last executing test programs: 7.306677814s ago: executing program 2 (id=493): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x800) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xffffffffffffffff, 0x6, 0x8, @scatter={0x0, 0xcc, 0x0}, &(0x7f0000000240)="128d7acf0800", 0x0, 0x0, 0x10, 0xffffffff, 0x0}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0x0, 0x0, 0x4006044}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f815108f6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e67", 0x26f}], 0x1}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) r4 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r4, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r4, &(0x7f00000002c0)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x2940000, @mcast1, 0x9}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000780)="f4000900062b3325fe80000000000000dc8b850f238466ccfe807a000000ad6e911b51818462b4003a000000", 0x3a}], 0x1}, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) unshare(0x40400) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) creat(0x0, 0x72) r6 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r6) getsockname$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r7, 0x504a3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @local}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r8 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r8, 0x0, 0x0) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r9, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) r10 = socket(0x10, 0x803, 0x2) getsockname$packet(r10, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendto$packet(r9, &(0x7f0000000180)="280320000a0014000000fbf719143baa111f43c851ffab286e16195ecf3d77cc32b6d78839980700e6669d3c865c6b96e84000050016f37fe8c0295f5c", 0x3d, 0x840, &(0x7f00000000c0)={0x11, 0x86dd, r11, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2eaaaac15ca67ef2}}, 0x14) 5.883294316s ago: executing program 0 (id=503): r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x8550, 0xc00, 0x1, 0xf}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r0, 0x18, &(0x7f0000000040)={0x9, 0xffffffffffffffff, 0x4, {0xc, 0x9}, 0x3}, 0x1) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x121002, 0x0) socket(0x10, 0x80002, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c0000001805017b0000000000000000050000000800b8"], 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000100)={0x5, 0x20001000, 0xffffffffffffffff, 0x1}, 0x10) modify_ldt$write2(0x11, &(0x7f0000000000)={0x3, 0x20000000, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x10) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYBLOB="010000000000000000001400000018"], 0x44}}, 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r5, &(0x7f00000000c0)='blkio.bfq.idle_time\x00', 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1c}}, 0x884) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r7 = socket$inet_udp(0x2, 0x2, 0x0) openat$cdrom(0xffffff9c, &(0x7f0000000280), 0x0, 0x0) bind$inet(r7, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) connect$inet(r7, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) sendmmsg$inet(r7, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r8, 0x400452c8, &(0x7f0000000100)) ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c9, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x7a31, 0x7fff}, @sack_perm, @sack_perm, @mss={0x2, 0x4}, @window={0x3, 0x800, 0x6}, @window={0x3, 0x1, 0x10}, @sack_perm], 0x8) 5.593521368s ago: executing program 0 (id=504): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$sg(&(0x7f00000001c0), 0x508d48d4, 0x40902) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x2000000000000013, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xb8, &(0x7f0000000140)=""/184, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) request_key(0x0, &(0x7f0000000380)={'syz', 0x3}, 0x0, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r4, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, &(0x7f00000007c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', r5}, 0x94) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) socket$netlink(0x10, 0x3, 0x14) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x35, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x88}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) 5.581021664s ago: executing program 3 (id=505): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r2, &(0x7f00000002c0)="05031600ecfc140000004788031c", 0xe, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) syz_open_procfs(0xffffffffffffffff, 0x0) 5.516230041s ago: executing program 2 (id=506): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r1, 0x8008f511, &(0x7f0000000000)) keyctl$search(0xa, 0x0, &(0x7f0000000380)='encrypted\x00', &(0x7f0000000580)={'syz', 0x1}, 0x0) setsockopt$sock_int(r1, 0x1, 0x23, &(0x7f0000000300)=0x20, 0x4) recvmmsg(r1, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40002100, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$CDROM_CHANGER_NSLOTS(r2, 0x5328) write$binfmt_misc(r1, &(0x7f0000000300), 0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, r7, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x10) sendmsg$NL80211_CMD_LEAVE_IBSS(r4, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="01002abd7000fedbdf252c00000008000300", @ANYRES32=r8, @ANYBLOB="8faf07860cf912f4dcd28c0d4a4787d3e76c81521b6ba79eccb894f480ac9b92a703e1f2f1e0502cdd1691d5f192d8f6b22b8f3fea740ce91ce2bb8d13d85dbccd5e149163909f2fe7275211495657a43ce8a014dc4e612049c8030c537ab2a9b9093e7797a2ddba04b0c1d847a1"], 0x1c}, 0x1, 0x0, 0x0, 0x24004044}, 0x8000) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="30000000030603000000000000000000010000030900020073797a3100000000050001000700"/48], 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x800) 4.320717026s ago: executing program 1 (id=507): r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000640), 0x800, 0x0) ioctl$CDROMREADAUDIO(r0, 0x5392, 0x0) 4.257445333s ago: executing program 1 (id=508): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) ioctl$VIDIOC_CROPCAP(r3, 0xc02c563a, &(0x7f0000000280)={0x8, {0x9, 0x3f9b, 0x7fffffff, 0xaa}, {0x2, 0x1ff, 0x4, 0x80000001}, {0x4, 0xe}}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0x18, &(0x7f0000000840)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000001c00000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r4, 0xfffff000, 0xe, 0x0, &(0x7f0000000300)="61df712bc884fed5722780b605a7", 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x70bd25, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x80, 0x3c, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x802000000000000, 0x9}, {}, 0x5}}, 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[], 0x188}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r5 = io_uring_setup(0x667, &(0x7f0000000000)={0x0, 0xa14a, 0x1000, 0x2, 0x235}) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_int(r6, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r6, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000300)=""/4, 0x4}], 0x1, &(0x7f0000000400)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x42}], 0x18}, 0x4000000) ioctl$DRM_IOCTL_AGP_ACQUIRE(r2, 0x6430) close_range(r5, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f00000000c0)=0xaba3) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40046201, &(0x7f0000000100)='\x00') 4.120906399s ago: executing program 1 (id=509): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) writev(0xffffffffffffffff, &(0x7f0000000840)=[{0x0}], 0x1) r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) bpf$TOKEN_CREATE(0x24, &(0x7f0000000440)={0x0, r0}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x3, &(0x7f0000000280)=ANY=[@ANYRES64, @ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x7, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000400)='.log\x00', 0x80, 0x2b) r2 = socket$inet(0x2, 0x3, 0xff) sendmsg$inet(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x4e1e, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000180)="96bc14", 0xfdef}], 0x2}, 0x24008004) ioctl$TCFLSH(r1, 0x540b, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000002c0)={0x9, @pix={0xb, 0x9, 0x32315258, 0x7, 0xe, 0x8, 0x5, 0xa, 0x0, 0x2, 0x0, 0x3}}) mount(&(0x7f0000000080)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='affs\x00', 0xa08410, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207"], 0x10}}, 0x0) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newrule={0x1c, 0x20, 0xf4db158ec847dc81, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1f}}, 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x44004) 3.89765785s ago: executing program 0 (id=510): syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="04140600c900000301"], 0x9) 3.770313253s ago: executing program 0 (id=511): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100ffffffff00004000010000000507000000000000080009000000001008000a000000000014001f0000000000000000000000000000000000060002000000000014002000000000000000000000000000000000010500210001000000"], 0x64}, 0x1, 0x620b}, 0x0) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1cd) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0xf, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000086fc000085000000860000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0x10, 0x38, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x40c01, 0x0) write(r4, &(0x7f0000000280)='dummy_udc.0', 0xb) write(r4, &(0x7f00000002c0)='\n', 0x1) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x8) bpf$BPF_GET_MAP_INFO(0x3, 0x0, 0x0) r5 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r5, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) set_mempolicy_home_node(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x4c850) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)={0x34, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0xaf}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0xc5}, 0x20000886) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) memfd_create(0x0, 0x5) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) 3.299319644s ago: executing program 2 (id=512): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) writev(0xffffffffffffffff, &(0x7f0000000840)=[{0x0}], 0x1) r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) bpf$TOKEN_CREATE(0x24, &(0x7f0000000440)={0x0, r0}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x3, &(0x7f0000000280)=ANY=[@ANYRES64, @ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x7, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000400)='.log\x00', 0x80, 0x2b) r2 = socket$inet(0x2, 0x3, 0xff) sendmsg$inet(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x4e1e, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000180)="96bc14", 0xfdef}], 0x2}, 0x24008004) ioctl$TCFLSH(r1, 0x540b, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000002c0)={0x9, @pix={0xb, 0x9, 0x32315258, 0x7, 0xe, 0x8, 0x5, 0xa, 0x0, 0x2, 0x0, 0x3}}) mount(&(0x7f0000000080)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='affs\x00', 0xa08410, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207"], 0x10}}, 0x0) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newrule={0x1c, 0x20, 0xf4db158ec847dc81, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1f}}, 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x44004) 3.298885028s ago: executing program 3 (id=513): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) writev(0xffffffffffffffff, &(0x7f0000000840)=[{0x0}], 0x1) r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) bpf$TOKEN_CREATE(0x24, &(0x7f0000000440)={0x0, r0}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x3, &(0x7f0000000280)=ANY=[@ANYRES64, @ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x7, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000400)='.log\x00', 0x80, 0x2b) r2 = socket$inet(0x2, 0x3, 0xff) sendmsg$inet(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x4e1e, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000180)="96bc14", 0xfdef}], 0x2}, 0x24008004) ioctl$TCFLSH(r1, 0x540b, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000002c0)={0x9, @pix={0xb, 0x9, 0x32315258, 0x7, 0xe, 0x8, 0x5, 0xa, 0x0, 0x2, 0x0, 0x3}}) mount(&(0x7f0000000080)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='affs\x00', 0xa08410, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207"], 0x10}}, 0x0) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newrule={0x1c, 0x20, 0xf4db158ec847dc81, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1f}}, 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x44004) 3.110032394s ago: executing program 1 (id=514): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={0x0, 0x0, 0x37}, 0x28) socket$rxrpc(0x21, 0x2, 0x2) r0 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101080, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$BSG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000040)=0x200) r2 = openat$qrtrtun(0xffffff9c, &(0x7f0000000080), 0x4001) read$qrtrtun(r2, &(0x7f00000000c0)=""/61, 0x3d) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000140)={'comedi_bond\x00', [0x3, 0xfffffffc, 0x5, 0x4, 0x2f, 0xfffffff7, 0x8001, 0xa22, 0xfffffff8, 0x2, 0xfffffffc, 0x8502, 0x5006, 0x1000007, 0x1, 0x10003, 0x801000, 0x7fffffff, 0x1ff, 0x3ff, 0x1001010, 0x1ff, 0x8, 0x3, 0x8001, 0x7, 0x3ff, 0x5, 0x400, 0x3, 0xfffd]}) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x24044080) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) 3.108408336s ago: executing program 1 (id=515): r0 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(0x0, 0x400002, 0x34d403) socket$nl_generic(0x10, 0x3, 0x10) r1 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r2, &(0x7f0000000000)={0xa0000001}) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x2c00c014) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) unshare(0x22020400) r7 = memfd_create(&(0x7f00000001c0)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\v\x14d\xa2\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xce\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\xd5)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb7\xe6_M\xbe\x19\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xac\rP\xf42\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xf4\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)', 0x0) execveat(r7, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r8 = dup(r6) write$UHID_INPUT(r8, &(0x7f0000001040)={0xfc, {"a2e3ad09ed1a09f91b37090987f70e06d038e7ff7fc6e5539b0d3d0e8b089b3f383b6c090890e0879b0a0ac6e70a9b3361959b509a240d5b0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d07640936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4040aea0, &(0x7f0000000340)=@x86={0x7, 0x3, 0x6, 0x0, 0x8, 0x7, 0x6, 0x0, 0x4, 0x9, 0x8, 0x9, 0x0, 0x7, 0x401, 0xa, 0x1, 0x40, 0x10, '\x00', 0x4d, 0x55}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003a00)=[{{&(0x7f0000000180)={0xa, 0x4e24, 0x0, @loopback, 0xa}, 0x1c, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="200000002900000032008000fe80643213f30000000000000e0000000000000000", @ANYRES32=0x0], 0x20}}], 0x1, 0x1000) epoll_pwait(r2, &(0x7f00000000c0)=[{}, {}], 0x2, 0xfe, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="440000001000010404000000fdffffff00000000", @ANYRES32=0x0, @ANYBLOB="38410000440b00002400128009000100626f6e640000000014000280050001000100000008000200", @ANYBLOB="f7"], 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r10 = epoll_create1(0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r9, 0x40045010, &(0x7f0000000080)) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r9, &(0x7f0000000000)={0x10000001}) 2.324885592s ago: executing program 3 (id=516): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) writev(0xffffffffffffffff, &(0x7f0000000840)=[{0x0}], 0x1) r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) bpf$TOKEN_CREATE(0x24, &(0x7f0000000440)={0x0, r0}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x3, &(0x7f0000000280)=ANY=[@ANYRES64, @ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x7, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000400)='.log\x00', 0x80, 0x2b) r2 = socket$inet(0x2, 0x3, 0xff) sendmsg$inet(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x4e1e, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000180)="96bc14", 0xfdef}], 0x2}, 0x24008004) ioctl$TCFLSH(r1, 0x540b, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000002c0)={0x9, @pix={0xb, 0x9, 0x32315258, 0x7, 0xe, 0x8, 0x5, 0xa, 0x0, 0x2, 0x0, 0x3}}) mount(&(0x7f0000000080)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='affs\x00', 0xa08410, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207"], 0x10}}, 0x0) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f0000000100)="b34715ecd0", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newrule={0x1c, 0x20, 0xf4db158ec847dc81, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1f}}, 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x44004) 2.319643959s ago: executing program 2 (id=517): openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0x88002, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount$tmpfs(0x0, 0x0, 0x0, 0x86022, &(0x7f0000000580)=ANY=[@ANYBLOB="61756469742c67e1506910fc83995f747970653d696d9e2343237846886d617369672c736d61636b667368"]) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) madvise(&(0x7f00002d9000/0x2000)=nil, 0x2000, 0x70) openat$null(0xffffff9c, 0x0, 0x101201, 0x0) fanotify_init(0x200, 0x0) shutdown(0xffffffffffffffff, 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x7, 0x30, 0x5, 0x5}, &(0x7f00000000c0)=0x18) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x4, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r1, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00') preadv(r2, &(0x7f0000000b80)=[{&(0x7f0000000580)=""/85, 0x55}], 0x1, 0x0, 0x0) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) fsetxattr$system_posix_acl(r3, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000010"], 0xfe44, 0x0) r4 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x4c, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r4, 0x80047c05, &(0x7f0000000080)) 1.853491876s ago: executing program 0 (id=518): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x20) mount$9p_virtio(&(0x7f00000001c0), &(0x7f00000002c0)='./file0\x00', &(0x7f00000004c0), 0x8017, &(0x7f0000000200)={'trans=virtio,', {[{@cache_mmap}]}}) syz_open_dev$usbmon(&(0x7f0000000300), 0x7, 0x82c0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0xab1, 0x10000, 0x0, 0x1000051}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080)) io_uring_enter(r3, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 1.330212272s ago: executing program 2 (id=519): r0 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(0x0, 0x400002, 0x34d403) socket$nl_generic(0x10, 0x3, 0x10) r1 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r2, &(0x7f0000000000)={0xa0000001}) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x2c00c014) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) unshare(0x22020400) r7 = memfd_create(&(0x7f00000001c0)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\v\x14d\xa2\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xce\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\xd5)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb7\xe6_M\xbe\x19\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xac\rP\xf42\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xf4\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)', 0x0) execveat(r7, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r8 = dup(r6) write$UHID_INPUT(r8, &(0x7f0000001040)={0xfc, {"a2e3ad09ed1a09f91b37090987f70e06d038e7ff7fc6e5539b0d3d0e8b089b3f383b6c090890e0879b0a0ac6e70a9b3361959b509a240d5b0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d07640936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4040aea0, &(0x7f0000000340)=@x86={0x7, 0x3, 0x6, 0x0, 0x8, 0x7, 0x6, 0x0, 0x4, 0x9, 0x8, 0x9, 0x0, 0x7, 0x401, 0xa, 0x1, 0x40, 0x10, '\x00', 0x4d, 0x55}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003a00)=[{{&(0x7f0000000180)={0xa, 0x4e24, 0x0, @loopback, 0xa}, 0x1c, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="200000002900000032008000fe80643213f30000000000000e0000000000000000", @ANYRES32=0x0], 0x20}}], 0x1, 0x1000) epoll_pwait(r2, &(0x7f00000000c0)=[{}, {}], 0x2, 0xfe, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="440000001000010404000000fdffffff00000000", @ANYRES32=0x0, @ANYBLOB="38410000440b00002400128009000100626f6e640000000014000280050001000100000008000200", @ANYBLOB="f7"], 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r10 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r9, &(0x7f0000000000)={0x10000001}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000fef000/0xe000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000fee000/0x4000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0}, 0x64) 1.274788302s ago: executing program 3 (id=520): socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="04140600c900000301"], 0x9) 1.210405s ago: executing program 3 (id=521): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r0, &(0x7f0000000000), 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280), 0x680, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x20000001) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) write(r2, &(0x7f0000000040)="05000000010000", 0x7) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x80, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000500)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r9 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r9, 0x8910, &(0x7f0000000000)={'wg0\x00', @ifru_map={0x7, 0xb, 0xffff, 0x84, 0x9, 0x5}}) ioctl$sock_netdev_private(r9, 0x8948, &(0x7f0000000000)) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r8, &(0x7f0000000580)={0x0, 0xae0c, 0x800, 0x3, 0x3e, 0x0, r4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x8000, 0x3, 0xaf}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x800, 0x0, 0x1f0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8000587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x0, 0x0, r11, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x2a0, 0x0, 0x0}}, 0x0) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) r13 = syz_open_dev$sg(&(0x7f0000001600), 0x6, 0x40043) write$binfmt_aout(r13, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000000000800080000014000091ff0f00004500f5ff06ff00010100fc5e15f4c3d3fbd80dad0000c8f2"], 0x125) bind$xdp(0xffffffffffffffff, &(0x7f0000000240)={0x2c, 0x1, r12}, 0x10) r14 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r14, 0xe) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x3f00000000000000) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000003c0)={'pcl816\x00', [0x140, 0x0, 0x3, 0x2, 0xff, 0x10000, 0x7ffd, 0x6, 0x3, 0xc72d, 0x4, 0x10, 0xf8, 0x8, 0x4ce, 0x9e9c, 0x104, 0x401, 0x6, 0x8, 0x2, 0x2, 0xa, 0x9, 0xff9, 0x200000, 0xaf, 0x0, 0x7, 0x0, 0x4, 0x80000000]}) 1.176417672s ago: executing program 1 (id=522): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$sg(&(0x7f00000001c0), 0x508d48d4, 0x40902) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x2000000000000013, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xb8, &(0x7f0000000140)=""/184, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) request_key(0x0, &(0x7f0000000380)={'syz', 0x3}, 0x0, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r4, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, &(0x7f00000007c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', r5}, 0x94) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r6 = socket$netlink(0x10, 0x3, 0x14) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x35, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x88}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x70bd28, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bond_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x24004091}, 0x808) socket$inet6(0xa, 0x3, 0x2c) syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r7) 596.908072ms ago: executing program 0 (id=523): r0 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(0x0, 0x400002, 0x34d403) socket$nl_generic(0x10, 0x3, 0x10) r1 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r2, &(0x7f0000000000)={0xa0000001}) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x2c00c014) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) unshare(0x22020400) r7 = memfd_create(&(0x7f00000001c0)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\v\x14d\xa2\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xce\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\xd5)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb7\xe6_M\xbe\x19\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xac\rP\xf42\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xf4\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)', 0x0) execveat(r7, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r8 = dup(r6) write$UHID_INPUT(r8, &(0x7f0000001040)={0xfc, {"a2e3ad09ed1a09f91b37090987f70e06d038e7ff7fc6e5539b0d3d0e8b089b3f383b6c090890e0879b0a0ac6e70a9b3361959b509a240d5b0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d07640936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4040aea0, &(0x7f0000000340)=@x86={0x7, 0x3, 0x6, 0x0, 0x8, 0x7, 0x6, 0x0, 0x4, 0x9, 0x8, 0x9, 0x0, 0x7, 0x401, 0xa, 0x1, 0x40, 0x10, '\x00', 0x4d, 0x55}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003a00)=[{{&(0x7f0000000180)={0xa, 0x4e24, 0x0, @loopback, 0xa}, 0x1c, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="200000002900000032008000fe80643213f30000000000000e0000000000000000", @ANYRES32=0x0], 0x20}}], 0x1, 0x1000) epoll_pwait(r2, &(0x7f00000000c0)=[{}, {}], 0x2, 0xfe, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="440000001000010404000000fdffffff00000000", @ANYRES32=0x0, @ANYBLOB="38410000440b00002400128009000100626f6e640000000014000280050001000100000008000200", @ANYBLOB="f7"], 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r10 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r9, &(0x7f0000000000)={0x10000001}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000fef000/0xe000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000fee000/0x4000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0}, 0x64) 594.21012ms ago: executing program 3 (id=524): ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000480)=0x1ff) r0 = socket$inet6(0xa, 0x3, 0x86) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x15) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, &(0x7f0000000000)={0x0, 0x1, 0x18, 0x52, 0x91, &(0x7f0000000080)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a73090000000000001b0f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000000000000472471ff55010010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd3f5380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc07caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97235936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5611a4e94266b295ea7a86812aff0f896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) write$binfmt_misc(r2, &(0x7f0000000000), 0x6) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) request_key(&(0x7f00000011c0)='big_key\x00', &(0x7f0000001200)={'syz', 0x1}, &(0x7f0000001240)='\x00', 0x0) add_key(0x0, &(0x7f00000005c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r3 = socket$kcm(0x29, 0x5, 0x0) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000140)=ANY=[@ANYRES16=r4, @ANYBLOB="010027bd7000ffdbdf252800000008000200", @ANYRES32=r5], 0x24}}, 0x4004850) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$hpet(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x1) splice(r3, 0x0, r6, 0x0, 0xf3e, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @loopback, 0xfffffffc}, 0x1c) 0s ago: executing program 2 (id=525): syz_ublk_setup_io_uring(0xd61, &(0x7f0000000280)={0x0, 0xdf75, 0x1000, 0x40002, 0x393}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r0, r1, r2, &(0x7f0000000400)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x2, 0x603, 0x0, 0x0, 0x1000, 0xb6a4, 0x0, 0x0, 0xa8}}}, &(0x7f0000000180)) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffffff, &(0x7f0000000380)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0xdf) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='44100,48000,88200,96000,176400,1+2000,352800,3', 0x2e) symlinkat(&(0x7f0000000580)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./myconfig/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000640)='usbip-', 0x6) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, &(0x7f00000000c0)={'pcmda12\x00', [0x100, 0x7, 0x2, 0x1000, 0xf, 0x5, 0x79, 0x3, 0x80008, 0x6, 0xffffffff, 0x1, 0x800008, 0x5, 0x100, 0x101, 0xfffffffb, 0x9, 0x7f, 0x7fffffff, 0x89, 0xca9f, 0xfffffffe, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0xa6b8, 0x0, 0xfffffff8]}) r8 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r8, 0x29, 0x3b, &(0x7f0000000140)=ANY=[], 0x8) setsockopt$inet6_udp_int(r8, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) connect$inet6(r8, &(0x7f0000000080)={0xa, 0x4e26, 0x8, @mcast2, 0xa}, 0x1c) setsockopt$SO_BINDTODEVICE_wg(r5, 0x1, 0x19, &(0x7f0000000000)='wg1\x00', 0x4) sendmmsg$inet6(r8, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) pselect6(0x40, &(0x7f0000000000)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="fffffffffffffdf9a684a51b86dd600c7a00d8c225ccd109a27f3291082000183afffe800000000000e700000000000000bbfe8000000000000000000000000000aa8800907800000000fe800000"], 0x0) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000080)={0x1, @pix_mp={0x400000, 0x5, 0x0, 0x32525942, 0xc, [{0x6, 0xfffffffe}, {}, {0x2, 0x8}, {0x1, 0xfffffffc}, {0x80}, {}, {0xffffc33a}, {0x200}], 0x3, 0xfe, 0x0, 0x0, 0x5}}) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000000)={{{@in=@dev, @in6=@mcast1}}, {{@in6=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000280)=0xe4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) kernel console output (not intermixed with test programs): 93.426776][ T42] kauditd_printk_skb: 6 callbacks suppressed [ 93.426791][ T42] audit: type=1326 audit(1785617016.314:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6654 comm="syz.0.150" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7fc00000 [ 93.437392][ T5918] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.440909][ T42] audit: type=1326 audit(1785617016.334:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6654 comm="syz.0.150" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7fc00000 [ 93.441012][ T5918] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.633257][ T6668] FAULT_INJECTION: forcing a failure. [ 93.633257][ T6668] name failslab, interval 1, probability 0, space 0, times 1 [ 93.637583][ T6668] CPU: 2 UID: 0 PID: 6668 Comm: syz.3.153 Tainted: G L syzkaller #0 PREEMPT(full) [ 93.637601][ T6668] Tainted: [L]=SOFTLOCKUP [ 93.637605][ T6668] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.637612][ T6668] Call Trace: [ 93.637616][ T6668] [ 93.637620][ T6668] dump_stack_lvl+0x100/0x190 [ 93.637638][ T6668] should_fail_ex.cold+0x5/0xa [ 93.637677][ T6668] should_failslab+0xc2/0x120 [ 93.637694][ T6668] __kmalloc_cache_noprof+0x91/0x6c0 [ 93.637705][ T6668] ? find_held_lock+0x2b/0x80 [ 93.637720][ T6668] ? alloc_fs_context+0x57/0xf40 [ 93.637736][ T6668] alloc_fs_context+0x57/0xf40 [ 93.637750][ T6668] ? __get_fs_type+0xe3/0x200 [ 93.637765][ T6668] path_mount+0xdbd/0x23d0 [ 93.637781][ T6668] ? __pfx_path_mount+0x10/0x10 [ 93.637793][ T6668] ? lockdep_hardirqs_on+0x78/0x100 [ 93.637809][ T6668] ? putname+0xb1/0x110 [ 93.637822][ T6668] ? kmem_cache_free+0x127/0x6b0 [ 93.637837][ T6668] ? __ia32_sys_mount+0x292/0x310 [ 93.637850][ T6668] __ia32_sys_mount+0x292/0x310 [ 93.637864][ T6668] ? __pfx___ia32_sys_mount+0x10/0x10 [ 93.637877][ T6668] ? ksys_write+0x1ac/0x250 [ 93.637887][ T6668] ? __pfx_ksys_write+0x10/0x10 [ 93.637900][ T6668] __do_fast_syscall_32+0xe7/0x970 [ 93.637915][ T6668] ? lockdep_hardirqs_on+0x78/0x100 [ 93.637930][ T6668] do_fast_syscall_32+0x32/0x70 [ 93.637945][ T6668] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 93.637960][ T6668] RIP: 0023:0xf707efec [ 93.637973][ T6668] Code: Unable to access opcode bytes at 0xf707efc2. [ 93.637978][ T6668] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 93.637993][ T6668] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000000 [ 93.638000][ T6668] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 93.638006][ T6668] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 93.638012][ T6668] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 93.638018][ T6668] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 93.638032][ T6668] [ 94.088047][ T42] audit: type=1326 audit(1785617016.974:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6654 comm="syz.0.150" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf70aefec code=0x7fc00000 [ 94.100346][ T42] audit: type=1326 audit(1785617016.974:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6654 comm="syz.0.150" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf70af017 code=0x7fc00000 [ 94.323679][ T6686] binder: 6685:6686 ioctl 4008f50a 0 returned -22 [ 94.357633][ T5765] Bluetooth: hci3: command 0x0c1a tx timeout [ 94.363352][ T6686] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 95.023428][ T24] usb 6-1: unable to get BOS descriptor or descriptor too short [ 95.028554][ T24] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 95.037404][ T24] usb 6-1: can't read configurations, error -71 [ 95.282467][ T6702] netlink: 60 bytes leftover after parsing attributes in process `syz.0.164'. [ 95.297342][ T6702] netlink: 8 bytes leftover after parsing attributes in process `syz.0.164'. [ 95.768623][ T6716] netlink: 12 bytes leftover after parsing attributes in process `syz.3.168'. [ 96.576028][ T6730] netlink: 68 bytes leftover after parsing attributes in process `syz.1.172'. [ 96.608265][ T6725] wg2 speed is unknown, defaulting to 1000 [ 97.110447][ T6739] Bluetooth: hci0: Opcode 0x0c1a failed: -112 [ 97.120378][ T6741] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 97.122928][ T6741] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 97.135497][ T6741] vhci_hcd vhci_hcd.0: Device attached [ 97.477542][ T5829] usb 44-1: SetAddress Request (2) to port 0 [ 97.480215][ T5757] Bluetooth: hci3: command 0x0c1a tx timeout [ 97.493117][ T5829] usb 44-1: new SuperSpeed USB device number 2 using vhci_hcd [ 97.684180][ T6745] vhci_hcd: connection reset by peer [ 97.687634][ T12] vhci_hcd vhci_hcd.3: stop threads [ 97.690028][ T12] vhci_hcd vhci_hcd.3: release socket [ 97.692451][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 97.866162][ T6739] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 97.871380][ T6739] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 97.891666][ T6739] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 98.049237][ T6765] netlink: 'syz.0.181': attribute type 1 has an invalid length. [ 98.078170][ T6765] gretap1: entered allmulticast mode [ 98.237468][ T9] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 98.372851][ T6774] netlink: 40 bytes leftover after parsing attributes in process `syz.3.183'. [ 98.388001][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 98.394908][ T9] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 98.399110][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.402625][ T9] usb 6-1: Product: syz [ 98.404415][ T9] usb 6-1: Manufacturer: syz [ 98.406450][ T9] usb 6-1: SerialNumber: syz [ 98.415041][ T9] usb 6-1: config 0 descriptor?? [ 98.623356][ T6761] netlink: 4 bytes leftover after parsing attributes in process `syz.1.179'. [ 98.897950][ T9] dvb_usb_dtv5100 6-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -71 [ 98.911875][ T9] usb 6-1: USB disconnect, device number 5 [ 99.171606][ T5765] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 99.174893][ T5757] Bluetooth: hci1: command 0x0c1a tx timeout [ 99.177858][ T64] Bluetooth: hci0: command 0x0c1a tx timeout [ 99.287802][ T6785] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 99.878620][ T5765] Bluetooth: hci2: command 0x0c1a tx timeout [ 99.912745][ T6796] kvm: apic: phys broadcast and lowest prio [ 99.958500][ T5765] Bluetooth: hci3: command 0x0c1a tx timeout [ 99.989154][ T6805] netlink: 4 bytes leftover after parsing attributes in process `syz.0.190'. [ 99.994086][ T6805] netlink: 4 bytes leftover after parsing attributes in process `syz.0.190'. [ 101.204729][ T6844] netlink: 4 bytes leftover after parsing attributes in process `syz.2.199'. [ 101.210462][ T6844] netlink: 4 bytes leftover after parsing attributes in process `syz.2.199'. [ 101.231935][ T6832] sock: sock_set_timeout: `syz.3.197' (pid 6832) tries to set negative timeout [ 101.242637][ T5765] Bluetooth: hci0: command 0x0c1a tx timeout [ 101.437525][ T41] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 101.590708][ T41] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 101.613840][ T41] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 101.618441][ T41] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 101.621316][ T41] usb 5-1: Product: syz [ 101.622741][ T41] usb 5-1: Manufacturer: syz [ 101.624282][ T41] usb 5-1: SerialNumber: syz [ 101.904383][ T41] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 4 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 102.599814][ T5829] usb 44-1: device descriptor read/8, error -110 [ 102.807268][ T6861] openvswitch: netlink: Flow actions attr not present in new flow. [ 102.908424][ T6868] 9pnet_virtio: no channels available for device syz [ 102.990512][ T5829] usb usb44-port1: attempt power cycle [ 103.317402][ T64] Bluetooth: hci0: command 0x0c1a tx timeout [ 103.435174][ T6874] netlink: 4 bytes leftover after parsing attributes in process `syz.1.209'. [ 103.443592][ T6874] netlink: 4 bytes leftover after parsing attributes in process `syz.1.209'. [ 103.515809][ T6876] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.548882][ T5829] usb usb44-port1: unable to enumerate USB device [ 103.595801][ T6876] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.664521][ T6876] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.712931][ T6878] sctp: [Deprecated]: syz.2.211 (pid 6878) Use of struct sctp_assoc_value in delayed_ack socket option. [ 103.712931][ T6878] Use struct sctp_sack_info instead [ 103.722019][ T6878] sctp: [Deprecated]: syz.2.211 (pid 6878) Use of struct sctp_assoc_value in delayed_ack socket option. [ 103.722019][ T6878] Use struct sctp_sack_info instead [ 103.743729][ T6876] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.859436][ T5918] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.865796][ T6882] netlink: 40 bytes leftover after parsing attributes in process `syz.3.213'. [ 103.887415][ T5918] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.897397][ T5918] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.900330][ T5918] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.538000][ T34] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 104.586355][ T6905] Illegal XDP return value 4294967282 on prog (id 52) dev syz_tun, expect packet loss! [ 104.698288][ T34] usb 6-1: Using ep0 maxpacket: 32 [ 104.705422][ T34] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 104.717221][ T34] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 104.721390][ T34] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 104.724866][ T34] usb 6-1: Product: syz [ 104.726667][ T34] usb 6-1: Manufacturer: syz [ 104.729131][ T34] usb 6-1: SerialNumber: syz [ 104.732965][ T34] usb 6-1: config 0 descriptor?? [ 104.735319][ T6890] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 104.739657][ T34] hub 6-1:0.0: bad descriptor, ignoring hub [ 104.741601][ T34] hub 6-1:0.0: probe with driver hub failed with error -5 [ 105.205670][ T6918] netlink: 40 bytes leftover after parsing attributes in process `syz.3.223'. [ 105.293087][ T6922] netlink: 40 bytes leftover after parsing attributes in process `syz.2.225'. [ 105.632144][ T50] usb 6-1: USB disconnect, device number 6 [ 105.718368][ T6936] netlink: 8 bytes leftover after parsing attributes in process `syz.2.226'. [ 105.866035][ T6948] pim6reg: entered allmulticast mode [ 105.886322][ T6943] pim6reg: left allmulticast mode [ 106.057466][ T9] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 106.217401][ T9] usb 8-1: Using ep0 maxpacket: 8 [ 106.225092][ T9] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 106.229195][ T9] usb 8-1: config 0 has no interface number 0 [ 106.232148][ T9] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 106.236795][ T9] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 106.242841][ T9] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 106.247839][ T9] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 106.253611][ T9] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 106.259977][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.272915][ T9] usb 8-1: config 0 descriptor?? [ 106.311881][ T9] ldusb 8-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 106.861236][ T6947] netlink: 'syz.3.229': attribute type 1 has an invalid length. [ 106.869580][ T5837] usb 8-1: USB disconnect, device number 2 [ 106.887229][ T5837] ldusb 8-1:0.55: LD USB Device #1 now disconnected [ 106.906769][ T6958] wg2 speed is unknown, defaulting to 1000 [ 107.066288][ T6967] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 107.141576][ T6969] netlink: 40 bytes leftover after parsing attributes in process `syz.1.234'. [ 107.292816][ T6971] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.427342][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 107.539720][ T6971] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.720331][ T6971] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.788679][ T6971] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.823879][ T6978] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.977815][ T6978] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.047171][ T6978] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.154746][ T6978] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.175718][ T5918] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.251118][ T5915] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.267451][ T5915] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.281731][ T5915] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.348142][ T5915] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.379795][ T5915] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.385226][ T5915] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.391819][ T5915] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.401087][ T6984] netlink: 8 bytes leftover after parsing attributes in process `syz.3.238'. [ 108.777470][ T5845] usb 5-1: USB disconnect, device number 4 [ 108.792974][ T5845] usblp0: removed [ 109.273218][ T6998] pim6reg: entered allmulticast mode [ 109.284928][ T6990] pim6reg: left allmulticast mode [ 109.716796][ T7004] netlink: 4 bytes leftover after parsing attributes in process `syz.3.243'. [ 109.724501][ T7004] netlink: 4 bytes leftover after parsing attributes in process `syz.3.243'. [ 109.938845][ T7017] netlink: 'syz.2.244': attribute type 1 has an invalid length. [ 109.944541][ T7017] netlink: 4 bytes leftover after parsing attributes in process `syz.2.244'. [ 109.949470][ T7010] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 109.952547][ T7010] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 109.957215][ T7010] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 110.003208][ T7021] FAULT_INJECTION: forcing a failure. [ 110.003208][ T7021] name failslab, interval 1, probability 0, space 0, times 0 [ 110.008844][ T7021] CPU: 1 UID: 0 PID: 7021 Comm: syz.3.248 Tainted: G L syzkaller #0 PREEMPT(full) [ 110.008871][ T7021] Tainted: [L]=SOFTLOCKUP [ 110.008877][ T7021] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 110.008886][ T7021] Call Trace: [ 110.008892][ T7021] [ 110.008898][ T7021] dump_stack_lvl+0x100/0x190 [ 110.008926][ T7021] should_fail_ex.cold+0x5/0xa [ 110.008947][ T7021] should_failslab+0xc2/0x120 [ 110.008971][ T7021] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 110.008995][ T7021] ? __d_alloc+0x35/0xa50 [ 110.009019][ T7021] __d_alloc+0x35/0xa50 [ 110.009041][ T7021] d_alloc+0x4a/0x1e0 [ 110.009062][ T7021] lookup_one_qstr_excl+0x171/0x250 [ 110.009087][ T7021] start_dirop+0x59/0xb0 [ 110.009114][ T7021] simple_start_creating+0xf9/0x110 [ 110.009132][ T7021] ? __pfx_simple_start_creating+0x10/0x10 [ 110.009149][ T7021] ? mntput+0x70/0xa0 [ 110.009173][ T7021] ? simple_pin_fs+0xa3/0x190 [ 110.009201][ T7021] debugfs_start_creating.part.0+0x82/0x170 [ 110.009229][ T7021] __debugfs_create_file+0xb3/0x4f0 [ 110.009258][ T7021] debugfs_create_file_full+0x41/0x60 [ 110.009286][ T7021] ref_tracker_dir_debugfs+0x19e/0x2e0 [ 110.009305][ T7021] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 110.009345][ T7021] ? lockdep_init_map_type+0x5c/0x250 [ 110.009365][ T7021] ? __pfx_geneve_setup+0x10/0x10 [ 110.009384][ T7021] alloc_netdev_mqs+0x314/0x15c0 [ 110.009417][ T7021] rtnl_create_link+0xc13/0xf80 [ 110.009453][ T7021] rtnl_newlink+0x13bd/0x2380 [ 110.009488][ T7021] ? __pfx_rtnl_newlink+0x10/0x10 [ 110.009513][ T7021] ? rcu_is_watching+0x12/0xc0 [ 110.009534][ T7021] ? kasan_quarantine_put+0x104/0x240 [ 110.009558][ T7021] ? kfree_skbmem+0x19a/0x210 [ 110.009575][ T7021] ? kmem_cache_free+0x127/0x6b0 [ 110.009605][ T7021] ? find_held_lock+0x2b/0x80 [ 110.009635][ T7021] ? find_held_lock+0x2b/0x80 [ 110.009656][ T7021] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 110.009680][ T7021] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 110.009707][ T7021] ? __pfx_rtnl_newlink+0x10/0x10 [ 110.009733][ T7021] rtnetlink_rcv_msg+0x95e/0xe90 [ 110.009761][ T7021] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 110.009794][ T7021] ? ref_tracker_free+0x37e/0x6c0 [ 110.009814][ T7021] netlink_rcv_skb+0x159/0x420 [ 110.009835][ T7021] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 110.009861][ T7021] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 110.009889][ T7021] ? netlink_deliver_tap+0x1ae/0xcc0 [ 110.009911][ T7021] netlink_unicast+0x585/0x850 [ 110.009934][ T7021] ? __pfx_netlink_unicast+0x10/0x10 [ 110.009962][ T7021] netlink_sendmsg+0x8b0/0xda0 [ 110.009987][ T7021] ? __pfx_netlink_sendmsg+0x10/0x10 [ 110.010011][ T7021] ? apparmor_socket_sendmsg+0x15b/0x270 [ 110.010036][ T7021] ____sys_sendmsg+0xa4d/0xbe0 [ 110.010054][ T7021] ? __pfx_netlink_sendmsg+0x10/0x10 [ 110.010076][ T7021] ? __pfx_____sys_sendmsg+0x10/0x10 [ 110.010108][ T7021] ___sys_sendmsg+0x190/0x1e0 [ 110.010130][ T7021] ? __pfx____sys_sendmsg+0x10/0x10 [ 110.010163][ T7021] ? find_held_lock+0x2b/0x80 [ 110.010202][ T7021] __sys_sendmsg+0x160/0x210 [ 110.010228][ T7021] ? __pfx___sys_sendmsg+0x10/0x10 [ 110.010260][ T7021] ? __pfx_ksys_write+0x10/0x10 [ 110.010284][ T7021] __do_fast_syscall_32+0xe7/0x970 [ 110.010308][ T7021] ? lockdep_hardirqs_on+0x78/0x100 [ 110.010333][ T7021] do_fast_syscall_32+0x32/0x70 [ 110.010358][ T7021] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 110.010380][ T7021] RIP: 0023:0xf707efec [ 110.010402][ T7021] Code: Unable to access opcode bytes at 0xf707efc2. [ 110.010409][ T7021] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 110.010426][ T7021] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 110.010441][ T7021] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 110.010451][ T7021] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 110.010461][ T7021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 110.010471][ T7021] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 110.010495][ T7021] [ 110.252970][ T7023] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.494915][ T7023] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.872757][ T7032] netlink: 16 bytes leftover after parsing attributes in process `syz.3.251'. [ 110.906719][ T7032] syz.3.251: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 110.915375][ T7032] CPU: 1 UID: 0 PID: 7032 Comm: syz.3.251 Tainted: G L syzkaller #0 PREEMPT(full) [ 110.915405][ T7032] Tainted: [L]=SOFTLOCKUP [ 110.915411][ T7032] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 110.915423][ T7032] Call Trace: [ 110.915431][ T7032] [ 110.915438][ T7032] dump_stack_lvl+0x100/0x190 [ 110.915466][ T7032] warn_alloc.cold+0x94/0xa8 [ 110.915487][ T7032] ? __pfx_warn_alloc+0x10/0x10 [ 110.915512][ T7032] ? kasan_save_stack+0x3f/0x50 [ 110.915537][ T7032] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 110.915556][ T7032] ? xskq_create+0x52/0x1d0 [ 110.915576][ T7032] ? xsk_setsockopt+0x743/0xab0 [ 110.915595][ T7032] ? do_sock_setsockopt+0xf3/0x1d0 [ 110.915623][ T7032] ? __sys_setsockopt+0x119/0x190 [ 110.915645][ T7032] ? __ia32_sys_setsockopt+0xbc/0x160 [ 110.915690][ T7032] ? __do_fast_syscall_32+0xe7/0x970 [ 110.915718][ T7032] ? do_fast_syscall_32+0x32/0x70 [ 110.915743][ T7032] ? xskq_create+0xfb/0x1d0 [ 110.915763][ T7032] __vmalloc_node_range_noprof+0x136c/0x1630 [ 110.915799][ T7032] ? xskq_create+0xfb/0x1d0 [ 110.915823][ T7032] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 110.915852][ T7032] ? kasan_save_track+0x14/0x30 [ 110.915876][ T7032] ? __kasan_kmalloc+0xaa/0xb0 [ 110.915890][ T7032] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 110.915901][ T7032] ? xskq_create+0xfb/0x1d0 [ 110.915913][ T7032] vmalloc_user_noprof+0x9e/0xe0 [ 110.915930][ T7032] ? xskq_create+0xfb/0x1d0 [ 110.915943][ T7032] xskq_create+0xfb/0x1d0 [ 110.915957][ T7032] xsk_setsockopt+0x743/0xab0 [ 110.915969][ T7032] ? __pfx_aa_sk_perm+0x10/0x10 [ 110.915985][ T7032] ? __pfx_xsk_setsockopt+0x10/0x10 [ 110.915997][ T7032] ? find_held_lock+0x2b/0x80 [ 110.916013][ T7032] ? aa_sock_opt_perm+0xfe/0x1b0 [ 110.916025][ T7032] ? __pfx_xsk_setsockopt+0x10/0x10 [ 110.916037][ T7032] do_sock_setsockopt+0xf3/0x1d0 [ 110.916057][ T7032] __sys_setsockopt+0x119/0x190 [ 110.916089][ T7032] __ia32_sys_setsockopt+0xbc/0x160 [ 110.916105][ T7032] ? __do_fast_syscall_32+0x98/0x970 [ 110.916120][ T7032] ? lockdep_hardirqs_on+0x78/0x100 [ 110.916135][ T7032] __do_fast_syscall_32+0xe7/0x970 [ 110.916152][ T7032] do_fast_syscall_32+0x32/0x70 [ 110.916168][ T7032] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 110.916183][ T7032] RIP: 0023:0xf707efec [ 110.916199][ T7032] Code: Unable to access opcode bytes at 0xf707efc2. [ 110.916204][ T7032] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 110.916215][ T7032] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000011b [ 110.916221][ T7032] RDX: 0000000000000006 RSI: 0000000080000000 RDI: 0000000000000004 [ 110.916227][ T7032] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 110.916233][ T7032] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 110.916240][ T7032] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 110.916255][ T7032] [ 110.916363][ T7032] Mem-Info: [ 110.952576][ T7029] pim6reg: entered allmulticast mode [ 111.075735][ T7032] active_anon:8894 inactive_anon:17980 isolated_anon:0 [ 111.075735][ T7032] active_file:9530 inactive_file:24126 isolated_file:0 [ 111.075735][ T7032] unevictable:3816 dirty:701 writeback:0 [ 111.075735][ T7032] slab_reclaimable:7904 slab_unreclaimable:55650 [ 111.075735][ T7032] mapped:25389 shmem:22971 pagetables:1166 [ 111.075735][ T7032] sec_pagetables:297 bounce:0 [ 111.075735][ T7032] kernel_misc_reclaimable:0 [ 111.075735][ T7032] free:29651 free_pcp:11029 free_cma:0 [ 111.184327][ T7028] pim6reg: left allmulticast mode [ 111.219449][ T7032] Node 0 active_anon:1368kB inactive_anon:8836kB active_file:12kB inactive_file:2192kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:476kB dirty:328kB writeback:0kB shmem:13640kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8640kB pagetables:1416kB sec_pagetables:1148kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 111.285320][ T7032] Node 1 active_anon:40308kB inactive_anon:63084kB active_file:38108kB inactive_file:94312kB unevictable:3628kB isolated(anon):0kB isolated(file):0kB mapped:100680kB dirty:2476kB writeback:0kB shmem:78244kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5024kB pagetables:3248kB sec_pagetables:40kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 111.307800][ T7032] Node 0 DMA free:1820kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:128kB inactive_anon:312kB active_file:4kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:412kB local_pcp:124kB free_cma:0kB [ 111.308133][ T7023] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.323153][ T7032] lowmem_reserve[]: 0 280 280 280 280 [ 111.334925][ T7032] Node 0 DMA32 free:12756kB boost:0kB min:12772kB low:15964kB high:19156kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1240kB inactive_anon:8524kB active_file:8kB inactive_file:2192kB unevictable:3536kB writepending:328kB zspages:0kB present:1032196kB managed:286888kB mlocked:0kB bounce:0kB free_pcp:8188kB local_pcp:1600kB free_cma:0kB [ 111.355381][ T7032] lowmem_reserve[]: 0 0 0 0 0 [ 111.358325][ T7032] Node 1 DMA32 free:104028kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:34108kB inactive_anon:63084kB active_file:38108kB inactive_file:94312kB unevictable:3628kB writepending:2476kB zspages:2176kB present:1048432kB managed:948212kB mlocked:92kB bounce:0kB free_pcp:44604kB local_pcp:11764kB free_cma:0kB [ 111.370143][ T7032] lowmem_reserve[]: 0 0 0 0 0 [ 111.371771][ T7032] Node 0 DMA: 17*4kB (UM) 11*8kB (UM) 8*16kB (UM) 16*32kB (UM) 2*64kB (U) 1*128kB (M) 1*256kB (M) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 1820kB [ 111.376778][ T7032] Node 0 DMA32: 1*4kB (M) 118*8kB (UM) 28*16kB (UE) 145*32kB (UME) 33*64kB (UME) 12*128kB (UE) 8*256kB (UME) 2*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 12756kB [ 111.382986][ T7032] Node 1 DMA32: 198*4kB (UME) 15*8kB (UME) 8*16kB (UM) 162*32kB (U) 83*64kB (UE) 64*128kB (UME) 48*256kB (UME) 32*512kB (UME) 20*1024kB (UM) 11*2048kB (UM) 3*4096kB (M) = 103696kB [ 111.390602][ T7032] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 111.393908][ T7032] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 111.401088][ T7032] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 111.404161][ T7032] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 111.407236][ T7032] 57514 total pagecache pages [ 111.409125][ T7032] 891 pages in swap cache [ 111.410715][ T7032] Free swap = 117572kB [ 111.412327][ T7032] Total swap = 124996kB [ 111.415173][ T7032] 524155 pages RAM [ 111.416538][ T7032] 0 pages HighMem/MovableOnly [ 111.418580][ T7032] 211540 pages reserved [ 111.420210][ T7032] 0 pages cma reserved [ 111.555193][ T7023] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.957404][ T64] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 111.957420][ T5765] Bluetooth: hci3: command 0x0c1a tx timeout [ 111.957728][ T5751] Bluetooth: hci2: command 0x0c1a tx timeout [ 111.960214][ T64] Bluetooth: hci0: command 0x0c1a tx timeout [ 111.964923][ T5757] Bluetooth: hci1: command 0x0c1a tx timeout [ 112.167480][ T12] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.178122][ T12] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.180894][ T12] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.183783][ T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.022694][ T7059] netlink: 4 bytes leftover after parsing attributes in process `syz.2.260'. [ 113.029320][ T7059] netlink: 4 bytes leftover after parsing attributes in process `syz.2.260'. [ 113.307845][ T7063] se_dev->se_dev_ptr already set for storage object [ 113.412331][ T7066] program syz.2.262 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 113.578284][ T7055] netlink: 'syz.0.258': attribute type 1 has an invalid length. [ 113.580753][ T7055] netlink: 228 bytes leftover after parsing attributes in process `syz.0.258'. [ 113.863934][ T7080] capability: warning: `syz.2.263' uses deprecated v2 capabilities in a way that may be insecure [ 113.875922][ T7080] e1000e 0000:00:02.0 eth1: removed PHC [ 114.039001][ T7080] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 114.963715][ T7106] pimreg3: entered allmulticast mode [ 115.011202][ T7111] netlink: 'syz.0.269': attribute type 1 has an invalid length. [ 115.016151][ T7111] ip6t_srh: unknown srh invflags B520 [ 115.088771][ T7116] netlink: 'syz.1.268': attribute type 1 has an invalid length. [ 115.092887][ T7117] netlink: 4 bytes leftover after parsing attributes in process `syz.2.270'. [ 115.095933][ T7116] netlink: 4 bytes leftover after parsing attributes in process `syz.1.268'. [ 115.102064][ T7117] netlink: 4 bytes leftover after parsing attributes in process `syz.2.270'. [ 115.468030][ T41] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 115.506974][ T7146] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.603816][ T7146] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.644392][ T41] usb 7-1: Using ep0 maxpacket: 32 [ 115.694224][ T41] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 115.718775][ T41] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 115.723316][ T41] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 115.727370][ T7146] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.731424][ T41] usb 7-1: Product: syz [ 115.733173][ T41] usb 7-1: Manufacturer: syz [ 115.736497][ T41] usb 7-1: SerialNumber: syz [ 115.857394][ T41] usb 7-1: config 0 descriptor?? [ 115.878405][ T7126] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 115.902943][ T41] hub 7-1:0.0: bad descriptor, ignoring hub [ 115.906276][ T41] hub 7-1:0.0: probe with driver hub failed with error -5 [ 116.343697][ T7146] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.717661][ T5830] usb 7-1: USB disconnect, device number 2 [ 116.820679][ T7182] FAULT_INJECTION: forcing a failure. [ 116.820679][ T7182] name failslab, interval 1, probability 0, space 0, times 0 [ 116.826238][ T7182] CPU: 1 UID: 0 PID: 7182 Comm: syz.2.282 Tainted: G L syzkaller #0 PREEMPT(full) [ 116.826265][ T7182] Tainted: [L]=SOFTLOCKUP [ 116.826271][ T7182] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.826281][ T7182] Call Trace: [ 116.826288][ T7182] [ 116.826294][ T7182] dump_stack_lvl+0x100/0x190 [ 116.826321][ T7182] should_fail_ex.cold+0x5/0xa [ 116.826343][ T7182] should_failslab+0xc2/0x120 [ 116.826374][ T7182] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 116.826398][ T7182] ? __alloc_skb+0x5b7/0x710 [ 116.826421][ T7182] ? __alloc_skb+0x140/0x710 [ 116.826448][ T7182] __alloc_skb+0x140/0x710 [ 116.826469][ T7182] ? __alloc_skb+0x5b7/0x710 [ 116.826489][ T7182] ? __pfx___alloc_skb+0x10/0x10 [ 116.826519][ T7182] netlink_alloc_large_skb+0x69/0x150 [ 116.826541][ T7182] netlink_sendmsg+0x680/0xda0 [ 116.826565][ T7182] ? __pfx_netlink_sendmsg+0x10/0x10 [ 116.826587][ T7182] ? apparmor_socket_sendmsg+0x15b/0x270 [ 116.826611][ T7182] ____sys_sendmsg+0xa4d/0xbe0 [ 116.826627][ T7182] ? __pfx_netlink_sendmsg+0x10/0x10 [ 116.826647][ T7182] ? __pfx_____sys_sendmsg+0x10/0x10 [ 116.826677][ T7182] ___sys_sendmsg+0x190/0x1e0 [ 116.826697][ T7182] ? __pfx____sys_sendmsg+0x10/0x10 [ 116.826726][ T7182] ? find_held_lock+0x2b/0x80 [ 116.826765][ T7182] __sys_sendmsg+0x160/0x210 [ 116.826791][ T7182] ? __pfx___sys_sendmsg+0x10/0x10 [ 116.826823][ T7182] ? __pfx_ksys_write+0x10/0x10 [ 116.826846][ T7182] __do_fast_syscall_32+0xe7/0x970 [ 116.826871][ T7182] ? lockdep_hardirqs_on+0x78/0x100 [ 116.826895][ T7182] do_fast_syscall_32+0x32/0x70 [ 116.826919][ T7182] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 116.826942][ T7182] RIP: 0023:0xf702efec [ 116.826965][ T7182] Code: Unable to access opcode bytes at 0xf702efc2. [ 116.826973][ T7182] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 116.826991][ T7182] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800001c0 [ 116.827002][ T7182] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 116.827012][ T7182] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 116.827021][ T7182] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 116.827032][ T7182] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 116.827055][ T7182] [ 117.121395][ T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.176419][ T7188] netlink: 8 bytes leftover after parsing attributes in process `syz.2.283'. [ 117.335099][ T7179] syzkaller0: entered promiscuous mode [ 117.336997][ T7179] syzkaller0: entered allmulticast mode [ 118.260444][ T7199] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 118.267232][ T7199] cramfs: wrong magic [ 119.109573][ T7195] pim6reg: entered allmulticast mode [ 119.111452][ T7194] pim6reg: left allmulticast mode [ 119.147733][ T5918] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.151782][ T5918] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.165890][ T7201] se_dev->se_dev_ptr already set for storage object [ 119.207452][ T5918] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.320984][ T7209] netlink: 4 bytes leftover after parsing attributes in process `syz.3.292'. [ 119.325145][ T7209] netlink: 4 bytes leftover after parsing attributes in process `syz.3.292'. [ 119.534649][ T41] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 119.561120][ T5837] IPVS: starting estimator thread 0... [ 119.625517][ T7220] netlink: 'syz.2.294': attribute type 1 has an invalid length. [ 119.628166][ T7220] netlink: 4 bytes leftover after parsing attributes in process `syz.2.294'. [ 119.667492][ T7218] IPVS: using max 43 ests per chain, 103200 per kthread [ 119.707581][ T41] usb 6-1: Using ep0 maxpacket: 32 [ 119.720826][ T41] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 119.737593][ T41] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 119.742201][ T41] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 119.745856][ T41] usb 6-1: Product: syz [ 119.748170][ T41] usb 6-1: Manufacturer: syz [ 119.750444][ T41] usb 6-1: SerialNumber: syz [ 119.768265][ T41] usb 6-1: config 0 descriptor?? [ 119.774001][ T7203] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 119.777147][ T7222] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 119.784301][ T7222] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 119.791880][ T41] hub 6-1:0.0: bad descriptor, ignoring hub [ 119.801695][ T41] hub 6-1:0.0: probe with driver hub failed with error -5 [ 119.805368][ T7222] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 119.819773][ T7222] comedi comedi2: comedi_config --init_data is deprecated [ 120.143266][ T7227] FAULT_FLAG_ALLOW_RETRY missing 801 [ 120.145827][ T7227] CPU: 0 UID: 0 PID: 7227 Comm: syz.0.296 Tainted: G L syzkaller #0 PREEMPT(full) [ 120.145852][ T7227] Tainted: [L]=SOFTLOCKUP [ 120.145858][ T7227] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 120.145868][ T7227] Call Trace: [ 120.145874][ T7227] [ 120.145881][ T7227] dump_stack_lvl+0x100/0x190 [ 120.145910][ T7227] handle_userfault.cold+0x54/0x65 [ 120.145937][ T7227] ? do_raw_spin_unlock+0x145/0x1e0 [ 120.145960][ T7227] ? _raw_spin_unlock+0x28/0x50 [ 120.145980][ T7227] ? __free_frozen_pages+0x751/0x1090 [ 120.146013][ T7227] ? __pfx_handle_userfault+0x10/0x10 [ 120.146041][ T7227] ? rcu_read_unlock+0x2d/0xb0 [ 120.146059][ T7227] ? rcu_read_unlock+0x2d/0xb0 [ 120.146084][ T7227] do_anonymous_page+0x1a56/0x2080 [ 120.146111][ T7227] __handle_mm_fault+0x1d2c/0x2a00 [ 120.146132][ T7227] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 120.146155][ T7227] ? __pfx___handle_mm_fault+0x10/0x10 [ 120.146176][ T7227] ? pte_offset_map_lock+0x174/0x320 [ 120.146199][ T7227] ? find_held_lock+0x2b/0x80 [ 120.146230][ T7227] ? follow_page_pte+0x4d0/0x13f0 [ 120.146259][ T7227] handle_mm_fault+0x37b/0xa30 [ 120.146281][ T7227] __get_user_pages+0x1178/0x32a0 [ 120.146358][ T7227] ? __pfx___get_user_pages+0x10/0x10 [ 120.146394][ T7227] populate_vma_page_range+0x267/0x3f0 [ 120.146424][ T7227] ? __pfx_populate_vma_page_range+0x10/0x10 [ 120.146455][ T7227] ? vma_set_page_prot+0xb1/0x120 [ 120.146483][ T7227] mprotect_fixup+0x955/0xe30 [ 120.146506][ T7227] ? __pfx_mprotect_fixup+0x10/0x10 [ 120.146557][ T7227] ? __pfx_mas_prev+0x10/0x10 [ 120.146593][ T7227] do_mprotect_pkey+0xa4b/0xef0 [ 120.146622][ T7227] ? __pfx_do_mprotect_pkey+0x10/0x10 [ 120.146651][ T7227] ? find_held_lock+0x2b/0x80 [ 120.146674][ T7227] ? __fget_files+0x215/0x3d0 [ 120.146708][ T7227] __ia32_sys_mprotect+0x75/0xb0 [ 120.146727][ T7227] ? lockdep_hardirqs_on+0x78/0x100 [ 120.146748][ T7227] __do_fast_syscall_32+0xe7/0x970 [ 120.146776][ T7227] do_fast_syscall_32+0x32/0x70 [ 120.146800][ T7227] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 120.146824][ T7227] RIP: 0023:0xf70aefec [ 120.146845][ T7227] Code: Unable to access opcode bytes at 0xf70aefc2. [ 120.146852][ T7227] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 000000000000007d [ 120.146870][ T7227] RAX: ffffffffffffffda RBX: 0000000080ffc000 RCX: 0000000000004000 [ 120.146881][ T7227] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 120.146890][ T7227] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 120.146902][ T7227] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 120.146911][ T7227] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 120.146936][ T7227] [ 120.362043][ T7229] netlink: 4 bytes leftover after parsing attributes in process `syz.3.297'. [ 120.367114][ T7229] netlink: 4 bytes leftover after parsing attributes in process `syz.3.297'. [ 120.472451][ T7231] se_dev->se_dev_ptr already set for storage object [ 120.522280][ T7233] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.636618][ T7233] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.758747][ T7233] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.849316][ T6285] usb 6-1: USB disconnect, device number 7 [ 120.863096][ T7233] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.716507][ T7239] pim6reg: entered allmulticast mode [ 121.718362][ T5757] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 121.718949][ T5765] Bluetooth: hci0: command 0x0c1a tx timeout [ 121.727094][ T7238] pim6reg: left allmulticast mode [ 121.807565][ T5765] Bluetooth: hci1: command 0x0c1a tx timeout [ 121.810177][ T5757] Bluetooth: hci2: command 0x0c1a tx timeout [ 121.877493][ T5757] Bluetooth: hci3: command 0x0c1a tx timeout [ 121.877603][ T5918] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.885851][ T5918] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.891680][ T5918] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.899145][ T5918] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.938555][ T7242] netlink: 4 bytes leftover after parsing attributes in process `syz.1.301'. [ 121.944085][ T7242] netlink: 4 bytes leftover after parsing attributes in process `syz.1.301'. [ 122.536735][ T7254] netlink: 8 bytes leftover after parsing attributes in process `syz.1.306'. [ 122.588443][ T7257] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 122.599963][ T7257] bond0: (slave veth1_vlan): Error: Device is in use and cannot be enslaved [ 123.071566][ T7275] FAULT_INJECTION: forcing a failure. [ 123.071566][ T7275] name failslab, interval 1, probability 0, space 0, times 0 [ 123.076771][ T7275] CPU: 0 UID: 0 PID: 7275 Comm: syz.2.313 Tainted: G L syzkaller #0 PREEMPT(full) [ 123.076790][ T7275] Tainted: [L]=SOFTLOCKUP [ 123.076793][ T7275] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 123.076805][ T7275] Call Trace: [ 123.076810][ T7275] [ 123.076815][ T7275] dump_stack_lvl+0x100/0x190 [ 123.076833][ T7275] should_fail_ex.cold+0x5/0xa [ 123.076849][ T7275] should_failslab+0xc2/0x120 [ 123.076869][ T7275] __kmalloc_noprof+0xfc/0x820 [ 123.076888][ T7275] ? rcu_is_watching+0x12/0xc0 [ 123.076908][ T7275] ? tomoyo_realpath_from_path+0xb6/0x690 [ 123.076938][ T7275] tomoyo_realpath_from_path+0xb6/0x690 [ 123.076958][ T7275] tomoyo_path_number_perm+0x23c/0x580 [ 123.076973][ T7275] ? tomoyo_path_number_perm+0x22e/0x580 [ 123.076988][ T7275] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 123.077003][ T7275] ? get_pid_task+0x106/0x250 [ 123.077030][ T7275] ? find_held_lock+0x2b/0x80 [ 123.077043][ T7275] ? __fget_files+0x215/0x3d0 [ 123.077054][ T7275] ? hook_file_ioctl_common+0x140/0x440 [ 123.077068][ T7275] ? __fget_files+0x215/0x3d0 [ 123.077081][ T7275] ? __fget_files+0x21f/0x3d0 [ 123.077093][ T7275] security_file_ioctl_compat+0xd3/0x230 [ 123.077109][ T7275] __ia32_compat_sys_ioctl+0xc2/0x360 [ 123.077128][ T7275] __do_fast_syscall_32+0xe7/0x970 [ 123.077145][ T7275] ? lockdep_hardirqs_on+0x78/0x100 [ 123.077161][ T7275] do_fast_syscall_32+0x32/0x70 [ 123.077176][ T7275] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 123.077191][ T7275] RIP: 0023:0xf702efec [ 123.077206][ T7275] Code: Unable to access opcode bytes at 0xf702efc2. [ 123.077210][ T7275] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 123.077221][ T7275] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c05c5340 [ 123.077228][ T7275] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 123.077234][ T7275] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 123.077240][ T7275] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 123.077246][ T7275] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 123.077260][ T7275] [ 123.077265][ T7275] ERROR: Out of memory at tomoyo_realpath_from_path. [ 123.117057][ T7276] pim6reg: entered allmulticast mode [ 123.172008][ T7272] pim6reg: left allmulticast mode [ 123.418761][ T7285] netlink: 8 bytes leftover after parsing attributes in process `syz.0.317'. [ 123.676845][ T7293] comedi comedi2: comedi_config --init_data is deprecated [ 123.750674][ T7295] [U]  [ 123.751809][ T7295] [U] K{ [ 123.756123][ T7295] [U] T 1ŠFFˊ`GJǘGO/MC [ 123.762296][ T7295] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 123.767829][ T7295] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 123.771704][ T7295] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 123.786274][ T7295] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 123.796019][ T7295] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 123.800937][ T7295] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 123.805788][ T7295] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 123.848934][ T7295] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 123.854313][ T7295] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 123.863134][ T7295] [U] 22Ʃ۩X?0;3U [ 123.864992][ T7295] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 123.880275][ T7295] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 123.883473][ T7295] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 123.886484][ T7295] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 123.888732][ T7295] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 123.892762][ T7295] [U] EC [ 123.894277][ T7295] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 123.910946][ T7294] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 123.966496][ T7301] netlink: 40 bytes leftover after parsing attributes in process `syz.1.322'. [ 124.391810][ T7290] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 124.395416][ T7320] comedi comedi2: comedi_config --init_data is deprecated [ 124.397951][ T7290] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 124.400308][ T7290] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 124.401670][ T7319] netlink: 40 bytes leftover after parsing attributes in process `syz.1.326'. [ 125.455739][ T7352] netlink: 4 bytes leftover after parsing attributes in process `syz.0.336'. [ 125.649595][ T5765] Bluetooth: hci0: command 0x0c1a tx timeout [ 125.649638][ T64] Bluetooth: hci1: command 0x0c1a tx timeout [ 125.650358][ T5757] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 125.687016][ T7364] netlink: 4 bytes leftover after parsing attributes in process `syz.3.340'. [ 125.693887][ T7364] netlink: 4 bytes leftover after parsing attributes in process `syz.3.340'. [ 125.780695][ T7367] process 'syz.0.338' launched './file0' with NULL argv: empty string added [ 126.024788][ T7375] wg2 speed is unknown, defaulting to 1000 [ 126.151318][ T7378] bond1 (unregistering): Released all slaves [ 126.437461][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 126.439829][ T5765] Bluetooth: hci2: command 0x0c1a tx timeout [ 126.712772][ T7388] netlink: 40 bytes leftover after parsing attributes in process `syz.2.345'. [ 126.762864][ T7386] syzkaller0: entered promiscuous mode [ 126.767498][ T7386] syzkaller0: entered allmulticast mode [ 126.996666][ T7396] binder: 7394:7396 ioctl 4018620d 0 returned -22 [ 127.258527][ T7402] netlink: 4 bytes leftover after parsing attributes in process `syz.0.350'. [ 127.272020][ T7402] netlink: 4 bytes leftover after parsing attributes in process `syz.0.350'. [ 127.404856][ T7411] netlink: 8 bytes leftover after parsing attributes in process `syz.2.352'. [ 127.411758][ T7411] FAULT_INJECTION: forcing a failure. [ 127.411758][ T7411] name failslab, interval 1, probability 0, space 0, times 0 [ 127.418850][ T7411] CPU: 0 UID: 0 PID: 7411 Comm: syz.2.352 Tainted: G L syzkaller #0 PREEMPT(full) [ 127.418876][ T7411] Tainted: [L]=SOFTLOCKUP [ 127.418881][ T7411] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 127.418890][ T7411] Call Trace: [ 127.418896][ T7411] [ 127.418902][ T7411] dump_stack_lvl+0x100/0x190 [ 127.418927][ T7411] should_fail_ex.cold+0x5/0xa [ 127.418943][ T7411] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 127.418961][ T7411] should_failslab+0xc2/0x120 [ 127.418984][ T7411] kmem_cache_alloc_noprof+0x91/0x6a0 [ 127.419004][ T7411] ? skb_clone+0x190/0x400 [ 127.419030][ T7411] skb_clone+0x190/0x400 [ 127.419052][ T7411] netlink_deliver_tap+0xaed/0xcc0 [ 127.419075][ T7411] netlink_unicast+0x6a5/0x850 [ 127.419095][ T7411] ? __pfx_netlink_unicast+0x10/0x10 [ 127.419111][ T7411] ? genl_rcv_msg+0x4be/0x800 [ 127.419136][ T7411] netlink_ack+0x655/0xb80 [ 127.419159][ T7411] netlink_rcv_skb+0x333/0x420 [ 127.419176][ T7411] ? __pfx_genl_rcv_msg+0x10/0x10 [ 127.419197][ T7411] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 127.419223][ T7411] ? netlink_deliver_tap+0x1ae/0xcc0 [ 127.419243][ T7411] genl_rcv+0x28/0x40 [ 127.419260][ T7411] netlink_unicast+0x585/0x850 [ 127.419280][ T7411] ? __pfx_netlink_unicast+0x10/0x10 [ 127.419304][ T7411] netlink_sendmsg+0x8b0/0xda0 [ 127.419334][ T7411] ? __pfx_netlink_sendmsg+0x10/0x10 [ 127.419355][ T7411] ? apparmor_socket_sendmsg+0x15b/0x270 [ 127.419376][ T7411] ____sys_sendmsg+0xa4d/0xbe0 [ 127.419392][ T7411] ? __pfx_netlink_sendmsg+0x10/0x10 [ 127.419410][ T7411] ? __pfx_____sys_sendmsg+0x10/0x10 [ 127.419437][ T7411] ___sys_sendmsg+0x190/0x1e0 [ 127.419456][ T7411] ? __pfx____sys_sendmsg+0x10/0x10 [ 127.419484][ T7411] ? find_held_lock+0x2b/0x80 [ 127.419518][ T7411] __sys_sendmsg+0x160/0x210 [ 127.419540][ T7411] ? __pfx___sys_sendmsg+0x10/0x10 [ 127.419567][ T7411] ? __pfx_ksys_write+0x10/0x10 [ 127.419588][ T7411] __do_fast_syscall_32+0xe7/0x970 [ 127.419637][ T7411] ? lockdep_hardirqs_on+0x78/0x100 [ 127.419659][ T7411] do_fast_syscall_32+0x32/0x70 [ 127.419680][ T7411] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 127.419700][ T7411] RIP: 0023:0xf702efec [ 127.419720][ T7411] Code: Unable to access opcode bytes at 0xf702efc2. [ 127.419727][ T7411] RSP: 002b:00000000f53fc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 127.419742][ T7411] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000240 [ 127.419751][ T7411] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 127.419760][ T7411] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 127.419769][ T7411] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 127.419778][ T7411] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 127.419798][ T7411] [ 127.427352][ T7413] netlink: 'syz.0.354': attribute type 1 has an invalid length. [ 127.476729][ T7415] trusted_key: encrypted_key: keylen for the ecryptfs format must be equal to 64 bytes [ 127.515271][ T7413] netlink: 200 bytes leftover after parsing attributes in process `syz.0.354'. [ 127.550224][ T7413] netlink: 'syz.0.354': attribute type 1 has an invalid length. [ 127.553224][ T7413] netlink: 29 bytes leftover after parsing attributes in process `syz.0.354'. [ 127.709537][ T7422] binder: 7421:7422 ioctl c00c6211 0 returned -14 [ 127.918661][ T7429] tipc: Started in network mode [ 127.921204][ T7429] tipc: Node identity 0050040000000000002, cluster identity 1 [ 127.945461][ T7429] Invalid ELF header magic: != ELF [ 127.964401][ T7429] overlayfs: overlapping lowerdir path [ 128.568096][ T7441] netlink: 'syz.0.361': attribute type 1 has an invalid length. [ 128.573921][ T7441] netlink: 200 bytes leftover after parsing attributes in process `syz.0.361'. [ 128.582554][ T7441] netlink: 'syz.0.361': attribute type 1 has an invalid length. [ 129.048883][ T7460] 9p: Could not find request transport: f [ 129.247411][ T34] usb 8-1: new full-speed USB device number 3 using dummy_hcd [ 129.398867][ T34] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 129.403490][ T34] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 129.410261][ T34] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 129.415626][ T34] usb 8-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 129.418928][ T34] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.421486][ T34] usb 8-1: Product: syz [ 129.423481][ T34] usb 8-1: Manufacturer: syz [ 129.425672][ T34] usb 8-1: SerialNumber: syz [ 129.434748][ T34] usb 8-1: config 0 descriptor?? [ 129.441839][ T7459] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 129.567966][ T34] rc_core: IR keymap rc-streamzap not found [ 129.571553][ T34] Registered IR keymap rc-empty [ 129.578388][ T34] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0 [ 129.599797][ T34] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/rc/rc0/input7 [ 129.931662][ T5830] usb 8-1: USB disconnect, device number 3 [ 130.008587][ T9] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 130.190995][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 130.208350][ T9] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 130.217165][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 130.235167][ T9] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 130.244201][ T9] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 130.249601][ T9] usb 5-1: Product: syz [ 130.253846][ T9] usb 5-1: Manufacturer: syz [ 130.256044][ T9] usb 5-1: SerialNumber: syz [ 130.316481][ T9] usb 5-1: config 0 descriptor?? [ 130.346075][ T9] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 130.355428][ T9] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 130.530272][ T9] usb 5-1: USB disconnect, device number 5 [ 130.531554][ C2] ldusb 5-1:0.0: usb_submit_urb failed (-19) [ 130.534760][ T9] ldusb 5-1:0.0: LD USB Device #0 now disconnected [ 130.601916][ T5830] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 130.737789][ T5830] usb 8-1: device descriptor read/64, error -71 [ 130.998125][ T5830] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 131.137962][ T5830] usb 8-1: device descriptor read/64, error -71 [ 131.249102][ T5830] usb usb8-port1: attempt power cycle [ 131.490560][ T7492] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 131.493185][ T7492] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 131.498194][ T7492] vhci_hcd vhci_hcd.0: Device attached [ 131.532724][ T7492] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 131.617673][ T5830] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 131.637903][ T5830] usb 8-1: device descriptor read/8, error -71 [ 131.787515][ T2325] usb 42-1: SetAddress Request (6) to port 0 [ 131.790167][ T2325] usb 42-1: new SuperSpeed USB device number 6 using vhci_hcd [ 131.807416][ T7496] netlink: 'syz.0.375': attribute type 1 has an invalid length. [ 131.833784][ T7496] bond1: entered promiscuous mode [ 131.838070][ T7496] 8021q: adding VLAN 0 to HW filter on device bond1 [ 131.877851][ T5830] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 131.880675][ T7496] bond1: (slave bridge1): making interface the new active one [ 131.883287][ T7496] bridge1: entered promiscuous mode [ 131.886282][ T7496] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 131.910798][ T5830] usb 8-1: device descriptor read/8, error -71 [ 131.966996][ T7496] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 131.972343][ T7496] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 132.017690][ T5830] usb usb8-port1: unable to enumerate USB device [ 132.073091][ T7493] vhci_hcd: connection reset by peer [ 132.076214][ T13] vhci_hcd vhci_hcd.2: stop threads [ 132.078775][ T13] vhci_hcd vhci_hcd.2: release socket [ 132.080685][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 132.308908][ T7504] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 132.439393][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.562723][ T7508] __nla_validate_parse: 1 callbacks suppressed [ 132.562744][ T7508] netlink: 8 bytes leftover after parsing attributes in process `syz.1.379'. [ 132.794382][ T7517] comedi comedi2: comedi_config --init_data is deprecated [ 133.049541][ T7522] netlink: 4 bytes leftover after parsing attributes in process `syz.0.383'. [ 133.053528][ T7522] netlink: 4 bytes leftover after parsing attributes in process `syz.0.383'. [ 133.122225][ T7526] [U]  [ 133.123590][ T7526] [U] K{ [ 133.124975][ T7526] [U] T 1ŠFFˊ`GJǘGO/MC [ 133.129105][ T7526] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 133.136180][ T7526] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 133.142103][ T7526] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 133.158903][ T7526] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 133.168362][ T7526] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 133.173140][ T7526] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 133.177674][ T7526] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 133.208611][ T7526] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 133.211678][ T7526] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 133.215964][ T7526] [U] 22Ʃ۩X?0;3U [ 133.217656][ T7526] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 133.225639][ T7526] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 133.228656][ T7526] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 133.231259][ T7526] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 133.233304][ T7526] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 133.237116][ T7526] [U] EC [ 133.238614][ T7526] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 133.255346][ T7525] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 133.318520][ T7532] [U]  [ 133.319468][ T7532] [U] K{ [ 133.320637][ T7532] [U] T 1ŠFFˊ`GJǘGO/MC [ 133.323189][ T7532] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 133.329429][ T7532] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 133.333210][ T7532] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 133.345041][ T7532] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 133.353019][ T7532] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 133.357054][ T7532] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 133.361390][ T7532] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 133.391984][ T7532] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 133.396225][ T7532] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 133.402241][ T7532] [U] 22Ʃ۩X?0;3U [ 133.404743][ T7532] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 133.415338][ T7532] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 133.419123][ T7532] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 133.422663][ T7532] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 133.425626][ T7532] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 133.431247][ T7532] [U] EC [ 133.432916][ T7532] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 133.454274][ T7531] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 133.499889][ T7510] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 133.502528][ T7510] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 133.504923][ T7510] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 133.530644][ T7516] comedi comedi2: comedi_config --init_data is deprecated [ 133.636266][ T7547] comedi comedi3: comedi_config --init_data is deprecated [ 133.889685][ T7560] 9p: Bad value for 'wfdno' [ 134.382005][ T7562] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 134.759750][ T64] Bluetooth: hci1: command 0x0c1a tx timeout [ 134.762464][ T64] Bluetooth: hci0: command 0x0c1a tx timeout [ 134.774793][ T5765] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 135.158247][ T7566] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 135.161351][ T7566] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 135.178338][ T7566] vhci_hcd vhci_hcd.0: Device attached [ 135.202441][ T7561] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 135.210366][ T7567] vhci_hcd: connection closed [ 135.244945][ T13] vhci_hcd vhci_hcd.2: stop threads [ 135.249796][ T13] vhci_hcd vhci_hcd.2: release socket [ 135.252131][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 135.259503][ T7561] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 135.262558][ T7561] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 135.265952][ T7561] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 135.270782][ T7561] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 135.302355][ T7561] pci 0000:00:01.0: Adding to iommu group 1 [ 135.312657][ T7561] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 135.314891][ T7561] pci 0000:00:01.0: vgaarb: bridge control possible [ 135.316911][ T7561] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 135.334384][ T7561] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 135.346550][ T7561] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 135.357174][ T7561] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 135.368707][ T5830] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 135.391681][ T7561] [drm] Found bochs VGA, ID 0xb0c5. [ 135.394647][ T7561] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 135.402093][ T7561] bochs-drm 0000:00:01.0: probe with driver bochs-drm failed with error -4 [ 135.539091][ T5830] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 135.545823][ T5830] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 135.549086][ T5830] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 135.553063][ T5830] usb 6-1: config 0 interface 0 has no altsetting 0 [ 135.558934][ T5830] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 135.562464][ T5830] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 135.566836][ T5830] usb 6-1: config 0 interface 0 has no altsetting 0 [ 135.567731][ T5765] Bluetooth: hci3: command 0x0c1a tx timeout [ 135.571336][ T5830] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 135.571595][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 135.574989][ T5830] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 135.581779][ T5830] usb 6-1: config 0 interface 0 has no altsetting 0 [ 135.585373][ T5830] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 135.589530][ T5830] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 135.593669][ T5830] usb 6-1: config 0 interface 0 has no altsetting 0 [ 135.597130][ T5830] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 135.601068][ T5830] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 135.605255][ T5830] usb 6-1: config 0 interface 0 has no altsetting 0 [ 135.609381][ T5830] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 135.612617][ T5830] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 135.616480][ T5830] usb 6-1: config 0 interface 0 has no altsetting 0 [ 135.619770][ T5830] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 135.622736][ T5830] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 135.626087][ T5830] usb 6-1: config 0 interface 0 has no altsetting 0 [ 135.629935][ T5830] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 135.632755][ T5830] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 135.636106][ T5830] usb 6-1: config 0 interface 0 has no altsetting 0 [ 135.642701][ T5830] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 135.646265][ T5830] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 135.649163][ T5830] usb 6-1: Product: syz [ 135.650792][ T5830] usb 6-1: Manufacturer: syz [ 135.652688][ T5830] usb 6-1: SerialNumber: syz [ 135.660503][ T5830] usb 6-1: config 0 descriptor?? [ 135.665518][ T5830] yurex 6-1:0.0: USB YUREX device now attached to Yurex #0 [ 135.766385][ T7579] FAULT_INJECTION: forcing a failure. [ 135.766385][ T7579] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 135.771945][ T7579] CPU: 1 UID: 0 PID: 7579 Comm: syz.2.399 Tainted: G L syzkaller #0 PREEMPT(full) [ 135.771970][ T7579] Tainted: [L]=SOFTLOCKUP [ 135.771975][ T7579] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.771993][ T7579] Call Trace: [ 135.771999][ T7579] [ 135.772007][ T7579] dump_stack_lvl+0x100/0x190 [ 135.772138][ T7579] should_fail_ex.cold+0x5/0xa [ 135.772171][ T7579] _copy_to_user+0x32/0xd0 [ 135.772241][ T7579] simple_read_from_buffer+0xcb/0x170 [ 135.772282][ T7579] proc_fail_nth_read+0x1af/0x230 [ 135.772306][ T7579] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 135.772332][ T7579] ? rw_verify_area+0xce/0x6d0 [ 135.772357][ T7579] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 135.772372][ T7579] vfs_read+0x1e4/0xb40 [ 135.772385][ T7579] ? __pfx_vfs_read+0x10/0x10 [ 135.772394][ T7579] ? find_held_lock+0x2b/0x80 [ 135.772416][ T7579] ? __fget_files+0x215/0x3d0 [ 135.772429][ T7579] ? __fget_files+0x21f/0x3d0 [ 135.772443][ T7579] ksys_read+0x12a/0x250 [ 135.772453][ T7579] ? __pfx_ksys_read+0x10/0x10 [ 135.772467][ T7579] do_int80_emulation+0x14b/0x720 [ 135.772533][ T7579] asm_int80_emulation+0x1a/0x20 [ 135.772546][ T7579] RIP: 0023:0xf71673eb [ 135.772556][ T7579] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 135.772567][ T7579] RSP: 002b:00000000f541d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 135.772579][ T7579] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00000000f541d5d0 [ 135.772585][ T7579] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 135.772592][ T7579] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 135.772598][ T7579] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 135.772604][ T7579] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 135.772618][ T7579] [ 135.882286][ T5830] usb 6-1: USB disconnect, device number 8 [ 135.886378][ T5830] yurex 6-1:0.0: USB YUREX #0 now disconnected [ 135.911541][ T7581] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 136.115352][ T42] audit: type=1800 audit(1785617059.004:23): pid=7586 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.402" name="idVendor" dev="configfs" ino=16959 res=0 errno=0 [ 136.149333][ T7586] bond1: entered promiscuous mode [ 136.326293][ T7594] se_dev->se_dev_ptr already set for storage object [ 136.514406][ T7596] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 136.517010][ T7596] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 136.520407][ T7596] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 136.527380][ T7596] comedi comedi2: comedi_config --init_data is deprecated [ 136.785430][ T7601] syzkaller0: entered promiscuous mode [ 136.787624][ T7601] syzkaller0: entered allmulticast mode [ 136.866229][ T2325] usb 42-1: device descriptor read/8, error -110 [ 137.030410][ T7608] program syz.2.408 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 138.051976][ T34] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 138.249438][ T34] usb 5-1: Using ep0 maxpacket: 32 [ 138.258292][ T2325] usb usb42-port1: attempt power cycle [ 138.259969][ T34] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 138.266154][ T34] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 138.269529][ T34] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 138.272568][ T34] usb 5-1: Product: syz [ 138.274051][ T34] usb 5-1: Manufacturer: syz [ 138.275717][ T34] usb 5-1: SerialNumber: syz [ 138.282002][ T34] usb 5-1: config 0 descriptor?? [ 138.290850][ T7607] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 138.293941][ T34] hub 5-1:0.0: bad descriptor, ignoring hub [ 138.295886][ T34] hub 5-1:0.0: probe with driver hub failed with error -5 [ 138.527463][ T5765] Bluetooth: hci2: command 0x0c1a tx timeout [ 138.529784][ T5765] Bluetooth: hci0: command 0x0c1a tx timeout [ 138.531771][ T5765] Bluetooth: hci1: command 0x0c1a tx timeout [ 138.567448][ T64] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 138.607385][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 138.828809][ T2325] usb usb42-port1: unable to enumerate USB device [ 139.302919][ T7608] infiniband syz0: set active [ 139.305441][ T7608] infiniband syz0: added bond_slave_1 [ 139.309170][ T7608] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 139.313407][ T7608] infiniband syz0: Couldn't open port 1 [ 139.319670][ T7608] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 139.325814][ T7608] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 139.332956][ T7608] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 139.334149][ T7612] netlink: 8 bytes leftover after parsing attributes in process `syz.1.410'. [ 139.343696][ T7037] usb 5-1: USB disconnect, device number 6 [ 139.356725][ T7608] RDS/IB: syz0: added [ 139.358156][ T7608] smc: adding ib device syz0 with port count 1 [ 139.360122][ T7608] smc: ib device syz0 port 1 has no pnetid [ 139.395713][ T42] audit: type=1807 audit(1785617062.284:24): action=measure res=1 [ 139.400565][ T7614] ima: policy update completed [ 139.404327][ T42] audit: type=1802 audit(1785617062.294:25): pid=7614 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=completed comm="syz.1.411" res=1 errno=0 [ 139.529035][ T42] audit: type=1800 audit(1785617062.424:26): pid=6161 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=157503 res=0 errno=0 [ 139.539483][ T42] audit: type=1800 audit(1785617062.434:27): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=157517 res=0 errno=0 [ 139.578584][ T42] audit: type=1800 audit(1785617062.474:28): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16007 res=0 errno=0 [ 139.600167][ T42] audit: type=1800 audit(1785617062.494:29): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16007 res=0 errno=0 [ 139.609441][ T42] audit: type=1800 audit(1785617062.504:30): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16265 res=0 errno=0 [ 139.656744][ T7617] wg2 speed is unknown, defaulting to 1000 [ 139.659821][ T42] audit: type=1800 audit(1785617062.554:31): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16265 res=0 errno=0 [ 139.668897][ T42] audit: type=1800 audit(1785617062.554:32): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=157531 res=0 errno=0 [ 139.892338][ T7624] intel_xhci_usb_sw pcspkr: probe with driver intel_xhci_usb_sw failed with error -22 [ 139.965888][ T7628] [U]  [ 139.966853][ T7628] [U] K{ [ 140.017765][ T7628] [U] T 1ŠFFˊ`GJǘGO/MC [ 140.021287][ T7628] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 140.027139][ T7628] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 140.031944][ T7628] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 140.047425][ T7628] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 140.055978][ T7628] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 140.060489][ T7628] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 140.065006][ T7628] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 140.096148][ T7628] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 140.100034][ T7628] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 140.104503][ T7628] [U] 22Ʃ۩X?0;3U [ 140.106349][ T7628] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 140.115103][ T7628] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 140.118771][ T7628] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 140.121774][ T7628] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 140.123998][ T7628] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 140.128148][ T7628] [U] EC [ 140.129624][ T7628] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 140.140594][ T7626] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 140.141725][ T7627] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 140.167696][ T7626] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 140.169797][ T7626] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 140.172113][ T7632] comedi comedi2: comedi_config --init_data is deprecated [ 140.340224][ T7637] netlink: 8 bytes leftover after parsing attributes in process `syz.0.418'. [ 140.357414][ T7640] netlink: 40 bytes leftover after parsing attributes in process `syz.2.419'. [ 140.729335][ T7650] pimreg: entered allmulticast mode [ 140.766843][ T7647] netlink: 'syz.0.422': attribute type 1 has an invalid length. [ 140.770801][ T7647] netlink: 4 bytes leftover after parsing attributes in process `syz.0.422'. [ 141.034532][ T7658] [U]  [ 141.035687][ T7658] [U] K{ [ 141.038391][ T7658] [U] T 1ŠFFˊ`GJǘGO/MC [ 141.041240][ T7658] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 141.058858][ T7658] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 141.067493][ T7658] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 141.094845][ T7658] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 141.106474][ T7658] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 141.111128][ T7658] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 141.117614][ T7658] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 141.156255][ T7658] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 141.160018][ T7658] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 141.164920][ T7658] [U] 22Ʃ۩X?0;3U [ 141.166845][ T7658] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 141.176632][ T7658] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 141.180425][ T7658] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 141.183527][ T7658] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 141.183772][ T42] kauditd_printk_skb: 18 callbacks suppressed [ 141.183786][ T42] audit: type=1800 audit(1785617064.074:51): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16007 res=0 errno=0 [ 141.186408][ T7658] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 141.201685][ T7658] [U] EC [ 141.203335][ T7658] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 141.214803][ T7657] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 141.387392][ T42] audit: type=1800 audit(1785617064.204:52): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16136 res=0 errno=0 [ 141.395187][ T42] audit: type=1800 audit(1785617064.234:53): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16265 res=0 errno=0 [ 141.424419][ T7667] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 141.426819][ T7667] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 141.429453][ T7667] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 141.433393][ T7667] comedi comedi2: comedi_config --init_data is deprecated [ 141.685396][ T42] audit: type=1800 audit(1785617064.574:54): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16136 res=0 errno=0 [ 141.711665][ T7677] overlayfs: failed to resolve './file3': -2 [ 141.714455][ T42] audit: type=1800 audit(1785617064.604:55): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=177292 res=0 errno=0 [ 141.770163][ T42] audit: type=1800 audit(1785617064.664:56): pid=7672 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.429" name="unbind" dev="sysfs" ino=22869 res=0 errno=0 [ 141.782022][ T42] audit: type=1800 audit(1785617064.674:57): pid=7672 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.429" name="align" dev="sysfs" ino=6577 res=0 errno=0 [ 141.851707][ T42] audit: type=1800 audit(1785617064.744:58): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16136 res=0 errno=0 [ 141.948835][ T42] audit: type=1800 audit(1785617064.844:59): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16136 res=0 errno=0 [ 141.965935][ T42] audit: type=1800 audit(1785617064.854:60): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16265 res=0 errno=0 [ 142.001573][ T7686] comedi comedi1: comedi_parport: I/O base address not correctly aligned [ 142.037401][ T64] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 142.037461][ T5757] Bluetooth: hci0: command 0x0c1a tx timeout [ 142.138200][ T7689] [U]  [ 142.139235][ T7689] [U] K{ [ 142.140390][ T7689] [U] T 1ŠFFˊ`GJǘGO/MC [ 142.142948][ T7689] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 142.148582][ T7689] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 142.152497][ T7689] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 142.168602][ T7689] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 142.178656][ T7689] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 142.183477][ T7689] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 142.189896][ T7689] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 142.225465][ T7689] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 142.229937][ T7689] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 142.235287][ T7689] [U] 22Ʃ۩X?0;3U [ 142.237752][ T7689] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 142.247932][ T7037] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 142.252472][ T7689] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 142.257926][ T7689] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 142.261923][ T7689] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 142.261975][ T7692] netlink: 4 bytes leftover after parsing attributes in process `syz.1.436'. [ 142.264917][ T7689] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 142.274649][ T7689] [U] EC [ 142.276260][ T7692] netlink: 4 bytes leftover after parsing attributes in process `syz.1.436'. [ 142.276419][ T7689] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 142.309331][ T7688] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 142.363484][ T7694] [U]  [ 142.364809][ T7694] [U] K{ [ 142.366265][ T7694] [U] T 1ŠFFˊ`GJǘGO/MC [ 142.370820][ T7694] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 142.377168][ T7694] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 142.382504][ T7694] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 142.398074][ T7037] usb 7-1: Using ep0 maxpacket: 32 [ 142.398532][ T7694] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 142.407684][ T7037] usb 7-1: unable to get BOS descriptor or descriptor too short [ 142.410891][ T7694] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 142.419035][ T7694] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 142.422679][ T7037] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 142.424496][ T7694] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 142.449884][ T7037] usb 7-1: config 14 has no interface number 0 [ 142.468149][ T7694] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 142.474860][ T7694] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 142.482139][ T7694] [U] 22Ʃ۩X?0;3U [ 142.484548][ T7694] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 142.495617][ T7694] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 142.499630][ T7694] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 142.503077][ T7694] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 142.505992][ T7694] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 142.510683][ T7037] usb 7-1: config 14 has no interface number 1 [ 142.511143][ T7694] [U] EC [ 142.515189][ T7037] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 142.515293][ T7694] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 142.522971][ T7696] syz.3.438 (7696) used greatest stack depth: 19104 bytes left [ 142.528400][ T7037] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 142.533326][ T7037] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 142.538254][ T7037] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 142.543601][ T7037] usb 7-1: config 14 interface 57 has no altsetting 0 [ 142.547032][ T7037] usb 7-1: config 14 interface 228 has no altsetting 0 [ 142.553478][ T7037] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 142.560358][ T7037] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.563986][ T7693] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 142.564080][ T7037] usb 7-1: Product: syz [ 142.573025][ T7037] usb 7-1: Manufacturer: syz [ 142.575373][ T7037] usb 7-1: SerialNumber: syz [ 142.620785][ T7699] syzkaller0: entered promiscuous mode [ 142.623276][ T7699] syzkaller0: entered allmulticast mode [ 142.834236][ T9] IPVS: starting estimator thread 0... [ 142.937470][ T7705] IPVS: using max 43 ests per chain, 103200 per kthread [ 143.487538][ T64] Bluetooth: hci3: command 0x0c1a tx timeout [ 143.489393][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 143.489659][ T5765] Bluetooth: hci1: command 0x0c1a tx timeout [ 143.724609][ T7713] netlink: 8 bytes leftover after parsing attributes in process `syz.0.443'. [ 144.198369][ T7701] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 144.207491][ T7701] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 144.213256][ T7701] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 144.219906][ T7701] comedi comedi2: comedi_config --init_data is deprecated [ 144.467513][ T5837] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 144.532346][ T7724] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.632259][ T5837] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 144.643042][ T5837] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 144.649343][ T7724] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.659554][ T5837] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 144.663828][ T5837] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.745810][ T7716] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 144.757574][ T5757] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 144.760363][ T5765] Bluetooth: hci0: command 0x0c1a tx timeout [ 144.838709][ T7728] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.920917][ T7724] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.922284][ T5837] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 146.287917][ T5757] Bluetooth: hci3: command 0x0c1a tx timeout [ 146.301608][ T5757] Bluetooth: hci2: command 0x0c1a tx timeout [ 146.308974][ T5765] Bluetooth: hci1: command 0x0c1a tx timeout [ 146.376592][ T42] kauditd_printk_skb: 28 callbacks suppressed [ 146.376609][ T42] audit: type=1800 audit(1785617069.264:89): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16007 res=0 errno=0 [ 146.497178][ T42] audit: type=1800 audit(1785617069.384:90): pid=5750 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=177588 res=0 errno=0 [ 146.969230][ T42] audit: type=1800 audit(1785617069.864:91): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=177607 res=0 errno=0 [ 147.021632][ T5829] usb 5-1: USB disconnect, device number 7 [ 147.038329][ T42] audit: type=1800 audit(1785617069.934:92): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=177620 res=0 errno=0 [ 147.067966][ T42] audit: type=1800 audit(1785617069.944:93): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=177633 res=0 errno=0 [ 147.102187][ T42] audit: type=1800 audit(1785617069.944:94): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=177646 res=0 errno=0 [ 147.125091][ T42] audit: type=1800 audit(1785617070.004:95): pid=7732 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=177659 res=0 errno=0 [ 147.148469][ T42] audit: type=1800 audit(1785617070.024:96): pid=7734 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=177671 res=0 errno=0 [ 147.164044][ T42] audit: type=1800 audit(1785617070.024:97): pid=7736 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=177712 res=0 errno=0 [ 147.172850][ T42] audit: type=1800 audit(1785617070.044:98): pid=7734 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=30012 res=0 errno=0 [ 147.194727][ T7728] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.321565][ T7741] netlink: 8 bytes leftover after parsing attributes in process `syz.0.452'. [ 147.812612][ T7037] legousbtower 7-1:14.57: interrupt endpoints not found [ 147.825628][ T7037] legousbtower 7-1:14.228: interrupt endpoints not found [ 147.832420][ T7037] usb 7-1: USB disconnect, device number 3 [ 147.843231][ T7724] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.884705][ T7728] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 147.951608][ T7743] syzkaller0: entered promiscuous mode [ 147.954277][ T7743] syzkaller0: entered allmulticast mode [ 148.187440][ T7037] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 148.349338][ T7037] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 148.353406][ T7037] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 148.357480][ T7037] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 148.364845][ T7037] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 148.368598][ T7037] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 148.372041][ T7037] usb 7-1: Product: syz [ 148.373809][ T7037] usb 7-1: Manufacturer: syz [ 148.375784][ T7037] usb 7-1: SerialNumber: syz [ 148.607256][ T7037] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 4 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 148.865574][ T5837] usb 7-1: USB disconnect, device number 4 [ 148.880358][ T5837] usblp0: removed [ 149.994089][ T7728] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.065132][ T7745] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.371584][ T13] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 150.388017][ T13] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 150.494777][ T7745] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.537176][ T13] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 150.541849][ T13] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 150.549340][ T5828] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 150.556209][ T5828] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 150.570229][ T7745] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.618530][ T5828] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 150.627597][ T5828] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 150.663727][ T7745] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.763365][ T7754] netlink: 40 bytes leftover after parsing attributes in process `syz.1.458'. [ 150.918174][ T5828] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 150.932503][ T5828] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 151.027543][ T5828] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 151.037444][ T5828] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 151.112537][ T7757] se_dev->se_dev_ptr already set for storage object [ 151.379703][ T42] kauditd_printk_skb: 25 callbacks suppressed [ 151.379720][ T42] audit: type=1800 audit(1785617074.274:124): pid=7764 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.459" name="new_array" dev="sysfs" ino=64937 res=0 errno=0 [ 151.421683][ T7764] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 151.429350][ T42] audit: type=1800 audit(1785617074.324:125): pid=7764 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.459" name="level" dev="sysfs" ino=132080 res=0 errno=0 [ 151.501684][ T7769] netlink: 8 bytes leftover after parsing attributes in process `syz.0.461'. [ 151.517207][ T42] audit: type=1800 audit(1785617074.404:126): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=179284 res=0 errno=0 [ 151.537647][ T42] audit: type=1800 audit(1785617074.414:127): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=179299 res=0 errno=0 [ 151.558348][ T42] audit: type=1800 audit(1785617074.424:128): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=179314 res=0 errno=0 [ 151.579209][ T42] audit: type=1800 audit(1785617074.434:129): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=179329 res=0 errno=0 [ 151.579251][ T42] audit: type=1800 audit(1785617074.474:130): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16265 res=0 errno=0 [ 151.605174][ T42] audit: type=1800 audit(1785617074.494:131): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=179377 res=0 errno=0 [ 151.684820][ T42] audit: type=1800 audit(1785617074.574:132): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16136 res=0 errno=0 [ 152.312467][ T42] audit: type=1800 audit(1785617075.204:133): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16136 res=0 errno=0 [ 152.329435][ T7788] bond1 (unregistering): Released all slaves [ 152.458989][ T7797] wg2 speed is unknown, defaulting to 1000 [ 152.814425][ T7803] pimreg3: entered allmulticast mode [ 152.827419][ T7037] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 152.940673][ T7807] netlink: 'syz.3.467': attribute type 1 has an invalid length. [ 152.947954][ T7807] netlink: 4 bytes leftover after parsing attributes in process `syz.3.467'. [ 152.987580][ T7037] usb 7-1: Using ep0 maxpacket: 32 [ 152.993010][ T7037] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 153.000288][ T7037] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 153.003938][ T7037] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 153.007191][ T7037] usb 7-1: Product: syz [ 153.010068][ T7037] usb 7-1: Manufacturer: syz [ 153.012073][ T7037] usb 7-1: SerialNumber: syz [ 153.016528][ T7037] usb 7-1: config 0 descriptor?? [ 153.023404][ T7795] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 153.031468][ T7037] hub 7-1:0.0: bad descriptor, ignoring hub [ 153.036026][ T7037] hub 7-1:0.0: probe with driver hub failed with error -5 [ 153.113242][ T7806] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 153.568762][ T7814] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.958588][ T7814] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.047557][ T7037] usb 7-1: USB disconnect, device number 5 [ 154.085935][ T7814] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.145878][ T7818] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 154.175389][ T7814] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.189958][ T7820] netlink: 8 bytes leftover after parsing attributes in process `syz.1.470'. [ 154.264203][ T7825] netlink: 40 bytes leftover after parsing attributes in process `syz.2.473'. [ 154.477560][ T13] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.483620][ T13] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.491060][ T13] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 154.496038][ T13] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.085311][ T7833] openvswitch: netlink: Message has 1 unknown bytes. [ 155.108830][ T7831] netlink: 40 bytes leftover after parsing attributes in process `syz.1.474'. [ 155.117253][ T7831] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(10) [ 155.117309][ T7831] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 155.117474][ T7831] vhci_hcd vhci_hcd.0: Device attached [ 155.253830][ T7840] netlink: 36 bytes leftover after parsing attributes in process `syz.2.476'. [ 155.392129][ T7835] vhci_hcd: cannot find a urb of seqnum 0 max seqnum 0 [ 155.403039][ T5828] vhci_hcd vhci_hcd.1: stop threads [ 155.404786][ T5828] vhci_hcd vhci_hcd.1: release socket [ 155.406524][ T5828] vhci_hcd vhci_hcd.1: disconnect device [ 155.427437][ T6285] usb 39-1: new low-speed USB device number 2 using vhci_hcd [ 155.430672][ T6285] usb 39-1: enqueue for inactive port 0 [ 155.507564][ T6285] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 156.173677][ T7848] syzkaller0: entered promiscuous mode [ 156.175828][ T7848] syzkaller0: entered allmulticast mode [ 156.352281][ T7850] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 156.360964][ T7850] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 156.361774][ T7855] netlink: 8 bytes leftover after parsing attributes in process `syz.0.480'. [ 156.363189][ T7850] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 156.744554][ T42] kauditd_printk_skb: 28 callbacks suppressed [ 156.744567][ T42] audit: type=1800 audit(1785617079.634:162): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16265 res=0 errno=0 [ 157.934043][ T7858] comedi comedi2: comedi_config --init_data is deprecated [ 157.972380][ T42] audit: type=1800 audit(1785617080.864:163): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=187476 res=0 errno=0 [ 158.002745][ T42] audit: type=1800 audit(1785617080.894:164): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16007 res=0 errno=0 [ 158.017000][ T42] audit: type=1800 audit(1785617080.904:165): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16136 res=0 errno=0 [ 158.045873][ T7870] netlink: 16 bytes leftover after parsing attributes in process `syz.2.484'. [ 158.055556][ T7870] netlink: 16 bytes leftover after parsing attributes in process `syz.2.484'. [ 158.069210][ T42] audit: type=1800 audit(1785617080.954:166): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16007 res=0 errno=0 [ 158.111084][ T42] audit: type=1800 audit(1785617081.004:167): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=187494 res=0 errno=0 [ 158.131946][ T42] audit: type=1800 audit(1785617081.004:168): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=187509 res=0 errno=0 [ 158.154914][ T42] audit: type=1800 audit(1785617081.044:169): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16265 res=0 errno=0 [ 158.168633][ T42] audit: type=1800 audit(1785617081.054:170): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=187524 res=0 errno=0 [ 158.178815][ T42] audit: type=1800 audit(1785617081.064:171): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=187539 res=0 errno=0 [ 158.366126][ T7884] netlink: 'syz.3.486': attribute type 1 has an invalid length. [ 158.366141][ T7884] netlink: 4 bytes leftover after parsing attributes in process `syz.3.486'. [ 158.367473][ T5765] Bluetooth: hci1: command 0x0c1a tx timeout [ 158.387110][ T7885] bond2 (unregistering): Released all slaves [ 158.424829][ T7881] udc dummy_udc.0: failed to start g1: -2 [ 158.424873][ T7881] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -2 [ 158.438252][ T5765] Bluetooth: hci3: command 0x0c1a tx timeout [ 158.438278][ T5765] Bluetooth: hci2: command 0x0c1a tx timeout [ 158.767411][ T5757] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 158.767508][ T64] Bluetooth: hci0: command 0x0c1a tx timeout [ 159.898647][ T7901] syzkaller0: entered promiscuous mode [ 159.900886][ T7901] syzkaller0: entered allmulticast mode [ 160.140059][ T7904] netlink: 8 bytes leftover after parsing attributes in process `syz.0.492'. [ 160.887417][ T9] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 161.037393][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 161.041778][ T9] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 161.051776][ T9] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 161.055430][ T9] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 161.059394][ T9] usb 7-1: Product: syz [ 161.061182][ T9] usb 7-1: Manufacturer: syz [ 161.063131][ T9] usb 7-1: SerialNumber: syz [ 161.071934][ T9] usb 7-1: config 0 descriptor?? [ 161.076239][ T7908] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 161.100546][ T9] hub 7-1:0.0: bad descriptor, ignoring hub [ 161.102569][ T9] hub 7-1:0.0: probe with driver hub failed with error -5 [ 161.651421][ T24] usb 7-1: USB disconnect, device number 6 [ 161.657498][ T7913] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 161.664868][ T7913] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 161.675717][ T7913] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 161.691121][ T7912] comedi comedi2: comedi_config --init_data is deprecated [ 161.743216][ T7930] se_dev->se_dev_ptr already set for storage object [ 161.842923][ T42] kauditd_printk_skb: 24 callbacks suppressed [ 161.842940][ T42] audit: type=1800 audit(1785617084.734:196): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16265 res=0 errno=0 [ 161.905808][ T7937] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.500'. [ 161.947059][ T42] audit: type=1800 audit(1785617084.834:197): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16265 res=0 errno=0 [ 161.983829][ T7939] [U]  [ 161.985258][ T7939] [U] K{ [ 161.986704][ T7939] [U] T 1ŠFFˊ`GJǘGO/MC [ 161.990224][ T7939] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 161.996718][ T7939] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 162.002264][ T7939] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 162.018647][ T7939] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 162.029886][ T7939] [U] ܾ4B`˗HT_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 162.035213][ T7939] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 162.041611][ T7939] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`Ʀ\ [ 162.090235][ T7939] [U] MX"{; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 162.105561][ T7939] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 162.120512][ T42] audit: type=1800 audit(1785617085.014:198): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=188056 res=0 errno=0 [ 162.124217][ T7939] [U] 22Ʃ۩X?0;3U [ 162.130686][ T7939] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 162.142258][ T7939] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 162.146448][ T7939] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 162.150480][ T7939] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 162.153522][ T7939] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 162.158630][ T7939] [U] EC [ 162.160315][ T7939] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 162.187750][ T7938] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 162.341699][ T7947] syzkaller0: entered promiscuous mode [ 162.344109][ T7947] syzkaller0: entered allmulticast mode [ 162.346534][ T42] audit: type=1800 audit(1785617085.234:199): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16136 res=0 errno=0 [ 162.379935][ T42] audit: type=1800 audit(1785617085.274:200): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16265 res=0 errno=0 [ 162.562923][ T7954] program syz.0.504 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 163.332306][ T7952] netlink: 8 bytes leftover after parsing attributes in process `syz.2.506'. [ 163.397498][ T64] Bluetooth: hci0: command 0x0c1a tx timeout [ 163.399306][ T5757] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 163.483541][ T42] audit: type=1800 audit(1785617086.374:201): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16007 res=0 errno=0 [ 163.544753][ T42] audit: type=1800 audit(1785617086.434:202): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16007 res=0 errno=0 [ 163.561692][ T7958] netlink: 4 bytes leftover after parsing attributes in process `syz.1.508'. [ 163.566350][ T7958] netlink: 4 bytes leftover after parsing attributes in process `syz.1.508'. [ 163.653619][ T42] audit: type=1800 audit(1785617086.544:203): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16007 res=0 errno=0 [ 163.717411][ T5757] Bluetooth: hci1: command 0x0c1a tx timeout [ 163.721108][ T5757] Bluetooth: hci3: command 0x0c1a tx timeout [ 163.724514][ T5757] Bluetooth: hci2: command 0x0c1a tx timeout [ 164.039538][ T7966] netlink: 80 bytes leftover after parsing attributes in process `syz.0.511'. [ 164.118156][ T42] audit: type=1800 audit(1785617087.014:204): pid=7966 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.511" name="UDC" dev="configfs" ino=21544 res=0 errno=0 [ 164.367370][ T5845] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 164.490461][ T42] audit: type=1800 audit(1785617087.384:205): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16136 res=0 errno=0 [ 164.528083][ T5845] usb 5-1: Using ep0 maxpacket: 16 [ 164.534735][ T5845] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 164.539197][ T5845] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 164.543952][ T5845] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 164.548141][ T5845] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 164.551834][ T5845] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 164.558274][ T5845] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 164.561853][ T5845] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 164.564870][ T5845] usb 5-1: Manufacturer: syz [ 164.568886][ T5845] usb 5-1: config 0 descriptor?? [ 164.827397][ T5845] rc_core: IR keymap rc-hauppauge not found [ 164.829564][ T5845] Registered IR keymap rc-empty [ 164.831565][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 164.857440][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 164.880861][ T5845] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0 [ 164.886826][ T5845] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/rc/rc0/input8 [ 164.976037][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 165.007647][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 165.037499][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 165.069543][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 165.107762][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 165.147486][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 165.169305][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 165.200744][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 165.240805][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 165.268789][ T5845] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 165.298658][ T5845] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 165.298678][ T5845] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 165.304135][ T5845] usb 5-1: USB disconnect, device number 8 [ 165.510610][ T7985] bond1 (unregistering): Released all slaves [ 166.795747][ T8005] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 166.796013][ T8005] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 166.796169][ T8005] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 166.799393][ T8005] comedi comedi2: comedi_config --init_data is deprecated [ 167.046501][ T8016] bond2 (unregistering): Released all slaves [ 167.190410][ T8019] program syz.1.522 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 167.204288][ T8019] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 167.277021][ T42] kauditd_printk_skb: 34 callbacks suppressed [ 167.277036][ T42] audit: type=1800 audit(1785617090.164:240): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16265 res=0 errno=0 [ 167.827087][ T42] audit: type=1800 audit(1785617090.714:241): pid=8025 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.525" name="p_srate" dev="configfs" ino=21569 res=0 errno=0 [ 167.834250][ T8025] ================================================================== [ 167.837072][ T8025] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x1d4/0x260 [ 167.839678][ T8025] Free of addr ffff888029978ba6 by task syz.2.525/8025 [ 167.841988][ T8025] [ 167.843002][ T8025] CPU: 3 UID: 0 PID: 8025 Comm: syz.2.525 Tainted: G L syzkaller #0 PREEMPT(full) [ 167.843031][ T8025] Tainted: [L]=SOFTLOCKUP [ 167.843037][ T8025] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 167.843049][ T8025] Call Trace: [ 167.843057][ T8025] [ 167.843066][ T8025] dump_stack_lvl+0x100/0x190 [ 167.843093][ T8025] print_report+0x13d/0x4b0 [ 167.843123][ T8025] ? __virt_addr_valid+0x239/0x430 [ 167.843145][ T8025] ? f_uac2_opts_p_srate_store+0x1d4/0x260 [ 167.843174][ T8025] kasan_report_invalid_free+0xb8/0x190 [ 167.843204][ T8025] ? f_uac2_opts_p_srate_store+0x1d4/0x260 [ 167.843232][ T8025] ? f_uac2_opts_p_srate_store+0x1d4/0x260 [ 167.843258][ T8025] ? f_uac2_opts_p_srate_store+0x1d4/0x260 [ 167.843285][ T8025] check_slab_allocation+0xe1/0xf0 [ 167.843306][ T8025] ? f_uac2_opts_p_srate_store+0x100/0x260 [ 167.843333][ T8025] kfree+0x1b6/0x6c0 [ 167.843348][ T8025] ? __asan_memcpy+0x3c/0x60 [ 167.843368][ T8025] f_uac2_opts_p_srate_store+0x1d4/0x260 [ 167.843396][ T8025] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 167.843448][ T8025] ? configfs_write_iter+0x388/0x4e0 [ 167.843469][ T8025] configfs_write_iter+0x302/0x4e0 [ 167.843488][ T8025] vfs_write+0x6ac/0x1050 [ 167.843504][ T8025] ? __pfx_configfs_write_iter+0x10/0x10 [ 167.843525][ T8025] ? __pfx_vfs_write+0x10/0x10 [ 167.843539][ T8025] ? find_held_lock+0x2b/0x80 [ 167.843567][ T8025] ksys_write+0x12a/0x250 [ 167.843581][ T8025] ? __pfx_ksys_write+0x10/0x10 [ 167.843597][ T8025] __do_fast_syscall_32+0xe7/0x970 [ 167.843624][ T8025] do_fast_syscall_32+0x32/0x70 [ 167.843646][ T8025] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 167.843667][ T8025] RIP: 0023:0xf702efec [ 167.843688][ T8025] Code: Unable to access opcode bytes at 0xf702efc2. [ 167.843698][ T8025] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 167.843717][ T8025] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000440 [ 167.843736][ T8025] RDX: 000000000000002e RSI: 0000000000000000 RDI: 0000000000000000 [ 167.843748][ T8025] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 167.843759][ T8025] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 167.843771][ T8025] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 167.843789][ T8025] [ 167.843796][ T8025] [ 167.917055][ T8025] Allocated by task 8025: [ 167.918636][ T8025] kasan_save_stack+0x30/0x50 [ 167.920603][ T8025] kasan_save_track+0x14/0x30 [ 167.922594][ T8025] __kasan_kmalloc+0xaa/0xb0 [ 167.924562][ T8025] __kmalloc_node_track_caller_noprof+0x331/0x830 [ 167.927206][ T8025] kstrdup+0x51/0xe0 [ 167.928874][ T8025] f_uac2_opts_p_srate_store+0x113/0x260 [ 167.931189][ T8025] configfs_write_iter+0x302/0x4e0 [ 167.933298][ T8025] vfs_write+0x6ac/0x1050 [ 167.935120][ T8025] ksys_write+0x12a/0x250 [ 167.936758][ T8025] __do_fast_syscall_32+0xe7/0x970 [ 167.938666][ T8025] do_fast_syscall_32+0x32/0x70 [ 167.940532][ T8025] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 167.942860][ T8025] [ 167.943647][ T8025] The buggy address belongs to the object at ffff888029978b80 [ 167.943647][ T8025] which belongs to the cache kmalloc-64 of size 64 [ 167.947842][ T8025] The buggy address is located 38 bytes inside of [ 167.947842][ T8025] 47-byte region [ffff888029978b80, ffff888029978baf) [ 167.951829][ T8025] [ 167.952635][ T8025] The buggy address belongs to the physical page: [ 167.954632][ T8025] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29978 [ 167.957350][ T8025] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 167.959601][ T8025] page_type: f5(slab) [ 167.960867][ T8025] raw: 00fff00000000000 ffff88801bc428c0 dead000000000100 dead000000000122 [ 167.964229][ T8025] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 167.967774][ T8025] page dumped because: kasan: bad access detected [ 167.970405][ T8025] page_owner tracks the page as allocated [ 167.972743][ T8025] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5758, tgid 5758 (syz-executor), ts 54367816026, free_ts 54259423144 [ 167.981062][ T8025] post_alloc_hook+0xfd/0x120 [ 167.983009][ T8025] get_page_from_freelist+0xf48/0x3530 [ 167.985268][ T8025] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 167.987761][ T8025] new_slab+0xa2/0x640 [ 167.989406][ T8025] refill_objects+0xe3/0x410 [ 167.991339][ T8025] __pcs_replace_empty_main+0x376/0x680 [ 167.993318][ T8025] __kmalloc_cache_noprof+0x479/0x6c0 [ 167.995010][ T8025] mpls_dev_notify+0x234/0x920 [ 167.996528][ T8025] notifier_call_chain+0x99/0x3f0 [ 167.998115][ T8025] call_netdevice_notifiers_info+0xbe/0x110 [ 167.999995][ T8025] register_netdevice+0x1998/0x25a0 [ 168.001619][ T8025] veth_newlink+0x316/0xa00 [ 168.003288][ T8025] rtnl_newlink+0x1499/0x2380 [ 168.004824][ T8025] rtnetlink_rcv_msg+0x95e/0xe90 [ 168.006377][ T8025] netlink_rcv_skb+0x159/0x420 [ 168.007914][ T8025] netlink_unicast+0x585/0x850 [ 168.009411][ T8025] page last free pid 5752 tgid 5752 stack trace: [ 168.011364][ T8025] __free_frozen_pages+0x79f/0x1090 [ 168.013072][ T8025] tlb_remove_table_rcu+0x2cf/0x380 [ 168.014732][ T8025] rcu_core+0x5a2/0x10d0 [ 168.016070][ T8025] handle_softirqs+0x1ea/0x9b0 [ 168.017582][ T8025] do_softirq+0xac/0xe0 [ 168.019167][ T8025] __local_bh_enable_ip+0xf8/0x120 [ 168.021039][ T8025] __alloc_skb+0x5db/0x710 [ 168.022405][ T8025] alloc_uevent_skb+0x7d/0x210 [ 168.023875][ T8025] kobject_uevent_env+0x122c/0x18b0 [ 168.025519][ T8025] device_add+0x1173/0x1970 [ 168.026970][ T8025] netdev_register_kobject+0x1a9/0x3d0 [ 168.028679][ T8025] register_netdevice+0x15b6/0x25a0 [ 168.030212][ T8025] veth_newlink+0x316/0xa00 [ 168.031970][ T8025] rtnl_newlink+0x1499/0x2380 [ 168.033878][ T8025] rtnetlink_rcv_msg+0x95e/0xe90 [ 168.035935][ T8025] netlink_rcv_skb+0x159/0x420 [ 168.037958][ T8025] [ 168.038959][ T8025] Memory state around the buggy address: [ 168.041149][ T8025] ffff888029978a80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 168.044275][ T8025] ffff888029978b00: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 168.047503][ T8025] >ffff888029978b80: 00 00 00 00 00 07 fc fc fc fc fc fc fc fc fc fc [ 168.050765][ T8025] ^ [ 168.052866][ T8025] ffff888029978c00: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 168.056174][ T8025] ffff888029978c80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 168.059282][ T8025] ================================================================== [ 168.062838][ T42] audit: type=1800 audit(1785617090.724:242): pid=5157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=16136 res=0 errno=0 [ 168.078941][ T8025] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 168.081999][ T8025] CPU: 3 UID: 0 PID: 8025 Comm: syz.2.525 Tainted: G L syzkaller #0 PREEMPT(full) [ 168.085941][ T8025] Tainted: [L]=SOFTLOCKUP [ 168.087298][ T8025] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.091326][ T8025] Call Trace: [ 168.092727][ T8025] [ 168.093970][ T8025] dump_stack_lvl+0x100/0x190 [ 168.095951][ T8025] vpanic+0x552/0x970 [ 168.097630][ T8025] ? __pfx_vpanic+0x10/0x10 [ 168.099500][ T8025] panic+0xd1/0xe0 [ 168.101004][ T8025] ? __pfx_panic+0x10/0x10 [ 168.102842][ T8025] ? preempt_schedule_common+0x42/0xc0 [ 168.105097][ T8025] ? f_uac2_opts_p_srate_store+0x1d4/0x260 [ 168.107502][ T8025] check_panic_on_warn.cold+0x19/0x34 [ 168.109685][ T8025] ? f_uac2_opts_p_srate_store+0x1d4/0x260 [ 168.112121][ T8025] end_report.part.0+0x3a/0x90 [ 168.114149][ T8025] kasan_report_invalid_free.cold+0xd/0x12 [ 168.116594][ T8025] ? f_uac2_opts_p_srate_store+0x1d4/0x260 [ 168.119025][ T8025] ? f_uac2_opts_p_srate_store+0x1d4/0x260 [ 168.121478][ T8025] ? f_uac2_opts_p_srate_store+0x1d4/0x260 [ 168.123961][ T8025] check_slab_allocation+0xe1/0xf0 [ 168.126059][ T8025] ? f_uac2_opts_p_srate_store+0x100/0x260 [ 168.128469][ T8025] kfree+0x1b6/0x6c0 [ 168.130110][ T8025] ? __asan_memcpy+0x3c/0x60 [ 168.131742][ T8025] f_uac2_opts_p_srate_store+0x1d4/0x260 [ 168.134024][ T8025] ? __pfx_f_uac2_opts_p_srate_store+0x10/0x10 [ 168.136563][ T8025] ? configfs_write_iter+0x388/0x4e0 [ 168.138749][ T8025] configfs_write_iter+0x302/0x4e0 [ 168.140895][ T8025] vfs_write+0x6ac/0x1050 [ 168.142630][ T8025] ? __pfx_configfs_write_iter+0x10/0x10 [ 168.145009][ T8025] ? __pfx_vfs_write+0x10/0x10 [ 168.147003][ T8025] ? find_held_lock+0x2b/0x80 [ 168.149006][ T8025] ksys_write+0x12a/0x250 [ 168.150786][ T8025] ? __pfx_ksys_write+0x10/0x10 [ 168.152788][ T8025] __do_fast_syscall_32+0xe7/0x970 [ 168.154950][ T8025] do_fast_syscall_32+0x32/0x70 [ 168.156961][ T8025] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 168.159618][ T8025] RIP: 0023:0xf702efec [ 168.161303][ T8025] Code: Unable to access opcode bytes at 0xf702efc2. [ 168.164024][ T8025] RSP: 002b:00000000f541d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 168.167398][ T8025] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000440 [ 168.170899][ T8025] RDX: 000000000000002e RSI: 0000000000000000 RDI: 0000000000000000 [ 168.174183][ T8025] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 168.177366][ T8025] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 168.180600][ T8025] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 168.183864][ T8025] [ 168.185835][ T8025] Kernel Offset: disabled [ 168.187610][ T8025] Rebooting in 86400 seconds.. VM DIAGNOSIS: 20:44:50 Registers: info registers vcpu 0 CPU#0 RAX=dffffc0000000000 RBX=ffffc90002d87b40 RCX=ffffffff851a89ee RDX=ffffc90002d87d52 RSI=0000000000000000 RDI=ffffc90002d87d52 RBP=0000000000000000 RSP=ffffc90002d87998 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff851a8a63 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096bdf000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f72bf000 CR3=0000000055b1b000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000005000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000001 RBX=0000000008000000 RCX=ffffffff8211fe71 RDX=0000000000000000 RSI=ffffffff8c400a00 RDI=0000000008000000 RBP=ffffc90005057f20 RSP=ffffc90005057ed0 R8 =0000000000000001 R9 =fffffbfff224561a R10=ffffffff9122b0d7 R11=0000000000000000 R12=ffff888044594a80 R13=0000000000000014 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff81ae0830 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096cdf000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000000000000000 CR3=0000000047f53000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000000 RBX=ffff88804e7f5a40 RCX=ffffffff829087e1 RDX=1ffff11009cfeb48 RSI=0000000000004000 RDI=0000000000006000 RBP=0000000000000001 RSP=ffffc900075b7990 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 R12=0000000000004000 R13=0000000000000000 R14=ffffffff82bcd5e0 R15=ffff88804e7f5a42 RIP=ffffffff8209a840 RFL=00000206 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007fb2b3669880 ffffffff 00c00000 GS =0000 ffff888096ddf000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000000005765b21c CR3=000000006d5fe000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=00000000c0c40000 Opmask01=0000000000000001 Opmask02=000000000000ffdf Opmask03=0000000000000000 Opmask04=00000000ffffefff Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 372f6b636f6c622f 7665642f7379732f ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00323a372f6b636f 6c622f7665642f73 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005654f728e0b0 00005654f728e0b0 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fb2b2ff1b20 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000ff0000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000ff000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffff000000000000 ffffffff00000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2a2a2a2a2a2a15d5 2a2a2a2a2a2a2a20 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2a2a559898c18a4a 2a2a2a2a4159434e ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 20676e6964616572 004b4f2034366f66 6e695f706f6f6c20 676e696461657200 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 05424b4c41444057 004b4f0511134a43 4b4c5f554a4a4905 424b4c4144405700 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 7361647c2a737369 63637c2a65686361 63627c2a6476787c 2a64767c2a72737c ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005654f729c660 00005654f728f510 00005654f72948d0 00005654f7290a70 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005654f72898e0 00005654f7319180 00005654f7293d20 00005654f728f730 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005654f7293a20 00005654f728b630 00005654f72a2040 00005654f7299790 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005654f72918a0 00005654f728fe40 00005654f729aab0 00005654f728aa30 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00005f4d4f521b00 3a3935353031373a 0000000000000021 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000700 0000000000000703 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=dffffc0000000060 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=ffffffff85a132b0 RDI=ffffffff9b9f71a0 RBP=ffffffff9b9f7160 RSP=ffffc900078cf540 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=7a7973203a6d6d43 R12=0000000000000000 R13=0000000000000020 R14=fffffbfff373ee86 R15=dffffc0000000000 RIP=ffffffff85a132d7 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096edf000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00000000f702f000 CR3=000000005c77a000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001f000000000 0000000400000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000