a9098e3aa84c9c77891d3c7f5f748685c70501b7ac627b25fd9152b30c12601da7c6b0f0186dcd256ac225f2f95fce5eb6fcc7ab83f8865dffc914a6886aa89c30906ab33f001138bbb4a88dc7c7beea7c36540edb0f44f12a3d0d71aa4524eec740bfdf86142a35edf490c123825cc6e142cea1b5865f7c5315f4c53dfa122ed153fe31fcd58fec9843ba9151868ad109a0ca364eec7663bc754962710cb962196eec9d604a2362ed781a76f2619d6a1ffd472d7e1e0a865fb2e7eef461a77af5912a35b883e937e16ff07ebbe404ed78c1f610699300588c6f2602dfc47a868962680b82b0eb69e50e5a2df145ab45dac1760a1dcf49d698e228c69775b0202ffd5c8860e2702433c161840c4e5750f991d96f8e65bd15ca93640b833a6d7cade1b0e500e06a7780f5d5c2521d151b338c35944763551cc43d8028ddecb25f3df4d0fb3caa6066b6efd432e55b07ce9ceb8177767b9e93ac457413a2c315a8aad6caa221d797c9e639e5c1f38d6c02a6e9ee175111f3bce0c653da099bb806e655c61240105c8629d62a86508952bd56eef27629c8c29e361e1bc39779c0cb57271d8cec8d4e6d2d64947a4a1ba8e09bab6786cdaac6d9592e1bac3f4c79183b51af973083d987f9de0d47793b4bd1e3c95de422c403e0e2ae57652a7d643c7980df3d53c01b37e54775b69bfbb6cd0788a430b94136f1a0c69d3b4419b93ea6c9b44a34d2fccc516c24689b6d8599bb8d7b54c49f60d7dd6709e1aa6ff9a879768ad62626c9da8785b81a5d364a0e2678c47fc8df64e665a9770a8a7237f22b65b7402f542666ce3ade5dd19b77b2dd093719faece88c631e08541b92b1b1d82a2629c313f327b1e9c4d4882948ddaeab8e77059cfc945b39edf2d353aa14c857d906851f375d7f05b94d39d7f96f02ad00490ac66e5c4f3d7cb3f1f926824dc0a232763a017e53dface38b55633d02ac36f89c317e79ab3ad63ebf6e096f215a8bed9bf7e0b4ceeaef3e2e9c125a5b0af2651e8f002c9ceea44a428b691d25e1fa59bab2b09b249d40a9ecb44f6edd44b72e2aca23d7ad2ea9e6c3555ed03bf426047bdda4236aba3c909de184d83cedf732683e585c7e385b18c942e77b2be5c334d8add64246cde5c4c6ae5d72696f87f369267e554aad8798dfd8bdd4708e844730b3484af4c0d6694f36b811b4a270d50f782bbf49f60075d382bba6af399198fc6b111c4ec5a314a372e3aa42b19ab58f8129bebb15f4480ef6a5f6bf5e918e576f147d8931fb400fe96fdda0fdeb206ada3bfc9bff2e9639ec363763d3a83cf46b2d244c236f610ef8c8c26ece3819ae14cdadc3c7f24fa6a0fd0e14cd4f57d033fa65b290fbc9cb2c70af580f72ddff8fb4c07b22c4f9dae6a2f9af221c32767a162903c775f4d49548c00b185723217d50e6ba4060d722ad80a695fad0a3bb7937513c41a9f3026b35f97ca27bf4af42b6fd5185667cdd16fac029ec8527b542c5523a8b80d4531514ca4488cae5f8db8eb9f09e330f422bead6f349addab4845e649cc063239495a5c55d15bf3d8966a5e81092fb1a8208745edb68eda4a70c447c2b6d5f9ce2581b77342b8e55375c43ef8357a64d849d1a5c21cc87c0db585bb043742f517e5904cb6e83de596ebc557926013b86b246db9b43583e1a7490410936795dff31b19e14409aeda329ddf7904354788af4bfa9a0ed94f8fc2ca13c7e96889b7a78ee7eabbaa24454f3ccc8569ea082cf1d764039063216f7fd36ec33c6346ffdd0d356a5a6b06c26f9e4d66567807b66eefa179581ae4acd5e22fba3c56623eb2c86ea8253cbf36dd439f2e38b128069620bdb5754079017eb8ff685e741c49518f07155ca1c51a3b7b56e6240ded5c35fbd323aac3fe28497a877b256304720c49199c81aaa77d8a4d85c0b9346a72678f266e1b9841a3a1b2d890fa34c2299fc07e1b14bd29a55e20068c2b5878529dfcad3465df76067030e9f89bd691c6cfce11083cca8c0f0e75aaea55dcb0c0e2a3b2d745af2cb0e0db7064a39fd6a8abc6a588f3eb32d4e93a04f8a0037ef3182ed584e4ed232e90e3bf94655e6681bfdd76aeb518749877d565ff7938bd0aa711ee43d0a4c319cc4084952879ae091b88c54e136f25280d238328832f5cba9ea060bb9784eec609227082288d7e1895fb6bd8664b9c7f8e22bd0bf6bb8b5c98c2a95fe4fa223c3a1cf9ea57387db4c95d3bb3367c6e48fa69f5071a7ac3a9e7cbbe92177e64ec71dcddf7129b5d3a958a87d3e5204630401e78f31f2b6086acd44372fc2eb4e3251dc29984d3c39a992aeece2843578c97cd12bdb950ac800b0f6c80b9dd0fa5098a852a34e365cd83ef49518cf27dc594391c78f27f0785e97e7b704cd7982747545be4b65c1eea0a4cf018b8919305474b2a017dc3518ec9331c833f82b57d55ad81c7bf860d3d1899d658c79dc286a46512a7c9efc34ecb917348bb8d94825dfd806a26cc3dd4f0375ea52c1e8a59f5819817053c32092d89327973a750dc7111342680290f4fd5a891b4b5366f2163e89b74c770162d6490956aa1a5cb5f49a1eaa674806332db70ad64fa193f7169069263d45f656f9c2d60cc2667dbde1c593d217a617a90b72d2608fd2e30d48acf43346f1a41cc1a4703efeec9dd2c126fd8b559815a234f0b8c68bfab658226c43bfb5aacda69cb46d0540e9144c63587257131d599fe0f0224b9227ef73b106070a938223f9bc95712e4257b1ac7402ba441dc06f113df031afd1ae4452274dd25152910de866930ab1ba0fa3534b81fdc14363ffcf14f474e2140692813ad6c39ad2027d89b39c5de4c283da442b78e5dbe7e5bb6830cdc99b003378c9307f8e7e646e79d2078b31ea44458cf6b3565f64bb6dbd4dddfc3123654a67c3a068609e439ff1c176eab3d7691e864f005137d00d32df1d5faeb3f4a83264e4324af9153df218b0a44c9b48e19bd22fbb1ed9bbadd825880e8617b843b4b9fd901af71b050c71c094127d8bd9debe449f6fb517bb1dd32e7b7861f6a2b7b495b4edf7bdf60d4ddf2e5f86b7162d1d79f9f20ae8333c861a3c6f6fa16c06cea3f203a9e4febf58f71b9bd944c37976b7917fe578344856cd526412af8046bbb5ae5c91ec37d4c8d9df81276071bdfd76a303776a9e8fcbb67a147fec35f0876dd01dadd9574d2cff800bbc7f80e401e219e22966e8085f56c7a73276b4ea603387bd3f7503d85e19001785ce687ab6ed3f753ed9e4255c1977d78cbc745e75e06a65f77641f186aae00ec5641b91a23d1e7884dc96a373c34b144f3f514546f096527cb46e0966ccd677e23ead817b89c40a509c8201cf68b31936ee09c9417188d5a04a0e70f9b760a2adaef2b8c1800fa35d5f1d96016e1b1d2dc9df3fd0d5832927018ebd80aa7784ce0c11ff6ca830", &(0x7f00000011c0)=""/94, 0xffffffff, 0x0, 0x1000, 0xcc, &(0x7f0000001240)="a92534096318482e299380dd137c3107eac4af6885d6c08a1669636aeefc6916a787be6386b22c6ad9651771c3a2119c1e187cdcabe7e6844d76fdca9748b35b281520e3e7c22c156c35676ae81abfd6493cebc64274c1f6b0ed0cf0a2564fa76f58b3e920ecbce80c021beb39d674ce6596d53542025d3673ea9c0932c7577dadccdd3a11c7906af10ec3ac828847cb18b1c06268273ada40c19b9e55f1d96bae12dc14e11356de132c265fa9f912c32b8971687c2e649a2972979aa013e272254aab095289b50bfbd4d6f3e4037a3396c0f4c8e8395cb8ccbed6b491c613f95a7c62e86f41a0ff0e577859cef596e7668fd126baf935346edadf582a79763e76e39ef22ae8d5511eade4c7328116712ad9e053e31ec62053b1a206f4cbbfe6c0e854ca60a1dccdfcd6fe75e77ad547d4ec272e199e6e4a3e07e08fd2b945c850b4cd69d469def3d22ca45c504f5ee179a10f12eed0f5699b8671d7da8987c6a4ed2fef6f2773804fa808a8c9e61ac91d26ea32ce9921053ed9547ffee957ba891b4531c62e3932ff4cc91e319239147a2470e0b27c662035a788d82c6fbd37528582dd10427e88064041a65bd471be6c912bbf3d47fc5f3e69f4ce911faefc245e112fa8f2323cf94373ae1f6e7b5c28138a20482b6ddb67154cad7fa177d9a8772a5abf5e7a4e3e769fe57af6e1a49b989ada6d4bd74472d1a38da90e46dc2e572624a26f683e9b3ab1563a6926f7b900a7a943c66ad6218661fdfd218be0b39c61b5f42d2d37190b1245b3a2bd78a841f7f827c0be72ce6bf21ba3b15a1518aa6f50551a2c2bcae97e655edecb4435f9e49f01326edb344dc2dd9226a80806aeab722b36fe1ffc1b6385530c91718b5456b5c530b189eab212f7a433fcc250dc8a70e4fb04fa6a564b17220f8575d306f7f119adb386a8fc166167e5ed612a9a0757a3de91d2559d1270f2eb4507743e4bc551d1392f751330e3fdab7be1171f7a4cacf92f086159552da405ed1393f99453310628a526964da57576ec2929054e9ce8d9965fe92bc2ce36c66c8f8a69da9382fa39bb0fda15f4d7546290b678ac7beec42aeb7198314c87bbd271669fc0a253060a92b132d452691ddb4c426409fa32f9d166abf7794601785421a0a86549ef50e5faf5f0bfa40bc79c18f40a2a673ac8bfcdca46c4c0103999c0a5ead02a4a8a4f9b06a941a9ded41d4128d3eb0e87d6848c891814f55fa998d2e2e7018f91f15751d09f22575013f35159e01fb656a2fdad60e828fa717a7bd1af770aa30f534542014ae61ed167d8d629a070cb5af7a185b34d5967b0c5c6670239adf52799472d59c775edfa79b2eaf4a32dbbecc55188d87dbbfaca18749907015249e5cdfe6de2b5d95417fbc0762fd82b5b826a3828f2f0b47f38af8b664d99e500184ef9cc067103ee3df3fdbe150d46ead5008240fc508071c84912cf21e237e9c2ea2368556566c36b35b7f7d077cf6894864304d625e1f4c1e57a0360cc855225a0d4397bf7a5f9e77951fd99cb0225a86a9e247094d53a9aed6c37b08fe597b2120d319f6ed36ecf5616c717cb0f739ab3c9ead6b8007c1205ccd741d07d2fd5f2aca513eb161216ea894b6f449df6bdbe28715ce3e4d5fa0e8c9b9350d847761514cc185203ccabcb90937b1ec860be3b7f102c80af44fd9cac0dcf0d4071fec8d3d5d2762beb8d58cecd15aeabd82c25b84449bc4cc9f98bea3d3e4a59f3eb9d4e3b3bea75602dc6dac57591723744e9c768c32ecdfc639c70947c26c9440835f1e12508511b642610b50054f088dfa9214f6919e2f5da82fa72fd61d298bb0e30f7532d347e1c442a2aee9b2fe3e2f2f384c2aa930bc859494bf164ca006fbd2b6a9a23cb576aad0ea308ae696e2bbbffbd643dc5dbc05309dc67735e841fe226aefe8688ad8efd7d23b05c0ad35cddfd7ecad0ba5a29a2c87c67d76e627aa4457b1dab0a6a99ed520e3b4bcab028a758589d8d31188a6b0b2af4d48d8c47a3b91e611c87ef9d962681a6bdb7120f36e3df12dd131406458c367e4c4913eb0dd785ba6d2a8e191aded5e1bb1cc84783555ceee76b8a95252bb0b4173e3dc9837789e46b149dddecdd441d5d00b095e94bae2464e5e7dba998893d8034818a8a2cc9b3aa4c9e633b739935ecf2233caabaa42e7e7002e12a8d13eead4a182226d67a16df06dd6f8d6cef152a1cbe5e0d9708750f27fe9691de322c41e414b1e05fd63a9bffaa0689cf78231cc04c6ba7e61d5b4ea20306f6135c3dedaf81bc2587062f672c02cfbe121ee9ae5d3485a12222fe7ff751f6a1cc9e06e745cdbd7f4653e431932690e19999f3364003e8bea81ba0fe9fcb4f13f0b2dbc19df051fde1d44f43871991dc69a5f5f6fa36f7e5c729b2375721dd09ced7108b556a241c67824de64ce26b1c0ca3028dc0e3c6b5f8ad3dbae93c94e5f120a55eebf1baf428694705f982751e719bf4510dfbfcf2f4d46cc8410fab69887195f6a477c5aab56400283090b26c3c14a805e1f2bd0a9a594963ee493b104843a7755ef1ec0f808c1a5a6afd5bb0f7a2c19a86763eda6b203762a800685acaab396f1d085cac49d2f3ea6f55c5715753c39e7828fe7949230407976247771d4c9fec60c9815d880b26ac6a072a16ab14b12e768e2bde74f120125d0685ca30107fbb461943b698764f32fe149620cbbb3935cb28bfb00408fe773c5c7fd92c8afebe37afc11429433f6c560a795eb7f860442fc9ab50ba4511151e476d9ab8d018547b19191d93c6b03be4e51f5a2d7e331b5eb148229b3253084175843498737b70f03a880c3115584824832ae6f32d6b700e1499134cc5f6791d83ed8049657082de549eb51056f1f3b8dea6d2ea2e2e4d08b4ada889c842133c36d63fa2bb60f218cd00958f54c673f107631ae629ffc33da574426c6f7386e5ff238660acb9ffd74ffab6634f8b4b0085ed469ee8093a1fb3f1a85b6d37d8d14bfe5efb94d4f82003b22b42fccd50a6fb9ebb10523991109c733c01b78996af4b32b7299ac2fb4698b502588ad027efcd93f2b9463a9c79a426dbbe0e85773194a67452f7fc1d497d081e873ea4fd2242e64f5150a7be0ba257a7328491e2705c008cbbf4e60fc6ecee3357e9ad3e18ee0580b9a27e758801ba3c3f9246a78dda86ebf8336679e81c318e757f63e72ed1571ecd8caabb74d8f93128d214f81374961a98cfef096060117ae79c087d93ae5f56253e5c6ab9d53a66dfc28d481595e874a9fbba84b72dd1152bd7ae8ef6a853e2e3a44820d5df82f842cd0fb0b086ed553a8b88eab5f79a9cabb4746d085a1e942255fdc7fad441ef8ad018cc5aabee75b734dfaeb2e55da70d5c95676984b73b72a49ab5ebde0d4d848c5fbc99e20ce7feb8c89782fcacf4c91c11f4940afb2a5aeb354872847320228fed792757275e9ef3b558a4d6516faeb1f8f5ccf706fdc71696744648f652428b453c5f6ab9049bf03d07878dffdfb25830fbe99a73aba16c225d9ef1ca622578fc0b459db83590385dc58eccb753b28fc544bc23fb51a6326832a1a7cd359773f79f43aeaa84a9cb4be16b35ec2274673e6a028dd34e13f9141fd20cb0cbc0f9b127c4004918273e92d883d2f2ce2c8ffe712e34ef15f3dd161836004f6c477edff0047bdceb565e14385b5eebb30e9b153333da6ce182a5fb97fe4e0be662a12e91f0f6db67fa92d8db1c998951457cc3d0ab017dd9a4e681e8625f8de76f4f70d29e3fc459f6d396b382eb739ca14b0051c3fdfdf211fd7c053df63e19633da3f7f3b8915cd614eb0c986d3ad770addbedfe159ec647a72ed50b967eaddde589ca40cb5501929c0fb678f974384e10dbec38fe25ca57d5824da4fac901973cefe0471b519d46636869f653f323ecf69febd8d890717bcbd4d76ab5a776613706f7d962974d49a350b1b0a9c654733c7019e12afdfcd550895683c2dc1ea6064aaec702198e42fa09da0bc04008b56e37c915ca8102baa5b41bda3e0e326173368b4cb41fe8485a56ff35678ec5ebab650ec15c9aaa7800198911558f1385229329a8caf504b072ae5bf710c9f2836b1fc13f504c01a656fd91b156ff6814d3c4d865937527d55e6a39153475b9bf1ede667af121a7fd3ff46c9305e4b66ab0fbb0d7b052377e99e831fdd793e9cdd7aaab51124cb3b2d3dbe6e1d95dc5a7887a3699ed8b55fa2655e0ba693e8b09724df34ff706c8a62d51fa958547f9c5aecc75cf45e524821f6c044a51ee921ea93084ea4346ab887bacdbee697315b3da6fc743ff372e65312379adbc2455285a2cd3eedf5f5f64df1897faa6fb09dfb978d0839b2e99ed125811e383a18f77d70233483baebbfb6557a7cbd6226580b1797c67cdff113a186a43e89192c1c126b7f2ae4706c61bb08df7a6029c2539e24aa9bd6ce14375c3e184befe77037bc48d95b67c1808fec4918167a8dc89eb3493e4c28969743f392e8064a3252cf71245f20c55a96904ec77a03965a0bd379f0ee2e257dd770512784fca7eb9f25180e42e8b4492d5dd7a30e78008bdf58bfc689ba22c7a46458aaff77f6a2ba2416b59253717c72f3c7c0fb8404850adda7945eb321351fd9b3ce0d4e60922e844c5009072cc37f622fe25a9fb886a52d0c1a0233c7ba01cc0738844482941e4c38ec86edce1c67fd693062f0f2b69013ab2256d9e44e1f2fb739690906edf4a19bba5b1cfa965856e6f5ffd0cad8439cb67b7494f9ad8f51f63ce4dfabffa0f5c209d5255f83f7bdc0fefd5f88f08f3f8c71d905546954f696b623da16d571062aafc2cd3ba69b694ff1a65469b1d1e09c5725598d00b5b02079f9d41a7b191f823fea8ae438b2419f35508bf73d6869f2e9e91a72c3ef2c35aebad08c82b8c689cadd03f7c0156781f9c89a559923f14e4aa8df8804942478cd528f74afb4161abbda8ecee2d219d421c604e7ed240760644beb9ad3e9c8ea6b525edb5010fccb9e0bfdd54ba4f3d8fa874d9cabf8c993f76d741c503b58f0b3022808e7238297a6df136892e52f09b5a691ea5eee86d3dc5615b6737c0a62c73c0984eb6727488a57465a50c871f4d6e2b15d767a5f8e63075f6b4cde8a4db73a94ffb40a2e2fbeca28d95466170cb3fbcb76ed4ade9cce7e0528d26a5ad00889d911de5304e259b0c70b5a6f92f81025de39d7636c9da7a80c7015456c8ec11fde8e82b94f60bf9bb91478b06c05aaf6b73640d314371a06676ae54c53c84363d9a513497ac56214cd8adf259a3515292b0a5ee646fb2466a3c20bf771a59a45a871c5d0e03a27a600911894707d90d3dd0d3d3e775f48f803155626c5accc3810473abca52bbf95114621642880647ef8a8e7238aeda9bc217bbccc062b5df72f292bd100d7e6e021cd39be12fc0f2b12b3e84fe3492160f1eb1d074dd9f93d9d34a483054c662fc782296733db5e4b309e8fb91ecb974d788b6a3a7c30021553437c0ac6af876a3412daaf0e7ca856f32ba4d1064821f281d2db206d5f81087e5f852983cb13ac3c1180cfd38b42f98c9fa1f20e27392395051a7a26dc51193ccc3e790f26f8b49292c87c3c528ea1daa6c21f6fcae554955693cab6a8fa7a92a6e736a52e0c4f55eb62a31d52c592ecda3452d5fcae776936dfd5bc5068ef3ff07b5500e6bde1925a5d7537734bfeaf6a53b67d476f71231156c8c4fa6764ee58165cc0b749d3ec3bc7a7c60afd482f5daf94af8f04da07d5255da9d74b350b7b51adbd55caadb3e191244dffe", &(0x7f0000002240)="85d1d2f5b70b67836516e36d05e8eafb277fe6a9f23b02fe4bd26db7fa00e258a68abf3798841ba9b6bf251af2dad2690af8c74acd79522b4306e0376c74fb1ff4c45aebe1d0b86944e33afb17ec06fda5f2768bd27456b14c80a2a22f612f2dd4e1bfd50113962af8d9b329ac74c8e6806d93a887e8f8df5dd9c7efdbf1266b3468e07623e481fef7152b9e39d13918ea0f04f2e850e2de9ccbac77a94c5f18ff1b5d3639c01683855cd8325ecaeb4cb2d39353fad6572b39672cddc7637290763e7f2a89eba61b79fb9f40"}, 0x40) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r4, 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000002400)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_GEM_CLOSE(0xffffffffffffffff, 0x40086409, &(0x7f0000002440)={r5}) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) syz_open_dev$mouse(&(0x7f0000002380)='/dev/input/mouse#\x00', 0x0, 0x2000) ptrace$getregs(0xc, r0, 0x3, &(0x7f0000000080)=""/249) wait4(0x0, 0x0, 0x0, 0x0) 22:10:32 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) [ 654.036624][T26049] FAULT_INJECTION: forcing a failure. [ 654.036624][T26049] name failslab, interval 1, probability 0, space 0, times 0 [ 654.111220][T26049] CPU: 0 PID: 26049 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 654.119578][T26049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 654.129633][T26049] Call Trace: [ 654.132936][T26049] dump_stack+0x188/0x20d [ 654.137280][T26049] should_fail.cold+0x5/0xa [ 654.141798][T26049] ? fault_create_debugfs_attr+0x140/0x140 [ 654.147622][T26049] should_failslab+0x5/0xf [ 654.152040][T26049] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 654.157401][T26049] ? mark_held_locks+0x9f/0xe0 [ 654.162154][T26049] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 654.167948][T26049] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 654.173944][T26049] snd_seq_port_connect+0x5d/0x510 [ 654.179037][T26049] ? _raw_read_unlock+0x24/0x40 [ 654.183889][T26049] ? snd_seq_port_use_ptr+0x136/0x1a0 [ 654.189245][T26049] snd_seq_ioctl_subscribe_port+0x1df/0x310 [ 654.195122][T26049] snd_seq_kernel_client_ctl+0xeb/0x130 [ 654.200666][T26049] snd_seq_oss_midi_open+0x3ee/0x670 [ 654.205950][T26049] ? snd_seq_oss_midi_setup+0x50/0x50 [ 654.211317][T26049] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 654.217109][T26049] ? get_mdev+0x75/0x90 [ 654.221261][T26049] ? get_mididev.isra.0+0x76/0xa0 [ 654.226267][T26049] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 654.232144][T26049] snd_seq_oss_open+0x7fa/0x980 [ 654.236980][T26049] odev_open+0x6c/0x90 [ 654.241029][T26049] ? odev_release+0x70/0x70 [ 654.245510][T26049] soundcore_open+0x446/0x600 [ 654.250172][T26049] ? sound_devnode+0xf0/0xf0 [ 654.254743][T26049] chrdev_open+0x219/0x5c0 [ 654.259153][T26049] ? cdev_put.part.0+0x50/0x50 [ 654.263902][T26049] ? security_file_open+0x84/0x410 [ 654.268996][T26049] do_dentry_open+0x546/0x1340 [ 654.273751][T26049] ? cdev_put.part.0+0x50/0x50 [ 654.278511][T26049] ? security_inode_permission+0xc4/0xf0 [ 654.284137][T26049] ? chown_common+0x550/0x550 [ 654.288794][T26049] ? inode_permission+0xab/0x500 [ 654.293728][T26049] path_openat+0x1e59/0x27d0 [ 654.298320][T26049] ? path_lookupat.isra.0+0x530/0x530 [ 654.303675][T26049] ? lock_acquire+0x1f2/0x8f0 [ 654.308672][T26049] do_filp_open+0x192/0x260 [ 654.313154][T26049] ? may_open_dev+0xf0/0xf0 [ 654.317643][T26049] ? do_raw_spin_lock+0x129/0x2e0 [ 654.322656][T26049] ? _raw_spin_unlock+0x24/0x40 [ 654.327486][T26049] ? __alloc_fd+0x46d/0x600 [ 654.331978][T26049] do_sys_openat2+0x585/0x7d0 [ 654.336638][T26049] ? file_open_root+0x400/0x400 [ 654.341469][T26049] ? __mutex_unlock_slowpath+0xe2/0x660 [ 654.347006][T26049] ? wait_for_completion+0x270/0x270 [ 654.352269][T26049] ? __this_cpu_preempt_check+0x28/0x190 [ 654.357899][T26049] ? __sb_end_write+0x101/0x1d0 [ 654.362731][T26049] do_sys_open+0xc3/0x140 [ 654.367040][T26049] ? filp_open+0x70/0x70 [ 654.371281][T26049] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 654.377256][T26049] ? do_syscall_64+0x21/0x7d0 [ 654.381912][T26049] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 654.387877][T26049] do_syscall_64+0xf6/0x7d0 [ 654.392359][T26049] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 654.398230][T26049] RIP: 0033:0x45ca59 [ 654.402106][T26049] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 654.421700][T26049] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 654.430115][T26049] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 654.438087][T26049] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 654.446073][T26049] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 654.454030][T26049] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 654.461998][T26049] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 22:10:33 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$qrtr(r1, &(0x7f0000001740)={&(0x7f00000001c0)={0x2a, 0x0, 0x3fff}, 0xc, &(0x7f0000001480)=[{&(0x7f0000000200)="eb03f27db14d81ebf9406593863889b64d72dc604212b11db7fd84a93e3c23e035cb56389a51feed9ccc987ea32a648ae3edcb3c96e2b921946b7721ba56c81c2d24935f0261b7dd6e7a16c144f695460dfd62dafe893ce907684dc8faebe985392a71771f7e9a43753307fc4a56220036ab5262df805c9e45eced4f41675d9f16a0ade3ce78f76ffa399ba96ec3dd11757f25eecf0e4b7875209993c1638154b9071958179d0631cbfa2ce6827c5e4d67b955dce5dbcd31cc5f3f355b711e6ab1bfc4c343686842121202c330e9c3c33fdd9b949d2ee3d15ccb91b1ea941a8254d05423e8f6c90281f03b9cc28506ac9c39e2567e1e22bfecfe3f9481ebe2b3b4cac1c3924e2d7cfc9b107a2082d32994228a557111e9ad680825054e0f996fb5b6a18b9afe82b82edb6368de00acf7a058dd972b52d251e6de663f95c9b1aad911b8779a786e45543a0d65a27ecdd01e0a980af8d38a7a7d24c07d3bf9941c6f988bca9cec13e634096820b514f431d1d59929db2db2c4244ee8ee371fb279631782e829064d02c37e12f90d2bcd76689a274d88a3a2f058cb5ea35135168a9964bd0badbfacd6679be5d410f496fa65f42a99894f9254bec5075ac89603c65c21ca660e4fe38acb74a6ef4e5c6a8f24d741c2dd5fe700cfbdb1d1f0509178d7cd7473b1b162501ea85406d006ac5a725435639fe1d171833fc0bb051bd1d8649d22c35dccbd248a6bfcd453a89141c0b82ace55510c9d7a86600da42ebfacdb9ff114315a8ee78b5cc94d0e71fd70ddc05eec282736ab715de399277d445072952d9cf60023cb5381a5edf269975b5079e3f8b47e25504bd87ff239485fb8d411874a587abe84bbe3b847b5c4afe18e4bf9cedd4e0acbe3b8b2a75dd9f52afd270d347bda1a4f90bccd8b189caa95672e5318cbe228e16d3aa0cc4fd647fb9afcfa2aae4081116b6f8da399e67c2387fb3ebb95eaa8b43eb463e0c0f97acf24d76c4a1823920787c5c251b1eb963971af84aae66bee2876b9c3e856acfb8030d2bb103bd4cfe13a6b672095cd6106f7fdbc4382fd2ad870b73b156a515a65618cac4c01a6139c6baf25433863683892ba79089f2afd8a84c9a1574671124300857c6d36bd941eb07c4990f667f1fe8a76338e42152beab21c0eb4e128f3524031e447e2f12ab79cadfaa51f2e2ae08a55ebacba19c00fc9931527d9d51d4c26113d7546e1fa22eb5b52a0750c72f4db5f66f85c4127268de0e907574e34649730d694cc5f0739a6472191a70ad19583dabf39874e2c012ef6fc6255ca4683a720a6ee913a287c1c7ba0424a1ca666053307f3fd39bbff362cecc89c2e02ecbc13c6dba8a9d1ddbda6d519f5b52b4ba5be014877cbe8b75670b3fa716364fa51f398adb1346db2a789b2d0132422641b581f44b4dec527ad980eb856ab58fb6bb4096a032ed39173568c4c0a004bc0598b25369c93fad1627209eed93b29c55a5c21885883b4c9fe2ab9efb3b001371a424759cd1ebd63dc624d39e187e0c9ccffe9e43fa5654a930723debb8d8265a676958329b362adf65d69ffc1f0068f7ead194879783d4a7bc56768cf6b16dd0450df92c7527f74a84b68f6ce34b94d93cc739853ea29b283562df77855bf1225f61cfebc030b799689e1480eeb5b432ab176b63aaa197f82d4e4eeccec2696fd8b185a6db68a73559c6dd98baad57b778d7e5f6dbcbe76e2ee74a18d4b0f9138b6e2a42ab374b5956f4d33f3eadf2873b3f27c22921a787323fbcc961bf9cc29a50c6390d916daed475501a65b1fbd611682ce8435ef31973b3ca89fd3cfe0f6aa709e55ace21146d6374c4684d07097c6d63d5a2e9b829725c4bbd970749b74de0608f347ab2b82c2130f9caf313209d552832e9cfff8cf4382e207428ed7c688436be26a7dd601cf1c8d3016f2e4f153c2972a3c50ce5c1ca0a16229299849f7b5b8727602c2131c1dadd9e2ae176281be164f5c7130f0f2dc5f5ec03344c3c65ab6ad7fd5dccf910b0f206ca80043093efff0e6baa726912f007638cce599165d31cffab9e21297fbbdc3e9394da83a015e3c67d976cfa73ce3e6fe9eb0dade86daa194e34b57cbf6cbf0c1afa7c10e4aae0331ec1afcb600f43dc480620332ec79ca4e93496f70865097dc9ea0eccf939d9db85532558d8aa01d4dc125f1680980084034255e8304d8d6a2bf8bf4bd86184826899fb81bef2c0171cf752e980e4d0842e5f2f24b1f351e3e6bc68f0c8bb73c60f953b534932733bf134c8a29190661f3c4ad91ddfcd98e603df98bcff2479ab5fcf12c8e1b268e7cd64c70178a5e2a240eb341660b7adc8cef83f56a7f0e3c274001edcd0cd05eda19c859aada8c350dc04d923e2cbde73e89ff43adab9a5c13c968e3f26fc79da3d14e76d98d67b35393b1048f90f0f17dc74a92b35ed6aa0d4434a879ffcb29dac73d9e88ccc8b0bbdc82c1379e0a179f4b327d4e77d9c4cb4766a285c36e21afd3d49dde0d07b10eaa83a3deff0fe09808aa137ae92623e3ce151e535e533dbe739c2b04290154282caacec367164bf3c938b26fc8763dc6b61614d2259123e633f742d661b0ccbcdb1e0f064ee216e19a4228201531df23bb5916ee18b650180a946b9c701b91523be79a0a363a82537c75630df89e3b51255be8cd859cad5d4034a4fb6e47f37cc742c763da62aa5fec6e124655e48dc6a6a6d80521e4eb51286461fc737355e853c3c400dca8808f0c239eac2e082935058f91152134007516508887198d05d9e9ca38007fa0dd8f87c3a23870b7a40322f0cda431f21a1a161142486cd14dadcf5851c527d9add7f129be5c9f1c2522eccd749e97fdca4be40ef9d804245899a716f8ad94e3dac9af17dedbddfeed6cb6d114d3df7548ad7da1c071acb821ddc6e0ad1911223c760b1bd62c6265692d9efb520ba64d14e9a4a31739496a0b20110ee20a9e1553d38df5068d8565e2b8d6d8d510fb8ba796449e75159adf80736d2ac99c3eaf92efb8f763ff3a0ed4e785907425ab548744796ede6c8e00de6f7683dfeca55c3e6ce834f22a14b66e7c1c7f5eb790dcd47ad41b0621945e2773b899f1f83a40235617b771edb4afd44e3b08f85727106794dc974db7b28ffcede2976c8defaf943e6fa2207aceb34302cb155954260e1cb3dcf8db2c979bdbb3b76356d91f0e7f099e0b7cc256a8f98dafbc255d9686b4c7a04bd499e9d429e5707e0ca15c7e3b544b28bca473603722028b0868743186ac1826f16b439052811dba61a4c3d0f310f810541f4756c565116e5aade53afc03b4a9a4a3f5132145af6033f016beed5f1b21f18e130e355387b393a578bfc527a82ad4149437748c3b7ab7d41fdb24af4158185e3bbec24e898b7d28f07c6d058be4fb8d008f3600925454dc3bf647517c2cdea6e3cbc695868a55047ec94272642a0b53dae073499b2b86ac9aa7bd6fbcfd3c1c527482e2cdce8709ae8b582eeb8353e10945020f36d6132e91aa64e40940a54555ede02149cb64f2299c0cd573149d8fc2c1300a44937933b6d16d0921ef3e301125628259906878be0b5fa76d0007ef35ab904c5173bc01061716c1eb3ef702a212092f7401942ed55cf452a4d3afd532793a21ed3a8b880851c10e70ba5e6222e7947471eb5f9297ddeb09213a59c0f1950394bd633482879312ee2d730643bf1a360d1324fecaede10ad16e15faf5b36ba8dd697f6128885389753f8606b11382a32a5e504d964a6789a25102c9c4165d9b882f36a58e4a2df3782162115ef369bcd5fbe45ffa2950e0ebf493652711eeebd7a36894f41ad19dcf686bb790b8bd994922703b8138413e010d3212d6fbd2e7ef0c976bc6b9417b10254f838eefde2c87a0aafbbf8219eedd53e7ac3345345d57a529b80a4f6809f50a653eb246303e4c8aa34a09108b4b42242810d28e39991b1b4b88a3b8e161775edeedbc9f0afacb5549cbe4126eabf25939f6a9929f00ecc6e18f83dd699b64f4c54e7e88757b0536468fb29724059e064be7f6fdfe9a4bd7c8c47fa016e789149efdb068ea23b250e2c0cb083b5bb33a020def18e900a68c20c65a49293555f92bb96e56ea8eaa6972e7d65a0f00a19b30f149426503c0e4bff411673d7781b3a521111adcc2adf789e48ac94731a821c606077215af6c352ed575b916b0fc0de62278364741738b370d0db4dff945fa3c7f4cc72c4ad4c3d9455b5d5df17f5926904e94be20717a8abf5b42264707f520dd831d26debedcf48737b5c96b6b09318e8ffe0ccae3e1fb2d36d391da6d2015b91993b97ada781050e5b0cdfa083f60446247101b67eaa254372f100f4dfab2c0f701a11930a169785d8f7652b432fe7e4b9772c049b72bd4b920ea3f0e799254103fb880c098b0794583042e278d457cf91c6080f4db4041828a00be55891c8e325bf93774250de4c7e21efc46f13104b001211974a7214e9bb73e7cda29a900ece7900b7be5f5fbef281b1e705bfa921431d6da75ac44518cef534799bc0c6613a61e707f102c0c6b1edc365e1c2709c622a822c39134f9c356c3e71f1107dcd5e4de25abf2ed5f96613d5438cc00ee93ce6a57a825117090c2e6ff428223eba7ab2f464fa820190a88369f696a077ed0eddafbdaa33cefb08795b45fff6e599f7eeae46d4b76ef4808706143d8d8a571d62c029d4bb4928827eecf083a513740342e0028fe55680d79ab21359c7d41afd52d29b9db9d28fa777e54a59cdf31c480f5ca66736f35232129e04974b7449a417e040b63e3ba89d0cf4652509d180b32b67b9b3f64e4f964ec771d3477d82d3c56c48cbef1f2f7358e11557fe7db964f010de05536a42c0553a3709f77278861639642c174a792142eb925bc43f19012cc22b23e70c3f2a3d6dd5b37b9bccffdc9d0c162d1f715a6798f7060291722af224eafe3578f43ec8c19e14aca7632c072888e1edac3b9a661deef68be4a30f8d12b3b671922d7cd3a68b2e8a43406846ddd3ed98cabe252badec12f700ef1e59d47310978b2a9c63792c14521e78fe7bf5d6fa45984a32701b65b7f58246c9e2001c677900fefe6186e292ecb9fcbfe55a07bb2beb1ab34c1b2165579015ed6b3ec06ae62d4ddc4e2ea5dd62a6f2fd04ad9ab61a0a609b5fc97005e2dd1d853bc597d1cb3c96b57cbd785b394005f1c4e1d653e949c1409733972d0f46edacf568666f5364e826e88434454fe337309104bc50b29efc41744611c02f3886741e2232ef33aba2b974255476a383c0df092c0fef27ff34df2612b6678c5ec18c8343ef6cf4798da33a3c080a265d91943c996f5d031f347816966428a4ab75dc3cced6e8319c9ecd4c4d239eafbd27b07d347d780b9a6112b14d325bf4eb7db24f5eded6be6f7c9be8818fbe9393631990860d866023b096cae56a3c921f6cc6d0c6b505c04efe5e07c39825c6debf2d7f5c926d7e720d2d6e55bf04c1a734bfb45a5489bccc83ae2d32a1c1ed44aef39d28e8f429d135b737941e9cc2fcaed1ab4b8242250e9ae7a163f70d8049fa7045659a431ae3cf05927d311d7ead4358e1c761bbba7a216bf2ba9d5f011a44308f90f62031e30c500c22ddf2485c2b468d376be34414d11eef78ed6d3478ec9e546ed8612adc48bfadd95a5e483446ec46b2e0062d7785739697f60de51f3296e8dc1fce7c23ece6845f940687dfb291b51a9ec2c755df99a24d905b9b1d318c0590eaee22bacde1a8eea8e7ddb8be4482985854843ab49e808700adf7b", 0x1000}, {&(0x7f0000001200)="f5b650be62fb9e424ef87924005be653e7b74330f54628958690a06e3f54b63ff69a892a20bd9547be6ca241a79de4c403313040fabfee0c3e9843948120f7b9d8837fd446ae1af4c1945a8d2cc52f8c80049708f446da92063b870bb4bfb1ad77235d7ea7f410b03072bec8fd703dc8061cd035409d2209c85002dd77b6d38b2e9729d96c53d6d77241fe4ff1707af7f4ffbdc4d7fcf5a7ea20040a93b592ff427fd75fda", 0xa5}, {&(0x7f00000012c0)="85f8ec03a51fe1863fc3093adb", 0xd}, {&(0x7f0000001300)="d263483ae5e260bce1d06d94ffec82cb72dc4f544c2bc27ff5f3b7323544ad56ab894e3e9cf104396616b5161c39753dfc41dbf9411814fbe48802e99d5743216fd554c7b9e97b77082778053c909dab136fe9d0cc94", 0x56}, {&(0x7f0000001380)="eb8698573d2f4203ce9bdefe199fb0eadd8775243dc791fcc81bea259d17822c651ea3f40c925a19f8569d1323a5b70cdbb2e9e60bea03df6457914b5c45eca6c6ee65cc0f6da30dbc7e93c45d5e38ec596a9a43feb388e9a904a902802dbe19c880616e8dd58ce9b3cf2cb4f04833912cf4b85613730864b99c1c50c2b118307633f5a2a735aa018e5fd399e1a94d8584415bd7326f6ee9d4ec34d581cf46b767a2284889c5184cf5d1f0a24d2438e0e3f4b776cc724329e33b320f1a717d33fd8b143615abad7448cc60f89033bb8f57f6d563fb456f848badd301505ad8af254bf7", 0xe3}], 0x5, &(0x7f0000001b40)=ANY=[@ANYBLOB="000100000000000084000000020000006a9aafae285121b615bad80b27ade7a6088a4f7e93ca072a734d3ac3f50274aae0d349d725a5743c433718da2734f159d709fcd31dd7ec6a0282ccbd3e5e7191db484a50d2272144a7753129f86bce3d9123f59530f3f274ea43d3b000023aa3f78551616b52bb9c87e07eefabb146ef308960e06c933919891744fdb9bf2358a2f2a11f03d493f98cf476ca99b44b65c26dee77451fb2a0a74e1d3c477c8a9bb04b79a4bd9bf63e5b1c8c99c96d29511d8c36a2b1c575a971dfa0f4872f476a15e5491c5939f68b0bbece61e0162a54b019235598d53a932bc1b3e8e2a59f155cd7f8680dec1def7300000000000000680000000000000088000000ffffff7fa3308f89954188944f9c5787852642653aad64b8d5ba4269923d1df2a476c7cb7e2485fe4f9fbb6ce48fb8139d893b005f3ce37ac89a668575f8686113088e847b51fd8a82d30adf609b070fed2536485bd42d46fbc3e5d1b00000000000000018010000ff0700006f2f1aa57074f6b5975f8632dc07615dbb0f6797e9e625298fdc8e90ae558a3765df988e5b9c2377a5ae9da8fe900234743de1153cec897746e6aeb25eed8c4f2a089a6f51c02617ac54f96148ff16f739997a813323518a1517891261a9b2bdefe0eaf8015a82bbb7d034563ab31fae1ae1212145480feb7753d6f1e623aa5a3773beaa13a75749686f48c8a03af4304711759afad6164852000000000000000703f9afcdaf087e87a235a9780767a1722112aa1b423a0fa808c1315fba2ce9178c4428d49ee7aed385b0dac02b9a41054f5f367604d3f300dcab5e832364b710c0530651525eb427a6436983cfe42c22ad9443740df3b5aaacb1717a56c88c167d800515f3503a077baf987e056a0b93c6f87366023404eb98c1504006cc7fb5732c7478cb759568928401317b4086cdc7d1c197b9d5d3a39502815301053d8e524a0d4185ed54bcea5acae99a7cbbd71ad6dc7683dbcdfd30933bdf8c9c3ef18a0c1c983dc890543837f2ff099360040b581d91f6223b48ffb41874a2d4c974194160cbff73643c90e18b059e471d6eab34b3c3fc536c2d07cfa704838971ece71773000e97467949b68d0c19df7cfdacec61224a15520a"], 0x218, 0x10}, 0x38) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) keyctl$get_persistent(0x5, r3, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f0000000140)={0xe951, 0x8, {r0}, {r3}, 0xe18d, 0x1}) sched_setaffinity(r4, 0x8, &(0x7f0000000180)=0x2) r5 = gettid() perf_event_open(&(0x7f0000000000)={0x4, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0xa}, 0x2000}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r5, 0x4) ptrace$setopts(0x4200, r5, 0x7, 0x0) r6 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcsu\x00', 0x200, 0x0) getsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f00000000c0), &(0x7f0000000100)=0x4) wait4(0x0, 0x0, 0x0, 0x0) 22:10:33 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x2c) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r1, 0x0, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000080)=0xfff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, r0, 0x0, 0xffffffffffffffff, 0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r3, 0x4008af60, &(0x7f00000000c0)={@host}) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:33 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) [ 654.656045][ T2469] usb 5-1: USB disconnect, device number 30 [ 654.839908][T26066] __nla_validate_parse: 40 callbacks suppressed [ 654.839915][T26066] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 654.857800][T26092] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 654.869221][T26092] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:33 executing program 4 (fault-call:4 fault-nth:26): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:33 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:33 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) ioctl$USBDEVFS_DROP_PRIVILEGES(r2, 0x4004551e, &(0x7f0000000080)=0x1f) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$SO_COOKIE(r2, 0x1, 0x39, &(0x7f00000000c0), &(0x7f0000000100)=0x8) 22:10:33 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x4800000000000000) 22:10:33 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, 0x0, 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:33 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0xffffffff00000000) [ 655.212852][T26155] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 655.254897][T26155] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:34 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:34 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$can_raw(0x1d, 0x3, 0x1) getsockname(r1, 0x0, 0x0) r2 = gettid() tkill(r2, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r2, 0x0, 0xffffffffffffffff, 0x0) tkill(r3, 0x4) ptrace$setopts(0x4206, r3, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) keyctl$get_persistent(0x5, r5, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000080)={0x4, 0x2, {r2}, {r5}, 0xffffffff00000001, 0x4}) process_vm_writev(r6, &(0x7f00000002c0)=[{&(0x7f00000000c0)=""/185, 0xb9}, {&(0x7f0000000200)=""/178, 0xb2}, {&(0x7f0000000180)=""/24, 0x18}], 0x3, &(0x7f0000000300), 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) [ 655.490239][T26155] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 655.508228][T26155] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 655.519510][T26190] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 655.525854][ T2469] usb 5-1: new high-speed USB device number 31 using dummy_hcd 22:10:34 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:34 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x4c00000000000000) [ 655.531471][T26190] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:34 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, 0x0, 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 655.618615][T26197] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:34 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6000000000000000) [ 655.775819][ T2469] usb 5-1: Using ep0 maxpacket: 8 [ 655.896372][ T2469] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 655.904383][ T2469] usb 5-1: config 0 has no interface number 0 [ 655.919678][ T2469] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 655.932884][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 655.944371][ T2469] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 655.955613][ T2469] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 655.969426][ T2469] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.984047][ T2469] usb 5-1: config 0 descriptor?? [ 656.007297][T26165] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 656.014611][T26165] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 656.256361][T26165] FAULT_INJECTION: forcing a failure. [ 656.256361][T26165] name failslab, interval 1, probability 0, space 0, times 0 [ 656.292643][T26165] CPU: 0 PID: 26165 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 656.301001][T26165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 656.311057][T26165] Call Trace: [ 656.314361][T26165] dump_stack+0x188/0x20d [ 656.318707][T26165] should_fail.cold+0x5/0xa [ 656.323226][T26165] ? fault_create_debugfs_attr+0x140/0x140 [ 656.329055][T26165] should_failslab+0x5/0xf [ 656.333743][T26165] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 656.339121][T26165] ? mutex_trylock+0x2c0/0x2c0 [ 656.343890][T26165] ? snd_seq_oss_midi_open+0x3ee/0x670 [ 656.349353][T26165] ? snd_seq_oss_synth_setup_midi+0x123/0x520 [ 656.355426][T26165] ? snd_seq_oss_open+0x7fa/0x980 [ 656.360465][T26165] open_substream+0xe9/0x880 [ 656.365066][T26165] rawmidi_open_priv+0x2e8/0x6e0 [ 656.370016][T26165] snd_rawmidi_kernel_open+0x1b5/0x270 [ 656.375488][T26165] midisynth_subscribe+0xf2/0x350 [ 656.380534][T26165] ? midisynth_use+0x250/0x250 [ 656.385312][T26165] ? down_write+0xdb/0x150 [ 656.389736][T26165] ? __down_timeout+0x2d0/0x2d0 [ 656.394582][T26165] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 656.400562][T26165] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 656.406373][T26165] check_and_subscribe_port+0x5b5/0x800 [ 656.411936][T26165] ? midisynth_use+0x250/0x250 [ 656.416705][T26165] snd_seq_port_connect+0x2e4/0x510 [ 656.421935][T26165] snd_seq_ioctl_subscribe_port+0x1df/0x310 [ 656.427819][T26165] snd_seq_kernel_client_ctl+0xeb/0x130 [ 656.433361][T26165] snd_seq_oss_midi_open+0x3ee/0x670 [ 656.438632][T26165] ? snd_seq_oss_midi_setup+0x50/0x50 [ 656.443985][T26165] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 656.449786][T26165] ? get_mdev+0x75/0x90 [ 656.453950][T26165] ? get_mididev.isra.0+0x76/0xa0 [ 656.458956][T26165] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 656.464835][T26165] snd_seq_oss_open+0x7fa/0x980 [ 656.469668][T26165] odev_open+0x6c/0x90 [ 656.473733][T26165] ? odev_release+0x70/0x70 [ 656.478219][T26165] soundcore_open+0x446/0x600 [ 656.482877][T26165] ? sound_devnode+0xf0/0xf0 [ 656.487455][T26165] chrdev_open+0x219/0x5c0 [ 656.491859][T26165] ? cdev_put.part.0+0x50/0x50 [ 656.496610][T26165] ? security_file_open+0x84/0x410 [ 656.501792][T26165] do_dentry_open+0x546/0x1340 [ 656.506560][T26165] ? cdev_put.part.0+0x50/0x50 [ 656.511306][T26165] ? security_inode_permission+0xc4/0xf0 [ 656.516928][T26165] ? chown_common+0x550/0x550 [ 656.521596][T26165] ? inode_permission+0xab/0x500 [ 656.526532][T26165] path_openat+0x1e59/0x27d0 [ 656.531119][T26165] ? path_lookupat.isra.0+0x530/0x530 [ 656.536500][T26165] ? lock_acquire+0x1f2/0x8f0 [ 656.541161][T26165] do_filp_open+0x192/0x260 [ 656.545659][T26165] ? may_open_dev+0xf0/0xf0 [ 656.550171][T26165] ? do_raw_spin_lock+0x129/0x2e0 [ 656.555198][T26165] ? _raw_spin_unlock+0x24/0x40 [ 656.560024][T26165] ? __alloc_fd+0x46d/0x600 [ 656.564510][T26165] do_sys_openat2+0x585/0x7d0 [ 656.569256][T26165] ? file_open_root+0x400/0x400 [ 656.574084][T26165] ? __mutex_unlock_slowpath+0xe2/0x660 [ 656.579626][T26165] ? wait_for_completion+0x270/0x270 [ 656.584902][T26165] ? __this_cpu_preempt_check+0x28/0x190 [ 656.590540][T26165] ? __sb_end_write+0x101/0x1d0 [ 656.595393][T26165] do_sys_open+0xc3/0x140 [ 656.599705][T26165] ? filp_open+0x70/0x70 [ 656.603932][T26165] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 656.609896][T26165] ? do_syscall_64+0x21/0x7d0 [ 656.614554][T26165] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 656.620520][T26165] do_syscall_64+0xf6/0x7d0 [ 656.625003][T26165] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 656.630872][T26165] RIP: 0033:0x45ca59 [ 656.634840][T26165] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 656.654448][T26165] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 656.662853][T26165] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 656.670821][T26165] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 656.678795][T26165] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 656.686747][T26165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 656.694697][T26165] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 656.750320][ T17] usb 5-1: USB disconnect, device number 31 22:10:36 executing program 4 (fault-call:4 fault-nth:27): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:36 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:36 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6558000000000000) 22:10:36 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10005, 0x0) 22:10:36 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:36 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x677c0dd700000000) 22:10:36 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) [ 657.638482][ T17] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 657.895709][ T17] usb 5-1: Using ep0 maxpacket: 8 [ 658.035688][ T17] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 658.043869][ T17] usb 5-1: config 0 has no interface number 0 [ 658.050600][ T17] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 658.062118][ T17] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 658.072224][ T17] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 658.082188][ T17] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 658.091396][ T17] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 658.105039][ T17] usb 5-1: config 0 descriptor?? [ 658.126976][T26273] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 658.134300][T26273] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 658.395299][T26273] FAULT_INJECTION: forcing a failure. [ 658.395299][T26273] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 658.408653][T26273] CPU: 1 PID: 26273 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 658.416979][T26273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 658.427048][T26273] Call Trace: [ 658.430356][T26273] dump_stack+0x188/0x20d [ 658.434704][T26273] should_fail.cold+0x5/0xa [ 658.439220][T26273] ? save_stack+0x1b/0x40 [ 658.443563][T26273] ? fault_create_debugfs_attr+0x140/0x140 [ 658.449381][T26273] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 658.455457][T26273] ? mark_lock+0x11f/0xdd0 [ 658.459890][T26273] __alloc_pages_nodemask+0x17a/0x810 [ 658.465285][T26273] ? __alloc_pages_slowpath.constprop.0+0x2640/0x2640 [ 658.472056][T26273] ? find_held_lock+0x2d/0x110 [ 658.476836][T26273] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 658.482652][T26273] cache_grow_begin+0x8c/0xc10 [ 658.487459][T26273] ? cache_alloc_pfmemalloc+0x1e/0x140 [ 658.492931][T26273] kmem_cache_alloc_node_trace+0x6c3/0x790 [ 658.498749][T26273] ? free_object+0x70/0x70 [ 658.503170][T26273] ? lockdep_init_map_waits+0x26a/0x890 [ 658.508724][T26273] __kmalloc_node+0x38/0x60 [ 658.513238][T26273] kvmalloc_node+0x61/0xf0 [ 658.517663][T26273] open_substream+0x33d/0x880 [ 658.522351][T26273] rawmidi_open_priv+0x2e8/0x6e0 [ 658.527301][T26273] snd_rawmidi_kernel_open+0x1b5/0x270 [ 658.532772][T26273] midisynth_subscribe+0xf2/0x350 [ 658.537806][T26273] ? midisynth_use+0x250/0x250 [ 658.542581][T26273] ? down_write+0xdb/0x150 [ 658.547009][T26273] ? __down_timeout+0x2d0/0x2d0 [ 658.551868][T26273] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 658.557861][T26273] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 658.563691][T26273] check_and_subscribe_port+0x5b5/0x800 [ 658.569247][T26273] ? midisynth_use+0x250/0x250 [ 658.574023][T26273] snd_seq_port_connect+0x2e4/0x510 [ 658.579232][T26273] snd_seq_ioctl_subscribe_port+0x1df/0x310 [ 658.585150][T26273] snd_seq_kernel_client_ctl+0xeb/0x130 [ 658.590699][T26273] snd_seq_oss_midi_open+0x3ee/0x670 [ 658.595988][T26273] ? snd_seq_oss_midi_setup+0x50/0x50 [ 658.601386][T26273] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 658.607202][T26273] ? get_mdev+0x75/0x90 [ 658.611366][T26273] ? get_mididev.isra.0+0x76/0xa0 [ 658.616410][T26273] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 658.622341][T26273] snd_seq_oss_open+0x7fa/0x980 [ 658.627199][T26273] odev_open+0x6c/0x90 [ 658.631269][T26273] ? odev_release+0x70/0x70 [ 658.635776][T26273] soundcore_open+0x446/0x600 [ 658.640466][T26273] ? sound_devnode+0xf0/0xf0 [ 658.645062][T26273] chrdev_open+0x219/0x5c0 [ 658.649491][T26273] ? cdev_put.part.0+0x50/0x50 [ 658.654265][T26273] ? security_file_open+0x84/0x410 [ 658.659390][T26273] do_dentry_open+0x546/0x1340 [ 658.664168][T26273] ? cdev_put.part.0+0x50/0x50 [ 658.668945][T26273] ? security_inode_permission+0xc4/0xf0 [ 658.674591][T26273] ? chown_common+0x550/0x550 [ 658.679276][T26273] ? inode_permission+0xab/0x500 [ 658.684228][T26273] path_openat+0x1e59/0x27d0 [ 658.688836][T26273] ? path_lookupat.isra.0+0x530/0x530 [ 658.694216][T26273] ? lock_acquire+0x1f2/0x8f0 [ 658.698906][T26273] do_filp_open+0x192/0x260 [ 658.703418][T26273] ? may_open_dev+0xf0/0xf0 [ 658.707932][T26273] ? do_raw_spin_lock+0x129/0x2e0 [ 658.712978][T26273] ? _raw_spin_unlock+0x24/0x40 [ 658.717839][T26273] ? __alloc_fd+0x46d/0x600 [ 658.722358][T26273] do_sys_openat2+0x585/0x7d0 [ 658.727061][T26273] ? file_open_root+0x400/0x400 [ 658.732011][T26273] ? __mutex_unlock_slowpath+0xe2/0x660 [ 658.737568][T26273] ? wait_for_completion+0x270/0x270 22:10:37 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6800000000000000) 22:10:37 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:37 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x948c}, r0, 0x1, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x2c) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) ptrace$peek(0x1, r2, &(0x7f0000000080)) sched_yield() [ 658.742858][T26273] ? __this_cpu_preempt_check+0x28/0x190 [ 658.748504][T26273] ? __sb_end_write+0x101/0x1d0 [ 658.753377][T26273] do_sys_open+0xc3/0x140 [ 658.757755][T26273] ? filp_open+0x70/0x70 [ 658.762005][T26273] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 658.767998][T26273] ? do_syscall_64+0x21/0x7d0 [ 658.772681][T26273] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 658.778676][T26273] do_syscall_64+0xf6/0x7d0 [ 658.783194][T26273] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 658.789088][T26273] RIP: 0033:0x45ca59 [ 658.792988][T26273] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 658.812600][T26273] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 658.821022][T26273] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 658.829006][T26273] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 658.836980][T26273] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 658.844956][T26273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 658.852933][T26273] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 22:10:37 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(0x0, 0x4) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r1, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:37 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x3a) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) close(r3) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000080)={0x1, 0x10, 0xfa00, {&(0x7f0000000040), r5}}, 0x18) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000080)=0x1, r5, 0x0, 0x1, 0x4}}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) connect$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0xc, r6, 0x1, 0x7, 0x6, @broadcast}, 0x14) wait4(0x0, 0x0, 0x0, 0x0) [ 659.589185][ T3783] usb 5-1: USB disconnect, device number 32 22:10:38 executing program 4 (fault-call:4 fault-nth:28): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:38 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(0x0, 0x4) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r1, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:38 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() prctl$PR_GET_SECCOMP(0x15) tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:38 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x6c00000000000000) 22:10:38 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10005, 0x0) 22:10:38 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r5, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x48, 0x1410, 0x800, 0x70bd25, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_STAT_AUTO_MODE_MASK={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x2}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x8000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r6, 0x0, 0x0) write$tun(r6, &(0x7f0000000180)=ANY=[], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r7, 0x0, 0x0) sendmsg$NLBL_MGMT_C_REMOVE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000007c80)=ANY=[@ANYBLOB="2c20000082fe89dc230bc3cdab6c88d81f444f1636ada1864a5c82498aabb15e8c2b952d2032376324076c00d443e1acac7f3e44e19bfd236d90025330415a3047e8d2f84dcfdd196774fe4543017a24c5ba21679c65d0e398a98612d7caa80e868fae", @ANYRES16, @ANYBLOB="000000000000060000000200000006000b002600000008000700ac1e000108000800e0000001"], 0x2c}}, 0x0) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f0000000340)={&(0x7f0000000280), 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x2c}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4044090}, 0x20000830) sendfile(0xffffffffffffffff, r7, &(0x7f0000000080)=0x6b, 0x2) [ 660.155160][T26378] __nla_validate_parse: 27 callbacks suppressed [ 660.155170][T26378] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 660.198262][T26378] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 660.213045][T26378] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 660.233656][T26378] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:38 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(0x0, 0x4) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r1, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:39 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x7400000000000000) [ 660.252487][T26399] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 660.264881][T26399] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:39 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x8481, 0x0) write$binfmt_script(r0, &(0x7f0000000100)={'#! ', './file0', [], 0xa, "d62b95922ad361c142de34847b83b9f70b87be27bb92b88b79c7bbea1db105e04519793f1698e34033975bc0751af9defacfec172a61d2dc1079030c3fb4a3a524072177552e1c9d443847fdf1c5c497b69176eb85c155386912bf089a9d7a2659fa2aea971411e1"}, 0x73) r1 = gettid() tkill(r1, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0x0, 0xffffffffffffffff, 0x0) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) prctl$PR_GET_TSC(0x19, &(0x7f0000000080)) 22:10:39 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) [ 660.317744][T26407] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 660.347770][T26407] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 660.358214][T26407] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:39 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x7a00000000000000) [ 660.384873][T26412] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 22:10:39 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) [ 660.470963][ T3783] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 660.735568][ T3783] usb 5-1: Using ep0 maxpacket: 8 [ 660.865474][ T3783] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 660.873613][ T3783] usb 5-1: config 0 has no interface number 0 [ 660.881132][ T3783] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 660.893044][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 660.903835][ T3783] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 660.914506][ T3783] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 660.924364][ T3783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 660.933965][ T3783] usb 5-1: config 0 descriptor?? [ 660.966812][T26384] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 660.986189][T26384] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 661.211871][T26384] FAULT_INJECTION: forcing a failure. [ 661.211871][T26384] name failslab, interval 1, probability 0, space 0, times 0 [ 661.251692][T26384] CPU: 1 PID: 26384 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 661.260050][T26384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 661.270116][T26384] Call Trace: [ 661.273417][T26384] dump_stack+0x188/0x20d [ 661.277766][T26384] should_fail.cold+0x5/0xa [ 661.282285][T26384] ? fault_create_debugfs_attr+0x140/0x140 [ 661.288110][T26384] should_failslab+0x5/0xf [ 661.292535][T26384] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 661.297943][T26384] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 661.303760][T26384] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 661.309837][T26384] dummy_urb_enqueue+0x82/0x8a0 [ 661.314749][T26384] ? usb_hcd_map_urb_for_dma+0x4aa/0x14f0 [ 661.320487][T26384] usb_hcd_submit_urb+0x2aa/0x1ee0 [ 661.325611][T26384] ? snd_rawmidi_kernel_open+0x1b5/0x270 [ 661.331252][T26384] ? usb_create_hcd+0x30/0x30 [ 661.335943][T26384] ? __mutex_lock+0x460/0x13c0 [ 661.340711][T26384] ? do_sys_open+0xc3/0x140 [ 661.345218][T26384] ? lock_release+0x800/0x800 [ 661.350002][T26384] ? substream_open.isra.0+0xab/0x830 [ 661.355395][T26384] usb_submit_urb+0x6e5/0x13b0 [ 661.360173][T26384] ? down_read+0x110/0x420 [ 661.364607][T26384] snd_usbmidi_submit_urb+0x19/0x60 [ 661.369816][T26384] snd_usbmidi_input_start.part.0+0xbe/0x1c0 [ 661.375814][T26384] substream_open.isra.0+0x505/0x830 [ 661.381160][T26384] open_substream+0x42e/0x880 [ 661.385822][T26384] rawmidi_open_priv+0x2e8/0x6e0 [ 661.390743][T26384] snd_rawmidi_kernel_open+0x1b5/0x270 [ 661.396185][T26384] midisynth_subscribe+0xf2/0x350 [ 661.401192][T26384] ? midisynth_use+0x250/0x250 [ 661.405948][T26384] ? down_write+0xdb/0x150 [ 661.410346][T26384] ? __down_timeout+0x2d0/0x2d0 [ 661.415229][T26384] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 661.421243][T26384] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 661.427057][T26384] check_and_subscribe_port+0x5b5/0x800 [ 661.432610][T26384] ? midisynth_use+0x250/0x250 [ 661.437364][T26384] snd_seq_port_connect+0x2e4/0x510 [ 661.442558][T26384] snd_seq_ioctl_subscribe_port+0x1df/0x310 [ 661.448438][T26384] snd_seq_kernel_client_ctl+0xeb/0x130 [ 661.454009][T26384] snd_seq_oss_midi_open+0x3ee/0x670 [ 661.459279][T26384] ? snd_seq_oss_midi_setup+0x50/0x50 [ 661.464651][T26384] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 661.470444][T26384] ? get_mdev+0x75/0x90 [ 661.474687][T26384] ? get_mididev.isra.0+0x76/0xa0 [ 661.479693][T26384] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 661.485571][T26384] snd_seq_oss_open+0x7fa/0x980 [ 661.490404][T26384] odev_open+0x6c/0x90 [ 661.494451][T26384] ? odev_release+0x70/0x70 [ 661.498936][T26384] soundcore_open+0x446/0x600 [ 661.503597][T26384] ? sound_devnode+0xf0/0xf0 [ 661.508164][T26384] chrdev_open+0x219/0x5c0 [ 661.512578][T26384] ? cdev_put.part.0+0x50/0x50 [ 661.517452][T26384] ? security_file_open+0x84/0x410 [ 661.522544][T26384] do_dentry_open+0x546/0x1340 [ 661.527306][T26384] ? cdev_put.part.0+0x50/0x50 [ 661.532061][T26384] ? security_inode_permission+0xc4/0xf0 [ 661.537677][T26384] ? chown_common+0x550/0x550 [ 661.542356][T26384] ? inode_permission+0xab/0x500 [ 661.547282][T26384] path_openat+0x1e59/0x27d0 [ 661.551863][T26384] ? path_lookupat.isra.0+0x530/0x530 [ 661.557219][T26384] ? lock_acquire+0x1f2/0x8f0 [ 661.561889][T26384] do_filp_open+0x192/0x260 [ 661.566372][T26384] ? may_open_dev+0xf0/0xf0 [ 661.570860][T26384] ? do_raw_spin_lock+0x129/0x2e0 [ 661.575899][T26384] ? _raw_spin_unlock+0x24/0x40 [ 661.580727][T26384] ? __alloc_fd+0x46d/0x600 [ 661.585229][T26384] do_sys_openat2+0x585/0x7d0 [ 661.589919][T26384] ? file_open_root+0x400/0x400 [ 661.594759][T26384] ? __mutex_unlock_slowpath+0xe2/0x660 [ 661.600303][T26384] ? wait_for_completion+0x270/0x270 [ 661.605656][T26384] ? __this_cpu_preempt_check+0x28/0x190 [ 661.611291][T26384] ? __sb_end_write+0x101/0x1d0 [ 661.616133][T26384] do_sys_open+0xc3/0x140 [ 661.620490][T26384] ? filp_open+0x70/0x70 [ 661.624716][T26384] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 661.630680][T26384] ? do_syscall_64+0x21/0x7d0 [ 661.635365][T26384] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 661.641415][T26384] do_syscall_64+0xf6/0x7d0 [ 661.645904][T26384] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 661.651791][T26384] RIP: 0033:0x45ca59 [ 661.655668][T26384] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 661.675337][T26384] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 661.683728][T26384] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 661.691680][T26384] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 661.699653][T26384] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 661.707609][T26384] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 661.715757][T26384] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 661.730687][T26384] usb 5-1: usb_submit_urb: -12 [ 661.752886][ T3787] usb 5-1: USB disconnect, device number 33 22:10:41 executing program 4 (fault-call:4 fault-nth:29): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000f1b6df086a080200c5670000000109022400010000000009040200023c09000009050112080700000009058c0a08"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 22:10:41 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x8000000000000000) 22:10:41 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:41 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000180)='veth0_to_bridge\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r4, 0x0, 0x0) write$UHID_INPUT2(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="0c000000090009b07955ee9028a56a"], 0xf) socket$netlink(0x10, 0x3, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r5, 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e5001264935d718100000008004500"], 0x2a) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 22:10:41 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000009f2d8366e500120064935d7181000000080045"], 0x2a) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10005, 0x0) 22:10:41 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x8100000000000000) 22:10:41 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:41 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x88a8ffff00000000) [ 662.466476][T26518] ptrace attach of "/root/syz-executor.5"[26515] was attempted by "/root/syz-executor.5"[26518] [ 662.635351][ T3787] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 662.885451][ T3787] usb 5-1: Using ep0 maxpacket: 8 [ 663.025789][ T3787] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 663.033954][ T3787] usb 5-1: config 0 has no interface number 0 [ 663.042382][ T3787] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid maxpacket 1800, setting to 1024 [ 663.054380][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 663.065472][ T3787] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 8 [ 663.075771][ T3787] usb 5-1: New USB device found, idVendor=086a, idProduct=0002, bcdDevice=67.c5 [ 663.085006][ T3787] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 663.099500][ T3787] usb 5-1: config 0 descriptor?? [ 663.126630][T26497] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 663.134062][T26497] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 663.381126][T26497] FAULT_INJECTION: forcing a failure. [ 663.381126][T26497] name failslab, interval 1, probability 0, space 0, times 0 [ 663.405428][T26497] CPU: 0 PID: 26497 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 663.413783][T26497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 663.423841][T26497] Call Trace: [ 663.427151][T26497] dump_stack+0x188/0x20d 22:10:42 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = dup(0xffffffffffffffff) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb4, 0x9, 0x6, 0x301, 0x0, 0x0, {0xa, 0x0, 0x9}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_ADT={0x2c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e20}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x415}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR2={0x5}}]}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x9}, @IPSET_ATTR_ADT={0x2c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_COMMENT={0x7, 0x1a, '$C\x00'}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_BYTES={0xc, 0x18, 0x1, 0x0, 0x52a2}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x1}}]}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x1}, @IPSET_ATTR_NAMEREF={0x9, 0x13, 'syz0\x00'}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x2}, @IPSET_ATTR_COMMENT={0x7, 0x1a, '-#\x00'}, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0xa1}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040000) tkill(r0, 0x37) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r2, 0x4) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 22:10:42 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x37) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r1, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={r2, 0xc4fe, 0x10, 0x7f, 0x8}, &(0x7f00000000c0)=0x18) 22:10:42 executing program 3: r0 = socket(0x1000000010, 0x80002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r3, @ANYBLOB="00004c08000000000e0039000a000100726f757465"], 0x3c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x9effffff00000000) [ 663.431499][T26497] should_fail.cold+0x5/0xa [ 663.436024][T26497] ? fault_create_debugfs_attr+0x140/0x140 [ 663.441858][T26497] should_failslab+0x5/0xf [ 663.446285][T26497] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 663.451756][T26497] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 663.458876][T26497] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 663.464888][T26497] dummy_urb_enqueue+0x82/0x8a0 [ 663.469751][T26497] ? usb_hcd_map_urb_for_dma+0x4aa/0x14f0 [ 663.475496][T26497] usb_hcd_submit_urb+0x2aa/0x1ee0 [ 663.480625][T26497] ? snd_rawmidi_kernel_open+0x1b5/0x270 [ 663.486271][T26497] ? usb_create_hcd+0x30/0x30 [ 663.490970][T26497] ? __mutex_lock+0x460/0x13c0 [ 663.495739][T26497] ? do_sys_open+0xc3/0x140 [ 663.500250][T26497] ? lock_release+0x800/0x800 [ 663.504935][T26497] ? substream_open.isra.0+0xab/0x830 [ 663.510329][T26497] usb_submit_urb+0x6e5/0x13b0 [ 663.515102][T26497] ? down_read+0x110/0x420 [ 663.519530][T26497] snd_usbmidi_submit_urb+0x19/0x60 [ 663.524741][T26497] snd_usbmidi_input_start.part.0+0xbe/0x1c0 [ 663.530736][T26497] substream_open.isra.0+0x505/0x830 [ 663.536486][T26497] open_substream+0x42e/0x880 [ 663.541180][T26497] rawmidi_open_priv+0x2e8/0x6e0 [ 663.546131][T26497] snd_rawmidi_kernel_open+0x1b5/0x270 [ 663.551779][T26497] midisynth_subscribe+0xf2/0x350 [ 663.556812][T26497] ? midisynth_use+0x250/0x250 [ 663.561675][T26497] ? down_write+0xdb/0x150 [ 663.566103][T26497] ? __down_timeout+0x2d0/0x2d0 [ 663.570967][T26497] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 663.576951][T26497] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 663.582760][T26497] check_and_subscribe_port+0x5b5/0x800 [ 663.588298][T26497] ? midisynth_use+0x250/0x250 [ 663.593049][T26497] snd_seq_port_connect+0x2e4/0x510 [ 663.598682][T26497] snd_seq_ioctl_subscribe_port+0x1df/0x310 [ 663.604562][T26497] snd_seq_kernel_client_ctl+0xeb/0x130 [ 663.610095][T26497] snd_seq_oss_midi_open+0x3ee/0x670 [ 663.616242][T26497] ? snd_seq_oss_midi_setup+0x50/0x50 [ 663.621596][T26497] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 663.627394][T26497] ? get_mdev+0x75/0x90 [ 663.631532][T26497] ? get_mididev.isra.0+0x76/0xa0 [ 663.636561][T26497] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 663.642442][T26497] snd_seq_oss_open+0x7fa/0x980 [ 663.647292][T26497] odev_open+0x6c/0x90 [ 663.651372][T26497] ? odev_release+0x70/0x70 [ 663.655871][T26497] soundcore_open+0x446/0x600 [ 663.660548][T26497] ? sound_devnode+0xf0/0xf0 [ 663.665136][T26497] chrdev_open+0x219/0x5c0 [ 663.669550][T26497] ? cdev_put.part.0+0x50/0x50 [ 663.674311][T26497] ? security_file_open+0x84/0x410 [ 663.679407][T26497] do_dentry_open+0x546/0x1340 [ 663.684154][T26497] ? cdev_put.part.0+0x50/0x50 [ 663.688915][T26497] ? security_inode_permission+0xc4/0xf0 [ 663.694526][T26497] ? chown_common+0x550/0x550 [ 663.699193][T26497] ? inode_permission+0xab/0x500 [ 663.705076][T26497] path_openat+0x1e59/0x27d0 [ 663.709657][T26497] ? path_lookupat.isra.0+0x530/0x530 [ 663.715013][T26497] ? lock_acquire+0x1f2/0x8f0 [ 663.719687][T26497] do_filp_open+0x192/0x260 [ 663.724173][T26497] ? may_open_dev+0xf0/0xf0 [ 663.728664][T26497] ? do_raw_spin_lock+0x129/0x2e0 [ 663.733678][T26497] ? _raw_spin_unlock+0x24/0x40 [ 663.738511][T26497] ? __alloc_fd+0x46d/0x600 [ 663.743001][T26497] do_sys_openat2+0x585/0x7d0 [ 663.747666][T26497] ? file_open_root+0x400/0x400 [ 663.752599][T26497] ? __mutex_unlock_slowpath+0xe2/0x660 [ 663.758129][T26497] ? wait_for_completion+0x270/0x270 [ 663.763392][T26497] ? __this_cpu_preempt_check+0x28/0x190 [ 663.769007][T26497] ? __sb_end_write+0x101/0x1d0 [ 663.773858][T26497] do_sys_open+0xc3/0x140 [ 663.778173][T26497] ? filp_open+0x70/0x70 [ 663.782401][T26497] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 663.788379][T26497] ? do_syscall_64+0x21/0x7d0 [ 663.793037][T26497] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 663.799002][T26497] do_syscall_64+0xf6/0x7d0 [ 663.803502][T26497] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 663.809374][T26497] RIP: 0033:0x45ca59 [ 663.813250][T26497] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 663.832834][T26497] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 663.841224][T26497] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 663.849177][T26497] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 663.857129][T26497] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 663.865097][T26497] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 663.873047][T26497] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 663.897440][T26555] ptrace attach of "/root/syz-executor.5"[26553] was attempted by "/root/syz-executor.5"[26555] 22:10:42 executing program 2: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() tkill(r0, 0x26) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r1, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r2, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) read$usbfs(r3, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.stat\x00', 0x275a, 0x0) read$usbfs(r4, 0x0, 0x0) r5 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video37\x00', 0x2, 0x0) poll(&(0x7f0000000100)=[{}, {0xffffffffffffffff, 0x1024}, {r1, 0x1042}, {r2, 0xc001}, {r3, 0x1}, {r4, 0x200}, {r5}], 0x7, 0x8) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r6 = gettid() perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) tkill(r6, 0x4) ptrace$setopts(0x4206, r6, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) [ 664.001299][T26497] usb 5-1: usb_submit_urb: -12 [ 664.009461][T26497] ------------[ cut here ]------------ [ 664.015449][T26497] URB 00000000a89e7615 submitted while active [ 664.037830][T26497] WARNING: CPU: 0 PID: 26497 at drivers/usb/core/urb.c:363 usb_submit_urb+0x10c1/0x13b0 [ 664.048089][T26497] Kernel panic - not syncing: panic_on_warn set ... [ 664.054687][T26497] CPU: 0 PID: 26497 Comm: syz-executor.4 Not tainted 5.7.0-syzkaller #0 [ 664.063016][T26497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 664.073075][T26497] Call Trace: [ 664.076374][T26497] dump_stack+0x188/0x20d [ 664.080728][T26497] ? usb_submit_urb+0x1090/0x13b0 [ 664.085812][T26497] panic+0x2e3/0x75c [ 664.089702][T26497] ? add_taint.cold+0x16/0x16 [ 664.094374][T26497] ? __probe_kernel_read+0x188/0x1d0 [ 664.099666][T26497] ? __warn.cold+0x14/0x35 [ 664.104073][T26497] ? usb_submit_urb+0x10c1/0x13b0 [ 664.109082][T26497] __warn.cold+0x2f/0x35 [ 664.113314][T26497] ? usb_submit_urb+0x10c1/0x13b0 [ 664.118326][T26497] report_bug+0x27b/0x2f0 [ 664.122705][T26497] do_error_trap+0x12b/0x220 [ 664.127277][T26497] ? usb_submit_urb+0x10c1/0x13b0 [ 664.132301][T26497] do_invalid_op+0x32/0x40 [ 664.136697][T26497] ? usb_submit_urb+0x10c1/0x13b0 [ 664.141744][T26497] invalid_op+0x23/0x30 [ 664.145881][T26497] RIP: 0010:usb_submit_urb+0x10c1/0x13b0 [ 664.151491][T26497] Code: 89 de e8 12 ae 63 fc 84 db 0f 85 42 f6 ff ff e8 a5 ac 63 fc 4c 89 fe 48 c7 c7 40 1a ac 88 c6 05 82 8b 76 05 01 e8 97 b0 34 fc <0f> 0b e9 20 f6 ff ff c7 44 24 14 01 00 00 00 e9 d7 f6 ff ff 41 bd [ 664.171074][T26497] RSP: 0018:ffffc90004c372c0 EFLAGS: 00010286 [ 664.177119][T26497] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 664.186112][T26497] RDX: 0000000000040000 RSI: ffffffff815d5ba7 RDI: fffff52000986e4a [ 664.194255][T26497] RBP: dffffc0000000000 R08: ffff88804c9cc5c0 R09: ffffed1015cc6715 [ 664.202207][T26497] R10: ffff8880ae6338a7 R11: ffffed1015cc6714 R12: 0000000000000cc0 [ 664.210188][T26497] R13: 00000000fffffff0 R14: ffff8880a17af800 R15: ffff888099b26300 [ 664.218197][T26497] ? vprintk_func+0x97/0x1a6 [ 664.222794][T26497] snd_usbmidi_submit_urb+0x19/0x60 [ 664.227985][T26497] snd_usbmidi_input_start.part.0+0xbe/0x1c0 [ 664.233971][T26497] substream_open.isra.0+0x505/0x830 [ 664.239260][T26497] open_substream+0x42e/0x880 [ 664.243923][T26497] rawmidi_open_priv+0x2e8/0x6e0 [ 664.248848][T26497] snd_rawmidi_kernel_open+0x1b5/0x270 [ 664.254315][T26497] midisynth_subscribe+0xf2/0x350 [ 664.259530][T26497] ? midisynth_use+0x250/0x250 [ 664.264285][T26497] ? down_write+0xdb/0x150 [ 664.268687][T26497] ? __down_timeout+0x2d0/0x2d0 [ 664.273526][T26497] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 664.279509][T26497] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 664.285321][T26497] check_and_subscribe_port+0x5b5/0x800 [ 664.290854][T26497] ? midisynth_use+0x250/0x250 [ 664.295603][T26497] snd_seq_port_connect+0x2e4/0x510 [ 664.300798][T26497] snd_seq_ioctl_subscribe_port+0x1df/0x310 [ 664.306694][T26497] snd_seq_kernel_client_ctl+0xeb/0x130 [ 664.312238][T26497] snd_seq_oss_midi_open+0x3ee/0x670 [ 664.317504][T26497] ? snd_seq_oss_midi_setup+0x50/0x50 [ 664.322858][T26497] ? _raw_spin_unlock_irqrestore+0x62/0xe0 [ 664.328668][T26497] ? get_mdev+0x75/0x90 [ 664.332807][T26497] ? get_mididev.isra.0+0x76/0xa0 [ 664.337843][T26497] snd_seq_oss_synth_setup_midi+0x123/0x520 [ 664.343736][T26497] snd_seq_oss_open+0x7fa/0x980 [ 664.348574][T26497] odev_open+0x6c/0x90 [ 664.352638][T26497] ? odev_release+0x70/0x70 [ 664.357404][T26497] soundcore_open+0x446/0x600 [ 664.362072][T26497] ? sound_devnode+0xf0/0xf0 [ 664.366645][T26497] chrdev_open+0x219/0x5c0 [ 664.371061][T26497] ? cdev_put.part.0+0x50/0x50 [ 664.375812][T26497] ? security_file_open+0x84/0x410 [ 664.380926][T26497] do_dentry_open+0x546/0x1340 [ 664.385675][T26497] ? cdev_put.part.0+0x50/0x50 [ 664.390436][T26497] ? security_inode_permission+0xc4/0xf0 [ 664.396067][T26497] ? chown_common+0x550/0x550 [ 664.401073][T26497] ? inode_permission+0xab/0x500 [ 664.405999][T26497] path_openat+0x1e59/0x27d0 [ 664.410739][T26497] ? path_lookupat.isra.0+0x530/0x530 [ 664.416103][T26497] ? lock_acquire+0x1f2/0x8f0 [ 664.420784][T26497] do_filp_open+0x192/0x260 [ 664.425274][T26497] ? may_open_dev+0xf0/0xf0 [ 664.429767][T26497] ? do_raw_spin_lock+0x129/0x2e0 [ 664.434798][T26497] ? _raw_spin_unlock+0x24/0x40 [ 664.440325][T26497] ? __alloc_fd+0x46d/0x600 [ 664.444834][T26497] do_sys_openat2+0x585/0x7d0 [ 664.449496][T26497] ? file_open_root+0x400/0x400 [ 664.454340][T26497] ? __mutex_unlock_slowpath+0xe2/0x660 [ 664.459869][T26497] ? wait_for_completion+0x270/0x270 [ 664.465238][T26497] ? __this_cpu_preempt_check+0x28/0x190 [ 664.470851][T26497] ? __sb_end_write+0x101/0x1d0 [ 664.475783][T26497] do_sys_open+0xc3/0x140 [ 664.480097][T26497] ? filp_open+0x70/0x70 [ 664.484323][T26497] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 664.490302][T26497] ? do_syscall_64+0x21/0x7d0 [ 664.494973][T26497] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 664.500944][T26497] do_syscall_64+0xf6/0x7d0 [ 664.505436][T26497] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 664.511306][T26497] RIP: 0033:0x45ca59 [ 664.515184][T26497] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 664.535200][T26497] RSP: 002b:00007f3e4a4a5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 664.543587][T26497] RAX: ffffffffffffffda RBX: 00000000004f9280 RCX: 000000000045ca59 [ 664.551538][T26497] RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 664.559491][T26497] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 664.567458][T26497] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 664.575671][T26497] R13: 00000000000007fc R14: 00000000004cada2 R15: 00007f3e4a4a66d4 [ 664.585251][T26497] Kernel Offset: disabled [ 664.589729][T26497] Rebooting in 86400 seconds..