last executing test programs: 4.620517591s ago: executing program 1 (id=1178): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x804, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) setsockopt$inet_int(r0, 0x0, 0x12, &(0x7f0000000000)=0xc, 0x4) recvmmsg(r0, 0x0, 0x0, 0x40004020, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x55ebfcb85e78e904}, 0xc844) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x94) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x5, 0x3, 0x3800, 0x7, 0x11}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000002700)={&(0x7f0000000500), 0x0, &(0x7f0000001600)="e433cc715cbfcb33a6ecc990da57c7aae5630252d88b5e329afba13e53387ed524f439847a8388665047d1a205003eb8aea9aace1be240012acb2941c77891d289bc5fc44682745c10788cb6fe9e1def87c74f35334fa9bbd7af7e0ecd1fab76a2a89fcf2b8909515669b0", &(0x7f0000001700), 0x2, r4}, 0x38) connect$inet(r3, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x48815, 0x50103}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 4.390977857s ago: executing program 1 (id=1179): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) write(0xffffffffffffffff, &(0x7f0000000600)="59fa75c016f564278b6b9f4198efa1d9cc9c0708624d6c299160ad3bb1c2a6cc634dd46307b186e0f71b2a0c222c09ecaaae1545c40140e3b7b2b8370973f264666114236835c57fac639a098eb8a3bc55ad858897625abed5d6e8aa6eb0f3c1d725a0c12a0b09e2e5129d20b000e33ec9c18b51299a229b6596f81cd9d45ccc0710164133b53778c05054eb175e03586289018837f5b45995909756f8f92a95785f76a5440ecb03dc54a4656d57e81adc63b23cde1ff10a7abc32c45c180b0713435209f4e8ebc52a5bdee1d01036968e87a23c58d796af6bfffe", 0xdb) 4.390725079s ago: executing program 1 (id=1180): syz_open_dev$sg(&(0x7f0000000000), 0x334, 0x103502) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffd, 0xfffffffc}, 0x0) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_PIM(r3, 0x29, 0xcf, 0x0, 0x0) r4 = fsmount(r2, 0x1, 0x0) listns(&(0x7f0000000000)={0x20, 0x0, 0x3, 0x8000000}, &(0x7f0000000040)=[0x0], 0x1, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) fchdir(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfffd}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240448a0}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r9, &(0x7f00000004c0)="05", 0x1, 0x4000005, &(0x7f0000000140)={0x11, 0x18, r10, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x14) ioprio_set$pid(0x3, 0x0, 0x0) open(&(0x7f0000000040)='./file1\x00', 0x80242, 0x0) 2.65379664s ago: executing program 1 (id=1186): ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) ptrace$ARCH_MAP_VDSO_X32(0x1e, r0, 0x6, 0x2001) r1 = userfaultfd(0x801) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x3000) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x6a0}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000000c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000680)={"48e5416fae8a75e1773ced25cc5b60fc978893d728a13562165430a9158e84ef1d9e5bd44969d0dea7921bacc8f4711f267ebfe6980e2512283e83d742e4fb0166beead76ca956085cabc4f8dd88be442a4001012daa2814de0de43846e22b2ebc9fc4d191e9b0ca88c0e06f3242a65bf0f47355c9ba935dc43091b8d59c904b029f9ba7251d9b4a95aff65860f3593fa293ab4a5903b33466b5ce469e91114f8d859696c41de5eb3b5060e1887fa160c90a693f83af054f1f34f8336de8f3c7df480091f5451288f98380d01cb59112feb4cd625f7f3b7de8a97fd433b3e5dda8e7e89774fed6b7a2d3720ddaebe80753bd6e760b67a9b3e5a396e09fada873af5b8fe0b395f529bd82bb5bf5200529c72f86970e1c4e85002bf03d7a22f1e86f672ed3a4a2c742b96a0ba0d67a5c6ecfd4729aadce5cbf4fb78c25a76fd1bbfe2ef5f2eb30acf6d1834e08663c8dab498f2d411f54ca80c5d3013125f7ba059e1095992edab2b590b4268a1a3fcb66806c7c575ed8c249e902e9cfe8f1e35165d898163f98a5d74a7d877861e4699b1a8f731cf5f2a2794ae778de5b52cacda20a096a41a1130b3cb1d2dfeaa4e7a2ffb646f97a19c01ae5db9241f617f73bb3ad5be7cd5443c0485969c38261558dd03518f58b768325f6b8d380f3fb069a8e232db906a7b853a6914758428c7d8539fbb2860cca5f7ddeb8e9e52c53cc01963f39f018903c77bbe4bb55a7525be3e83b2642501b3ef7bd67c23453fce671feead9f9b44adebe4deeb01af88a93ccde8f55aaa24dd754c095e0a3eccec1682798acd204e675b3d046e1ce6fb3e6e1ee832d524ac7cd06637b6be286bb44d5908affdbcc943642bdb3f8cd8d86f3518d31e8bd3b633dc90ac15e3c199e2ee805db41c6c12fb769dc04afb1c359100acf25be312464aacd16cd55c95d5ce6cf5a0566dfc64cfaff240fe056671a96f50ea40c36146ab5f21920e918c116d2a342c387d7e32ae348dac64ac5849d73e72f260324a260b108f0d9113f6012ac582d6cdc3e1226c118d4ec1133744c3ba92e3a6e87bdbadc1e0875d8e6e954db0a0bcf9277a4f1b59acd3e997264cdb4960cff7fbc9f1edf5cabb417293d9a193b2be8cd1b8862a4377a3d38deeae40fe526cc4d3978efc7c768ccc3e4cdde673bb4c626caa879057a2832a3ba8fd4d61526950eb739ad995b576726817b1826963c7d64e1e73ff08a891fd660028ce50b0517210df71a19376eadf172f07f6e62b9bb048d6003a5f633156235b6750cfdbc7775ee941def0621682a562195150e38c517aa61d15b7b5064d6bc06ea082f5e8746863491cdc0d22641054d21203406a33e3a11c71f46a740ab04578c7c5210be1be6b0a674cc4bc39532b668eed8c0c83c42bd4738fc8677527224c9aec6e7a089d230b5a00c004dcb6d853e19dd"}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x8, 0x0, 0x5e12, 0x20, 0x13, 0x8000000000007, 0x106c, 0x9, 0x8000000000000, 0x8000000400007f, 0x0, 0x6, 0x0, 0x204, 0x0, 0x8001], 0xeeee0000, 0x2c0290}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) mprotect(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xa) 2.379722998s ago: executing program 0 (id=1188): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) write(0xffffffffffffffff, &(0x7f0000000600)="59fa75c016f564278b6b9f4198efa1d9cc9c0708624d6c299160ad3bb1c2a6cc634dd46307b186e0f71b2a0c222c09ecaaae1545c40140e3b7b2b8370973f264666114236835c57fac639a098eb8a3bc55ad858897625abed5d6e8aa6eb0f3c1d725a0c12a0b09e2e5129d20b000e33ec9c18b51299a229b6596f81cd9d45ccc0710164133b53778c05054eb175e03586289018837f5b45995909756f8f92a95785f76a5440ecb03dc54a4656d57e81adc63b23cde1ff10a7abc32c45c180b0713435209f4e8ebc52a5bdee1d01036968e87a23c58d796af6bfffe", 0xdb) 2.379541527s ago: executing program 0 (id=1189): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) listen(r1, 0x3) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x54, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x5e7b000}]}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}}, 0x0) accept4(r1, 0x0, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) syz_open_dev$tty1(0xc, 0x4, 0x2) close_range(r0, 0xffffffffffffffff, 0x0) 2.310932211s ago: executing program 0 (id=1190): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) clock_settime(0x1700, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$USERIO_CMD_REGISTER(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x2}, 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYRES16, @ANYRES32=r1], 0x10}}, 0x0) socket$netlink(0x10, 0x3, 0x0) mlock(&(0x7f0000ffb000/0x4000)=nil, 0x4000) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r3, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mbind(&(0x7f0000b40000/0x4000)=nil, 0x4000, 0x8000, 0x0, 0x40000000, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="1800120076000d0b"], 0x18}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x200080d4) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffffff, &(0x7f0000000100)='./sys\x00', 0x101841, 0x88) write(r5, &(0x7f0000000200)='i8042', 0x5) 2.106398277s ago: executing program 0 (id=1191): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x601c2, 0x0) ftruncate(r0, 0x8800000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="5400000010000104000000000200000000000000", @ANYRES32, @ANYBLOB="0000faffffff000034001280110001"], 0x54}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000007c0), r1) r3 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) write(r4, &(0x7f00000000c0), 0x0) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000540)={0x2, @vbi={0xb3, 0x7, 0x100100, 0x40a640b, [0x4b6fb5c, 0x8], [0x3], 0x13a}}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000280)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd7000fbdbdf251a00000004002e8008000300", @ANYRES32=r6, @ANYBLOB='4\x00.'], 0x6c}, 0x1, 0x0, 0x0, 0x20040040}, 0x20040) r7 = openat$null(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r8, 0x84, 0x13, 0x0, &(0x7f0000000480)) sendfile(r7, r0, 0x0, 0x558410e9) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r7, 0x29, 0x41, &(0x7f00000002c0)=ANY=[@ANYBLOB="66696c7465720007000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000768563e5c704639d5ef5a74e9e537a75bf5490388f86bead747beb93eeaaef2f80cc7c299d0a943c7dc96b378c5d18bb567e00000000257848e6664fe9f65c489dbc191e27f9d804532e84e2c9504c2a83a30f2bcda2356b5ea1529a095be7b049c4a134975b8c793b5f048fff5127fe7a4de327f0002701ee581cdca2d4cd687551f188f6d711c81bed2bbe9451651abe6db6eeacc049b620551ed2fa337eb02c99a93d177df0f02443c29c294d5ecadaa5b024415a30d3e9eb3c5db1da3bac7b998449b84a27280000000000000006218e7e089111123475f2d8f71de38b3aa3d036f6a69cfc991cda2210e85c083924f7"], 0x74) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000040000000400000006"], 0x50) bpf$BPF_GET_MAP_INFO(0x4, &(0x7f00000001c0)={r9, 0x58, &(0x7f0000000140)}, 0x10) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='N', 0x1, 0x7f7ffffe) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r10, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000fdffffff000000000a0000008500000005000000850000000700000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x34, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) write$binfmt_misc(r10, &(0x7f0000000000), 0xd) 2.093191914s ago: executing program 1 (id=1192): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r0 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000001c0)={r0, 0x7, 0x2, r0}) r1 = dup(r0) read$FUSE(r1, &(0x7f0000003940)={0x2020}, 0x2020) 2.055529801s ago: executing program 1 (id=1193): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x8, 0xa}, {}, {0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x5}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08060cdc030ec0007f03e3f70000004100e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32ebd9db70d5d7ec450800030006010000bdad446b9bbc7a46eb988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x8000) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mknod(&(0x7f00000000c0)='./bus\x00', 0x8000, 0xd02) listen(0xffffffffffffffff, 0x5) syz_emit_ethernet(0x4a, &(0x7f00000005c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000081001000080049b4003800000000a3069078ac1414bbac1414aa070f09e00000027f000001000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB], 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r6) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) read$FUSE(r1, 0x0, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8, @ANYBLOB="79a9"], 0x0) syz_open_dev$audion(&(0x7f00000002c0), 0x3, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 1.968408135s ago: executing program 0 (id=1194): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffffffffffff5]}, 0x8, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$sock_bt_hci(r0, 0x400448e6, &(0x7f0000000340)="914f4ad01e664c47f03c23fb5dce14aa2ea86e8bfa6358187e28ff3d3936531dbd5b76bb3c3cfb5d7069909e5ea177c6b83f110320282deb6e7d6d8e64a301cf3c574ce5eacb7027b2ceaacf39fe0407d15c2173845310d48e106ae5000da422bf49ff158ea73a652e46637c36840a337f841577fafb53ed22dc") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r2, 0x0, 0x0) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f00000000c0)={&(0x7f0000002d80)=ANY=[@ANYBLOB="918c7587b0b1a84c80d50af762dfde6fdfc6e3750e2036a1713f2e54c806772b481ccc2ec3e16ba314a1d8f8f23002c86f388a5de9d824f74b99687d8293da6c33f68cddc0fed7c513f2dad4b1253f119c484bb7d79ce4952a50e5b0f37fc45f43f712adb52fd80aace996dd4c54c23cba4a0d8c4cd5b41e1a5b1c7d4ec8cd52f3181e7ec47c8cc620f78a13917b5df767bf510d85a8384437cebff6f85bed4e8e48d72f7c5040c08a7e6c1b25625225feec88647d530cede6c8e8aa4b5658f1d8320474548ae8", @ANYBLOB="0204000204000000a8c85cc6fe483b27ef50ba0379d858a27800000000000002000100000004d6000000000000002047f416f899ba279f916bcb5441170229a075875731830216911b41aee92c27"], 0x20}, 0x1, 0x7}, 0x4000810) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000001c0)={0xffffffffffffffff, 0xe0, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000140), 0x0, 0x4003c, 0x0, 0x0, 0x10, &(0x7f0000000140), &(0x7f0000000500), 0x8, 0x64, 0x8, 0x8, &(0x7f0000000200)}}, 0x10) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x149002, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$P9_RSTATu(r3, &(0x7f00000004c0)=ANY=[@ANYBLOB="930200007d00000005f0000000000000050000000000000000000000000000000000000000000000000000000000000000001f00046e6f6465767b6376666f7892ffffff8102000000000031ffcebc920000003800704a86cec602007dfa673effeb09b5351f5bde05f7"], 0x232) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000002c0)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(twofish-generic)\x00'}, 0x58) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r6, 0x890b, &(0x7f00000002c0)={@mcast2, @rand_addr=' \x01\x00', @local, 0x1, 0x6, 0x0, 0x100, 0x2, 0x500000}) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x6, 0x0, 0x100, 0x6, 0x180104, r7}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000003c0), 0x0, 0x400c0c4) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000200)="adea08c7beef905d069c564c90c200", 0xf) r8 = socket$l2tp6(0xa, 0x2, 0x73) socket$inet_tcp(0x2, 0x1, 0x0) getpeername$l2tp6(r8, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) r9 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r10 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r10, &(0x7f0000000200), 0x12) bind$x25(r9, &(0x7f0000000080), 0x12) 1.728102392s ago: executing program 3 (id=1196): r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000600)="59fa75c016f564278b6b9f4198efa1d9cc9c0708624d6c299160ad3bb1c2a6cc634dd46307b186e0f71b2a0c222c09ecaaae1545c40140e3b7b2b8370973f264666114236835c57fac639a098eb8a3bc55ad858897625abed5d6e8aa6eb0f3c1d725a0c12a0b09e2e5129d20b000e33ec9c18b51299a229b6596f81cd9d45ccc0710164133b53778c05054eb175e03586289018837f5b45995909756f8f92a95785f76a5440ecb03dc54a4656d57e81adc63b23cde1ff10a7abc32c45c180b0713435209f4e8ebc52a5bdee1d01036968e87a23c58d796af6bfffe", 0xdb) 1.681613323s ago: executing program 2 (id=1197): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_TO_DATA={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "a834"}]}, @NFTA_RANGE_FROM_DATA={0xc, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, "d1"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000000200)) 1.620784889s ago: executing program 3 (id=1198): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) write(0xffffffffffffffff, &(0x7f0000000600)="59fa75c016f564278b6b9f4198efa1d9cc9c0708624d6c299160ad3bb1c2a6cc634dd46307b186e0f71b2a0c222c09ecaaae1545c40140e3b7b2b8370973f264666114236835c57fac639a098eb8a3bc55ad858897625abed5d6e8aa6eb0f3c1d725a0c12a0b09e2e5129d20b000e33ec9c18b51299a229b6596f81cd9d45ccc0710164133b53778c05054eb175e03586289018837f5b45995909756f8f92a95785f76a5440ecb03dc54a4656d57e81adc63b23cde1ff10a7abc32c45c180b0713435209f4e8ebc52a5bdee1d01036968e87a23c58d796af6bfffe", 0xdb) 1.620355814s ago: executing program 3 (id=1199): r0 = socket$inet_udp(0x2, 0x2, 0x0) socketpair(0x1d, 0x3, 0x1, &(0x7f0000000000)) r1 = socket$inet(0x2, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x94) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000780)={0x0, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3b}}}, 0x8, 0xfff7}, &(0x7f0000000840)=0x88) bind$tipc(0xffffffffffffffff, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x3, {0x41}}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0\x00', 0x1ff) r3 = socket$rds(0x15, 0x5, 0x0) connect$rds(r3, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) write(0xffffffffffffffff, 0x0, 0x0) r4 = openat$dir(0xffffff9c, &(0x7f0000000040)='./config/target/core/rd_mcp_0\x00', 0x202, 0x73) faccessat(r4, &(0x7f0000000640)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x94) write(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r5, &(0x7f0000000680)="6e6a6b0c002300000000006a899bde425361612e36", 0x15) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000180)=@raw={'raw\x00', 0x8, 0x3, 0x448, 0x2e8, 0x40000, 0x198, 0x2e8, 0x198, 0x3b0, 0x358, 0x358, 0x3b0, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x16}, 0x0, 0x0, 'vcan0\x00', 'wg1\x00', {}, {}, 0x2f}, 0x0, 0x2c8, 0x2e8, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r2}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @unspec=@NOTRACK={0x20}}, {{@ip={@local, @dev={0xac, 0x14, 0x14, 0x10}, 0x0, 0x0, 'team_slave_1\x00', 'wlan0\x00'}, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xb}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x0, 0x6}, {0x2, 0x2, 0x2}, 0x2, 0x9}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4a8) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003640), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000003680)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000003a00)={0x0, 0x0, &(0x7f00000039c0)={&(0x7f00000036c0)={0x54, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_FRAME={0x38, 0x33, @probe_response={{{0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1}, {0x1}, @device_b, @device_b, @from_mac=@device_b, {0x1, 0x20}, @value=@ver_80211n={0x0, 0x3de, 0x1, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}}, 0xd, @default, 0x22, @void, @void, @val={0x3, 0x1, 0x38}, @void, @void, @void, @void, @val={0x71, 0x7, {0x0, 0x1, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xd, 0x51}}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40400}, 0x10) 1.537543311s ago: executing program 3 (id=1200): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000440)=ANY=[@ANYRESHEX=0x0], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x40, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xff}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYRESHEX=r0], &(0x7f0000000300)='GPL\x00', 0x0, 0xffffffffffffff3d, 0x0, 0x0, 0x40, '\x00', r3, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r4, r2, 0x25, 0x2, @val=@perf_event={0xfffffffffffffffb}}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f0000000080), 0x0, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x0, 0x40002020, 0x0) socket$netlink(0x10, 0x3, 0x10) getpid() syz_pidfd_open(r5, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r9 = dup(r8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r9, 0x0) ioctl$BLKROSET(r9, 0x125d, &(0x7f0000000000)=0xd) ioctl$BLKRRPART(r9, 0x125f, 0x0) quotactl$Q_SYNC(0xffffffff80000102, 0x80010000, 0x0, 0x0) r10 = semget$private(0x0, 0x6, 0x3b1) semctl$GETZCNT(r10, 0x0, 0xf, 0x0) r11 = socket(0x28, 0x80000, 0xffffff81) bind$vsock_stream(r11, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) r12 = socket(0x5, 0xa, 0x0) connect$vsock_stream(r12, 0x0, 0x0) 1.300761437s ago: executing program 3 (id=1201): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r0 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000001c0)={r0, 0x7, 0x2, r0}) r1 = dup(r0) read$FUSE(r1, &(0x7f0000003940)={0x2020}, 0x2020) 1.299114211s ago: executing program 2 (id=1202): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0x138, 0x10, 0x633, 0x70bd2c, 0x0, {{@in=@loopback, @in=@empty, 0x0, 0x5, 0x0, 0xfffd, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0xfffffffd, 0x32}, @in=@local, {0x1, 0x3, 0x9, 0x9, 0x2, 0x0, 0x0, 0xfffffffffffffffc}, {0x0, 0x0, 0x5f, 0xa}, {0x1}, 0x100, 0x0, 0x2, 0x0, 0x0, 0x23}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x20040}, 0x80) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0xffff, 0xfffffffffffffffd, 0x2}, {0x1, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x39}, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(r1, 0x0, 0xb00) 861.185062ms ago: executing program 3 (id=1203): socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000000)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f00000002c0)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r0, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r0, 0x18, &(0x7f0000000280)={0x101, r0, 0x22, {0x2, 0x3}, 0xa6}, 0x1) r4 = syz_usb_connect$cdc_ncm(0x4, 0xbe, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xac, 0x2, 0x1, 0xd4, 0x80, 0x44, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "1e11f1"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x6, 0xb0, 0x6, 0x54}, {0x6, 0x24, 0x1a, 0x1000, 0x4}, [@mbim_extended={0x8, 0x24, 0x1c, 0x3, 0x0, 0x5a8e}, @mdlm_detail={0x45, 0x24, 0x13, 0x5, "5363ec61724e19120455c5e33fde700460cc8fab590138833fea21dc8cc5771a37574c0eb2d44fca37ff01a19eeb7e68ead366d3a45e53efe8e30d3e28dccf4ce1"}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x2, 0xf2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0xf7, 0x0, 0xa}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x2, 0xff, 0x3}}}}}}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x201, 0x5, 0x9, 0x80, 0x20}, 0x27, &(0x7f00000001c0)={0x5, 0xf, 0x27, 0x4, [@wireless={0xb, 0x10, 0x1, 0xc, 0x20, 0x9, 0x7c, 0xe56, 0x66}, @ext_cap={0x7, 0x10, 0x2, 0xe, 0x1, 0x5, 0x1f2}, @wireless={0xb, 0x10, 0x1, 0x0, 0x21, 0x1b, 0x1, 0x6, 0x1}, @generic={0x5, 0x10, 0x3, "3a1c"}]}, 0x2, [{0xfa, &(0x7f0000000200)=@string={0xfa, 0x3, "8534e2424ce6b88533418703b3f4f63ea779a33df2623f5c3273087ae8c043bc56a12e6b4f79dcdec2b9261e07452c82c2190a6d30f5ad4b1eb83c418e01d13e6c82a7183f8f4150168e10e8312676e56e2263d9ee86a17d7cd5b983c52bd09da2fc01838179ac737c809c457d2888a6279babd0842b4217307fb5a1ed125bb839ee3535fd3bed1cdba7c0e8435006a12407df72fde9b86a745c08f69242d2035937c002134d91e739657700bc0b09e59122ce7eacf1969409ee26acd74b8ad0878905e03c2173b292732b693ea9dc4643833ec5466394d792ffbcb7468cb544b31791f4faf5ae874732ef2422e7c667c12cbc39be64c574"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x4c39}}]}) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x121b80, 0x0) read$FUSE(r5, &(0x7f0000004180)={0x2020}, 0x2020) syz_usb_control_io$cdc_ncm(r4, &(0x7f00000004c0)={0xc, &(0x7f0000000380)={0x40, 0x24, 0xf2, {0xf2, 0x33, "8be033879c66fd78498c4f51c5646e6879ed363f94c806051c0895b9915aed8e5a7850172faed3b08f61b9d4f60738427689608a14e15f9577b104cc1346edc6be86f71c10de5027c659991cd409cea7b5ba7ad800c3c8fca55038e53ff94fc59fa6445a7ed9eb954f73669511314e403ae7cbff887b1f1770515b1266e25862a6b143bee831d10bfe4a2d7b9514eb6da0c6c0412f13f00fb1d9c9918ba1092a40e7a3c605e5c7f6dea95bd8ae10d27cf127d10c482d058fbe969dee8eb879e0b1cd7e60988156087ce263e1db9b789fa86021d63d6394f3690748ac7fddd13b853e11d3cbc169dcd44668537516f3ee"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000780)={0x24, &(0x7f0000000500)={0x20, 0xd, 0xb8, "041af5620835bc7ac248ad33a848d6bd8b8a1639453cf6e234642686e118762752730a23ca21a23d77fbde40a5148eb9d71be2a3caef37da5c12e869779fa8fd6904fda1a251ce53333863bfc9a4803f1e3a18237daa8873a48a04ff7cf2d372b6198fc4993b12d3e0fd7e899016b5345443b000617bbe96c96f00b8f0beb6bd84824da6f0b4134e5c95e75c05d52232e004665a59b226e6d94c193f2d85d14575e31d254cc8eac7ffc689dcf7461b8f63af4936cd9803b1"}, &(0x7f00000005c0)={0x0, 0xa, 0x1, 0x81}, &(0x7f0000000600)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000640)={0x20, 0x80, 0x1c, {0x2, 0xc8, 0x6, 0x8000, 0x8, 0xc8, 0x100, 0x0, 0x9, 0x1, 0x6, 0x3}}, &(0x7f0000000680)={0x20, 0x85, 0x4, 0x401}, &(0x7f00000006c0)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000700)={0x20, 0x87, 0x2, 0x2}, &(0x7f0000000740)={0x20, 0x89, 0x2}}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) socket$kcm(0x11, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x6, 0x4, 0x1, 0x0, r8}, 0x50) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13}, 0x90) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000140)={r10, r9}, 0xc) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$UDMABUF_CREATE_LIST(0xffffffffffffffff, 0x40087543, 0x0) creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39dcdb) r11 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r11}, &(0x7f0000000040)) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 840.20586ms ago: executing program 2 (id=1204): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$SG_BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) socket(0x10, 0x1, 0x9) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x48) ioctl$FS_IOC_GETFSSYSFSPATH(r0, 0x80811501, &(0x7f0000000140)={0x80}) setns(0xc9, 0x0) r1 = socket(0x8, 0x5, 0x5) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x40106183, &(0x7f00000000c0)={@none, 0x1}) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./debug/ref_tracker/netns-7-4026531833-notrefcnt\x00', 0x0, 0x0) openat$cuse(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = memfd_create(&(0x7f0000001440)='prodM\xb0\xea\a\x06\xbe\xaen/\xce4\xb7\xc1\xef\xba!\x9d\rSt\xa24\t\x00\x00\x00\x00\x00\x00\x00\xff\xff\x10\x04\x00\x00\x1dz\xd05\xe2e,\xb1\x84\xea\x91^%A\xe5\x9e\x13TdT\xc6^p\xb0#R\x04\x06\xae\xebA;Y\xeb\x8f\xec\xb4\xf9\x17\xb7\x04\xc2\xc0\xc6\xb4\v\xff\xfc\x88\x90\xabC\x02\x00\xf04\x03\x88\xae9\'>R^P{Vr!\xe2W\xc72\xea\xb7Wp\xc36\x96\xffZ\\A@\x00\x00\x00\xc9\xf3Y\xb8\x89#\xa1\xb1)Dk\xeb\xa1\t\x00{u[\xbd\x9d\xf4\xbf\\\xce\x02P\xf2MY\x05^\xffj\x9c\x14\xb7\xb6v\x1d*1>\x00 \x00\x00\x00\x00\x14C?]\x8c\xb4Y\xcf\x80\x85\xd6\x036\xc8~\xa8\f\x00\x00\xb5U\xec\xe06\xed\xe4\xfb\xdf\a\xd0lg\x13\xf9\x8b:Z>\xd7s\xef\xb3\x9f#\x15)\xf9\xe10\xc7\xb262-\x00\x00\x00\x00\xc8X\xdaNz\x0eu\x8f\x01\x00\x00\x00\x80\x00\x00\xdd\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc3\xa7/\x0f\x9b`\xa5\x98\x81a\xeev\x00\x00\x00\x00\a\x00\x00m2\xf2\xd8,\x17\xf8\x8e\xae\xc8\xad\xed<\"\x8e\n\x9d\xb13\x8d\xef\x96\xd2I\"8=tg\xdfU\xd0q\xf1\x0e\xccq*\xabM\x97}\x18\x8c5\x95/f\xec\xdc\xa3\xe1[\xc0\xaa\xefz\xc9\xf4[R\xc36b\xa2]\xed\xe8\xb0\xfa\"\xa2\xd27)\xd5yQ\xff}5\x94\x88\xa1\xdc\xa1g\xe0q\xc5:\xe4\xdf\x80\xb3,\xb9\xb2\xdc\x81\x9f6\x0f\x84WY\xbfSY`\xb8\a\x19\xb1\x058\xa4\xc3\xbb\xf8aB:\x84\x02?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf3o-GU\xb0\x00F\xb3o(aI[\xd6\x9fG\xaeI\x83\x93\x8cC\xc0#\xe0q\xd0Ex|\xdb\xa8\x16\xfe>:\t0\xfd\x8a\xc7\x84\xb5\xc7M-0A\xf0\x94\xf3\xcc\x8d\xbb3\\\"\x882\xb3\xa84\xac\x00\xdd}Ft\xc6\xcc\f}1X#\xe4\xe1\x94i\xce\xa1\xff\x95\x80\xb4T\x9c\x01\xf3\x1cLB\x94m(m\f\xbc\xebY\xa0\xf7\xf0\x9d\x10\xbd\x86\x1by\x00\x00\x00\x00\xb9\xb9\xbf\xdf~9\nC\xe9\xc5\x0e\xda\x9c(\x9b\"\xc7\x97\xfc\b\xd9\xc2T\xa7*\x7f]\xc8\xb3 .\x9b\x89\x0f\xf8$\xdd>lU\x13EG\xbb1] \xda\x19\xc5\x9bW\x02\xd2K\xba8~\x83\x19\xfa\xf7\x9b\f\xfa\x15\x95\xc4\xfcw\xbb\x92\x91\xc4\xa6\x907XK\xfc\x17]\xfa\xff\'\xef\x92\x1c\xb8\x1fK\xb2o \xd1\xbd\xb2\x11+\xa3R\xefQ\xc2\xbdW\x05\xec\xb3=@\x03\xc6^\xa2\x15%\xb0\'D#\xb6Q\x8f\x82?S>\x00P\x9cE\x92{d\xe6\x9cj1\x87\xb3\x01\xde\xe8\x89\xc4s\xb7\x14~}\xaa\x8c\xc3\x95BAE\xf2.\x8f#;a\x94\"\xd1U\xff\xe8v\xd3\x84d\xf4\x134\xa6XIkh\xaa\x15\x9a\xf7Z\xe3%\x88p\x90\xbb\x9dt\xa3\xe1\r\x8d\x94\"\x19\x8b\x17)\xea\xd5\x17\xeb\xe4\x1b\x0fBZ1\xbe\xee\xfa\x1c\xf9\xa6\x11\x94\x06\\P:\xaf\xcex\xc2\x82\x9a\x16\xfc\xa1\x05\x00\x00\x00\x1a\xdc\xb7\x12\xbba\b\xbb\xed\xb2\xd1W\xe2\x8b\x8d8}\x10W\xbd\xa60A\xc3\x03\xfa\x890\x86#\bQ\xcb)\xf6]\x9e\x14\xd2\xea\x82\xa8\xb7ZG\x15r\xf1l 1\x8d \xc1\xab\x19\\\x91\x13\x1b8\xe1\xc3\xa4\v\x94\xbfJ\xb5\xde\x95\x82\x00]B|\xe2[%\xe3\xf0\x04\xba\xed\xdb\xf5\x7f\x9d\xfe>\xf6m$M&\x7fq]\xe4\xf6\x82\xc3\x00\xb1zg}\x99E\xa4\x19\xe9\x1a4a\xd75D-k\x84\xa6\x12+\xebk\xa1\xfek\x89\xef\x18\xc1)6\xa65\xe2D\xbe\xe1\xdfq\xdd68\xf37g\xab9m\xe7\xddO\v?\xe0\xbe}\xa9U\xc7{\xd3\x16W\xbb\xe5\xd2\x93\xfe\xa4\x9d\r$\xe91c8`\x86\xbc)\xe29\xc3}\xb9P\xd5F\xc6\x12\x8c_x\xa8\xfa\xb5K\x03\x85\x93k\xe1\x8e\x1f)\".\xcc\'\v\xa6\x1bj\\\n\xe98yA\xd8T\x85\x80A\xcbo\x99\x99\xeb)r\x1a\xce\x18(\x185LL\xbcOeO\'\xe2\x86&\xe4\xe2\xe7~\x92\xa2\xb2\x1b\xc3\x00\x85\xce\xad7\x87\xa0\xfcc\xf5\xf8\xaf\v,q\xd4\x18\xbdM\x1a\xde\xba*L\x05m6\xecH\xd0T\xb8m\xdb\b\xa6\x02\xfb\x13\xac\x91\x8a\x8d\x94\x93\x8d=\xb1\x84\x9c\x9b\xe5\xc7\xa6\xc9Q\xc1eUc\xcc\x180^\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00KT2\x1b\x16=\x10\xd3\x9a\xf0\xb7;\xc0-\x9c\xac\xb9~\x9a\xdc\x15\x8d\xee*\x17\x82\x1e\xd2m+$\xb4\x8cOJ0\x85\x7f\xa0\x7f\xa8\xcc#\x0e\xa4\x86\x0fmO\xca\xa4\xd2\x9a\x16\xbb\x16\xb1\xd46l2ak[\xec\xe33\xae=\xaf\xffU)\x1fQ`\x81\xa2:\xf61\xafQ\xa6V-K;\xc50\n,\xb1j\x9b\x8f\xd0\xbd|\xbd\xb1+\x06\x98\xd4\x04\r!2\xe8\x16?H\x96\x182(\xcf\xf2\"\xf7.\x85\xc1-\xa3)|\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x5) fcntl$addseals(r3, 0x40a, 0x0) r4 = openat(r2, &(0x7f00000002c0)='./debug\x00', 0x208000, 0x2) write(r4, &(0x7f00000000c0)='1\x00', 0x1) read$FUSE(r4, &(0x7f0000002040)={0x2020}, 0x2020) socket$xdp(0x2c, 0x3, 0x0) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e22, 0x1, @mcast2, 0x8}}}, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$sndseq(0xffffff9c, &(0x7f0000000240), 0x1) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x110, 0x40000032, 0xffffffffffffffff, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SG_SET_FORCE_PACK_ID(r2, 0x227b, &(0x7f0000000040)) syz_emit_vhci(&(0x7f0000000840)=ANY=[@ANYBLOB="04050400c900", @ANYRES16=r5], 0x7) 322.414657ms ago: executing program 0 (id=1205): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x418, 0x0, 0x940c, 0x3002, 0x0, 0x2c0, 0x350, 0x3d8, 0x3d8, 0x350, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1dc, 0x244, 0x0, {}, [@common=@rt={{0x138}, {0x6, [0x400, 0x9], 0x1109442d, 0x2, 0x7, [@private1={0xfc, 0x1, '\x00', 0x1}, @empty, @private0, @mcast2, @dev={0xfe, 0x80, '\x00', 0x40}, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, @local, @local, @rand_addr=' \x01\x00', @private0, @private1, @local, @empty, @private1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @loopback], 0xfc}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0xb, 0x911, 0x0, 0x5, 'netbios-ns\x00', 'syz0\x00', {0x3}}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @mcast1, [0x0, 0x0, 0xff, 0xffffffff], [0xff, 0xff000000, 0x0, 0xff000000], 'netdevsim0\x00', 'ip_vti0\x00', {}, {0xff}, 0x21, 0xf4, 0x0, 0x5}, 0x0, 0xa4, 0x10c}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1d, 0x0, 0xfffffffc, 0x0, 'syz1\x00', 'syz0\x00', {0x9}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x474) syz_open_dev$I2C(&(0x7f00000007c0), 0x0, 0x40) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$kcm(0x29, 0x5, 0x0) write$cgroup_pressure(r3, &(0x7f0000000140)={'full'}, 0xfffffdef) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) bind$xdp(r5, &(0x7f0000000240)={0x2c, 0x1, r6}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x45) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) sendto$inet(r8, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r1, 0x8982, &(0x7f0000000300)={0x0, 'veth1_to_batadv\x00', {0x3}, 0x7}) setsockopt$inet_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3) recvfrom$inet(r8, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000340)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0xfffffffd, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180900000000000000000000000000009500000000000000ffc29652a2d06e0b5a8001cdcd6db33b14fdb45088e29e142cf0db18fd0f147518f57ea55a4a36e0ebb004d880947d7a5d03ac364a09bffdf3ffdba506dac9a3e569340b03f13afd5ae12b8e8d7c9892d2099a9208da142a6cad99af7b36ab2d92a84983a966d5199451645c1ff1d1d93939fe360878f5a7ebe5e8d1"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94) 84.145457ms ago: executing program 2 (id=1206): r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000600)="59fa75c016f564278b6b9f4198efa1d9cc9c0708624d6c299160ad3bb1c2a6cc634dd46307b186e0f71b2a0c222c09ecaaae1545c40140e3b7b2b8370973f264666114236835c57fac639a098eb8a3bc55ad858897625abed5d6e8aa6eb0f3c1d725a0c12a0b09e2e5129d20b000e33ec9c18b51299a229b6596f81cd9d45ccc0710164133b53778c05054eb175e03586289018837f5b45995909756f8f92a95785f76a5440ecb03dc54a4656d57e81adc63b23cde1ff10a7abc32c45c180b0713435209f4e8ebc52a5bdee1d01036968e87a23c58d796af6bfffe", 0xdb) 501.671µs ago: executing program 2 (id=1207): r0 = socket$alg(0x26, 0x5, 0x0) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000600)="59fa75c016f564278b6b9f4198efa1d9cc9c0708624d6c299160ad3bb1c2a6cc634dd46307b186e0f71b2a0c222c09ecaaae1545c40140e3b7b2b8370973f264666114236835c57fac639a098eb8a3bc55ad858897625abed5d6e8aa6eb0f3c1d725a0c12a0b09e2e5129d20b000e33ec9c18b51299a229b6596f81cd9d45ccc0710164133b53778c05054eb175e03586289018837f5b45995909756f8f92a95785f76a5440ecb03dc54a4656d57e81adc63b23cde1ff10a7abc32c45c180b0713435209f4e8ebc52a5bdee1d01036968e87a23c58d796af6bfffe", 0xdb) 0s ago: executing program 2 (id=1208): mkdir(&(0x7f0000000140)='./config\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r0 = open(&(0x7f0000000580)='./config/usb_gadget/g1\x00', 0x4041, 0x177) mkdir(&(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000800)={'gre0\x00', &(0x7f0000000700)={'gre0\x00', 0x0, 0x700, 0x700, 0x5233, 0x0, {{0x19, 0x4, 0x0, 0x33, 0x64, 0x66, 0x0, 0x0, 0x4, 0x0, @broadcast, @loopback, {[@timestamp_prespec={0x44, 0x2c, 0x70, 0x3, 0x5, [{@rand_addr=0x64010102, 0x80000001}, {@rand_addr=0x64010101, 0x10000}, {@multicast2, 0x2}, {@multicast2, 0x1}, {@multicast1, 0x3ff}]}, @timestamp_addr={0x44, 0xc, 0x98, 0x1, 0x6, [{@broadcast, 0x6}]}, @generic={0x7, 0x8, "5588244fdf58"}, @end, @generic={0x82, 0xe, "618417680325707ce45ece8b"}]}}}}}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002c00)={0xffffffffffffffff, 0x18000000000002a0, 0x42, 0x0, &(0x7f0000000500)="b9ff0300600d698cb89e14f086dd1f000c0cae0e4000632177fbac14140ee934a0a662079f4b4d2f87e5feca6aab845013f2325f1a39010108038da1924425181aa5", 0x0, 0x100, 0x60000000, 0x5c, 0xc0, &(0x7f0000000000), &(0x7f0000002c80)="8dc92a8ff39080a675b6565efa3ed46f2a2756e43abbfd8c44686c04d6a0c42f2599fc2b73f432c834dac249597b646035045af99decf86f5b32dc0404e599f56091e15e581ff6805ee283c0313298a5b8ba1c84f1850c217b5a2c2bc547eaf4585e5ba878d1660fa871a275fb61d1fec75942919083919f8d8fdad79615bc5d2d3fa40e054d38d49dfbebc2f137fc7110"}, 0x48) mkdir(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv\x00', 0x1ff) mkdir(&(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p\x00', 0x1ff) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f00000002c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x18d5}}, './config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00'}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="a800000001070101000000000000000007003fcc7c4c0a00"/40], 0x28}, 0x1, 0x0, 0x0, 0x4000041}, 0x804) r2 = open(&(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p/wWidth\x00', 0x241, 0x1ff) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f00000005c0)={0x2, {0x2, 0x7, 0xffff, 0x8, 0x5, 0x4}}) write(r2, &(0x7f0000000540)='1', 0x1) write(0xffffffffffffffff, &(0x7f0000000600), 0x0) close(0xffffffffffffffff) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000300), 0x8f, 0x40240) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f0000000000)={r3, 0x0, {0x2a12, 0x80010000, 0x0, 0x4, 0x100004, 0x0, 0x0, 0xe, 0x5, "fee8a2ab78fc179fd1f809000100aca7ca44c6a4b3e00d9683dda1af01000000c0ff12001000000000000000000300", "2809e8dbe1b22d0000b420a1a93c7540f476779e0117613dd4a5582b24ff08000000000000000000faffffff00", "e7460000102006000000e444000017123c00", [0xe0, 0x40000000]}}) write(r3, &(0x7f0000000440)="ef5b561406", 0x5) r5 = open(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p/dwMaxVideoFrameBufferSize\x00', 0x241, 0x1ff) write(r5, &(0x7f00000006c0)='1843', 0x4) close(r5) write(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f00000007c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000000940)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') kernel console output (not intermixed with test programs): 000 R15: 0000000000000000 [ 165.052019][ T8151] [ 165.072949][ T60] usb 5-1: USB disconnect, device number 10 [ 165.120705][ T8153] netlink: 72 bytes leftover after parsing attributes in process `syz.0.694'. [ 165.149825][ T8153] netlink: 72 bytes leftover after parsing attributes in process `syz.0.694'. [ 165.169598][ T8153] netlink: 72 bytes leftover after parsing attributes in process `syz.0.694'. [ 165.300079][ T8159] netlink: 20 bytes leftover after parsing attributes in process `syz.3.695'. [ 165.592279][ T8167] Missing 'naa.' prefix [ 165.592294][ T43] audit: type=1800 audit(1787772444.072:273): pid=8167 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.697" name="nexus" dev="configfs" ino=20814 res=0 errno=0 [ 166.205872][ T5526] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 166.283044][ T8181] netlink: 12 bytes leftover after parsing attributes in process `syz.0.701'. [ 166.362834][ T5526] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 166.369238][ T5526] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.378268][ T5526] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 166.386266][ T5526] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 166.394251][ T5526] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.404253][ T5526] usb 7-1: config 0 descriptor?? [ 166.753615][ T8196] lo speed is unknown, defaulting to 1000 [ 166.835598][ T5526] plantronics 0003:047F:FFFF.0018: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 167.710350][ T43] audit: type=1800 audit(1787772446.203:274): pid=8216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.708" name="nexus" dev="configfs" ino=20966 res=0 errno=0 [ 168.874052][ T60] usb 7-1: USB disconnect, device number 15 [ 169.902862][ T5744] Bluetooth: hci2: command 0x0406 tx timeout [ 169.905227][ T64] Bluetooth: hci1: command 0x2016 tx timeout [ 170.332027][ T8250] netlink: 4 bytes leftover after parsing attributes in process `syz.3.716'. [ 170.335531][ T8250] 1: renamed from veth1_virt_wifi (while UP) [ 170.416183][ T8252] netlink: 8 bytes leftover after parsing attributes in process `syz.3.718'. [ 170.570728][ T43] audit: type=1800 audit(1787772449.065:275): pid=8255 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.717" name="nexus" dev="configfs" ino=22725 res=0 errno=0 [ 170.879510][ T8259] FAULT_INJECTION: forcing a failure. [ 170.879510][ T8259] name failslab, interval 1, probability 10, space 0, times 0 [ 170.896824][ T8259] CPU: 0 UID: 0 PID: 8259 Comm: syz.0.721 Tainted: G L syzkaller #0 PREEMPT(full) [ 170.896843][ T8259] Tainted: [L]=SOFTLOCKUP [ 170.896847][ T8259] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 170.896854][ T8259] Call Trace: [ 170.896859][ T8259] [ 170.896864][ T8259] dump_stack_lvl+0x100/0x190 [ 170.896883][ T8259] should_fail_ex.cold+0x5/0xa [ 170.896991][ T8259] should_failslab+0xc2/0x120 [ 170.897003][ T8259] __kvmalloc_node_noprof+0x116/0x970 [ 170.897021][ T8259] ? traverse.part.0.constprop.0+0x397/0x650 [ 170.897038][ T8259] traverse.part.0.constprop.0+0x397/0x650 [ 170.897056][ T8259] seq_read_iter+0x93f/0x1270 [ 170.897070][ T8259] ? aa_file_perm+0x7f3/0x14d0 [ 170.897088][ T8259] seq_read+0x344/0x4d0 [ 170.897101][ T8259] ? __pfx_seq_read+0x10/0x10 [ 170.897116][ T8259] ? get_pid_task+0xfc/0x250 [ 170.897131][ T8259] ? get_pid_task+0xfc/0x250 [ 170.897150][ T8259] ? __pfx_seq_read+0x10/0x10 [ 170.897162][ T8259] proc_reg_read+0x240/0x330 [ 170.897178][ T8259] ? __pfx_proc_reg_read+0x10/0x10 [ 170.897194][ T8259] vfs_read+0x1e4/0xb40 [ 170.897209][ T8259] ? __pfx_vfs_read+0x10/0x10 [ 170.897220][ T8259] ? find_held_lock+0x2b/0x80 [ 170.897236][ T8259] ? __fget_files+0x215/0x3d0 [ 170.897249][ T8259] ? __fget_files+0x215/0x3d0 [ 170.897265][ T8259] ? __fget_files+0x21f/0x3d0 [ 170.897282][ T8259] ksys_pread64+0x161/0x1a0 [ 170.897296][ T8259] ? __pfx_ksys_pread64+0x10/0x10 [ 170.897308][ T8259] ? ksys_write+0x1ac/0x250 [ 170.897320][ T8259] ? __pfx_ksys_write+0x10/0x10 [ 170.897336][ T8259] __do_fast_syscall_32+0x13a/0x8b0 [ 170.897347][ T8259] ? lockdep_hardirqs_on+0x7d/0x110 [ 170.897364][ T8259] do_fast_syscall_32+0x32/0x70 [ 170.897374][ T8259] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 170.897389][ T8259] RIP: 0023:0xf70cefec [ 170.897406][ T8259] Code: Unable to access opcode bytes at 0xf70cefc2. [ 170.897411][ T8259] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 ORIG_RAX: 00000000000000b4 [ 170.897422][ T8259] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000200 [ 170.897428][ T8259] RDX: 00000000000000fd RSI: 0000000000000001 RDI: 0000000000000000 [ 170.897434][ T8259] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 170.897440][ T8259] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 170.897446][ T8259] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 170.897459][ T8259] [ 171.938188][ T43] audit: type=1800 audit(1787772450.440:276): pid=8282 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.727" name="nexus" dev="configfs" ino=21896 res=0 errno=0 [ 172.406859][ T8298] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 172.410410][ T8298] overlayfs: failed to set xattr on upper [ 172.416002][ T8298] overlayfs: ...falling back to redirect_dir=nofollow. [ 172.418870][ T8298] overlayfs: ...falling back to index=off. [ 172.421422][ T8298] overlayfs: ...falling back to uuid=null. [ 172.800494][ T8303] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 172.803311][ T8303] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 172.807516][ T8303] vhci_hcd vhci_hcd.0: Device attached [ 172.898889][ T43] audit: type=1800 audit(1787772451.404:277): pid=8310 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.736" name="nexus" dev="configfs" ino=21919 res=0 errno=0 [ 172.899106][ T8310] Missing 'naa.' prefix [ 173.097122][ T5837] usb 42-1: SetAddress Request (2) to port 0 [ 173.100868][ T5837] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 173.190654][ T8315] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 173.193259][ T8315] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 173.197426][ T8315] vhci_hcd vhci_hcd.0: Device attached [ 173.249619][ T8306] vhci_hcd: connection reset by peer [ 173.256867][ T5828] vhci_hcd vhci_hcd.2: stop threads [ 173.259843][ T5828] vhci_hcd vhci_hcd.2: release socket [ 173.268063][ T5828] vhci_hcd vhci_hcd.2: disconnect device [ 173.401209][ T6222] lo speed is unknown, defaulting to 1000 [ 173.407716][ T6222] syz2: Port: 1 Link ACTIVE [ 173.417836][ T8323] sch_tbf: burst 19872 is lower than device lo mtu (65505) ! [ 173.457695][ T8323] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 173.477474][ T5823] usb 38-1: SetAddress Request (2) to port 0 [ 173.480046][ T5823] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 173.810160][ T8317] vhci_hcd: connection reset by peer [ 173.815533][ T5814] vhci_hcd vhci_hcd.0: stop threads [ 173.817511][ T5814] vhci_hcd vhci_hcd.0: release socket [ 173.821164][ T5814] vhci_hcd vhci_hcd.0: disconnect device [ 174.141198][ T43] audit: type=1800 audit(1787772452.648:278): pid=8335 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.743" name="nexus" dev="configfs" ino=23621 res=0 errno=0 [ 174.150887][ T8335] Missing 'naa.' prefix [ 174.356671][ T43] audit: type=1800 audit(1787772452.868:279): pid=8341 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.745" name="nexus" dev="configfs" ino=23640 res=0 errno=0 [ 174.356887][ T8341] Missing 'naa.' prefix [ 174.701741][ T5526] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 174.852274][ T5526] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 174.857527][ T5526] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 174.862821][ T5526] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 174.866369][ T5526] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 174.870874][ T5526] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 174.878826][ T5526] usb 7-1: config 0 descriptor?? [ 175.235611][ T8356] binder: 8354:8356 ioctl c0306201 80000040 returned -14 [ 175.246770][ T8356] ublk1: read batch cmd buffer failed [ 175.249954][ T8356] ublk1: read batch cmd buffer failed [ 175.277748][ T43] audit: type=1800 audit(1787772453.791:280): pid=8360 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.752" name="nexus" dev="configfs" ino=22973 res=0 errno=0 [ 175.278069][ T8360] Missing 'naa.' prefix [ 175.584420][ T43] audit: type=1800 audit(1787772454.102:281): pid=8364 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.754" name="nexus" dev="configfs" ino=21081 res=0 errno=0 [ 175.597917][ T8364] Missing 'naa.' prefix [ 175.893956][ T5526] plantronics 0003:047F:FFFF.0019: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 175.898682][ T43] audit: type=1326 audit(1787772454.413:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8365 comm="syz.3.755" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f26fec code=0x0 [ 175.983354][ T5955] usb 7-1: USB disconnect, device number 16 [ 176.094652][ T8381] netlink: 'syz.0.760': attribute type 11 has an invalid length. [ 176.223795][ T8395] Missing 'naa.' prefix [ 176.225045][ T43] audit: type=1800 audit(1787772454.734:283): pid=8395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.765" name="nexus" dev="configfs" ino=23026 res=0 errno=0 [ 176.372898][ T8405] netlink: 40 bytes leftover after parsing attributes in process `syz.0.769'. [ 176.592604][ T8420] syzkaller1: entered promiscuous mode [ 176.597141][ T8420] syzkaller1: entered allmulticast mode [ 176.647851][ T43] audit: type=1800 audit(1787772455.155:284): pid=8424 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.775" name="nexus" dev="configfs" ino=22157 res=0 errno=0 [ 176.654293][ T8424] Missing 'naa.' prefix [ 176.985432][ T10] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 177.181144][ T10] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.00 [ 177.184079][ T10] usb 6-1: no configurations [ 177.185600][ T10] usb 6-1: can't read configurations, error -22 [ 177.583814][ T10] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 177.738072][ T8448] openvswitch: netlink: Flow actions attr not present in new flow. [ 177.744176][ T10] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.00 [ 177.751716][ T10] usb 6-1: no configurations [ 177.753224][ T10] usb 6-1: can't read configurations, error -22 [ 177.760967][ T10] usb usb6-port1: attempt power cycle [ 177.765038][ T8448] 9p: Could not find request transport: xen [ 177.770003][ T43] audit: type=1800 audit(1787772456.288:285): pid=8451 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.784" name="nexus" dev="configfs" ino=23151 res=0 errno=0 [ 177.770288][ T8451] Missing 'naa.' prefix [ 177.824106][ T5526] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 177.868549][ T8456] FAULT_INJECTION: forcing a failure. [ 177.868549][ T8456] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 177.873259][ T8456] CPU: 0 UID: 0 PID: 8456 Comm: syz.2.786 Tainted: G L syzkaller #0 PREEMPT(full) [ 177.873277][ T8456] Tainted: [L]=SOFTLOCKUP [ 177.873281][ T8456] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 177.873288][ T8456] Call Trace: [ 177.873293][ T8456] [ 177.873298][ T8456] dump_stack_lvl+0x100/0x190 [ 177.873318][ T8456] should_fail_ex.cold+0x5/0xa [ 177.873331][ T8456] _copy_to_user+0x32/0xd0 [ 177.873346][ T8456] simple_read_from_buffer+0xcb/0x170 [ 177.873362][ T8456] proc_fail_nth_read+0x1af/0x230 [ 177.873376][ T8456] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 177.873390][ T8456] ? rw_verify_area+0xce/0x6d0 [ 177.873401][ T8456] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 177.873413][ T8456] vfs_read+0x1e4/0xb40 [ 177.873428][ T8456] ? __pfx_vfs_read+0x10/0x10 [ 177.873439][ T8456] ? find_held_lock+0x2b/0x80 [ 177.873455][ T8456] ? __fget_files+0x215/0x3d0 [ 177.873471][ T8456] ? __fget_files+0x21f/0x3d0 [ 177.873488][ T8456] ksys_read+0x12a/0x250 [ 177.873500][ T8456] ? __pfx_ksys_read+0x10/0x10 [ 177.873517][ T8456] do_int80_emulation+0x166/0x650 [ 177.873529][ T8456] asm_int80_emulation+0x1a/0x20 [ 177.873541][ T8456] RIP: 0023:0xf71d74eb [ 177.873550][ T8456] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 177.873561][ T8456] RSP: 002b:00000000f548d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 177.873572][ T8456] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f548d5d0 [ 177.873579][ T8456] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 177.873585][ T8456] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 177.873591][ T8456] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 177.873596][ T8456] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 177.873610][ T8456] [ 177.949723][ T8463] netlink: 12 bytes leftover after parsing attributes in process `syz.2.788'. [ 177.974260][ T5526] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 177.981370][ T5526] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 177.987558][ T5526] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 177.993294][ T5526] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 178.001532][ T5526] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.013079][ T5526] usb 5-1: config 0 descriptor?? [ 178.062745][ T5955] usb 8-1: new full-speed USB device number 18 using dummy_hcd [ 178.192639][ T5837] usb 42-1: device descriptor read/8, error -110 [ 178.212340][ T10] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 178.213002][ T5955] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 178.219403][ T5955] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 39, changing to 4 [ 178.223598][ T5955] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 178.227090][ T5955] usb 8-1: config 0 interface 0 has no altsetting 0 [ 178.232909][ T5955] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 178.233088][ T10] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.00 [ 178.235602][ T5955] usb 8-1: Product: syz [ 178.238417][ T10] usb 6-1: no configurations [ 178.239700][ T5955] usb 8-1: Manufacturer: syz [ 178.241210][ T10] usb 6-1: can't read configurations, error -22 [ 178.242721][ T5955] usb 8-1: SerialNumber: syz [ 178.248190][ T5955] usb 8-1: config 0 descriptor?? [ 178.254063][ T5955] usb 8-1: selecting invalid altsetting 0 [ 178.325482][ T8465] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(9) [ 178.327770][ T8465] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 178.332920][ T8465] vhci_hcd vhci_hcd.0: Device attached [ 178.380132][ T6276] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 178.383325][ T6276] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 178.391913][ T10] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 178.417506][ T10] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.00 [ 178.421984][ T10] usb 6-1: no configurations [ 178.423734][ T10] usb 6-1: can't read configurations, error -22 [ 178.429295][ T5526] plantronics 0003:047F:FFFF.001A: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 178.433523][ T10] usb usb6-port1: unable to enumerate USB device [ 178.467916][ T5837] usb 42-1: SetAddress Request (3) to port 0 [ 178.470101][ T5837] usb 42-1: new SuperSpeed USB device number 3 using vhci_hcd [ 178.473787][ T8465] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 178.511897][ T5823] usb 38-1: device descriptor read/8, error -110 [ 178.802263][ T8466] vhci_hcd: connection reset by peer [ 178.809810][ T5814] vhci_hcd vhci_hcd.2: stop threads [ 178.811610][ T5814] vhci_hcd vhci_hcd.2: release socket [ 178.814812][ T5814] vhci_hcd vhci_hcd.2: disconnect device [ 178.901466][ T5823] usb usb38-port1: attempt power cycle [ 179.472535][ T5823] usb usb38-port1: unable to enumerate USB device [ 179.622638][ T8478] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 179.748610][ T43] audit: type=1800 audit(1787772458.272:286): pid=8481 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.793" name="nexus" dev="configfs" ino=21189 res=0 errno=0 [ 179.755263][ T8481] Missing 'naa.' prefix [ 179.763813][ T8483] Format for deleting device is "id" (uint). [ 180.540455][ T8499] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 180.546494][ T8499] sctp: [Deprecated]: syz.0.799 (pid 8499) Use of struct sctp_assoc_value in delayed_ack socket option. [ 180.546494][ T8499] Use struct sctp_sack_info instead [ 180.742913][ T10] usb 8-1: USB disconnect, device number 18 [ 180.954294][ T43] audit: type=1800 audit(1787772459.475:287): pid=8512 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.804" name="nexus" dev="configfs" ino=21233 res=0 errno=0 [ 180.954756][ T8512] Missing 'naa.' prefix [ 181.275660][ T9] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 181.446280][ T9] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 181.452739][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 181.456571][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 181.465333][ T9] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 181.470446][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.471291][ T5823] usb 5-1: USB disconnect, device number 11 [ 181.475726][ T9] usb 7-1: config 0 descriptor?? [ 181.602252][ T43] audit: type=1800 audit(1787772460.126:288): pid=8539 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.813" name="nexus" dev="configfs" ino=22249 res=0 errno=0 [ 181.602520][ T8539] Missing 'naa.' prefix [ 181.797515][ T43] audit: type=1326 audit(1787772460.327:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 181.806481][ T43] audit: type=1326 audit(1787772460.327:290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 181.813455][ T43] audit: type=1326 audit(1787772460.327:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=114 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 181.890259][ T9] plantronics 0003:047F:FFFF.001B: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 181.926070][ T43] audit: type=1326 audit(1787772460.457:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f93008 code=0x7ffc0000 [ 181.934411][ T43] audit: type=1326 audit(1787772460.457:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 181.942009][ T43] audit: type=1326 audit(1787772460.457:294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 182.144089][ T10] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 182.314674][ T10] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 182.323655][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.327207][ T10] usb 6-1: Product: syz [ 182.329083][ T10] usb 6-1: Manufacturer: syz [ 182.331193][ T10] usb 6-1: SerialNumber: syz [ 182.362379][ T8553] syzkaller0: entered promiscuous mode [ 182.364896][ T8553] syzkaller0: entered allmulticast mode [ 182.379968][ T1034] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 182.387257][ T5751] Bluetooth: hci1: unexpected event for opcode 0x2007 [ 182.800837][ T43] kauditd_printk_skb: 2 callbacks suppressed [ 182.800850][ T43] audit: type=1326 audit(1787772461.328:297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 182.809834][ T43] audit: type=1326 audit(1787772461.328:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 182.818807][ T43] audit: type=1326 audit(1787772461.328:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 183.465551][ T1034] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 183.476002][ T1034] ath9k_htc: Failed to initialize the device [ 183.541564][ T5837] usb 42-1: device descriptor read/8, error -110 [ 183.625331][ T1034] usb 6-1: ath9k_htc: USB layer deinitialized [ 183.661878][ T5837] usb usb42-port1: attempt power cycle [ 183.718328][ T8565] netlink: 'syz.2.821': attribute type 29 has an invalid length. [ 183.945722][ T6222] usb 7-1: USB disconnect, device number 17 [ 184.172932][ T43] audit: type=1800 audit(1787772462.711:300): pid=8567 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.822" name="nexus" dev="configfs" ino=23389 res=0 errno=0 [ 184.180027][ T8567] Missing 'naa.' prefix [ 184.263374][ T5837] usb usb42-port1: unable to enumerate USB device [ 184.278778][ T8571] SET target dimension over the limit! [ 184.287044][ T8547] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 184.289340][ T8571] netlink: 32 bytes leftover after parsing attributes in process `syz.3.824'. [ 184.292067][ T8547] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 184.315599][ T8547] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 184.318048][ T8547] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 184.329686][ T8547] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 184.331655][ T8571] 9p: Bad value for 'rfdno' [ 184.337128][ T8547] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 184.337683][ T8571] jffs2: notice: (8571) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 184.339905][ T8547] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 184.359265][ T8563] fuse: Bad value for 'fd' [ 184.362324][ T43] audit: type=1326 audit(1787772462.901:301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 184.377655][ T43] audit: type=1326 audit(1787772462.901:302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 184.384594][ T8563] ip6t_srh: unknown srh match flags 4000 [ 184.411897][ T43] audit: type=1326 audit(1787772462.951:303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 184.426587][ T8569] openvswitch: netlink: VXLAN extension 1 has unexpected len 0 expected 4 [ 184.433171][ T43] audit: type=1326 audit(1787772462.971:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 184.439832][ T43] audit: type=1326 audit(1787772462.971:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 184.448276][ T43] audit: type=1326 audit(1787772462.981:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8546 comm="syz.1.815" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 184.474127][ T5837] usb 6-1: USB disconnect, device number 21 [ 184.789754][ T1034] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 184.939245][ T1034] usb 5-1: Using ep0 maxpacket: 8 [ 184.941367][ T1034] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 184.945282][ T1034] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 184.948141][ T1034] usb 5-1: config 0 has no interface number 0 [ 184.950529][ T1034] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 184.954646][ T1034] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 184.958972][ T1034] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 184.962592][ T1034] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 184.967745][ T1034] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 184.974209][ T1034] usb 5-1: config 0 descriptor?? [ 184.982098][ T1034] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 185.306182][ T8594] lo speed is unknown, defaulting to 1000 [ 185.330380][ T8597] netlink: 52 bytes leftover after parsing attributes in process `syz.3.831'. [ 185.578255][ T1034] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 185.735626][ T8611] netlink: 4 bytes leftover after parsing attributes in process `syz.3.833'. [ 185.739309][ T1034] usb 6-1: Using ep0 maxpacket: 16 [ 185.742294][ T1034] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 185.747719][ T8612] jffs2: notice: (8612) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 185.750609][ T1034] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 185.760280][ T1034] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 185.765554][ T1034] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.773142][ T1034] usb 6-1: config 0 descriptor?? [ 186.077465][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 186.170149][ T8621] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.173382][ T8621] bridge0: port 2(bridge_slave_1) entered listening state [ 186.176631][ T8621] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.179771][ T8621] bridge0: port 1(bridge_slave_0) entered listening state [ 186.308101][ T1034] usbhid 6-1:0.0: can't add hid device: -71 [ 186.310977][ T1034] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 186.316015][ T1034] usb 6-1: USB disconnect, device number 22 [ 186.337240][ T5097] Bluetooth: hci2: command 0x0406 tx timeout [ 186.337283][ T5751] Bluetooth: hci3: command 0x0406 tx timeout [ 186.347342][ T5751] Bluetooth: hci1: command 0x2016 tx timeout [ 186.748265][ T6222] libceph: connect (1)[c::]:6789 error -101 [ 186.750394][ T6222] libceph: mon0 (1)[c::]:6789 connect error [ 187.083814][ T6222] libceph: connect (1)[c::]:6789 error -101 [ 187.086645][ T6222] libceph: mon0 (1)[c::]:6789 connect error [ 187.176031][ T5823] usb 7-1: new low-speed USB device number 18 using dummy_hcd [ 187.305858][ T5823] usb 7-1: device descriptor read/64, error -71 [ 187.545471][ T5823] usb 7-1: new low-speed USB device number 19 using dummy_hcd [ 187.552190][ T6222] usb 5-1: USB disconnect, device number 12 [ 187.581752][ T6222] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 187.596266][ T42] libceph: connect (1)[c::]:6789 error -101 [ 187.600338][ T42] libceph: mon0 (1)[c::]:6789 connect error [ 187.677473][ T5823] usb 7-1: device descriptor read/64, error -71 [ 187.785540][ T5823] usb usb7-port1: attempt power cycle [ 187.843336][ T8629] ceph: No mds server is up or the cluster is laggy [ 188.124785][ T5823] usb 7-1: new low-speed USB device number 20 using dummy_hcd [ 188.145515][ T5823] usb 7-1: device descriptor read/8, error -71 [ 188.384511][ T5823] usb 7-1: new low-speed USB device number 21 using dummy_hcd [ 188.405597][ T5823] usb 7-1: device descriptor read/8, error -71 [ 188.414555][ T5751] Bluetooth: hci3: command 0x0406 tx timeout [ 188.424395][ T5751] Bluetooth: hci1: command 0x2016 tx timeout [ 188.424421][ T5097] Bluetooth: hci2: command 0x0406 tx timeout [ 188.515160][ T5823] usb usb7-port1: unable to enumerate USB device [ 188.579926][ T5097] Bluetooth: hci2: Ignoring connect complete event for invalid link type [ 189.363252][ T6222] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 189.374534][ T43] kauditd_printk_skb: 16 callbacks suppressed [ 189.374546][ T43] audit: type=1800 audit(1787772467.918:323): pid=8663 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.851" name="nexus" dev="configfs" ino=23899 res=0 errno=0 [ 189.374762][ T8663] Missing 'naa.' prefix [ 189.422061][ T8665] syzkaller0: entered promiscuous mode [ 189.424290][ T8665] syzkaller0: entered allmulticast mode [ 189.513902][ T6222] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 189.519048][ T6222] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 189.523728][ T6222] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 189.527834][ T6222] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 189.535938][ T6222] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.541414][ T6222] usb 5-1: config 0 descriptor?? [ 189.966270][ T6222] plantronics 0003:047F:FFFF.001C: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 190.014101][ T43] audit: type=1326 audit(1787772468.559:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8677 comm="syz.1.857" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 190.020878][ T43] audit: type=1326 audit(1787772468.559:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8677 comm="syz.1.857" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 190.029551][ T43] audit: type=1326 audit(1787772468.559:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8677 comm="syz.1.857" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 190.036464][ T43] audit: type=1326 audit(1787772468.559:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8677 comm="syz.1.857" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 190.044718][ T43] audit: type=1326 audit(1787772468.559:328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8677 comm="syz.1.857" exe="/syz-executor" sig=0 arch=40000003 syscall=136 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 190.051390][ T43] audit: type=1326 audit(1787772468.559:329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8677 comm="syz.1.857" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 190.058353][ T43] audit: type=1326 audit(1787772468.559:330): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8677 comm="syz.1.857" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 190.065374][ T43] audit: type=1326 audit(1787772468.559:331): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8677 comm="syz.1.857" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 190.071993][ T43] audit: type=1326 audit(1787772468.559:332): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8677 comm="syz.1.857" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 190.129615][ T8680] syzkaller0: entered promiscuous mode [ 190.131455][ T8680] syzkaller0: entered allmulticast mode [ 190.135798][ T8680] tipc: Started in network mode [ 190.137474][ T8680] tipc: Node identity 76c0d7bd5ef, cluster identity 4711 [ 190.141852][ T8680] tipc: Enabled bearer , priority 0 [ 190.163416][ T8679] tipc: Resetting bearer [ 190.175590][ T8679] tipc: Disabling bearer [ 190.319237][ T8685] syzkaller0: entered promiscuous mode [ 190.321275][ T8685] syzkaller0: entered allmulticast mode [ 190.491927][ T5097] Bluetooth: hci2: command 0x0406 tx timeout [ 190.493792][ T8691] random: crng reseeded on system resumption [ 190.749956][ T8700] FAULT_INJECTION: forcing a failure. [ 190.749956][ T8700] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 190.754211][ T8700] CPU: 1 UID: 0 PID: 8700 Comm: syz.3.865 Tainted: G L syzkaller #0 PREEMPT(full) [ 190.754230][ T8700] Tainted: [L]=SOFTLOCKUP [ 190.754234][ T8700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 190.754240][ T8700] Call Trace: [ 190.754245][ T8700] [ 190.754250][ T8700] dump_stack_lvl+0x100/0x190 [ 190.754268][ T8700] should_fail_ex.cold+0x5/0xa [ 190.754282][ T8700] _copy_from_iter+0x1f4/0x1690 [ 190.754297][ T8700] ? _copy_from_iter+0x350/0x1690 [ 190.754310][ T8700] ? _copy_from_iter+0x270/0x1690 [ 190.754323][ T8700] ? __pfx__copy_from_iter+0x10/0x10 [ 190.754338][ T8700] ? __pfx__copy_from_iter+0x10/0x10 [ 190.754354][ T8700] copy_page_from_iter+0x238/0x300 [ 190.754370][ T8700] skb_copy_datagram_from_iter+0x399/0x720 [ 190.754391][ T8700] tun_get_user+0x188c/0x3c20 [ 190.754410][ T8700] ? __pfx_tun_get_user+0x10/0x10 [ 190.754423][ T8700] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 190.754444][ T8700] ? find_held_lock+0x2b/0x80 [ 190.754461][ T8700] ? tun_get+0x191/0x370 [ 190.754471][ T8700] ? tun_get+0x191/0x370 [ 190.754485][ T8700] tun_chr_write_iter+0xdc/0x200 [ 190.754498][ T8700] vfs_write+0x6af/0x1050 [ 190.754511][ T8700] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 190.754525][ T8700] ? __pfx_vfs_write+0x10/0x10 [ 190.754537][ T8700] ? find_held_lock+0x2b/0x80 [ 190.754560][ T8700] ksys_write+0x12a/0x250 [ 190.754572][ T8700] ? __pfx_ksys_write+0x10/0x10 [ 190.754588][ T8700] do_int80_emulation+0x166/0x650 [ 190.754601][ T8700] asm_int80_emulation+0x1a/0x20 [ 190.754612][ T8700] RIP: 0023:0xf71274eb [ 190.754622][ T8700] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 190.754633][ T8700] RSP: 002b:00000000f53e644c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 190.754644][ T8700] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000200 [ 190.754651][ T8700] RDX: 000000000000fef3 RSI: 0000000000000000 RDI: 0000000000000000 [ 190.754657][ T8700] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 190.754663][ T8700] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 190.754668][ T8700] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 190.754681][ T8700] [ 191.562791][ T8714] netlink: 'syz.2.871': attribute type 1 has an invalid length. [ 191.573943][ T8714] exFAT-fs (nbd2): mounting with "discard" option, but the device does not support discard [ 191.577408][ T8714] exFAT-fs (nbd2): unable to read boot sector [ 191.579502][ T8714] exFAT-fs (nbd2): failed to read boot sector [ 191.582945][ T8714] exFAT-fs (nbd2): failed to recognize exfat type [ 191.940888][ T5823] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 192.100258][ T5823] usb 7-1: Using ep0 maxpacket: 8 [ 192.102926][ T5823] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 192.106724][ T5823] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 192.109328][ T5823] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 192.112963][ T5823] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 192.116333][ T5823] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 192.119449][ T5823] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 192.123781][ T5823] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.130578][ T10] usb 5-1: USB disconnect, device number 13 [ 192.334208][ T5823] usb 7-1: usb_control_msg returned -32 [ 192.336074][ T5823] usbtmc 7-1:16.0: can't read capabilities [ 192.499967][ T5955] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 192.660410][ T5955] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 192.664685][ T5955] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 192.668538][ T5955] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 192.672567][ T5955] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 192.677381][ T5955] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.682042][ T5955] usb 8-1: config 0 descriptor?? [ 192.692789][ T8729] usbtmc 7-1:16.0: usb_bulk_msg returned -71 [ 193.101192][ T8731] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 193.102067][ T5955] plantronics 0003:047F:FFFF.001D: hiddev1,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 193.152359][ T8734] syzkaller0: entered promiscuous mode [ 193.154800][ T8734] syzkaller0: entered allmulticast mode [ 193.163667][ T8734] tipc: Enabled bearer , priority 0 [ 193.170411][ T8734] tipc: Resetting bearer [ 193.174614][ T8732] tipc: Resetting bearer [ 193.185640][ T8732] tipc: Disabling bearer [ 193.343705][ T8737] netlink: 40 bytes leftover after parsing attributes in process `syz.0.879'. [ 193.348188][ T8737] MTD: Attempt to mount non-MTD device "/dev/sr0" [ 193.374000][ T1433] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.376771][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.068461][ T5955] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 194.219136][ T5955] usb 6-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 194.223847][ T5955] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 194.227653][ T5955] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.442127][ T5955] qmi_wwan 6-1:1.0: cdc-wdm2: USB WDM device [ 194.480763][ T5955] wwan wwan0: port wwan0qmi0 attached [ 194.665005][ T5955] qmi_wwan 6-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.1-1, WWAN/QMI device, 76:87:20:02:a3:66 [ 194.717653][ T10] usb 7-1: USB disconnect, device number 22 [ 194.858825][ T5955] usb 6-1: USB disconnect, device number 23 [ 194.880569][ T5955] qmi_wwan 6-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.1-1, WWAN/QMI device [ 194.997817][ T0] NOHZ tick-stop error: local softirq work is pending, handler #280!!! [ 195.012755][ T8767] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(7) [ 195.014832][ T8767] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 195.022187][ T8767] vhci_hcd vhci_hcd.0: Device attached [ 195.028563][ T5955] wwan wwan0: port wwan0qmi0 disconnected [ 195.081800][ T8772] input: syz0 as /devices/virtual/input/input24 [ 195.280243][ T5955] usb 8-1: USB disconnect, device number 19 [ 195.287861][ T5837] usb 42-1: SetAddress Request (6) to port 0 [ 195.295753][ T5837] usb 42-1: new SuperSpeed USB device number 6 using vhci_hcd [ 195.630281][ T8768] vhci_hcd: connection reset by peer [ 195.632274][ T5814] vhci_hcd vhci_hcd.2: stop threads [ 195.633987][ T5814] vhci_hcd vhci_hcd.2: release socket [ 195.641414][ T5814] vhci_hcd vhci_hcd.2: disconnect device [ 196.241910][ T8814] FAULT_INJECTION: forcing a failure. [ 196.241910][ T8814] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 196.246033][ T8814] CPU: 0 UID: 0 PID: 8814 Comm: syz.2.890 Tainted: G L syzkaller #0 PREEMPT(full) [ 196.246050][ T8814] Tainted: [L]=SOFTLOCKUP [ 196.246054][ T8814] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 196.246060][ T8814] Call Trace: [ 196.246065][ T8814] [ 196.246070][ T8814] dump_stack_lvl+0x100/0x190 [ 196.246087][ T8814] should_fail_ex.cold+0x5/0xa [ 196.246101][ T8814] _copy_from_user+0x2e/0xd0 [ 196.246115][ T8814] cmsghdr_from_user_compat_to_kern+0x354/0x7d0 [ 196.246134][ T8814] ? __pfx_cmsghdr_from_user_compat_to_kern+0x10/0x10 [ 196.246147][ T8814] ? __import_iovec+0x1d2/0x640 [ 196.246164][ T8814] ____sys_sendmsg+0x607/0xbe0 [ 196.246180][ T8814] ? __pfx_____sys_sendmsg+0x10/0x10 [ 196.246197][ T8814] ? _kstrtoull+0x13c/0x1f0 [ 196.246212][ T8814] ? __pfx__kstrtoull+0x10/0x10 [ 196.246229][ T8814] ___sys_sendmsg+0x190/0x1e0 [ 196.246245][ T8814] ? __pfx____sys_sendmsg+0x10/0x10 [ 196.246261][ T8814] ? __lock_acquire+0x4c5/0x1ec0 [ 196.246287][ T8814] __sys_sendmmsg+0x309/0x440 [ 196.246300][ T8814] ? __pfx___sys_sendmmsg+0x10/0x10 [ 196.246310][ T8814] ? find_held_lock+0x2b/0x80 [ 196.246330][ T8814] ? __mutex_unlock_slowpath+0x35d/0x930 [ 196.246353][ T8814] ? fput+0x7c/0x100 [ 196.246368][ T8814] ? ksys_write+0x1ac/0x250 [ 196.246382][ T8814] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 196.246396][ T8814] ? lockdep_hardirqs_on+0x7d/0x110 [ 196.246412][ T8814] __do_fast_syscall_32+0x13a/0x8b0 [ 196.246422][ T8814] ? lockdep_hardirqs_on+0x7d/0x110 [ 196.246439][ T8814] do_fast_syscall_32+0x32/0x70 [ 196.246449][ T8814] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 196.246463][ T8814] RIP: 0023:0xf709efec [ 196.246477][ T8814] Code: Unable to access opcode bytes at 0xf709efc2. [ 196.246482][ T8814] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 196.246493][ T8814] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000040 [ 196.246500][ T8814] RDX: 0000000000000001 RSI: 0000000000040800 RDI: 0000000000000000 [ 196.246506][ T8814] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 196.246512][ T8814] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 196.246518][ T8814] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 196.246531][ T8814] [ 196.456693][ T10] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 196.529300][ T8820] (syz.0.891,8820,2):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 196.556549][ T8820] (syz.0.891,8820,2):ocfs2_fill_super:1177 ERROR: status = -22 [ 196.619109][ T10] usb 6-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 196.623611][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 196.627305][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.639792][ T10] as10x_usb: device has been detected [ 196.642002][ T10] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 196.648891][ T10] usb 6-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 196.670234][ T10] as10x_usb: error during firmware upload part1 [ 196.672577][ T10] Registered device Abilis Systems DVB-Titan [ 197.347202][ T8823] 9pnet_fd: p9_fd_create_tcp (8823): problem connecting socket to 127.0.0.1 [ 197.512568][ T8841] netlink: 4 bytes leftover after parsing attributes in process `syz.0.897'. [ 197.517725][ T8841] syzkaller0: entered promiscuous mode [ 197.519518][ T8841] syzkaller0: entered allmulticast mode [ 197.615832][ T1034] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 197.766113][ T1034] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 197.775262][ T1034] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 197.782777][ T1034] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 197.786939][ T1034] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 197.792044][ T1034] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.798602][ T1034] usb 8-1: config 0 descriptor?? [ 197.907916][ T8854] netlink: 88 bytes leftover after parsing attributes in process `syz.1.889'. [ 198.026538][ T8858] netlink: 68 bytes leftover after parsing attributes in process `syz.1.889'. [ 198.030677][ T8858] netlink: 12 bytes leftover after parsing attributes in process `syz.1.889'. [ 198.218455][ T1034] plantronics 0003:047F:FFFF.001E: hiddev1,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 198.541019][ T43] kauditd_printk_skb: 74 callbacks suppressed [ 198.541048][ T43] audit: type=1800 audit(1787772477.086:407): pid=8861 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.901" name="nexus" dev="configfs" ino=26708 res=0 errno=0 [ 198.551406][ T8861] Missing 'naa.' prefix [ 198.900266][ T8869] gre1: entered promiscuous mode [ 198.948652][ T5097] Bluetooth: hci3: unexpected event 0x18 length: 247 > 23 [ 198.950425][ T8871] loop6: detected capacity change from 0 to 2640 [ 198.960169][ T8871] buffer_io_error: 10 callbacks suppressed [ 198.960180][ T8871] Buffer I/O error on dev loop6, logical block 0, async page read [ 198.964702][ T8871] Buffer I/O error on dev loop6, logical block 0, async page read [ 198.968021][ T8871] Buffer I/O error on dev loop6, logical block 0, async page read [ 198.970668][ T8871] Buffer I/O error on dev loop6, logical block 0, async page read [ 198.973235][ T8871] Buffer I/O error on dev loop6, logical block 0, async page read [ 198.976207][ T8871] Buffer I/O error on dev loop6, logical block 0, async page read [ 198.980629][ T8871] Buffer I/O error on dev loop6, logical block 0, async page read [ 198.983475][ T8871] Buffer I/O error on dev loop6, logical block 0, async page read [ 198.986158][ T8871] ldm_validate_partition_table(): Disk read failed. [ 198.988677][ T8871] Buffer I/O error on dev loop6, logical block 0, async page read [ 198.991196][ T8871] Buffer I/O error on dev loop6, logical block 0, async page read [ 198.993834][ T8871] Dev loop6: unable to read RDB block 0 [ 198.996163][ T8871] loop6: unable to read partition table [ 198.998126][ T8871] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 199.128865][ T5147] ldm_validate_partition_table(): Disk read failed. [ 199.131179][ T5147] Dev loop6: unable to read RDB block 0 [ 199.133614][ T5147] loop6: unable to read partition table [ 199.210884][ T41] usb 6-1: USB disconnect, device number 24 [ 199.272921][ T41] Unregistered device Abilis Systems DVB-Titan [ 199.310589][ T41] as10x_usb: device has been disconnected [ 199.409419][ T8895] binder: 8894:8895 ioctl 4018620d 0 returned -22 [ 199.657533][ T5955] lg-g15 0003:046D:0A07.001F: hidraw2: USB HID v0.00 Device [syz0] on syz0 [ 199.685624][ T8901] fido_id[8901]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 199.772089][ T8905] openvswitch: netlink: Multiple metadata blocks provided [ 200.064184][ T5955] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 200.214119][ T5955] usb 6-1: Using ep0 maxpacket: 8 [ 200.217175][ T5955] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 200.220975][ T5955] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 200.223679][ T5955] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 200.226876][ T5955] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 200.229997][ T5955] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 200.233225][ T5955] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 200.237328][ T5955] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.324161][ T5837] usb 42-1: device descriptor read/8, error -110 [ 200.353773][ T5526] usb 8-1: USB disconnect, device number 20 [ 200.459782][ T5955] usb 6-1: usb_control_msg returned -32 [ 200.461615][ T5955] usbtmc 6-1:16.0: can't read capabilities [ 200.472703][ T5097] Bluetooth: hci1: unexpected event for opcode 0x2024 [ 200.519261][ T8916] netlink: 16 bytes leftover after parsing attributes in process `syz.2.918'. [ 200.523052][ T8915] binder: 8910:8915 ioctl 4018620d 0 returned -22 [ 200.821556][ T43] audit: type=1800 audit(1787772479.368:408): pid=8919 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.920" name="nexus" dev="configfs" ino=24158 res=0 errno=0 [ 201.078746][ T5837] usb usb42-port1: attempt power cycle [ 201.622156][ T8927] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 201.642399][ T8928] hpfs: hpfs_map_sector(): read error [ 201.685381][ C3] bridge0: port 1(bridge_slave_0) entered learning state [ 201.688588][ C3] bridge0: port 2(bridge_slave_1) entered learning state [ 201.793218][ T5526] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 201.943142][ T5526] usb 8-1: Using ep0 maxpacket: 8 [ 201.946010][ T5526] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 201.950306][ T5526] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 201.953975][ T5526] usb 8-1: config 0 has no interface number 0 [ 201.956557][ T5526] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 201.961041][ T5526] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 201.965847][ T5526] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 201.969262][ T5526] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 201.973420][ T5526] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.977960][ T5526] usb 8-1: config 0 descriptor?? [ 201.983719][ T5526] ldusb 8-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 202.093988][ T5837] usb usb42-port1: unable to enumerate USB device [ 202.185879][ T8921] usbtmc 6-1:16.0: send_request_dev_dep_msg_in returned -90 [ 202.207122][ T8921] lo speed is unknown, defaulting to 1000 [ 202.369164][ T8921] usbtmc 6-1:16.0: send_request_dev_dep_msg_in returned -90 [ 202.379685][ T5955] usb 8-1: USB disconnect, device number 21 [ 202.388058][ T5955] ldusb 8-1:0.55: LD USB Device #1 now disconnected [ 202.607808][ T8943] mmap: syz.0.929 (8943): VmData 37388288 exceed data ulimit 7. Update limits or use boot option ignore_rlimit_data. [ 202.618621][ T43] audit: type=1800 audit(1787772481.168:409): pid=8945 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.930" name="nexus" dev="configfs" ino=24828 res=0 errno=0 [ 202.623131][ T8945] Missing 'naa.' prefix [ 202.755878][ T8954] syzkaller0: entered promiscuous mode [ 202.757858][ T8954] syzkaller0: entered allmulticast mode [ 202.764429][ T8954] tipc: Enabled bearer , priority 0 [ 202.767763][ T8953] tipc: Resetting bearer [ 202.783894][ T8953] tipc: Disabling bearer [ 202.812723][ T5955] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 202.829892][ T5526] usb 6-1: USB disconnect, device number 25 [ 202.973370][ T5955] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 202.977182][ T5955] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 202.980916][ T5955] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 202.984726][ T5955] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 202.988824][ T5955] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.997855][ T5955] usb 8-1: config 0 descriptor?? [ 203.033282][ T8969] loop6: detected capacity change from 0 to 2640 [ 203.035787][ T8969] ldm_validate_partition_table(): Disk read failed. [ 203.037955][ T8969] Dev loop6: unable to read RDB block 0 [ 203.049887][ T8969] loop6: unable to read partition table [ 203.052076][ T8969] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 203.281608][ T8988] kvm: user requested TSC rate below hardware speed [ 203.287337][ T8988] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 203.290451][ T8988] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 203.412540][ T5955] plantronics 0003:047F:FFFF.0020: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 204.547384][ T9012] netlink: 'syz.1.953': attribute type 10 has an invalid length. [ 204.582083][ T5955] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 204.600228][ T9015] netlink: 27 bytes leftover after parsing attributes in process `syz.2.954'. [ 204.731857][ T5955] usb 5-1: Using ep0 maxpacket: 8 [ 204.734702][ T5955] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 204.738993][ T5955] usb 5-1: config 16 has an invalid descriptor of length 113, skipping remainder of the config [ 204.742536][ T5955] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 204.746567][ T5955] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.753031][ T5955] usbtmc 5-1:16.0: bulk endpoints not found [ 204.993118][ T9005] 9pnet_fd: Insufficient options for proto=fd [ 205.082910][ T1034] usb 5-1: USB disconnect, device number 14 [ 205.183382][ T9046] netlink: 8 bytes leftover after parsing attributes in process `syz.3.963'. [ 205.186266][ T9046] netlink: 12 bytes leftover after parsing attributes in process `syz.3.963'. [ 205.206600][ T9046] netlink: 8 bytes leftover after parsing attributes in process `syz.3.963'. [ 205.209494][ T9046] netlink: 12 bytes leftover after parsing attributes in process `syz.3.963'. [ 205.212448][ T5814] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.212473][ T5814] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.212492][ T5814] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.212510][ T5814] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.253181][ T9048] netlink: 4 bytes leftover after parsing attributes in process `syz.3.964'. [ 205.264438][ T9048] macvtap1: entered promiscuous mode [ 205.266252][ T9048] bridge0: entered promiscuous mode [ 205.269061][ T9048] bridge0: port 3(macvtap1) entered blocking state [ 205.271288][ T9048] bridge0: port 3(macvtap1) entered disabled state [ 205.275229][ T9048] macvtap1: entered allmulticast mode [ 205.277192][ T9048] bridge0: entered allmulticast mode [ 205.281247][ T9048] macvtap1: left allmulticast mode [ 205.285658][ T9048] bridge0: left allmulticast mode [ 205.315613][ T1034] bridge0: left promiscuous mode [ 205.341657][ T10] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 205.457346][ T42] usb 8-1: USB disconnect, device number 22 [ 205.502435][ T10] usb 7-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 205.508317][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 205.512398][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.527910][ T10] as10x_usb: device has been detected [ 205.529927][ T10] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 205.555856][ T10] usb 7-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 205.577030][ T10] as10x_usb: error during firmware upload part1 [ 205.579345][ T10] Registered device Abilis Systems DVB-Titan [ 205.663539][ T9061] sctp: [Deprecated]: syz.0.969 (pid 9061) Use of struct sctp_assoc_value in delayed_ack socket option. [ 205.663539][ T9061] Use struct sctp_sack_info instead [ 206.001358][ T10] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 206.152390][ T10] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 206.156677][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 206.160362][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 206.164090][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 206.168270][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.172697][ T10] usb 5-1: config 0 descriptor?? [ 206.591513][ T10] plantronics 0003:047F:FFFF.0021: hiddev1,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 207.001669][ T6222] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 207.106104][ T9091] netlink: 'syz.3.978': attribute type 10 has an invalid length. [ 207.117360][ T9091] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 207.120726][ T9091] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 207.136260][ T9091] netlink: 14 bytes leftover after parsing attributes in process `syz.3.978'. [ 207.148400][ T9091] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 207.154383][ T9091] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 207.159731][ T9091] bond0 (unregistering): (slave syz_tun): Releasing backup interface [ 207.161618][ T6222] usb 6-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 207.166613][ T6222] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 207.170012][ T6222] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.176468][ T9091] bond0 (unregistering): (slave netdevsim1): Releasing backup interface [ 207.181583][ T9084] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 207.186005][ T9091] bond0 (unregistering): Released all slaves [ 207.188006][ T6222] opticon 6-1:1.0: opticon converter detected [ 207.196040][ T9093] syz.3.978: vmalloc error: size 2147483264, exceeds total pages, mode:0x400cc0(GFP_KERNEL_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 207.199539][ T6222] usb 6-1: opticon converter now attached to ttyUSB0 [ 207.202682][ T9093] CPU: 3 UID: 0 PID: 9093 Comm: syz.3.978 Tainted: G L syzkaller #0 PREEMPT(full) [ 207.202702][ T9093] Tainted: [L]=SOFTLOCKUP [ 207.202717][ T9093] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 207.202726][ T9093] Call Trace: [ 207.202731][ T9093] [ 207.202735][ T9093] dump_stack_lvl+0x100/0x190 [ 207.202756][ T9093] warn_alloc.cold+0x94/0xa8 [ 207.202777][ T9093] ? __pfx_warn_alloc+0x10/0x10 [ 207.202794][ T9093] ? __pfx_stack_trace_save+0x10/0x10 [ 207.202816][ T9093] ? __lock_acquire+0x4c5/0x1ec0 [ 207.202834][ T9093] __vmalloc_node_range_noprof+0x136c/0x1630 [ 207.202853][ T9093] ? do_replace+0x1c6/0x490 [ 207.202872][ T9093] ? do_raw_spin_lock+0x128/0x260 [ 207.202886][ T9093] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 207.202899][ T9093] ? __lock_acquire+0x4c5/0x1ec0 [ 207.202934][ T9093] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 207.202954][ T9093] ? do_replace+0x1c6/0x490 [ 207.202973][ T9093] __vmalloc_node_noprof+0xad/0xf0 [ 207.202991][ T9093] ? do_replace+0x1c6/0x490 [ 207.203015][ T9093] __vmalloc_noprof+0xa3/0x120 [ 207.203037][ T9093] ? __pfx___vmalloc_noprof+0x10/0x10 [ 207.203065][ T9093] do_replace+0x1c6/0x490 [ 207.203091][ T9093] ? __pfx_do_replace+0x10/0x10 [ 207.203126][ T9093] ? register_lock_class+0x3f/0x7b0 [ 207.203152][ T9093] compat_do_replace+0x589/0x7a0 [ 207.203176][ T9093] ? __pfx_compat_do_replace+0x10/0x10 [ 207.203200][ T9093] ? bpf_lsm_capable+0x9/0x10 [ 207.203215][ T9093] ? security_capable+0x80/0x260 [ 207.203230][ T9093] do_ebt_set_ctl+0x3f4/0x4a0 [ 207.203247][ T9093] ? __pfx_do_ebt_set_ctl+0x10/0x10 [ 207.203263][ T9093] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 207.203277][ T9093] ? futex_wake+0x4ea/0x5e0 [ 207.203306][ T9093] ? nf_sockopt_find.isra.0+0x222/0x290 [ 207.203321][ T9093] nf_setsockopt+0x8d/0xf0 [ 207.203334][ T9093] ip_setsockopt+0xcb/0xf0 [ 207.203349][ T9093] tcp_setsockopt+0xa7/0x100 [ 207.203367][ T9093] smc_setsockopt+0x1b6/0xa40 [ 207.203382][ T9093] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 207.203398][ T9093] ? __pfx_smc_setsockopt+0x10/0x10 [ 207.203413][ T9093] ? aa_sock_opt_perm+0xff/0x1b0 [ 207.203426][ T9093] ? __pfx_smc_setsockopt+0x10/0x10 [ 207.203441][ T9093] do_sock_setsockopt+0xf3/0x1d0 [ 207.203457][ T9093] __sys_setsockopt+0x119/0x190 [ 207.203472][ T9093] __ia32_sys_setsockopt+0xbc/0x160 [ 207.203483][ T9093] ? __do_fast_syscall_32+0xb3/0x8b0 [ 207.203493][ T9093] ? lockdep_hardirqs_on+0x7d/0x110 [ 207.203509][ T9093] __do_fast_syscall_32+0x13a/0x8b0 [ 207.203522][ T9093] do_fast_syscall_32+0x32/0x70 [ 207.203532][ T9093] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 207.203546][ T9093] RIP: 0023:0xf7f26fec [ 207.203562][ T9093] Code: Unable to access opcode bytes at 0xf7f26fc2. [ 207.203567][ T9093] RSP: 002b:00000000f53c550c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 207.203589][ T9093] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000000000000 [ 207.203600][ T9093] RDX: 0000000000000080 RSI: 0000000080000100 RDI: 0000000000000108 [ 207.203610][ T9093] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 207.203620][ T9093] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 207.203632][ T9093] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 207.203654][ T9093] [ 207.203804][ T9093] Mem-Info: [ 207.317655][ T9093] active_anon:8230 inactive_anon:175 isolated_anon:0 [ 207.317655][ T9093] active_file:2307 inactive_file:46694 isolated_file:0 [ 207.317655][ T9093] unevictable:2 dirty:233 writeback:0 [ 207.317655][ T9093] slab_reclaimable:7464 slab_unreclaimable:54493 [ 207.317655][ T9093] mapped:27216 shmem:1815 pagetables:1328 [ 207.317655][ T9093] sec_pagetables:301 bounce:0 [ 207.317655][ T9093] kernel_misc_reclaimable:0 [ 207.317655][ T9093] free:33505 free_pcp:13920 free_cma:0 [ 207.333498][ T9093] Node 0 active_anon:44kB inactive_anon:36kB active_file:12kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:32kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8224kB pagetables:1296kB sec_pagetables:1100kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 207.344869][ T9093] Node 1 active_anon:36576kB inactive_anon:664kB active_file:9216kB inactive_file:186776kB unevictable:8kB isolated(anon):0kB isolated(file):0kB mapped:112532kB dirty:928kB writeback:0kB shmem:10960kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6196kB pagetables:4016kB sec_pagetables:104kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 207.356174][ T9093] Node 0 DMA free:2060kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:20kB inactive_anon:4kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:676kB local_pcp:204kB free_cma:0kB [ 207.366172][ T9093] lowmem_reserve[]: 0 279 279 279 279 [ 207.368058][ T9093] Node 0 DMA32 free:14896kB boost:0kB min:12652kB low:15812kB high:18972kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24kB inactive_anon:32kB active_file:12kB inactive_file:0kB unevictable:0kB writepending:4kB zspages:32kB present:1032196kB managed:286280kB mlocked:0kB bounce:0kB free_pcp:12964kB local_pcp:3640kB free_cma:0kB [ 207.377447][ T9094] netlink: 8 bytes leftover after parsing attributes in process `syz.3.978'. [ 207.378537][ T9093] lowmem_reserve[]: 0 0 0 0 0 [ 207.384366][ T9093] Node 1 DMA32 free:113264kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:39276kB inactive_anon:664kB active_file:9216kB inactive_file:186776kB unevictable:8kB writepending:928kB zspages:2292kB present:1048432kB managed:948212kB mlocked:8kB bounce:0kB free_pcp:39432kB local_pcp:10832kB free_cma:0kB [ 207.395138][ T9093] lowmem_reserve[]: 0 0 0 0 0 [ 207.396767][ T9093] Node 0 DMA: 1*4kB (U) 3*8kB (UM) 9*16kB (UM) 19*32kB (UM) 4*64kB (U) 4*128kB (UM) 2*256kB (M) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2060kB [ 207.401779][ T9093] Node 0 DMA32: 0*4kB 176*8kB (UE) 129*16kB (UME) 57*32kB (UE) 60*64kB (UME) 39*128kB (UME) 3*256kB (UME) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 14896kB [ 207.406967][ T9093] Node 1 DMA32: 185*4kB (U) 190*8kB (UE) 335*16kB (UME) 105*32kB (UME) 158*64kB (UME) 50*128kB (UME) 35*256kB (UME) 16*512kB (ME) 17*1024kB (M) 11*2048kB (UM) 7*4096kB (UM) = 113252kB [ 207.413553][ T9093] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 207.416748][ T9093] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 207.419768][ T9093] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 207.423016][ T9093] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 207.426126][ T9093] 52359 total pagecache pages [ 207.427772][ T9093] 444 pages in swap cache [ 207.429262][ T9093] Free swap = 120112kB [ 207.430938][ T9093] Total swap = 124996kB [ 207.432395][ T9093] 524155 pages RAM [ 207.433730][ T9093] 0 pages HighMem/MovableOnly [ 207.435306][ T9093] 211692 pages reserved [ 207.436667][ T9093] 0 pages cma reserved [ 207.638604][ T43] audit: type=1800 audit(1787772486.191:410): pid=9097 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.979" name="nexus" dev="configfs" ino=26195 res=0 errno=0 [ 207.638649][ T9097] Missing 'naa.' prefix [ 208.173356][ T5955] usb 7-1: USB disconnect, device number 23 [ 208.188046][ T5955] Unregistered device Abilis Systems DVB-Titan [ 208.189388][ T5955] as10x_usb: device has been disconnected [ 208.623506][ T9112] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 208.664041][ T9115] block nbd0: not configured, cannot reconfigure [ 208.779938][ T5955] usb 5-1: USB disconnect, device number 15 [ 208.802012][ T9123] netlink: 8 bytes leftover after parsing attributes in process `syz.0.988'. [ 208.866432][ T9129] netlink: 4 bytes leftover after parsing attributes in process `syz.0.991'. [ 209.240299][ T5955] usb 5-1: new low-speed USB device number 16 using dummy_hcd [ 209.370365][ T5955] usb 5-1: device descriptor read/64, error -71 [ 209.610321][ T5955] usb 5-1: new low-speed USB device number 17 using dummy_hcd [ 209.630359][ T5823] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 209.740301][ T5955] usb 5-1: device descriptor read/64, error -71 [ 209.758988][ T34] usb 6-1: USB disconnect, device number 26 [ 209.775301][ T34] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 209.784403][ T5823] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 209.790112][ T34] opticon 6-1:1.0: device disconnected [ 209.808942][ T5823] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 209.823460][ T5823] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 209.836368][ T5823] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 209.855781][ T5823] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.864476][ T5955] usb usb5-port1: attempt power cycle [ 209.875339][ T5823] usb 7-1: config 0 descriptor?? [ 209.879002][ T9145] netlink: 'syz.1.998': attribute type 29 has an invalid length. [ 210.220317][ T5955] usb 5-1: new low-speed USB device number 18 using dummy_hcd [ 210.240935][ T5955] usb 5-1: device descriptor read/8, error -71 [ 210.302117][ T5823] plantronics 0003:047F:FFFF.0022: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 210.480452][ T5955] usb 5-1: new low-speed USB device number 19 using dummy_hcd [ 210.500774][ T5955] usb 5-1: device descriptor read/8, error -71 [ 210.610606][ T5955] usb usb5-port1: unable to enumerate USB device [ 210.788575][ T9155] xt_cgroup: xt_cgroup: no path or classid specified [ 210.895299][ T43] audit: type=1326 audit(2000000002.190:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9160 comm="syz.1.1003" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 210.904071][ T43] audit: type=1326 audit(2000000002.190:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9160 comm="syz.1.1003" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 210.910745][ T43] audit: type=1326 audit(2000000002.190:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9160 comm="syz.1.1003" exe="/syz-executor" sig=0 arch=40000003 syscall=114 compat=1 ip=0xf7f92fec code=0x7ffc0000 [ 211.287365][ T9175] openvswitch: netlink: Multiple metadata blocks provided [ 211.292516][ T9175] /dev/sg0: Can't lookup blockdev [ 211.442085][ T9181] FAULT_INJECTION: forcing a failure. [ 211.442085][ T9181] name failslab, interval 1, probability 10, space 0, times 0 [ 211.446233][ T9181] CPU: 1 UID: 0 PID: 9181 Comm: syz.3.1008 Tainted: G L syzkaller #0 PREEMPT(full) [ 211.446251][ T9181] Tainted: [L]=SOFTLOCKUP [ 211.446255][ T9181] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 211.446262][ T9181] Call Trace: [ 211.446268][ T9181] [ 211.446273][ T9181] dump_stack_lvl+0x100/0x190 [ 211.446303][ T9181] should_fail_ex.cold+0x5/0xa [ 211.446319][ T9181] should_failslab+0xc2/0x120 [ 211.446331][ T9181] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 211.446349][ T9181] ? __alloc_skb+0x5b7/0x710 [ 211.446359][ T9181] ? __alloc_skb+0x140/0x710 [ 211.446371][ T9181] __alloc_skb+0x140/0x710 [ 211.446381][ T9181] ? __alloc_skb+0x5b7/0x710 [ 211.446390][ T9181] ? __pfx___alloc_skb+0x10/0x10 [ 211.446404][ T9181] netlink_ack+0x117/0xb80 [ 211.446425][ T9181] netlink_rcv_skb+0x333/0x420 [ 211.446440][ T9181] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 211.446454][ T9181] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 211.446474][ T9181] ? netlink_deliver_tap+0x1ae/0xcc0 [ 211.446492][ T9181] netlink_unicast+0x585/0x850 [ 211.446509][ T9181] ? __pfx_netlink_unicast+0x10/0x10 [ 211.446528][ T9181] netlink_sendmsg+0x8b0/0xda0 [ 211.446546][ T9181] ? __pfx_netlink_sendmsg+0x10/0x10 [ 211.446563][ T9181] ? apparmor_socket_sendmsg+0x15b/0x270 [ 211.446581][ T9181] ____sys_sendmsg+0xa4d/0xbe0 [ 211.446595][ T9181] ? __pfx_netlink_sendmsg+0x10/0x10 [ 211.446611][ T9181] ? __pfx_____sys_sendmsg+0x10/0x10 [ 211.446634][ T9181] ___sys_sendmsg+0x190/0x1e0 [ 211.446650][ T9181] ? __pfx____sys_sendmsg+0x10/0x10 [ 211.446672][ T9181] ? find_held_lock+0x2b/0x80 [ 211.446698][ T9181] __sys_sendmsg+0x160/0x210 [ 211.446709][ T9181] ? __pfx___sys_sendmsg+0x10/0x10 [ 211.446725][ T9181] ? __pfx_ksys_write+0x10/0x10 [ 211.446741][ T9181] __do_fast_syscall_32+0x13a/0x8b0 [ 211.446752][ T9181] ? lockdep_hardirqs_on+0x7d/0x110 [ 211.446769][ T9181] do_fast_syscall_32+0x32/0x70 [ 211.446780][ T9181] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 211.446795][ T9181] RIP: 0023:0xf7f26fec [ 211.446809][ T9181] Code: Unable to access opcode bytes at 0xf7f26fc2. [ 211.446813][ T9181] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 211.446824][ T9181] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800007c0 [ 211.446831][ T9181] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 211.446837][ T9181] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 211.446843][ T9181] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 211.446849][ T9181] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 211.446862][ T9181] [ 211.703785][ T9190] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1012'. [ 211.714269][ T9190] bond0: (slave bond_slave_0): Releasing backup interface [ 211.717554][ T9190] bond_slave_0 (unregistering): left allmulticast mode [ 211.972381][ T9198] binder: BINDER_SET_CONTEXT_MGR already set [ 211.974352][ T9198] binder: 9197:9198 ioctl 4018620d 80000100 returned -16 [ 212.010005][ T9203] i2c i2c-0: new_device: Missing parameters [ 212.047142][ T9204] FAULT_INJECTION: forcing a failure. [ 212.047142][ T9204] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 212.051716][ T9204] CPU: 1 UID: 0 PID: 9204 Comm: syz.3.1015 Tainted: G L syzkaller #0 PREEMPT(full) [ 212.051735][ T9204] Tainted: [L]=SOFTLOCKUP [ 212.051739][ T9204] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 212.051746][ T9204] Call Trace: [ 212.051750][ T9204] [ 212.051755][ T9204] dump_stack_lvl+0x100/0x190 [ 212.051774][ T9204] should_fail_ex.cold+0x5/0xa [ 212.051788][ T9204] _copy_to_user+0x32/0xd0 [ 212.051802][ T9204] simple_read_from_buffer+0xcb/0x170 [ 212.051818][ T9204] proc_fail_nth_read+0x1af/0x230 [ 212.051832][ T9204] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 212.051846][ T9204] ? rw_verify_area+0xce/0x6d0 [ 212.051857][ T9204] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 212.051869][ T9204] vfs_read+0x1e4/0xb40 [ 212.051884][ T9204] ? __pfx_vfs_read+0x10/0x10 [ 212.051896][ T9204] ? find_held_lock+0x2b/0x80 [ 212.051912][ T9204] ? __fget_files+0x215/0x3d0 [ 212.051928][ T9204] ? __fget_files+0x21f/0x3d0 [ 212.051945][ T9204] ksys_read+0x12a/0x250 [ 212.051957][ T9204] ? __pfx_ksys_read+0x10/0x10 [ 212.051974][ T9204] do_int80_emulation+0x166/0x650 [ 212.051986][ T9204] asm_int80_emulation+0x1a/0x20 [ 212.051998][ T9204] RIP: 0023:0xf71274eb [ 212.052007][ T9204] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 212.052019][ T9204] RSP: 002b:00000000f53e64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 212.052029][ T9204] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53e65d0 [ 212.052036][ T9204] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 212.052042][ T9204] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 212.052048][ T9204] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 212.052054][ T9204] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 212.052067][ T9204] [ 212.166640][ T43] audit: type=1800 audit(2000000003.460:414): pid=9208 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1019" name="nexus" dev="configfs" ino=25400 res=0 errno=0 [ 212.174504][ T9208] Missing 'naa.' prefix [ 212.370384][ T42] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 212.510555][ T42] usb 5-1: device descriptor read/64, error -71 [ 212.601743][ T5526] usb 7-1: USB disconnect, device number 24 [ 212.771861][ T42] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 212.840395][ T5526] usb 7-1: new full-speed USB device number 25 using dummy_hcd [ 212.918087][ T42] usb 5-1: device descriptor read/64, error -71 [ 213.046468][ T42] usb usb5-port1: attempt power cycle [ 213.323105][ T9217] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1022'. [ 213.400798][ T42] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 213.438290][ T42] usb 5-1: device descriptor read/8, error -71 [ 213.658295][ T5526] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 213.681653][ T42] usb 5-1: new full-speed USB device number 23 using dummy_hcd [ 213.699232][ T5526] usb 7-1: config 0 interface 0 altsetting 255 endpoint 0x4 has an invalid bInterval 0, changing to 10 [ 213.702844][ T5526] usb 7-1: config 0 interface 0 has no altsetting 0 [ 213.706581][ T5526] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 213.709295][ T5526] usb 7-1: Product: syz [ 213.710723][ T5526] usb 7-1: Manufacturer: syz [ 213.712250][ T5526] usb 7-1: SerialNumber: syz [ 213.712386][ T42] usb 5-1: device descriptor read/8, error -71 [ 213.717536][ T5526] usb 7-1: config 0 descriptor?? [ 213.721882][ T5526] usb 7-1: selecting invalid altsetting 0 [ 213.853676][ T42] usb usb5-port1: unable to enumerate USB device [ 214.039781][ T9233] usb 7-1: BOGUS urb xfer, pipe 0 != type 1 [ 214.280390][ T42] usb 6-1: new full-speed USB device number 27 using dummy_hcd [ 214.430721][ T42] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 214.434581][ T42] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.438305][ T42] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 214.444503][ T42] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.447505][ T42] usb 6-1: Product: syz [ 214.448929][ T42] usb 6-1: Manufacturer: syz [ 214.450473][ T42] usb 6-1: SerialNumber: syz [ 214.458502][ T42] usb 6-1: 0:2 : does not exist [ 214.552624][ T9237] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 214.662501][ T42] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 214.685217][ T42] usb 6-1: USB disconnect, device number 27 [ 214.713049][ T7379] udevd[7379]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb6/6-1/6-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 215.010382][ T5823] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 215.038409][ T9242] FAULT_INJECTION: forcing a failure. [ 215.038409][ T9242] name failslab, interval 1, probability 10, space 0, times 0 [ 215.042479][ T9242] CPU: 0 UID: 0 PID: 9242 Comm: syz.0.1027 Tainted: G L syzkaller #0 PREEMPT(full) [ 215.042497][ T9242] Tainted: [L]=SOFTLOCKUP [ 215.042501][ T9242] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 215.042508][ T9242] Call Trace: [ 215.042513][ T9242] [ 215.042518][ T9242] dump_stack_lvl+0x100/0x190 [ 215.042536][ T9242] should_fail_ex.cold+0x5/0xa [ 215.042550][ T9242] should_failslab+0xc2/0x120 [ 215.042561][ T9242] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 215.042579][ T9242] ? __alloc_skb+0x140/0x710 [ 215.042594][ T9242] __alloc_skb+0x140/0x710 [ 215.042603][ T9242] ? __alloc_skb+0x5b7/0x710 [ 215.042613][ T9242] ? __pfx___alloc_skb+0x10/0x10 [ 215.042624][ T9242] ? tipc_nl_compat_name_table_dump_header+0x191/0x220 [ 215.042640][ T9242] ? __pfx_tipc_nl_compat_name_table_dump_header+0x10/0x10 [ 215.042655][ T9242] tipc_nl_compat_dumpit+0x295/0x820 [ 215.042671][ T9242] tipc_nl_compat_recv+0x6b0/0xc40 [ 215.042685][ T9242] ? __pfx_tipc_nl_compat_recv+0x10/0x10 [ 215.042721][ T9242] ? __pfx_tipc_nl_compat_name_table_dump_header+0x10/0x10 [ 215.042735][ T9242] ? __pfx_tipc_nl_name_table_dump+0x10/0x10 [ 215.042747][ T9242] ? __pfx_tipc_nl_compat_name_table_dump+0x10/0x10 [ 215.042764][ T9242] ? trace_contention_end+0x126/0x160 [ 215.042778][ T9242] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 215.042800][ T9242] genl_family_rcv_msg_doit+0x214/0x300 [ 215.042819][ T9242] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 215.042836][ T9242] ? genl_get_cmd+0x3e7/0x760 [ 215.042857][ T9242] ? __dev_queue_xmit+0xa33/0x4970 [ 215.042892][ T9242] ? __radix_tree_lookup+0x217/0x2b0 [ 215.042911][ T9242] genl_rcv_msg+0x560/0x800 [ 215.042923][ T9242] ? __pfx_genl_rcv_msg+0x10/0x10 [ 215.042934][ T9242] ? __pfx_tipc_nl_compat_recv+0x10/0x10 [ 215.042953][ T9242] netlink_rcv_skb+0x159/0x420 [ 215.042969][ T9242] ? __pfx_genl_rcv_msg+0x10/0x10 [ 215.042980][ T9242] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 215.043001][ T9242] ? netlink_deliver_tap+0x1ae/0xcc0 [ 215.043018][ T9242] genl_rcv+0x28/0x40 [ 215.043033][ T9242] netlink_unicast+0x585/0x850 [ 215.043051][ T9242] ? __pfx_netlink_unicast+0x10/0x10 [ 215.043071][ T9242] netlink_sendmsg+0x8b0/0xda0 [ 215.043089][ T9242] ? __pfx_netlink_sendmsg+0x10/0x10 [ 215.043110][ T9242] ? apparmor_socket_sendmsg+0x15b/0x270 [ 215.043126][ T9242] ____sys_sendmsg+0xa4d/0xbe0 [ 215.043140][ T9242] ? __pfx_netlink_sendmsg+0x10/0x10 [ 215.043156][ T9242] ? __pfx_____sys_sendmsg+0x10/0x10 [ 215.043177][ T9242] ___sys_sendmsg+0x190/0x1e0 [ 215.043193][ T9242] ? __pfx____sys_sendmsg+0x10/0x10 [ 215.043215][ T9242] ? find_held_lock+0x2b/0x80 [ 215.043240][ T9242] __sys_sendmsg+0x160/0x210 [ 215.043252][ T9242] ? __pfx___sys_sendmsg+0x10/0x10 [ 215.043267][ T9242] ? __pfx_ksys_write+0x10/0x10 [ 215.043284][ T9242] __do_fast_syscall_32+0x13a/0x8b0 [ 215.043294][ T9242] ? lockdep_hardirqs_on+0x7d/0x110 [ 215.043311][ T9242] do_fast_syscall_32+0x32/0x70 [ 215.043322][ T9242] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 215.043337][ T9242] RIP: 0023:0xf70cefec [ 215.043352][ T9242] Code: Unable to access opcode bytes at 0xf70cefc2. [ 215.043357][ T9242] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 215.043368][ T9242] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000100 [ 215.043374][ T9242] RDX: 0000000000001004 RSI: 0000000000000000 RDI: 0000000000000000 [ 215.043380][ T9242] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 215.043387][ T9242] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 215.043393][ T9242] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 215.043407][ T9242] [ 215.160794][ T5823] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 215.167149][ T5823] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 215.170864][ T5823] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 215.173944][ T5823] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 215.177916][ T5823] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.182595][ T5823] usb 8-1: config 0 descriptor?? [ 215.303677][ T5955] usb 7-1: USB disconnect, device number 25 [ 215.310559][ T43] audit: type=1800 audit(2000000006.600:415): pid=9245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1028" name="nexus" dev="configfs" ino=26339 res=0 errno=0 [ 215.330794][ T9245] Missing 'naa.' prefix [ 215.532890][ T5526] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 215.595825][ T5823] plantronics 0003:047F:FFFF.0023: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 217.040301][ C3] bridge0: port 2(bridge_slave_1) entered forwarding state [ 217.044560][ C3] bridge0: topology change detected, propagating [ 217.046882][ C3] bridge0: port 1(bridge_slave_0) entered forwarding state [ 217.049306][ C3] bridge0: topology change detected, propagating [ 218.184634][ T5823] usb 8-1: USB disconnect, device number 23 [ 224.208371][ T43] audit: type=1800 audit(2000000015.500:416): pid=9313 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1038" name="nexus" dev="configfs" ino=28699 res=0 errno=0 [ 224.214387][ T9313] Missing 'naa.' prefix [ 224.521523][ T9332] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1050'. [ 225.177806][ T43] audit: type=1326 audit(2000000016.470:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9336 comm="syz.3.1044" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f26fec code=0x7ffc0000 [ 225.190452][ T43] audit: type=1326 audit(2000000016.470:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9336 comm="syz.3.1044" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f26fec code=0x7ffc0000 [ 225.197422][ T43] audit: type=1326 audit(2000000016.470:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9336 comm="syz.3.1044" exe="/syz-executor" sig=0 arch=40000003 syscall=114 compat=1 ip=0xf7f26fec code=0x7ffc0000 [ 225.293080][ T9329] 9p: Bad value for 'rfdno' [ 225.299631][ T43] audit: type=1326 audit(2000000016.590:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9336 comm="syz.3.1044" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f27008 code=0x7ffc0000 [ 225.306493][ T43] audit: type=1326 audit(2000000016.590:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9336 comm="syz.3.1044" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f26fec code=0x7ffc0000 [ 225.313237][ T43] audit: type=1326 audit(2000000016.590:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9336 comm="syz.3.1044" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f26fec code=0x7ffc0000 [ 225.349413][ T9329] jffs2: notice: (9329) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 225.521893][ T5823] usb 8-1: new high-speed USB device number 24 using dummy_hcd [ 225.527322][ T5955] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 225.694210][ T5823] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 225.709294][ T5823] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.716484][ T5955] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 225.719680][ T5823] usb 8-1: Product: syz [ 225.722081][ T5823] usb 8-1: Manufacturer: syz [ 225.726647][ T5823] usb 8-1: SerialNumber: syz [ 225.730071][ T5955] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 225.736835][ T5955] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 225.745320][ T5955] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 225.759325][ T5955] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.890897][ T5955] usb 7-1: config 0 descriptor?? [ 226.288542][ T34] usb 8-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 226.504576][ T43] audit: type=1326 audit(2000000017.800:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9336 comm="syz.3.1044" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f26fec code=0x7ffc0000 [ 226.513060][ T43] audit: type=1326 audit(2000000017.810:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9336 comm="syz.3.1044" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71274eb code=0x7ffc0000 [ 226.571700][ T5955] plantronics 0003:047F:FFFF.0024: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 226.713310][ T43] audit: type=1326 audit(2000000018.010:425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9336 comm="syz.3.1044" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f26fec code=0x7ffc0000 [ 226.780703][ T9337] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 226.786001][ T9337] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 226.788759][ T9337] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 226.821430][ T1034] lo speed is unknown, defaulting to 1000 [ 226.823948][ T1034] syz2: Port: 1 Link DOWN [ 226.831228][ T10] lo speed is unknown, defaulting to 1000 [ 226.862503][ T10] usb 8-1: USB disconnect, device number 24 [ 227.360254][ T34] ath9k_htc 8-1:1.0: ath9k_htc: Target is unresponsive [ 227.362721][ T34] ath9k_htc: Failed to initialize the device [ 227.365171][ T10] usb 8-1: ath9k_htc: USB layer deinitialized [ 227.530535][ T9359] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 227.544322][ T9359] sctp: [Deprecated]: syz.3.1048 (pid 9359) Use of struct sctp_assoc_value in delayed_ack socket option. [ 227.544322][ T9359] Use struct sctp_sack_info instead [ 227.856556][ T9363] syzkaller0: entered promiscuous mode [ 227.859012][ T9363] syzkaller0: entered allmulticast mode [ 228.580896][ T10] usb 7-1: USB disconnect, device number 26 [ 228.800820][ T9373] Missing 'naa.' prefix [ 228.812036][ T5097] Bluetooth: hci3: command 0x0406 tx timeout [ 228.814039][ T5097] Bluetooth: hci2: command 0x0406 tx timeout [ 228.816090][ T5751] Bluetooth: hci1: command 0x2016 tx timeout [ 228.852932][ T9370] fuse: Bad value for 'fd' [ 229.263529][ T9370] ip6t_srh: unknown srh match flags 4000 [ 232.350898][ T34] usb 8-1: new high-speed USB device number 25 using dummy_hcd [ 232.500795][ T34] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 232.504696][ T34] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 232.508168][ T34] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 232.511530][ T34] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 232.515850][ T34] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.520150][ T34] usb 8-1: config 0 descriptor?? [ 232.882369][ T9405] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 232.887174][ T9405] sctp: [Deprecated]: syz.1.1062 (pid 9405) Use of struct sctp_assoc_value in delayed_ack socket option. [ 232.887174][ T9405] Use struct sctp_sack_info instead [ 233.706516][ T34] plantronics 0003:047F:FFFF.0025: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 233.720676][ T34] usb 8-1: USB disconnect, device number 25 [ 233.742376][ T9407] fido_id[9407]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb8/report_descriptor': No such file or directory [ 233.758567][ T43] kauditd_printk_skb: 27 callbacks suppressed [ 233.758580][ T43] audit: type=1800 audit(2000000025.050:453): pid=9409 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1063" name="nexus" dev="configfs" ino=27941 res=0 errno=0 [ 233.758780][ T9409] Missing 'naa.' prefix [ 235.138392][ T9424] netlink: 'syz.3.1069': attribute type 1 has an invalid length. [ 235.262821][ T9429] netlink: 'syz.3.1069': attribute type 10 has an invalid length. [ 235.270389][ T9429] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1069'. [ 235.549316][ T9429] dummy0: entered promiscuous mode [ 236.061392][ T9433] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1072'. [ 236.067887][ T9433] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1072'. [ 236.072537][ T9433] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1072'. [ 236.267114][ T43] audit: type=1800 audit(2000000027.559:454): pid=9438 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1073" name="nexus" dev="configfs" ino=27984 res=0 errno=0 [ 236.269490][ T9438] Missing 'naa.' prefix [ 236.404548][ T9440] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4000675772 (8001351544 ns) > initial count (4731795314 ns). Using initial count to start timer. [ 238.287637][ T9461] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4000675772 (8001351544 ns) > initial count (4731795314 ns). Using initial count to start timer. [ 238.429216][ T43] audit: type=1800 audit(2000000029.719:455): pid=9465 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1082" name="nexus" dev="configfs" ino=27541 res=0 errno=0 [ 238.437041][ T9465] Missing 'naa.' prefix [ 238.498401][ T9467] 9p: Bad value for 'rfdno' [ 238.541857][ T9469] netlink: 'syz.3.1084': attribute type 1 has an invalid length. [ 238.544638][ T9469] netlink: 220 bytes leftover after parsing attributes in process `syz.3.1084'. [ 238.551971][ T9] usb 7-1: new full-speed USB device number 27 using dummy_hcd [ 238.715290][ T9] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 238.721822][ T9] usb 7-1: config 0 interface 0 altsetting 255 endpoint 0x4 has an invalid bInterval 0, changing to 10 [ 238.725074][ T9472] netlink: 'syz.1.1085': attribute type 1 has an invalid length. [ 238.727894][ T9472] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1085'. [ 238.728776][ T9] usb 7-1: config 0 interface 0 has no altsetting 0 [ 238.734709][ T9] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 238.737495][ T9] usb 7-1: Product: syz [ 238.738842][ T9] usb 7-1: Manufacturer: syz [ 238.741184][ T9] usb 7-1: SerialNumber: syz [ 238.747014][ T9] usb 7-1: config 0 descriptor?? [ 238.751843][ T9] usb 7-1: selecting invalid altsetting 0 [ 239.017703][ T9] usb 7-1: USB disconnect, device number 27 [ 239.141984][ T9482] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1088'. [ 239.482924][ T9491] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1090'. [ 239.775062][ T43] audit: type=1800 audit(2000000031.069:456): pid=9494 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1091" name="nexus" dev="configfs" ino=28049 res=0 errno=0 [ 239.775237][ T9494] Missing 'naa.' prefix [ 239.895309][ T9496] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4000675772 (8001351544 ns) > initial count (4731795314 ns). Using initial count to start timer. [ 240.096224][ T9499] 9p: Bad value for 'rfdno' [ 240.228047][ T9502] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1096'. [ 240.234676][ T9502] FAULT_INJECTION: forcing a failure. [ 240.234676][ T9502] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 240.239156][ T9502] CPU: 3 UID: 0 PID: 9502 Comm: syz.3.1096 Tainted: G L syzkaller #0 PREEMPT(full) [ 240.239174][ T9502] Tainted: [L]=SOFTLOCKUP [ 240.239178][ T9502] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 240.239186][ T9502] Call Trace: [ 240.239191][ T9502] [ 240.239195][ T9502] dump_stack_lvl+0x100/0x190 [ 240.239216][ T9502] should_fail_ex.cold+0x5/0xa [ 240.239229][ T9502] _copy_from_user+0x2e/0xd0 [ 240.239244][ T9502] get_compat_msghdr+0xb3/0x480 [ 240.239260][ T9502] ? __pfx_get_compat_msghdr+0x10/0x10 [ 240.239275][ T9502] ? rcu_is_watching+0x13/0xc0 [ 240.239291][ T9502] ? ___sys_sendmsg+0x19d/0x1e0 [ 240.239306][ T9502] ? kfree+0x1e5/0x6c0 [ 240.239319][ T9502] ? __pfx__kstrtoull+0x10/0x10 [ 240.239335][ T9502] ___sys_sendmsg+0x1b6/0x1e0 [ 240.239352][ T9502] ? __pfx____sys_sendmsg+0x10/0x10 [ 240.239367][ T9502] ? __lock_acquire+0x4c5/0x1ec0 [ 240.239390][ T9502] ? __pfx___might_resched+0x10/0x10 [ 240.239404][ T9502] __sys_sendmmsg+0x309/0x440 [ 240.239417][ T9502] ? __pfx___sys_sendmmsg+0x10/0x10 [ 240.239428][ T9502] ? find_held_lock+0x2b/0x80 [ 240.239447][ T9502] ? __mutex_unlock_slowpath+0x35d/0x930 [ 240.239472][ T9502] ? fput+0x7c/0x100 [ 240.239487][ T9502] ? ksys_write+0x1ac/0x250 [ 240.239501][ T9502] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 240.239515][ T9502] ? lockdep_hardirqs_on+0x7d/0x110 [ 240.239531][ T9502] __do_fast_syscall_32+0x13a/0x8b0 [ 240.239541][ T9502] ? lockdep_hardirqs_on+0x7d/0x110 [ 240.239558][ T9502] do_fast_syscall_32+0x32/0x70 [ 240.239568][ T9502] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 240.239583][ T9502] RIP: 0023:0xf7f26fec [ 240.239597][ T9502] Code: Unable to access opcode bytes at 0xf7f26fc2. [ 240.239602][ T9502] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 240.239618][ T9502] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800002c0 [ 240.239624][ T9502] RDX: 000000000000009f RSI: 0000000000000000 RDI: 0000000000000000 [ 240.239630][ T9502] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 240.239636][ T9502] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 240.239642][ T9502] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 240.239655][ T9502] [ 240.460938][ T9506] netlink: 420 bytes leftover after parsing attributes in process `syz.0.1099'. [ 240.498132][ T9516] tipc: Enabling of bearer rejected, failed to enable media [ 240.544666][ T9521] overlay: Unknown parameter 'uid<18446744073709551615' [ 240.678276][ T9525] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1100'. [ 240.760313][ T34] usb 8-1: new high-speed USB device number 26 using dummy_hcd [ 240.911788][ T34] usb 8-1: Using ep0 maxpacket: 32 [ 240.915740][ T34] usb 8-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 240.935160][ T34] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 240.946274][ T34] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 240.955092][ T34] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 240.969083][ T34] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.974872][ T34] usb 8-1: Product: syz [ 240.976215][ T34] usb 8-1: Manufacturer: syz [ 240.980169][ T34] usb 8-1: SerialNumber: syz [ 240.986671][ T34] usb 8-1: config 0 descriptor?? [ 240.998590][ T34] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/input/input27 [ 241.024641][ T5132] xpad 8-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.056641][ T5132] xpad 8-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.074713][ T5132] xpad 8-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.094882][ T5132] xpad 8-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.118012][ T5132] xpad 8-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.124972][ T9323] xpad 8-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.228843][ T5132] xpad 8-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 241.970318][ T41] usb 8-1: USB disconnect, device number 26 [ 242.041313][ T9534] 9p: Bad value for 'rfdno' [ 242.095035][ T9535] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4000675772 (8001351544 ns) > initial count (4731795314 ns). Using initial count to start timer. [ 242.257806][ T43] audit: type=1800 audit(2000000033.549:457): pid=9538 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1101" name="nexus" dev="configfs" ino=28173 res=0 errno=0 [ 242.258120][ T9538] Missing 'naa.' prefix [ 242.349871][ T9544] netlink: 'syz.1.1104': attribute type 1 has an invalid length. [ 242.352597][ T9544] netlink: 220 bytes leftover after parsing attributes in process `syz.1.1104'. [ 242.381157][ T9549] FAULT_INJECTION: forcing a failure. [ 242.381157][ T9549] name failslab, interval 1, probability 10, space 0, times 0 [ 242.386314][ T9549] CPU: 3 UID: 0 PID: 9549 Comm: syz.0.1107 Tainted: G L syzkaller #0 PREEMPT(full) [ 242.386341][ T9549] Tainted: [L]=SOFTLOCKUP [ 242.386348][ T9549] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 242.386365][ T9549] Call Trace: [ 242.386382][ T9549] [ 242.386390][ T9549] dump_stack_lvl+0x100/0x190 [ 242.386441][ T9549] should_fail_ex.cold+0x5/0xa [ 242.386469][ T9549] should_failslab+0xc2/0x120 [ 242.386495][ T9549] __kmalloc_node_noprof+0x101/0x830 [ 242.386526][ T9549] ? __get_vm_area_node+0x1ff/0x350 [ 242.386541][ T9549] ? __get_vm_area_node+0x22b/0x350 [ 242.386562][ T9549] ? __vmalloc_node_range_noprof+0x409/0x1630 [ 242.386586][ T9549] __vmalloc_node_range_noprof+0x409/0x1630 [ 242.386614][ T9549] ? bpf_check+0x1cc/0xb7d0 [ 242.386642][ T9549] ? rcu_read_unlock+0x17/0x60 [ 242.386664][ T9549] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 242.386683][ T9549] ? rcu_is_watching+0x13/0xc0 [ 242.386717][ T9549] ? rcu_is_watching+0x13/0xc0 [ 242.386740][ T9549] ? __kmalloc_large_node_noprof+0x5d/0x70 [ 242.386778][ T9549] ? find_held_lock+0x2b/0x80 [ 242.386814][ T9549] ? bpf_check+0x1cc/0xb7d0 [ 242.386830][ T9549] __vmalloc_node_noprof+0xad/0xf0 [ 242.386849][ T9549] ? bpf_check+0x1cc/0xb7d0 [ 242.386868][ T9549] bpf_check+0x1cc/0xb7d0 [ 242.386883][ T9549] ? trace_contention_end+0x126/0x160 [ 242.386905][ T9549] ? __lock_acquire+0x4c5/0x1ec0 [ 242.386921][ T9549] ? __css_rstat_updated+0x1ce/0x590 [ 242.386947][ T9549] ? __lock_acquire+0x4c5/0x1ec0 [ 242.386964][ T9549] ? __pfx___css_rstat_updated+0x10/0x10 [ 242.386991][ T9549] ? __lock_acquire+0x4c5/0x1ec0 [ 242.387009][ T9549] ? __mod_memcg_state+0x12b/0x500 [ 242.387032][ T9549] ? __pfx_bpf_check+0x10/0x10 [ 242.387052][ T9549] ? find_held_lock+0x2b/0x80 [ 242.387074][ T9549] ? bpf_prog_load+0x1933/0x2fa0 [ 242.387100][ T9549] ? __asan_memset+0x23/0x50 [ 242.387123][ T9549] ? lsm_blob_alloc+0x2b/0x90 [ 242.387149][ T9549] ? bpf_prog_load+0x244d/0x2fa0 [ 242.387167][ T9549] bpf_prog_load+0x244d/0x2fa0 [ 242.387194][ T9549] ? __pfx_bpf_prog_load+0x10/0x10 [ 242.387216][ T9549] ? __lock_acquire+0x4c5/0x1ec0 [ 242.387256][ T9549] __sys_bpf+0x18dc/0x4e80 [ 242.387283][ T9549] ? __pfx___sys_bpf+0x10/0x10 [ 242.387308][ T9549] ? find_held_lock+0x2b/0x80 [ 242.387331][ T9549] ? get_pid_task+0xfc/0x250 [ 242.387361][ T9549] ? get_pid_task+0xfc/0x250 [ 242.387390][ T9549] ? proc_fail_nth_write+0x9f/0x220 [ 242.387409][ T9549] ? find_held_lock+0x2b/0x80 [ 242.387438][ T9549] ? rcu_read_lock_any_held+0x6a/0x90 [ 242.387464][ T9549] ? find_held_lock+0x2b/0x80 [ 242.387486][ T9549] ? ksys_write+0x190/0x250 [ 242.387506][ T9549] ? ksys_write+0x190/0x250 [ 242.387540][ T9549] ? fput+0x7c/0x100 [ 242.387570][ T9549] ? __ia32_sys_bpf+0xcc/0x170 [ 242.387591][ T9549] __ia32_sys_bpf+0xcc/0x170 [ 242.387614][ T9549] ? __do_fast_syscall_32+0xb3/0x8b0 [ 242.387656][ T9549] __do_fast_syscall_32+0x13a/0x8b0 [ 242.387672][ T9549] ? lockdep_hardirqs_on+0x7d/0x110 [ 242.387699][ T9549] do_fast_syscall_32+0x32/0x70 [ 242.387716][ T9549] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 242.387738][ T9549] RIP: 0023:0xf70cefec [ 242.387761][ T9549] Code: Unable to access opcode bytes at 0xf70cefc2. [ 242.387782][ T9549] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 242.387799][ T9549] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800017c0 [ 242.387810][ T9549] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 242.387820][ T9549] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 242.387830][ T9549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 242.387839][ T9549] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 242.387862][ T9549] [ 242.387873][ T9549] syz.0.1107: vmalloc error: size 4096, failed to allocated page array size 8, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 242.522347][ T9549] CPU: 3 UID: 0 PID: 9549 Comm: syz.0.1107 Tainted: G L syzkaller #0 PREEMPT(full) [ 242.522365][ T9549] Tainted: [L]=SOFTLOCKUP [ 242.522369][ T9549] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 242.522376][ T9549] Call Trace: [ 242.522381][ T9549] [ 242.522385][ T9549] dump_stack_lvl+0x100/0x190 [ 242.522404][ T9549] warn_alloc.cold+0x94/0xa8 [ 242.522428][ T9549] ? __pfx_warn_alloc+0x10/0x10 [ 242.522442][ T9549] ? dump_stack_lvl+0x17c/0x190 [ 242.522454][ T9549] ? rcu_is_watching+0x13/0xc0 [ 242.522470][ T9549] ? __kasan_kmalloc+0x8a/0xb0 [ 242.522505][ T9549] ? __kmalloc_node_noprof+0x359/0x830 [ 242.522521][ T9549] ? __get_vm_area_node+0x1ff/0x350 [ 242.522532][ T9549] ? __get_vm_area_node+0x22b/0x350 [ 242.522542][ T9549] ? __vmalloc_node_range_noprof+0x409/0x1630 [ 242.522556][ T9549] __vmalloc_node_range_noprof+0x1394/0x1630 [ 242.522573][ T9549] ? bpf_check+0x1cc/0xb7d0 [ 242.522588][ T9549] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 242.522599][ T9549] ? rcu_is_watching+0x13/0xc0 [ 242.522616][ T9549] ? rcu_is_watching+0x13/0xc0 [ 242.522636][ T9549] ? __kmalloc_large_node_noprof+0x5d/0x70 [ 242.522652][ T9549] ? find_held_lock+0x2b/0x80 [ 242.522680][ T9549] ? bpf_check+0x1cc/0xb7d0 [ 242.522696][ T9549] __vmalloc_node_noprof+0xad/0xf0 [ 242.522715][ T9549] ? bpf_check+0x1cc/0xb7d0 [ 242.522734][ T9549] bpf_check+0x1cc/0xb7d0 [ 242.522765][ T9549] ? trace_contention_end+0x126/0x160 [ 242.522780][ T9549] ? __lock_acquire+0x4c5/0x1ec0 [ 242.522791][ T9549] ? __css_rstat_updated+0x1ce/0x590 [ 242.522803][ T9549] ? __lock_acquire+0x4c5/0x1ec0 [ 242.522814][ T9549] ? __pfx___css_rstat_updated+0x10/0x10 [ 242.522830][ T9549] ? __lock_acquire+0x4c5/0x1ec0 [ 242.522841][ T9549] ? __mod_memcg_state+0x12b/0x500 [ 242.522857][ T9549] ? __pfx_bpf_check+0x10/0x10 [ 242.522871][ T9549] ? find_held_lock+0x2b/0x80 [ 242.522886][ T9549] ? bpf_prog_load+0x1933/0x2fa0 [ 242.522902][ T9549] ? __asan_memset+0x23/0x50 [ 242.522915][ T9549] ? lsm_blob_alloc+0x2b/0x90 [ 242.522933][ T9549] ? bpf_prog_load+0x244d/0x2fa0 [ 242.522952][ T9549] bpf_prog_load+0x244d/0x2fa0 [ 242.522980][ T9549] ? __pfx_bpf_prog_load+0x10/0x10 [ 242.523004][ T9549] ? __lock_acquire+0x4c5/0x1ec0 [ 242.523043][ T9549] __sys_bpf+0x18dc/0x4e80 [ 242.523066][ T9549] ? __pfx___sys_bpf+0x10/0x10 [ 242.523088][ T9549] ? find_held_lock+0x2b/0x80 [ 242.523112][ T9549] ? get_pid_task+0xfc/0x250 [ 242.523137][ T9549] ? get_pid_task+0xfc/0x250 [ 242.523168][ T9549] ? proc_fail_nth_write+0x9f/0x220 [ 242.523188][ T9549] ? find_held_lock+0x2b/0x80 [ 242.523209][ T9549] ? rcu_read_lock_any_held+0x6a/0x90 [ 242.523226][ T9549] ? find_held_lock+0x2b/0x80 [ 242.523240][ T9549] ? ksys_write+0x190/0x250 [ 242.523252][ T9549] ? ksys_write+0x190/0x250 [ 242.523274][ T9549] ? fput+0x7c/0x100 [ 242.523290][ T9549] ? __ia32_sys_bpf+0xcc/0x170 [ 242.523304][ T9549] __ia32_sys_bpf+0xcc/0x170 [ 242.523319][ T9549] ? __do_fast_syscall_32+0xb3/0x8b0 [ 242.523331][ T9549] __do_fast_syscall_32+0x13a/0x8b0 [ 242.523341][ T9549] ? lockdep_hardirqs_on+0x7d/0x110 [ 242.523358][ T9549] do_fast_syscall_32+0x32/0x70 [ 242.523368][ T9549] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 242.523382][ T9549] RIP: 0023:0xf70cefec [ 242.523398][ T9549] Code: Unable to access opcode bytes at 0xf70cefc2. [ 242.523403][ T9549] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 242.523414][ T9549] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800017c0 [ 242.523420][ T9549] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 242.523427][ T9549] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 242.523432][ T9549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 242.523439][ T9549] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 242.523452][ T9549] [ 242.523536][ T9549] Mem-Info: [ 242.627909][ T9556] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4000675772 (8001351544 ns) > initial count (4731795314 ns). Using initial count to start timer. [ 242.630298][ T9549] active_anon:8793 inactive_anon:121 isolated_anon:0 [ 242.630298][ T9549] active_file:2309 inactive_file:45277 isolated_file:0 [ 242.630298][ T9549] unevictable:0 dirty:284 writeback:0 [ 242.630298][ T9549] slab_reclaimable:7473 slab_unreclaimable:55261 [ 242.630298][ T9549] mapped:24320 shmem:539 pagetables:1216 [ 242.630298][ T9549] sec_pagetables:301 bounce:0 [ 242.630298][ T9549] kernel_misc_reclaimable:0 [ 242.630298][ T9549] free:30243 free_pcp:13793 free_cma:0 [ 242.630331][ T9549] Node 0 active_anon:72kB inactive_anon:8kB active_file:20kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:32kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8096kB pagetables:1176kB sec_pagetables:1100kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 242.684736][ T9549] Node 1 active_anon:35100kB inactive_anon:476kB active_file:9216kB inactive_file:181108kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:97348kB dirty:1132kB writeback:0kB shmem:2156kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5900kB pagetables:3688kB sec_pagetables:104kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 242.696233][ T9549] Node 0 DMA free:2064kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:0kB active_file:8kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:648kB local_pcp:148kB free_cma:0kB [ 242.708520][ T9549] lowmem_reserve[]: 0 279 279 279 279 [ 242.710701][ T9549] Node 0 DMA32 free:15496kB boost:0kB min:12652kB low:15812kB high:18972kB reserved_highatomic:0KB free_highatomic:0KB active_anon:68kB inactive_anon:8kB active_file:12kB inactive_file:0kB unevictable:0kB writepending:4kB zspages:32kB present:1032196kB managed:286280kB mlocked:0kB bounce:0kB free_pcp:12932kB local_pcp:3612kB free_cma:0kB [ 242.721102][ T9549] lowmem_reserve[]: 0 0 0 0 0 [ 242.722887][ T9549] Node 1 DMA32 free:103412kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:0KB free_highatomic:0KB active_anon:35100kB inactive_anon:476kB active_file:9216kB inactive_file:181108kB unevictable:0kB writepending:1132kB zspages:2208kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:41816kB local_pcp:20016kB free_cma:0kB [ 242.733694][ T9549] lowmem_reserve[]: 0 0 0 0 0 [ 242.735408][ T9549] Node 0 DMA: 6*4kB (M) 9*8kB (UM) 7*16kB (UM) 18*32kB (UM) 4*64kB (U) 4*128kB (UM) 2*256kB (M) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2064kB [ 242.739947][ T9549] Node 0 DMA32: 104*4kB (U) 184*8kB (UME) 117*16kB (UE) 86*32kB (UE) 50*64kB (UME) 39*128kB (UME) 3*256kB (UME) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 15472kB [ 242.745483][ T9549] Node 1 DMA32: 18*4kB (UME) 55*8kB (UE) 190*16kB (UME) 329*32kB (UME) 160*64kB (UME) 51*128kB (UME) 35*256kB (UME) 28*512kB (ME) 20*1024kB (UM) 8*2048kB (UM) 3*4096kB (M) = 103296kB [ 242.751533][ T9549] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 242.755741][ T9549] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 242.759796][ T9549] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 242.764016][ T9549] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 242.768115][ T9549] 48512 total pagecache pages [ 242.770355][ T9549] 395 pages in swap cache [ 242.772381][ T9549] Free swap = 120532kB [ 242.774319][ T9549] Total swap = 124996kB [ 242.776260][ T9549] 524155 pages RAM [ 242.777965][ T9549] 0 pages HighMem/MovableOnly [ 242.795903][ T9549] 211692 pages reserved [ 242.797790][ T9549] 0 pages cma reserved [ 242.916894][ T9566] 9p: Bad value for 'rfdno' [ 243.121078][ T43] audit: type=1800 audit(2000000034.419:458): pid=9575 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1114" name="nexus" dev="configfs" ino=29093 res=0 errno=0 [ 243.121273][ T9575] Missing 'naa.' prefix [ 243.440370][ T10] usb 6-1: new low-speed USB device number 28 using dummy_hcd [ 243.561712][ T9] usb 8-1: new high-speed USB device number 27 using dummy_hcd [ 243.603873][ T10] usb 6-1: New USB device found, idVendor=0582, idProduct=0027, bcdDevice= 0.40 [ 243.609552][ T10] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 190, changing to 4 [ 243.615273][ T10] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 243.619932][ T10] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 129, changing to 4 [ 243.624577][ T10] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 64, setting to 0 [ 243.632944][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.635973][ T10] usb 6-1: Product: Р [ 243.637807][ T10] usb 6-1: Manufacturer: М [ 243.639769][ T10] usb 6-1: SerialNumber: ﾎ悇䯮瀩䞜Ǵୌ쥽쐶굧⃅㎩㟂੐斻ᕧ놦⭁鯝恹 [ 243.730449][ T9] usb 8-1: Using ep0 maxpacket: 8 [ 243.736693][ T9] usb 8-1: unable to get BOS descriptor or descriptor too short [ 243.739286][ T9] usb 8-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 243.743837][ T9] usb 8-1: config 0 has an invalid interface number: 88 but max is 0 [ 243.746585][ T9] usb 8-1: config 0 has no interface number 0 [ 243.748616][ T9] usb 8-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 243.752624][ T9] usb 8-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid wMaxPacketSize 0 [ 243.756167][ T9] usb 8-1: config 0 interface 88 has no altsetting 0 [ 243.766818][ T9] usb 8-1: string descriptor 0 read error: -22 [ 243.771549][ T9] usb 8-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 243.781671][ T9] usb 8-1: config 0 descriptor?? [ 243.802158][ T9] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.88/input/input28 [ 243.857056][ T9588] 9p: Bad value for 'rfdno' [ 243.976563][ T10] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 243.982085][ T10] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 243.992249][ T10] usb 6-1: USB disconnect, device number 28 [ 244.034783][ T9345] udevd[9345]: Error opening device "/dev/input/event4": Input/output error [ 244.040685][ T9345] udevd[9345]: Unable to EVIOCGABS device "/dev/input/event4" [ 244.044392][ T9345] udevd[9345]: Unable to EVIOCGABS device "/dev/input/event4" [ 244.070809][ T42] usb 8-1: USB disconnect, device number 27 [ 244.914506][ T43] audit: type=1800 audit(2000000036.209:459): pid=9605 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1126" name="nexus" dev="configfs" ino=28211 res=0 errno=0 [ 244.921265][ T9605] Missing 'naa.' prefix [ 245.574959][ T9613] tmpfs: Bad value for 'mpol' [ 246.996531][ T9622] 9p: Bad value for 'rfdno' [ 246.998149][ T9620] FAULT_INJECTION: forcing a failure. [ 246.998149][ T9620] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 246.998619][ T9618] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4000675772 (8001351544 ns) > initial count (4731795314 ns). Using initial count to start timer. [ 247.010395][ T9620] CPU: 3 UID: 0 PID: 9620 Comm: syz.1.1133 Tainted: G L syzkaller #0 PREEMPT(full) [ 247.010425][ T9620] Tainted: [L]=SOFTLOCKUP [ 247.010430][ T9620] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 247.010441][ T9620] Call Trace: [ 247.010448][ T9620] [ 247.010455][ T9620] dump_stack_lvl+0x100/0x190 [ 247.010481][ T9620] should_fail_ex.cold+0x5/0xa [ 247.010503][ T9620] _copy_to_user+0x32/0xd0 [ 247.010525][ T9620] __copy_siginfo_to_user32+0x9a/0x100 [ 247.010551][ T9620] ? __pfx___copy_siginfo_to_user32+0x10/0x10 [ 247.010581][ T9620] ? _raw_spin_unlock_irq+0x29/0x50 [ 247.010599][ T9620] ? siginfo_layout+0x156/0x290 [ 247.010622][ T9620] ia32_setup_rt_frame+0x6ac/0xaf0 [ 247.010664][ T9620] ? __pfx_ia32_setup_rt_frame+0x10/0x10 [ 247.010688][ T9620] ? __pfx_vfs_read+0x10/0x10 [ 247.010706][ T9620] ? find_held_lock+0x2b/0x80 [ 247.010757][ T9620] arch_do_signal_or_restart+0x459/0x7a0 [ 247.010779][ T9620] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 247.010802][ T9620] ? fput+0x7c/0x100 [ 247.010830][ T9620] exit_to_user_mode_loop+0x139/0x700 [ 247.010856][ T9620] ? rcu_is_watching+0x13/0xc0 [ 247.010880][ T9620] __do_fast_syscall_32+0x59f/0x8b0 [ 247.010896][ T9620] ? lockdep_hardirqs_on+0x7d/0x110 [ 247.010924][ T9620] do_fast_syscall_32+0x32/0x70 [ 247.010940][ T9620] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 247.010961][ T9620] RIP: 0023:0xf7f92fea [ 247.010972][ T9620] Code: 19 85 d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 80 5d 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 247.010989][ T9620] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 247.011013][ T9620] RAX: 0000000000000003 RBX: 0000000000000004 RCX: 00000000800002c0 [ 247.011024][ T9620] RDX: 0000000000002020 RSI: 0000000000000000 RDI: 0000000000000000 [ 247.011034][ T9620] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 247.011045][ T9620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 247.011055][ T9620] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 247.011091][ T9620] [ 247.079252][ T9627] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 249.125137][ T9654] 9p: Bad value for 'rfdno' [ 249.349001][ T9658] ubi16: attaching mtd0 [ 249.356120][ T9658] ubi16: scanning is finished [ 249.358502][ T9658] ubi16 error: ubi_read_volume_table: the layout volume was not found [ 249.470127][ T9665] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 249.687731][ T9658] ubi16 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 249.687863][ T9673] 9p: Bad value for 'rfdno' [ 249.771590][ T9671] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4000675772 (8001351544 ns) > initial count (4731795314 ns). Using initial count to start timer. [ 250.240340][ T5751] Bluetooth: hci2: command 0x0406 tx timeout [ 250.242376][ T5097] Bluetooth: hci2: Opcode 0x206a failed: -110 [ 250.456374][ T9685] Bluetooth: (null): Invalid header checksum [ 250.801335][ T9691] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1159'. [ 250.920411][ T9695] comedi comedi1: dt2814: I/O base address not correctly aligned [ 252.972338][ T5097] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 253.085693][ T9699] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.1161'. [ 253.315514][ T9701] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4000675772 (8001351544 ns) > initial count (4731795314 ns). Using initial count to start timer. [ 253.458981][ T9704] 9p: Bad value for 'rfdno' [ 253.575887][ T9714] sch_tbf: burst 32855 is lower than device lo mtu (65505) ! [ 253.579015][ T9714] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1169'. [ 253.691775][ T5837] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 253.856884][ T5837] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 253.887417][ T5837] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 253.900301][ T5837] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 253.922419][ T5837] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.349993][ T5837] usb 5-1: usb_control_msg returned -32 [ 254.351988][ T5837] usbtmc 5-1:16.0: can't read capabilities [ 254.736812][ T9727] usbtmc 5-1:16.0: usbtmc488_ioctl_trigger returned -90 [ 254.801694][ T1433] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.009629][ T9734] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1175'. [ 255.012607][ T9734] FAULT_INJECTION: forcing a failure. [ 255.012607][ T9734] name failslab, interval 1, probability 10, space 0, times 0 [ 255.018739][ T9734] CPU: 3 UID: 0 PID: 9734 Comm: syz.3.1175 Tainted: G L syzkaller #0 PREEMPT(full) [ 255.018765][ T9734] Tainted: [L]=SOFTLOCKUP [ 255.018770][ T9734] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 255.018777][ T9734] Call Trace: [ 255.018783][ T9734] [ 255.018788][ T9734] dump_stack_lvl+0x100/0x190 [ 255.018808][ T9734] should_fail_ex.cold+0x5/0xa [ 255.018823][ T9734] should_failslab+0xc2/0x120 [ 255.018834][ T9734] kmem_cache_alloc_noprof+0x91/0x6a0 [ 255.018852][ T9734] ? __lock_acquire+0x4c5/0x1ec0 [ 255.018864][ T9734] ? xfrm_state_alloc+0x23/0x5c0 [ 255.018891][ T9734] xfrm_state_alloc+0x23/0x5c0 [ 255.018905][ T9734] __find_acq_core+0x89b/0x2d50 [ 255.018927][ T9734] xfrm_find_acq+0x7b/0xa0 [ 255.018947][ T9734] xfrm_alloc_userspi+0x68e/0xc40 [ 255.018963][ T9734] ? __pfx_xfrm_alloc_userspi+0x10/0x10 [ 255.018975][ T9734] ? __nla_parse+0x40/0x60 [ 255.018987][ T9734] ? __pfx_xfrm_alloc_userspi+0x10/0x10 [ 255.018999][ T9734] xfrm_user_rcv_msg+0x411/0xd00 [ 255.019017][ T9734] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 255.019035][ T9734] ? kfree_skbmem+0x19f/0x210 [ 255.019050][ T9734] ? consume_skb+0xd6/0x110 [ 255.019076][ T9734] ? rcu_is_watching+0x13/0xc0 [ 255.019092][ T9734] ? trace_contention_end+0x126/0x160 [ 255.019106][ T9734] ? __mutex_lock+0x26c/0x1bc0 [ 255.019125][ T9734] netlink_rcv_skb+0x159/0x420 [ 255.019156][ T9734] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 255.019173][ T9734] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 255.019197][ T9734] xfrm_netlink_rcv+0x71/0x90 [ 255.019213][ T9734] netlink_unicast+0x585/0x850 [ 255.019230][ T9734] ? __pfx_netlink_unicast+0x10/0x10 [ 255.019250][ T9734] netlink_sendmsg+0x8b0/0xda0 [ 255.019268][ T9734] ? __pfx_netlink_sendmsg+0x10/0x10 [ 255.019286][ T9734] ? apparmor_socket_sendmsg+0x15b/0x270 [ 255.019302][ T9734] ____sys_sendmsg+0xa4d/0xbe0 [ 255.019317][ T9734] ? __pfx_netlink_sendmsg+0x10/0x10 [ 255.019334][ T9734] ? __pfx_____sys_sendmsg+0x10/0x10 [ 255.019355][ T9734] ___sys_sendmsg+0x190/0x1e0 [ 255.019371][ T9734] ? __pfx____sys_sendmsg+0x10/0x10 [ 255.019392][ T9734] ? find_held_lock+0x2b/0x80 [ 255.019416][ T9734] __sys_sendmsg+0x160/0x210 [ 255.019428][ T9734] ? __pfx___sys_sendmsg+0x10/0x10 [ 255.019444][ T9734] ? __pfx_ksys_write+0x10/0x10 [ 255.019459][ T9734] __do_fast_syscall_32+0x13a/0x8b0 [ 255.019470][ T9734] ? lockdep_hardirqs_on+0x7d/0x110 [ 255.019488][ T9734] do_fast_syscall_32+0x32/0x70 [ 255.019498][ T9734] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 255.019513][ T9734] RIP: 0023:0xf7f26fec [ 255.019529][ T9734] Code: Unable to access opcode bytes at 0xf7f26fc2. [ 255.019535][ T9734] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 255.019545][ T9734] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000180 [ 255.019552][ T9734] RDX: 0000000004000014 RSI: 0000000000000000 RDI: 0000000000000000 [ 255.019563][ T9734] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 255.019569][ T9734] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 255.019576][ T9734] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 255.019590][ T9734] [ 256.060181][ T9748] syzkaller0: entered promiscuous mode [ 256.062866][ T9748] syzkaller0: entered allmulticast mode [ 256.353847][ T9751] 9p: Bad value for 'rfdno' [ 256.580953][ T9] usb 5-1: USB disconnect, device number 24 [ 257.742073][ T9764] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4000675772 (8001351544 ns) > initial count (4731795314 ns). Using initial count to start timer. [ 258.123255][ T9780] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1191'. [ 258.130418][ T9780] netlink: 'syz.0.1191': attribute type 1 has an invalid length. [ 258.133739][ T9780] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1191'. [ 258.393618][ T9791] netlink: 'syz.3.1195': attribute type 3 has an invalid length. [ 258.413754][ T9791] Bluetooth: MGMT ver 1.23 [ 258.520505][ T34] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 258.593002][ T9798] Missing 'naa.' prefix [ 258.593021][ T43] audit: type=1800 audit(2000000049.889:460): pid=9798 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1199" name="nexus" dev="configfs" ino=29471 res=0 errno=0 [ 258.729019][ T34] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 258.773557][ T34] usb 6-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 258.777353][ T34] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 258.782096][ T34] usb 6-1: config 0 interface 0 has no altsetting 0 [ 258.792569][ T34] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 258.795598][ T34] usb 6-1: Product: syz [ 258.798011][ T34] usb 6-1: Manufacturer: syz [ 258.799539][ T34] usb 6-1: SerialNumber: syz [ 258.817203][ T9800] Trying to write to read-only block-device nullb0 [ 258.897515][ T34] usb 6-1: config 0 descriptor?? [ 258.925066][ T34] usb 6-1: selecting invalid altsetting 0 [ 258.969497][ T9811] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1202'. [ 260.251974][ T9831] [ 260.252988][ T9831] ====================================================== [ 260.255735][ T9831] WARNING: possible circular locking dependency detected [ 260.258441][ T9831] syzkaller #0 Tainted: G L [ 260.260861][ T9831] ------------------------------------------------------ [ 260.263575][ T9831] syz.2.1208/9831 is trying to acquire lock: [ 260.265913][ T9831] ffffffff903d1d28 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_frame_w_width_store+0x12c/0x370 [ 260.270048][ T9831] [ 260.270048][ T9831] but task is already holding lock: [ 260.272868][ T9831] ffff8880268e0d70 (&p->frag_sem){++++}-{4:4}, at: configfs_write_iter+0x218/0x4e0 [ 260.276513][ T9831] [ 260.276513][ T9831] which lock already depends on the new lock. [ 260.276513][ T9831] [ 260.280539][ T9831] [ 260.280539][ T9831] the existing dependency chain (in reverse order) is: [ 260.284021][ T9831] [ 260.284021][ T9831] -> #3 (&p->frag_sem){++++}-{4:4}: [ 260.286933][ T9831] lock_acquire+0x1b9/0x370 [ 260.288908][ T9831] down_write_killable+0x93/0x240 [ 260.291085][ T9831] configfs_rmdir+0x3fa/0x950 [ 260.293131][ T9831] vfs_rmdir+0x328/0x8a0 [ 260.295016][ T9831] filename_rmdir+0x31a/0x5c0 [ 260.297068][ T9831] __ia32_sys_unlinkat+0xf5/0x130 [ 260.299254][ T9831] __do_fast_syscall_32+0x13a/0x8b0 [ 260.301518][ T9831] do_fast_syscall_32+0x32/0x70 [ 260.303634][ T9831] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.306273][ T9831] [ 260.306273][ T9831] -> #2 (&sb->s_type->i_mutex_key#28){++++}-{4:4}: [ 260.309667][ T9831] lock_acquire+0x1b9/0x370 [ 260.311651][ T9831] down_write+0x8b/0x1f0 [ 260.313538][ T9831] configfs_depend_item_unlocked+0xf3/0x6a0 [ 260.316059][ T9831] usbg_make_tpg+0x261/0x620 [ 260.318085][ T9831] target_fabric_make_tpg+0xab/0x8c0 [ 260.320384][ T9831] configfs_mkdir+0x51e/0xb70 [ 260.322453][ T9831] vfs_mkdir+0x364/0x850 [ 260.324350][ T9831] filename_mkdirat+0x48b/0x5e0 [ 260.326489][ T9831] __ia32_sys_mkdirat+0x88/0xc0 [ 260.328565][ T9831] __do_fast_syscall_32+0x13a/0x8b0 [ 260.330716][ T9831] do_fast_syscall_32+0x32/0x70 [ 260.332948][ T9831] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.335677][ T9831] [ 260.335677][ T9831] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 260.338700][ T9831] lock_acquire+0x1b9/0x370 [ 260.340666][ T9831] __mutex_lock+0x1a4/0x1bc0 [ 260.342713][ T9831] tcm_set_name+0x29/0xb0 [ 260.344620][ T9831] function_make+0x21c/0x3f0 [ 260.346549][ T9831] configfs_mkdir+0x51e/0xb70 [ 260.348589][ T9831] vfs_mkdir+0x364/0x850 [ 260.350460][ T9831] filename_mkdirat+0x48b/0x5e0 [ 260.352494][ T9831] __ia32_sys_mkdirat+0x88/0xc0 [ 260.354607][ T9831] __do_fast_syscall_32+0x13a/0x8b0 [ 260.356811][ T9831] do_fast_syscall_32+0x32/0x70 [ 260.358895][ T9831] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.361556][ T9831] [ 260.361556][ T9831] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 260.364815][ T9831] check_prev_add+0xeb/0xe60 [ 260.366441][ T9831] __lock_acquire+0x1492/0x1ec0 [ 260.368169][ T9831] lock_acquire+0x1b9/0x370 [ 260.369755][ T9831] __mutex_lock+0x1a4/0x1bc0 [ 260.371387][ T9831] uvcg_frame_w_width_store+0x12c/0x370 [ 260.373311][ T9831] configfs_write_iter+0x302/0x4e0 [ 260.375087][ T9831] vfs_write+0x6af/0x1050 [ 260.376640][ T9831] ksys_write+0x12a/0x250 [ 260.378181][ T9831] __do_fast_syscall_32+0x13a/0x8b0 [ 260.379971][ T9831] do_fast_syscall_32+0x32/0x70 [ 260.381659][ T9831] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.383808][ T9831] [ 260.383808][ T9831] other info that might help us debug this: [ 260.383808][ T9831] [ 260.386961][ T9831] Chain exists of: [ 260.386961][ T9831] gadget_subsys.su_mutex --> &sb->s_type->i_mutex_key#28 --> &p->frag_sem [ 260.386961][ T9831] [ 260.391394][ T9831] Possible unsafe locking scenario: [ 260.391394][ T9831] [ 260.393705][ T9831] CPU0 CPU1 [ 260.395373][ T9831] ---- ---- [ 260.397037][ T9831] rlock(&p->frag_sem); [ 260.398402][ T9831] lock(&sb->s_type->i_mutex_key#28); [ 260.400953][ T9831] lock(&p->frag_sem); [ 260.403035][ T9831] lock(gadget_subsys.su_mutex); [ 260.404619][ T9831] [ 260.404619][ T9831] *** DEADLOCK *** [ 260.404619][ T9831] [ 260.407066][ T9831] locks held by syz.2.1208/9831: 4, last CPU#3: [ 260.409031][ T9831] #0: ffff8880212fe470 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 260.411853][ T9831] #1: ffff888023006460 (sb_writers#14){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 260.414675][ T9831] #2: ffff888013f71a80 (&buffer->mutex){+.+.}-{4:4}, at: configfs_write_iter+0x76/0x4e0 [ 260.417813][ T9831] #3: ffff8880268e0d70 (&p->frag_sem){++++}-{4:4}, at: configfs_write_iter+0x218/0x4e0 [ 260.420834][ T9831] [ 260.420834][ T9831] stack backtrace: [ 260.422712][ T9831] CPU: 3 UID: 0 PID: 9831 Comm: syz.2.1208 Tainted: G L syzkaller #0 PREEMPT(full) [ 260.422729][ T9831] Tainted: [L]=SOFTLOCKUP [ 260.422733][ T9831] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 260.422740][ T9831] Call Trace: [ 260.422746][ T9831] [ 260.422753][ T9831] dump_stack_lvl+0x100/0x190 [ 260.422767][ T9831] print_circular_bug.cold+0x178/0x1be [ 260.422786][ T9831] check_noncircular+0x146/0x160 [ 260.422800][ T9831] check_prev_add+0xeb/0xe60 [ 260.422813][ T9831] __lock_acquire+0x1492/0x1ec0 [ 260.422827][ T9831] lock_acquire+0x1b9/0x370 [ 260.422839][ T9831] ? uvcg_frame_w_width_store+0x12c/0x370 [ 260.422853][ T9831] ? __pfx___might_resched+0x10/0x10 [ 260.422865][ T9831] __mutex_lock+0x1a4/0x1bc0 [ 260.422883][ T9831] ? uvcg_frame_w_width_store+0x12c/0x370 [ 260.422896][ T9831] ? uvcg_frame_w_width_store+0x12c/0x370 [ 260.422909][ T9831] ? _kstrtoull+0x13c/0x1f0 [ 260.422926][ T9831] ? __pfx___mutex_lock+0x10/0x10 [ 260.422945][ T9831] ? __pfx_kstrtou16+0x10/0x10 [ 260.422961][ T9831] ? __pfx___might_resched+0x10/0x10 [ 260.422973][ T9831] ? uvcg_frame_w_width_store+0x12c/0x370 [ 260.422986][ T9831] uvcg_frame_w_width_store+0x12c/0x370 [ 260.423004][ T9831] ? __pfx_uvcg_frame_w_width_store+0x10/0x10 [ 260.423017][ T9831] ? configfs_write_iter+0x388/0x4e0 [ 260.423034][ T9831] configfs_write_iter+0x302/0x4e0 [ 260.423050][ T9831] vfs_write+0x6af/0x1050 [ 260.423065][ T9831] ? __pfx_configfs_write_iter+0x10/0x10 [ 260.423083][ T9831] ? __pfx_vfs_write+0x10/0x10 [ 260.423095][ T9831] ? find_held_lock+0x2b/0x80 [ 260.423114][ T9831] ksys_write+0x12a/0x250 [ 260.423127][ T9831] ? __pfx_ksys_write+0x10/0x10 [ 260.423141][ T9831] __do_fast_syscall_32+0x13a/0x8b0 [ 260.423152][ T9831] do_fast_syscall_32+0x32/0x70 [ 260.423162][ T9831] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.423177][ T9831] RIP: 0023:0xf709efec [ 260.423194][ T9831] Code: Unable to access opcode bytes at 0xf709efc2. [ 260.423200][ T9831] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 260.423212][ T9831] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000540 [ 260.423219][ T9831] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 260.423226][ T9831] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 260.423233][ T9831] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 260.423240][ T9831] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 260.423251][ T9831] [ 260.707219][ T34] usb 6-1: USB disconnect, device number 29