syzkaller login: [ 300.432882][ T1859] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 300.479834][ T1859] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 320.408574][ T1859] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. Warning: Permanently added '[localhost]:30581' (ECDSA) to the list of known hosts. 1970/01/01 00:06:03 fuzzer started 1970/01/01 00:06:23 dialing manager at localhost:39821 [ 390.097657][ T2038] cgroup: Unknown subsys name 'net' [ 391.345760][ T2038] cgroup: Unknown subsys name 'rlimit' 1970/01/01 00:06:30 syscalls: 2817 1970/01/01 00:06:30 code coverage: enabled 1970/01/01 00:06:30 comparison tracing: enabled 1970/01/01 00:06:30 extra coverage: enabled 1970/01/01 00:06:30 delay kcov mmap: mmap returned an invalid pointer 1970/01/01 00:06:30 setuid sandbox: enabled 1970/01/01 00:06:30 namespace sandbox: enabled 1970/01/01 00:06:30 Android sandbox: /sys/fs/selinux/policy does not exist 1970/01/01 00:06:30 fault injection: enabled 1970/01/01 00:06:30 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 1970/01/01 00:06:30 net packet injection: enabled 1970/01/01 00:06:30 net device setup: enabled 1970/01/01 00:06:30 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 1970/01/01 00:06:30 devlink PCI setup: PCI device 0000:00:10.0 is not available 1970/01/01 00:06:30 USB emulation: enabled 1970/01/01 00:06:30 hci packet injection: /dev/vhci does not exist 1970/01/01 00:06:30 wifi device emulation: /sys/class/mac80211_hwsim/ does not exist 1970/01/01 00:06:30 802.15.4 emulation: /sys/bus/platform/devices/mac802154_hwsim does not exist 1970/01/01 00:06:31 fetching corpus: 0, signal 0/2000 (executing program) 1970/01/01 00:06:37 fetching corpus: 50, signal 28071/31282 (executing program) 1970/01/01 00:06:41 fetching corpus: 100, signal 43651/47885 (executing program) 1970/01/01 00:06:44 fetching corpus: 150, signal 49316/54682 (executing program) 1970/01/01 00:06:48 fetching corpus: 200, signal 56805/63035 (executing program) 1970/01/01 00:06:52 fetching corpus: 250, signal 63917/70821 (executing program) 1970/01/01 00:06:55 fetching corpus: 300, signal 68002/75673 (executing program) 1970/01/01 00:06:58 fetching corpus: 348, signal 75058/82988 (executing program) 1970/01/01 00:07:02 fetching corpus: 398, signal 81124/89360 (executing program) 1970/01/01 00:07:04 fetching corpus: 448, signal 84186/92894 (executing program) 1970/01/01 00:07:07 fetching corpus: 498, signal 87853/96846 (executing program) 1970/01/01 00:07:10 fetching corpus: 548, signal 92096/101187 (executing program) 1970/01/01 00:07:14 fetching corpus: 598, signal 94737/104092 (executing program) 1970/01/01 00:07:20 fetching corpus: 648, signal 97587/107108 (executing program) 1970/01/01 00:07:22 fetching corpus: 698, signal 100405/110005 (executing program) 1970/01/01 00:07:25 fetching corpus: 748, signal 102386/112195 (executing program) 1970/01/01 00:07:28 fetching corpus: 798, signal 105923/115573 (executing program) 1970/01/01 00:07:33 fetching corpus: 848, signal 108159/117866 (executing program) 1970/01/01 00:07:36 fetching corpus: 898, signal 110839/120432 (executing program) 1970/01/01 00:07:39 fetching corpus: 948, signal 112557/122186 (executing program) 1970/01/01 00:07:42 fetching corpus: 998, signal 114821/124340 (executing program) 1970/01/01 00:07:44 fetching corpus: 1048, signal 116086/125691 (executing program) 1970/01/01 00:07:49 fetching corpus: 1098, signal 118871/128040 (executing program) 1970/01/01 00:07:52 fetching corpus: 1148, signal 121558/130273 (executing program) 1970/01/01 00:07:55 fetching corpus: 1198, signal 123476/131858 (executing program) 1970/01/01 00:07:58 fetching corpus: 1248, signal 125046/133270 (executing program) 1970/01/01 00:08:02 fetching corpus: 1298, signal 126889/134779 (executing program) 1970/01/01 00:08:06 fetching corpus: 1348, signal 127850/135678 (executing program) 1970/01/01 00:08:10 fetching corpus: 1398, signal 128946/136663 (executing program) 1970/01/01 00:08:14 fetching corpus: 1448, signal 130993/138157 (executing program) 1970/01/01 00:08:17 fetching corpus: 1498, signal 131881/138898 (executing program) 1970/01/01 00:08:20 fetching corpus: 1548, signal 133884/140265 (executing program) 1970/01/01 00:08:22 fetching corpus: 1598, signal 135302/141213 (executing program) 1970/01/01 00:08:24 fetching corpus: 1648, signal 136371/141974 (executing program) 1970/01/01 00:08:26 fetching corpus: 1698, signal 137490/142739 (executing program) 1970/01/01 00:08:30 fetching corpus: 1748, signal 138970/143658 (executing program) 1970/01/01 00:08:32 fetching corpus: 1798, signal 141217/144913 (executing program) 1970/01/01 00:08:37 fetching corpus: 1847, signal 142732/145722 (executing program) 1970/01/01 00:08:40 fetching corpus: 1896, signal 144235/146566 (executing program) 1970/01/01 00:08:43 fetching corpus: 1946, signal 145762/147345 (executing program) 1970/01/01 00:08:44 fetching corpus: 1963, signal 146048/147500 (executing program) 1970/01/01 00:08:44 fetching corpus: 1963, signal 146048/147531 (executing program) 1970/01/01 00:08:44 fetching corpus: 1963, signal 146048/147559 (executing program) 1970/01/01 00:08:45 fetching corpus: 1963, signal 146048/147607 (executing program) 1970/01/01 00:08:45 fetching corpus: 1963, signal 146048/147645 (executing program) 1970/01/01 00:08:45 fetching corpus: 1963, signal 146048/147673 (executing program) 1970/01/01 00:08:45 fetching corpus: 1963, signal 146048/147706 (executing program) 1970/01/01 00:08:45 fetching corpus: 1963, signal 146048/147747 (executing program) 1970/01/01 00:08:46 fetching corpus: 1963, signal 146048/147787 (executing program) 1970/01/01 00:08:46 fetching corpus: 1963, signal 146048/147823 (executing program) 1970/01/01 00:08:46 fetching corpus: 1963, signal 146048/147847 (executing program) 1970/01/01 00:08:46 fetching corpus: 1963, signal 146048/147882 (executing program) 1970/01/01 00:08:46 fetching corpus: 1963, signal 146048/147922 (executing program) 1970/01/01 00:08:46 fetching corpus: 1963, signal 146048/147958 (executing program) 1970/01/01 00:08:47 fetching corpus: 1963, signal 146048/147999 (executing program) 1970/01/01 00:08:47 fetching corpus: 1963, signal 146048/148035 (executing program) 1970/01/01 00:08:47 fetching corpus: 1963, signal 146048/148076 (executing program) 1970/01/01 00:08:47 fetching corpus: 1963, signal 146048/148115 (executing program) 1970/01/01 00:08:47 fetching corpus: 1963, signal 146048/148145 (executing program) 1970/01/01 00:08:47 fetching corpus: 1963, signal 146048/148181 (executing program) 1970/01/01 00:08:48 fetching corpus: 1964, signal 146055/148222 (executing program) 1970/01/01 00:08:48 fetching corpus: 1964, signal 146055/148258 (executing program) 1970/01/01 00:08:48 fetching corpus: 1964, signal 146055/148283 (executing program) 1970/01/01 00:08:48 fetching corpus: 1964, signal 146055/148323 (executing program) 1970/01/01 00:08:48 fetching corpus: 1964, signal 146055/148358 (executing program) 1970/01/01 00:08:48 fetching corpus: 1964, signal 146055/148389 (executing program) 1970/01/01 00:08:48 fetching corpus: 1964, signal 146055/148418 (executing program) 1970/01/01 00:08:48 fetching corpus: 1964, signal 146055/148449 (executing program) 1970/01/01 00:08:49 fetching corpus: 1964, signal 146055/148482 (executing program) 1970/01/01 00:08:49 fetching corpus: 1964, signal 146055/148517 (executing program) 1970/01/01 00:08:49 fetching corpus: 1964, signal 146055/148556 (executing program) 1970/01/01 00:08:49 fetching corpus: 1964, signal 146055/148592 (executing program) 1970/01/01 00:08:49 fetching corpus: 1964, signal 146055/148634 (executing program) 1970/01/01 00:08:49 fetching corpus: 1964, signal 146055/148668 (executing program) 1970/01/01 00:08:49 fetching corpus: 1964, signal 146055/148683 (executing program) 1970/01/01 00:08:49 fetching corpus: 1964, signal 146055/148683 (executing program) 1970/01/01 00:10:55 starting 2 fuzzer processes 00:10:56 executing program 0: bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0) 00:10:56 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000000100)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @dev}, 0x1c, 0x0}}, {{&(0x7f00000004c0)={0xa, 0x4e2c, 0x0, @private2}, 0x1c, 0x0, 0x0, &(0x7f00000019c0)=[@pktinfo={{0x23, 0x29, 0x32, {@empty}}}], 0x28}}], 0x2, 0x0) [ 692.205582][ T2045] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 692.348056][ T2047] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 692.392462][ T2045] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 692.935505][ T2047] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 706.084696][ T2045] device hsr_slave_0 entered promiscuous mode [ 706.150366][ T2045] device hsr_slave_1 entered promiscuous mode [ 708.279605][ T2047] device hsr_slave_0 entered promiscuous mode [ 708.337245][ T2047] device hsr_slave_1 entered promiscuous mode [ 708.360386][ T2047] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 708.367345][ T2047] Cannot create hsr debugfs directory [ 717.780047][ T2045] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 717.966135][ T2045] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 718.276604][ T2045] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 718.648110][ T2045] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 719.752172][ T2047] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 719.896671][ T2047] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 720.353961][ T2047] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 720.534447][ T2047] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 730.755868][ T2045] 8021q: adding VLAN 0 to HW filter on device bond0 [ 731.948176][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 732.046790][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 734.619329][ T2047] 8021q: adding VLAN 0 to HW filter on device bond0 [ 735.273837][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 735.328510][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 741.036900][ T2040] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 741.085748][ T2040] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 741.330082][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 741.372842][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 741.597708][ T2040] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 741.909432][ T2653] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 742.712700][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 742.783467][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 742.996433][ T2040] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 743.057834][ T2040] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 743.367145][ T2045] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 744.389102][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 744.410117][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 744.658476][ T2040] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 744.694758][ T2040] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 745.058123][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 745.106505][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 745.358854][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 745.766984][ T2653] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 747.147646][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 747.226683][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 747.252855][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 747.283718][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 747.619776][ T2047] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 748.948698][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 748.985738][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 778.596678][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 778.689871][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 786.284260][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 786.356338][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 793.598924][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 793.721663][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 793.926797][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 793.957568][ T2039] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 793.997488][ T2045] device veth0_vlan entered promiscuous mode [ 794.681848][ T2045] device veth1_vlan entered promiscuous mode [ 796.742469][ T2682] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 796.802500][ T2682] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 797.136047][ T2045] device veth0_macvtap entered promiscuous mode [ 797.450470][ T2045] device veth1_macvtap entered promiscuous mode [ 798.306477][ T2666] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 798.875954][ T2666] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 798.950275][ T2666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 799.336136][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 799.368763][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 799.894490][ T2045] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 799.916716][ T2045] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 799.918295][ T2045] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 799.919739][ T2045] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 803.170265][ T2666] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 803.263629][ T2666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 803.444552][ T2097] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 803.499142][ T2097] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 803.856255][ T2047] device veth0_vlan entered promiscuous mode [ 804.845532][ T2047] device veth1_vlan entered promiscuous mode [ 807.090354][ T2097] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 807.156842][ T2097] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 807.499682][ T2047] device veth0_macvtap entered promiscuous mode [ 807.919561][ T2047] device veth1_macvtap entered promiscuous mode [ 808.703695][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 809.117324][ T2653] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 809.172878][ T2653] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 809.674298][ T2653] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 809.739726][ T2653] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 810.010458][ T2047] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.059705][ T2047] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.073635][ T2047] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.075375][ T2047] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 00:13:30 executing program 0: bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0) 00:13:34 executing program 0: bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0) 00:13:36 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000000100)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @dev}, 0x1c, 0x0}}, {{&(0x7f00000004c0)={0xa, 0x4e2c, 0x0, @private2}, 0x1c, 0x0, 0x0, &(0x7f00000019c0)=[@pktinfo={{0x23, 0x29, 0x32, {@empty}}}], 0x28}}], 0x2, 0x0) 00:13:38 executing program 0: bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0) 00:13:40 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000000100)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @dev}, 0x1c, 0x0}}, {{&(0x7f00000004c0)={0xa, 0x4e2c, 0x0, @private2}, 0x1c, 0x0, 0x0, &(0x7f00000019c0)=[@pktinfo={{0x23, 0x29, 0x32, {@empty}}}], 0x28}}], 0x2, 0x0) 00:13:42 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000000)=0x1, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 00:13:43 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000000100)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @dev}, 0x1c, 0x0}}, {{&(0x7f00000004c0)={0xa, 0x4e2c, 0x0, @private2}, 0x1c, 0x0, 0x0, &(0x7f00000019c0)=[@pktinfo={{0x23, 0x29, 0x32, {@empty}}}], 0x28}}], 0x2, 0x0) [ 826.199139][ T2746] Zero length message leads to an empty skb 00:13:46 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000000)=0x1, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 00:13:51 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000000)=0x1, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 00:13:52 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000000)=0x1, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 00:13:54 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000000)=0x1, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 00:13:55 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000000)=0x1, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 00:13:57 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000000)=0x1, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 00:14:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)={0x14, r1, 0xb19, 0x0, 0x0, {0x2e}}, 0x14}}, 0x0) 00:14:02 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$inet(r1, &(0x7f0000000500)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000340)="9b7f", 0xffeb}], 0x1, &(0x7f00000004c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @broadcast}}}], 0x20}, 0x0) 00:14:03 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)={0x14, r1, 0xb19, 0x0, 0x0, {0x2e}}, 0x14}}, 0x0) 00:14:07 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)={0x14, r1, 0xb19, 0x0, 0x0, {0x2e}}, 0x14}}, 0x0) 00:14:07 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$inet(r1, &(0x7f0000000500)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000340)="9b7f", 0xffeb}], 0x1, &(0x7f00000004c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @broadcast}}}], 0x20}, 0x0) 00:14:10 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)={0x14, r1, 0xb19, 0x0, 0x0, {0x2e}}, 0x14}}, 0x0) 00:14:13 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$inet(r1, &(0x7f0000000500)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000340)="9b7f", 0xffeb}], 0x1, &(0x7f00000004c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @broadcast}}}], 0x20}, 0x0) 00:14:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast1}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast1}, @FOU_ATTR_PEER_V6={0xfffffffffffffff2, 0x9, @mcast1}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5}]}, 0x6c}}, 0x0) 00:14:17 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$inet(r1, &(0x7f0000000500)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000340)="9b7f", 0xffeb}], 0x1, &(0x7f00000004c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @broadcast}}}], 0x20}, 0x0) [ 859.529483][ T2776] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.0'. 00:14:19 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast1}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast1}, @FOU_ATTR_PEER_V6={0xfffffffffffffff2, 0x9, @mcast1}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5}]}, 0x6c}}, 0x0) [ 864.399841][ T2780] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.0'. 00:14:23 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast1}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast1}, @FOU_ATTR_PEER_V6={0xfffffffffffffff2, 0x9, @mcast1}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5}]}, 0x6c}}, 0x0) 00:14:25 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast1}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast1}, @FOU_ATTR_PEER_V6={0xfffffffffffffff2, 0x9, @mcast1}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5}]}, 0x6c}}, 0x0) [ 867.746468][ T2783] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'. 00:14:28 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast1}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast1}, @FOU_ATTR_PEER_V6={0xfffffffffffffff2, 0x9, @mcast1}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5}]}, 0x6c}}, 0x0) [ 869.907714][ T2785] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.0'. 00:14:29 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast1}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast1}, @FOU_ATTR_PEER_V6={0xfffffffffffffff2, 0x9, @mcast1}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5}]}, 0x6c}}, 0x0) [ 872.676839][ T2789] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'. [ 874.035850][ T2791] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.0'. 00:14:33 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast1}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast1}, @FOU_ATTR_PEER_V6={0xfffffffffffffff2, 0x9, @mcast1}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5}]}, 0x6c}}, 0x0) 00:14:36 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast1}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast1}, @FOU_ATTR_PEER_V6={0xfffffffffffffff2, 0x9, @mcast1}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5}]}, 0x6c}}, 0x0) [ 878.929715][ T2796] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.1'. [ 879.656003][ T2797] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.0'. 00:14:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x5}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_V4={0x8, 0x8, @multicast1}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast1}, @FOU_ATTR_PEER_V6={0xfffffffffffffff2, 0x9, @mcast1}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5}]}, 0x6c}}, 0x0) 00:14:41 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000001dc0)=0x7, 0x4) recvmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000040)="220dba48", 0xfe81, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x6}, 0x7f) [ 885.237805][ C1] ================================================================== [ 885.242390][ C1] BUG: KASAN: null-ptr-deref in __netif_receive_skb_core+0x111e/0x2730 [ 885.244091][ C1] Read of size 8 at addr 0000000000000000 by task ksoftirqd/1/19 [ 885.245913][ C1] [ 885.247763][ C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 885.249500][ C1] Hardware name: riscv-virtio,qemu (DT) [ 885.250886][ C1] Call Trace: [ 885.252344][ C1] [] dump_backtrace+0x2e/0x3c [ 885.254236][ C1] [] show_stack+0x34/0x40 [ 885.255568][ C1] [] dump_stack_lvl+0xe4/0x150 [ 885.256987][ C1] [] kasan_report+0x1de/0x1e0 [ 885.258374][ C1] [] __asan_load8+0x6e/0x96 [ 885.259735][ C1] [] __netif_receive_skb_core+0x111e/0x2730 [ 885.262116][ C1] [] __netif_receive_skb_one_core+0xb4/0x13a [ 885.263764][ C1] [] __netif_receive_skb+0x36/0xd8 [ 885.265257][ C1] [] process_backlog+0x206/0x4bc [ 885.266884][ C1] [] __napi_poll+0x7c/0x358 [ 885.268261][ C1] [] net_rx_action+0x5d0/0x702 [ 885.269631][ C1] [] __do_softirq+0x274/0x8fc [ 885.271678][ C1] [] run_ksoftirqd+0x8c/0xc0 [ 885.273808][ C1] [] smpboot_thread_fn+0x448/0x6cc [ 885.275218][ C1] [] kthread+0x19e/0x1fa [ 885.276756][ C1] [] ret_from_exception+0x0/0x10 [ 885.278326][ C1] ================================================================== [ 885.279464][ C1] Disabling lock debugging due to kernel taint [ 885.282206][ C1] Unable to handle kernel paging request at virtual address fffff5ef1aeb5000 [ 885.284346][ C1] Oops [#1] [ 885.285047][ C1] Modules linked in: [ 885.286051][ C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Tainted: G B 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 885.287327][ C1] Hardware name: riscv-virtio,qemu (DT) [ 885.288114][ C1] epc : kasan_check_range+0x102/0x136 [ 885.289099][ C1] ra : __kasan_check_write+0x14/0x1c [ 885.290088][ C1] epc : ffffffff80475f7a ra : ffffffff8047658a sp : ffffaf800743b7d0 [ 885.291940][ C1] gp : ffffffff85863ac0 tp : ffffaf8007416100 t0 : ffffffff86bcb657 [ 885.293342][ C1] t1 : fffff5ef1aeb5001 t2 : 0000000000000000 s0 : ffffaf800743b7e0 [ 885.294699][ C1] s1 : ffffaf8007f8b000 a0 : fffff5ef1aeb5002 a1 : 0000000000000008 [ 885.296689][ C1] a2 : 0000000000000001 a3 : ffffffff8273bc6e a4 : 0000000000000010 [ 885.297680][ C1] a5 : fffff5ef1aeb5000 a6 : ffffaf80d75a8002 a7 : ffffaf80d75a8009 [ 885.298706][ C1] s2 : ffffaf800c7620c0 s3 : ffffaf80d75a8002 s4 : ffffaf800743b980 [ 885.299737][ C1] s5 : ffffffff85889780 s6 : ffffaf80091ee000 s7 : ffffaf805a9f5c90 [ 885.301072][ C1] s8 : ffffffff8273e0b0 s9 : ffffaf800743ba60 s10: 0000000000000000 [ 885.302183][ C1] s11: ffffaf800743ba60 t3 : 0000000061736944 t4 : fffff5ef1aeb5000 [ 885.303584][ C1] t5 : fffff5ef1aeb5002 t6 : ffffaf800743b218 [ 885.305126][ C1] status: 0000000000000120 badaddr: fffff5ef1aeb5000 cause: 000000000000000d [ 885.306296][ C1] [] __netif_receive_skb_core+0x1186/0x2730 [ 885.307579][ C1] [] __netif_receive_skb_one_core+0xb4/0x13a [ 885.308921][ C1] [] __netif_receive_skb+0x36/0xd8 [ 885.310035][ C1] [] process_backlog+0x206/0x4bc [ 885.311594][ C1] [] __napi_poll+0x7c/0x358 [ 885.313019][ C1] [] net_rx_action+0x5d0/0x702 [ 885.314179][ C1] [] __do_softirq+0x274/0x8fc [ 885.315377][ C1] [] run_ksoftirqd+0x8c/0xc0 [ 885.317562][ C1] [] smpboot_thread_fn+0x448/0x6cc [ 885.318722][ C1] [] kthread+0x19e/0x1fa [ 885.319803][ C1] [] ret_from_exception+0x0/0x10 [ 885.322019][ C1] ---[ end trace 0000000000000000 ]--- [ 885.324402][ C1] Kernel panic - not syncing: Fatal exception in interrupt [ 885.326039][ C1] SMP: stopping secondary CPUs [ 885.327867][ C1] Rebooting in 86400 seconds.. VM DIAGNOSIS: 23:38:22 Registers: info registers vcpu 0 pc ffffffff831a24bc mhartid 0000000000000000 mstatus 00000000000000a2 mip 0000000000000000 mie 00000000000002aa mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff80010124 sepc ffffffff80201140 mcause 0000000000000009 scause 8000000000000005 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff80112a0a x2/sp ffffaf800d7f3630 x3/gp ffffffff85863ac0 x4/tp ffffaf800bf3b080 x5/t0 00000000357d9e92 x6/t1 000000007a6ad000 x7/t2 000000001f537ded x8/s0 ffffaf800d7f3970 x9/s1 ffffaf800d7f3a44 x10/a0 0000000000000000 x11/a1 ffffaf800bf3c080 x12/a2 1ffff5f0019acee3 x13/a3 0000000000c7e1e3 x14/a4 000000000000948f x15/a5 0000000000000002 x16/a6 0000000000f00000 x17/a7 ffffaf800d7f3a7b x18/s2 0000000000000010 x19/s3 ffffaf800cd67748 x20/s4 0000000000000000 x21/s5 0000000100008d64 x22/s6 ffffaf800d7f3a40 x23/s7 0000000000000000 x24/s8 ffffffff86c1a620 x25/s9 1ffff5f001afe70c x26/s10 0000000000000000 x27/s11 ffffaf8010e065c8 x28/t3 0000000000000037 x29/t4 fffff5ef01afe74f x30/t5 fffff5ef01afe750 x31/t6 00000000000000c6 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000 info registers vcpu 1 pc ffffffff8317561a mhartid 0000000000000001 mstatus 00000000000000a0 mip 00000000000000a0 mie 000000000000022a mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff804759a8 sepc ffffffff831afd22 mcause 8000000000000003 scause 8000000000000005 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff8317561a x2/sp ffffaf800743b730 x3/gp ffffffff85863ac0 x4/tp ffffaf8007416100 x5/t0 ffffffff86bcb657 x6/t1 fffff5ef0b53c90c x7/t2 0000000000000000 x8/s0 ffffaf800743b760 x9/s1 0000000000000000 x10/a0 0000000000000000 x11/a1 00000000000f0000 x12/a2 0000000000000101 x13/a3 ffffffff8317561a x14/a4 ffffaf8007416100 x15/a5 0000000000000000 x16/a6 0000000000f00000 x17/a7 ffffaf805a9e4863 x18/s2 ffffffff8453a6b0 x19/s3 ffffffff8273bc06 x20/s4 0000000000000000 x21/s5 ffffffff85863560 x22/s6 ffffaf80091ee000 x23/s7 ffffaf805a9f5c90 x24/s8 ffffffff8273e0b0 x25/s9 ffffaf800743ba60 x26/s10 0000000000000000 x27/s11 ffffaf800743ba60 x28/t3 fffffffff3f3f300 x29/t4 fffff5ef0b53c90c x30/t5 fffff5ef0b53c90d x31/t6 ffffaf800743b258 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000