last executing test programs: 5.094173071s ago: executing program 1 (id=245): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0xb35a, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x88fd537e5e114b6f, 0x12, r3, 0x0) getsockname$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000200)=0x1c) ioctl$UI_SET_LEDBIT(r2, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x11) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@ipv6_newrule={0x1c, 0x20, 0x2d2c6d60ea1da725, 0x70bd2b, 0x25dfdbf9, {0xa, 0x0, 0x20, 0xcd, 0x1, 0x0, 0x0, 0x1, 0x13}}, 0x1c}, 0x1, 0x0, 0x0, 0x845}, 0x4000000) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000100)={{0x548, 0x0, 0x896a}, 'syz0\x00', 0x1c}) r5 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582"], 0x0) syz_usb_control_io$cdc_ecm(r5, &(0x7f0000000140)={0xc, 0x0, 0x0}, &(0x7f0000000240)={0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="2014120000003219fad1a560da0781c2106a5bd2cb999f14"], 0x0, 0x0}) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt(r6, 0x8, 0xfffffffc, &(0x7f0000000340)=""/253, &(0x7f0000000440)=0xfd) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x34, 0x9, 0x6, 0x801, 0x0, 0x21000000, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x39}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x2}}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) syz_usb_ep_write$ath9k_ep1(r5, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) ioctl$UI_SET_LEDBIT(r2, 0x40045569, 0x4) ioctl$UI_DEV_CREATE(r2, 0x5501) ioctl$UI_DEV_DESTROY(r2, 0x5502) syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2, 0x9}}}}}}, 0x0) 3.520634025s ago: executing program 2 (id=262): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000340)={0x27800000000, 0x0, 0x9, 0xffffffffffffffff, 0x6}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000061199c00000000070000000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=@newqdisc={0x44, 0x24, 0xd0f, 0x200000, 0x25dfdbfe, {0x60, 0x0, 0x0, r4, {0x0, 0x2}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0xfffffffffffffecf, 0x3, {0x6, 0xf, 0x0, 0x7}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8814}, 0x24008004) 3.410841588s ago: executing program 2 (id=263): r0 = socket$inet(0x2, 0x4000000000000001, 0x6) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000180)) (async) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) (async) r2 = socket(0x2, 0x80805, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000540)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0x6, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES16=r2], 0x31c}, 0x1, 0x0, 0x0, 0x4050}, 0x4800) (async) syz_emit_ethernet(0xf4, &(0x7f00000009c0)=ANY=[@ANYBLOB="ffffffffffff0180c20000000004d4ff0b5cd9e5f63744c0376392f0197eeaa0eff6cba6377e6724f3657001b48d47cbcb0e0d8972088a6df313122cfef9d6204658c3eeef1fc774bfb129530681f7efa3a52e124ec242f8674265f7fc2b9d5c1bfd455e1f2faf711cefdbe51cedc475fe2e080e561f5cdab7961855da1a7bb8240ee2b536eb9957ae48380c2501258839669f001707138acb8a046c68bef8de20c1592ce49ac9d0c6035cbc25195ef62dc8794c8e4e18e474c5f5836a83f3211b7e3090c2d5c4ef02f773e4b642e99e20930d09f2993ffbd4124ecf9d060f41e95ffb7ebde300000000"], 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r4) sendmsg$NLBL_CALIPSO_C_REMOVE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, r5, 0x1, 0x70bd25, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x4008000) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000280)=ANY=[@ANYBLOB='d\x00\x00\b', @ANYRESOCT=r3, @ANYBLOB="7829eca9de9891203eea18280016be21fb1777a31659615d286ff72b61ee23d917c0a562eb690e0edae8640d240035af4f5c", @ANYRESOCT=r2, @ANYBLOB="48002f8008000100030000000c0002000203aa8aaaaaaaaa30000380240003800600010002000000060003"], 0x64}}, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) (async) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000003c0)={0x0}}, 0x8044) (async) r6 = io_uring_setup(0x726f, &(0x7f0000000440)={0x0, 0x826f, 0x40, 0x3, 0x118}) io_uring_register$IORING_REGISTER_BUFFERS(r6, 0x0, &(0x7f0000000840)=[{&(0x7f0000000340)=""/141, 0x8d}], 0x113e) (async) r7 = syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo/3\x00') read$FUSE(r7, &(0x7f00000040c0)={0x2020}, 0x2020) (async) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, 0x0, 0x0) (async) r9 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0xb, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x69}, {@remote, 0x4e24, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44) (async) sendmsg$sock(r9, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev, 0x9}, 0x80, 0x0}, 0x0) (async) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r10) sendmsg$NLBL_CIPSOV4_C_REMOVE(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="14000000", @ANYRES16=r11, @ANYBLOB="10002cbd7000fddbdf25020000005c800d01fe590e77683c3fc2a1912e9269787c56a24fb4d38848247eca26501b7f5052164ddfa585c549e386c89ef6dea12ea463b4cf4f03c28ac37f07d279402121bb7770902c8641abea6705572ad943d958583130ea9b"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4044001) 3.410341871s ago: executing program 2 (id=264): add_key(0x0, 0x0, &(0x7f00000000c0)="32fba588039a5f47a6", 0x9, 0xfffffffffffffff8) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791090000000000062000018000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x5, '\x00', 0x0, @flow_dissector}, 0x48) r0 = bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0), 0x4c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x40}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000200)='binder\x00', 0x40000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$tipc(0x1e, 0x5, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r1, 0x0, 0x42, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000080)={0x41, 0x4, 0x1}, 0x10) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000280)=@o_path={&(0x7f0000000240)='./proc\x00', r1, 0x4000, r0}, 0x14) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000100)="46f8ea0af174b849d4b8f0444e9389a2881d88e17dbac12598eb426699107c8dd3656d2190e5332075d6d902d7a4079448c02fb4cdd505b7a4b9ee065b83f3981177c23154ea0f0e2d13a6b4700a1f64944a42d8834a1739bf5db26344defddd02dcb788fd758697f608fb88be155dc2db8a58e3092d559a7ef229be4dadd843bfaf0b99652cb128a8b13e", 0x8b}], 0x1) 3.330122689s ago: executing program 2 (id=265): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) fstatat64(0xffffff9c, &(0x7f0000000340)='./file0/../file0\x00', &(0x7f0000000380), 0x6100) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101) mknod$loop(&(0x7f0000000300)='./tracing\x00', 0x2, 0x1) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000240)=[0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_ADDFB(r0, 0xc01c64ae, &(0x7f00000002c0)={r1, 0x6, 0x3, 0x2, 0xc, 0x8f, 0x3}) mount_setattr(r0, &(0x7f00000001c0)='./tracing\x00', 0x1000, &(0x7f0000000200)={0x8, 0x70, 0x40000, {r0}}, 0x20) 3.329818255s ago: executing program 2 (id=266): ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000001140)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x4, 0x800000000000008, 0x0, 0x0, 0x9, 0x1d, "faf97557e5a1149989fc8dbec3bd02b82a128bbad0099cebdc25f5ac00", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7b55cd0a5d81cd4a524bd3ffe70c7f2a04002f7b6aa54cc50a1fcaed1e1508374800", "715237641a8ccf162e43ac61f700000000009b4100", [0x9, 0x2a]}}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x4, 0x6, 0xff, 0x42}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000780), &(0x7f0000000180), 0x619, r0}, 0x38) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) (async, rerun: 64) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r2) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) (rerun: 64) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f00)={&(0x7f0000000ec0)={0x1c, r3, 0x1, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}}, 0x2) (async) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote, 0x218}, 0x1c) (async) r5 = socket(0x10, 0x80002, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r7 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@enum={0x2, 0x0, 0x0, 0xf}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x28}, 0x20) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x4, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, r10, 0x0, 0x1}, 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000001b40)={0x0, 0x0, 0x0, 0x0, 0xff, r11}, 0x38) (async) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f0000000200)={[0x1, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x3, 0x4002004be, 0x7ff, 0x9, 0x6, 0x400, 0x80, 0x9, 0x0, 0x3, 0x8d], 0x100000, 0x2c49c6}) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) (async, rerun: 32) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) (rerun: 32) set_thread_area(&(0x7f0000000000)={0xffffffff}) (async) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000001800010000000000000000000a002000000000000000000018001600140001000100000000000000000010000000000008000400", @ANYRES32=r12, @ANYBLOB="0600150007"], 0x44}}, 0x0) getsockname$inet6(r1, &(0x7f0000000040), &(0x7f0000000100)=0x1c) (async) sendmmsg$alg(r5, &(0x7f00000000c0), 0x492492492492627, 0x0) 2.980194639s ago: executing program 2 (id=270): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000300)=[@in={0x2, 0x4e22, @private=0x11}]}, &(0x7f0000000340)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r1, @in={{0x2, 0x4e23, @broadcast}}, 0x4, 0x0, 0x54c, 0x0, 0xa17433da3c5d69a5, 0x2, 0x85}, 0x9c) 2.923116232s ago: executing program 32 (id=270): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000300)=[@in={0x2, 0x4e22, @private=0x11}]}, &(0x7f0000000340)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r1, @in={{0x2, 0x4e23, @broadcast}}, 0x4, 0x0, 0x54c, 0x0, 0xa17433da3c5d69a5, 0x2, 0x85}, 0x9c) 2.047972369s ago: executing program 1 (id=273): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='temp_file\x00', 0x42, 0x1ff) write(r1, &(0x7f0000000080)='/dev/mapper/control', 0x13) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="030300400000fbdbdf250c00000008000300", @ANYRES32=r4, @ANYBLOB="995c655615f914020d2c0c09a65e78f147974ac6b3bdbc14fa"], 0x1c}, 0x1, 0x0, 0x0, 0x4c0c0}, 0x4004010) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a3200000000a0000000060a010400000000000000000100000208000b400000000078000480340001800b000100657874686472000024000280080001400000000c080003400000000208000440000000220500020007000000400001800c0001006269747769736500300002800800034000000002080001400000001408000240000000120c000780080001001f00000b08000640000000010900010073797a30"], 0x114}}, 0x0) lseek(r2, 0x0, 0x0) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) read(r1, &(0x7f0000000100), 0x14) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000300)={0x3, &(0x7f0000000240)=[{0x15, 0x0, 0x0, 0x1}, {0x54}, {0x6, 0x0, 0xa, 0x5}]}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$UBLK_U_CMD_START_DEV(r6, 0xc0207506, &(0x7f0000000440)={0x0, 0xffff, 0x0, 0x0, 0x0}) capget(&(0x7f00000004c0)={0x20080522, r7}, &(0x7f0000000500)={0x4a, 0xaaf, 0x80000000, 0x6, 0x1, 0x2}) ioctl(r6, 0xc138fd12, 0x0) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, &(0x7f0000000040)={'\x00', 0x7f, 0xa56, 0xfffffeff, 0x7, 0x9, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000140)={r0}) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x1a51, 0x95, 0x4, 0x4, 0x5ea7}, &(0x7f0000000240)=0x98) capget(&(0x7f0000000380)={0x20071026, r8}, &(0x7f0000000400)={0x9, 0xfffffff7, 0x1000, 0x4, 0x4, 0x5}) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r9, 0x84, 0xa, &(0x7f0000000280)={0x0, 0x40, 0x8008, 0x7fffffff, 0xa9, 0x3d, 0x5, 0x80000001, r10}, 0x20) capset(&(0x7f0000000080)={0x19980330, r8}, &(0x7f00000000c0)={0x3, 0x6, 0x1, 0x2, 0xfffffffb, 0x7}) syz_open_dev$hiddev(&(0x7f00000002c0), 0xd, 0x240001) ioctl$AUTOFS_DEV_IOCTL_VERSION(r1, 0xc0189371, &(0x7f0000000300)={{0x1, 0x1, 0x18, r6}, 'temp_file\x00'}) write(r11, &(0x7f0000000100)="520000002300010100020600"/41, 0xfffffffffffffed7) 1.920378878s ago: executing program 1 (id=274): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet6(r0, 0x0, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x11) (async) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000100)={{0x104, 0x80, 0x0, 0x6a8}, 'syz1\x00', 0x2f}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r4, &(0x7f0000000440)={0xa, 0x4e21, 0x7, @loopback, 0x1}, 0x1c) listen(r4, 0x50) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000600)=0x1, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e21, @local}], 0x10) listen(r5, 0x7) (async) listen(r5, 0x7) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) (async) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_batadv\x00', {0x1}, 0x2a}) socket$kcm(0x11, 0x3, 0x0) (async) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, 0x0, 0x0) (async) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, 0x0, 0x0) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) (async) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 1.650472783s ago: executing program 0 (id=276): r0 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r2, 0x80184132, &(0x7f0000000340)) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000420001000000000000000000030100000f0000003c00010000112233445566778899aabb86dd2c00001c0000110001110000010101010253aa58fe6cbdf0357065ae44132403b1fd606412c32506006704000280040003"], 0x5c}}, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000000c0), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x440c0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {r2}}, './proc/thread-self/fail-nth\x00'}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000700)={{r4}, &(0x7f0000000200), &(0x7f00000006c0)='%-5lx \x00'}, 0x1c) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r5, &(0x7f0000000000)='3', 0x4e) socket$nl_netfilter(0x10, 0x3, 0xc) openat$vcs(0xffffffffffffff9c, &(0x7f0000000180), 0x88000, 0x0) sendmsg$nl_route_sched_retired(0xffffffffffffffff, 0x0, 0x4040404) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4f}, @NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}, 0x1, 0x0, 0x0, 0x40}, 0x24000840) openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000300)={0x52, 0x0, 0x8, {0x0, 0x1}, {0x74, 0x2}, @const={0x0, {0x0, 0x33fe, 0x0, 0xfffc}}}) r7 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) write$char_usb(r7, &(0x7f0000000040)="e2", 0xff0f) ioctl$EVIOCGKEY(r7, 0x80404518, &(0x7f00000005c0)=""/218) pwritev(r0, &(0x7f0000000480)=[{&(0x7f0000000000)='1', 0x1}], 0x1, 0x8, 0xb) 1.560324389s ago: executing program 0 (id=278): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r1 = bpf$ITER_CREATE(0xb, 0x0, 0x0) close(r1) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = fsopen(0x0, 0x0) r3 = fsmount(r2, 0x0, 0x18) symlinkat(0x0, r3, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000440)={r1, 0xffffffffffffffff, 0x4, r0}, 0xf) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="09000000700000000094d8fde8ff29039a7d"], 0x18}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x9d) mprotect(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x5) msync(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x6) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) openat$nvram(0xffffff9c, &(0x7f0000000000), 0x400, 0x0) openat$hpet(0xffffff9c, &(0x7f0000000040), 0x4000, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r6, 0x100000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r7, &(0x7f0000000200)='1', 0x1) close(r7) r8 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r8, &(0x7f0000000340)='1\n', 0x2) 1.49866986s ago: executing program 0 (id=279): socket$inet6_tcp(0xa, 0x1, 0x0) (async) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) (async) fcntl$lock(0xffffffffffffffff, 0x23, &(0x7f0000000400)={0x0, 0x0, 0xfd8b, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async, rerun: 64) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x5}) (async, rerun: 64) socket$inet6(0xa, 0x80002, 0x0) (async, rerun: 32) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) (async) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, &(0x7f0000000180)="707a73408b202e2f66696c65303a30", 0xf) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x1e00, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async, rerun: 64) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) (async, rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'dh\x00', 0x10, 0x5, 0x2d}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000000)={0x6, @multicast1, 0x0, 0x0, 'none\x00', 0x3a, 0x5, 0x54}, 0x2c) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 64) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) 1.369691617s ago: executing program 3 (id=280): r0 = socket$nl_route(0x10, 0x3, 0x0) iopl(0x3) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="5c00000010000104000000a916834f", @ANYRES32=0x0, @ANYBLOB="eab0817dbdb5f31a24001280110001006272696467655f736c617665000000000c00058005001c0000000000140003006272696467655f736c6176655f30000004001a80"], 0x5c}, 0x1, 0x0, 0x0, 0x24044054}, 0x4040) open(&(0x7f0000000040)='./file0\x00', 0x86080, 0x181) 988.056643ms ago: executing program 1 (id=281): r0 = semget(0x1, 0x3, 0x19) semctl$IPC_INFO(r0, 0x2, 0x3, &(0x7f0000000000)=""/219) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000480)=@getneigh={0x14, 0x1e, 0x800, 0x70bd29, 0x25dfdbfc, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20040004}, 0x0) r2 = semget(0x1, 0x4, 0x39c) semctl$GETNCNT(r2, 0x4, 0xe, &(0x7f0000000340)=""/4096) semctl$SETALL(r2, 0x0, 0x11, &(0x7f0000000140)) semctl$SETALL(r2, 0x0, 0x11, &(0x7f0000000200)) semctl$SEM_STAT_ANY(r2, 0x3, 0x14, &(0x7f0000000100)=""/250) 987.690219ms ago: executing program 1 (id=282): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@delqdisc={0x58, 0x25, 0x10, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0xb, 0x6}, {0xf, 0xfff1}, {0x8, 0x6}}, [@TCA_RATE={0x6, 0x5, {0x81, 0x1}}, @TCA_RATE={0x6, 0x5, {0xf, 0xa}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0xb}, @qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x3be4}}]}, 0x58}}, 0x4c840) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_SEND_PRIO(r3, 0x6b, 0x3, 0x0, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r4, 0x8983, &(0x7f0000000080)={0x6, 'geneve1\x00', {0x1}, 0x86e}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000100)={0x0, 'veth0_to_team\x00', {0x4}, 0xdf30}) socket$nl_route(0x10, 0x3, 0x0) stat64(&(0x7f00000000c0)='./file0\x00', &(0x7f00000003c0)) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x15) r5 = semget$private(0x0, 0x2, 0x1d0) semctl$GETALL(r5, 0x0, 0xd, &(0x7f00000002c0)=""/203) semctl$SETALL(r5, 0x0, 0x11, &(0x7f0000000180)=[0x9, 0x9, 0x1]) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x4e22, 0xfffffff9, @ipv4={'\x00', '\xff\xff', @empty}, 0x4}, 0x1c) ioctl$TCSETS(r2, 0x404c4701, &(0x7f0000000040)={0x1, 0x8, 0x2, 0x400000, 0x1a, "0200d8ffffffffffffffe910000000040100"}) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newtfilter={0x44, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x5, 0x2}, {0x0, 0xfff3}, {0x9, 0xf}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x86dd}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x6}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041891}, 0x24000010) 889.983364ms ago: executing program 1 (id=283): r0 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi1\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x80000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x24) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$kcm(0x29, 0x5, 0x0) write$cgroup_pressure(r3, &(0x7f0000000140)={'full', 0x20, 0x0, 0x20, 0x2}, 0x2f) sendmmsg(r3, 0x0, 0x0, 0x20008883) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r5, &(0x7f00000006c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000540)=ANY=[@ANYBLOB="080100000a0a01080000000000000000000000030c000b4000000000000000000c000b40000000000000000073797a32000000000c0010400000000000004ac37ea3030001080005400000001208000c4000000007b400128010000180090001006861736800000000340001800b00010072656a65637400002400028005000200d6000000080001400000000005000000000000000800014000000001140001800e000100696d6d656469617465000000100001800b0001006c6f6f6b75700000280001800e000100627974656f7264657200000014000280080003400000000008000440000000b6140001800e000100627974656f726465720000000c00018008000100666962"], 0x108}, 0x1, 0x0, 0x0, 0x8000}, 0x4040810) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3) openat$cdrom(0xffffff9c, &(0x7f00000002c0), 0x101100, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32ef", 0x45}], 0x1}, 0x0) ioctl$VT_RELDISP(r1, 0x5605) ioctl$CDROM_SELECT_SPEED(0xffffffffffffffff, 0x5322, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000000)={'comedi_bond\x00', [0x4, 0x24, 0x7fffffff, 0x4, 0x90002, 0x5, 0xec, 0x890, 0x280ffa, 0xfffffffe, 0x4, 0x1, 0x1033, 0x7, 0x4c, 0x40000009, 0xfff7ffa6, 0x3ff, 0x1fe, 0x9ea, 0x3, 0xb, 0x9, 0x101, 0x1, 0x990e, 0x5, 0x18, 0x2, 0x2000006, 0x77fd]}) 500.638277ms ago: executing program 0 (id=284): socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x2, 0x0) setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000013002108000000000000000006000000", @ANYRES32=r1, @ANYBLOB="0600000021a500000c0001"], 0x2c}], 0x1}, 0x0) 500.314905ms ago: executing program 3 (id=285): mkdir(&(0x7f0000000640)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x12) chdir(&(0x7f0000001640)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ed) setxattr$incfs_metadata(&(0x7f0000000040)='./debug\x00', &(0x7f0000000080), 0x0, 0x0, 0x2) mount(0x0, 0x0, &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, &(0x7f00000001c0)=0x80) sendto$inet_nvme_icreq_pdu(0xffffffffffffffff, &(0x7f0000000200)={{0x0, 0xe, 0x80, 0x6}, 0x0, 0x0, 0x1, 0x3}, 0x80, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000180)={'bridge_slave_1\x00', &(0x7f0000000080)=@ethtool_gstrings={0x1b, 0x7}}) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(0xffffffffffffffff, 0xc1004110, &(0x7f0000000000)={0x0, [0x2, 0xffff133a, 0x2], [{0x0, 0xffffffff}, {0x2, 0xffffffff}, {0x0, 0x400ffff}, {}, {0x1}, {}, {}, {0x2, 0xfffffffc}, {0x0, 0x4}, {0x0, 0x1}, {0x0, 0xffffffff}], 0x12, 0x0, 0x0, 0x8000000}) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x7fff, 0x8, 0x94, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x4e40, &(0x7f0000000540)={0x0, 0x20b5, 0x10000, 0x42, 0x8b}, 0x0, 0x0, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @hyper}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) accept4$vsock_stream(r0, &(0x7f0000000280)={0x28, 0x0, 0x2711, @local}, 0x10, 0x800) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x1f, &(0x7f0000000000)=[0xffffffffffffffff], 0x1) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/kvm/halt_successful_poll\x00', 0x0, 0x0) read$char_usb(r6, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3a, 0x8, 0x0, 0x2, 0x0) 410.764269ms ago: executing program 0 (id=286): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r1 = bpf$ITER_CREATE(0xb, 0x0, 0x0) close(r1) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = fsopen(0x0, 0x0) r3 = fsmount(r2, 0x0, 0x18) symlinkat(0x0, r3, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x3}) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000440)={r1, 0xffffffffffffffff, 0x4, r0}, 0xf) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="09000000700000000094d8fde8ff29039a7d"], 0x18}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x5, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x9d) mprotect(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x5) msync(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x6) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) openat$nvram(0xffffff9c, &(0x7f0000000000), 0x400, 0x0) openat$hpet(0xffffff9c, &(0x7f0000000040), 0x4000, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r6, 0x100000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r7, &(0x7f0000000200)='1', 0x1) close(r7) r8 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r8, &(0x7f0000000340)='1\n', 0x2) 359.12382ms ago: executing program 0 (id=287): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000080)={0x9, 0x80000, r0}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000400)={{{@in=@loopback}}, {{@in6=@local}, 0x0, @in=@private}}, &(0x7f0000000500)=0xe4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) socket$can_j1939(0x1d, 0x2, 0x7) connect$can_j1939(r1, &(0x7f00000000c0)={0x1d, 0x0, 0x0, {0x2, 0xff, 0x3}, 0x104}, 0x18) r3 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x44, 0x24, 0xf0b, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xa, 0x9}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x100, 0x10, 0x2a43}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x6, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) 260.358736ms ago: executing program 3 (id=288): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000910095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x10000000004) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r0, r0, 0x2f, 0x3f00, @void}, 0x10) r1 = socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x0, 0x4) 180.519786ms ago: executing program 3 (id=289): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x40004}, 0x4004) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=ANY=[@ANYBLOB="3800000010ab560421bd7000fbdbdf25001f0000e51a2b90711038768eb0e0bf6a473483a3d7ea", @ANYRES32=r2, @ANYBLOB="a1b8000000000000180012800b00010069703667726500000800028004001200"], 0x38}, 0x1, 0x0, 0x0, 0x24008006}, 0x4000840) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ffd, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x94}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) sendto$packet(r0, &(0x7f0000000640)="e8b77052a9", 0x28, 0x40, &(0x7f0000000200)={0x11, 0x86dd, r2, 0x1, 0x0, 0x6, @local}, 0x14) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000002c0)={0x1, 0x58, &(0x7f0000000240)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000300)={r3, 0x3, 0x10}, 0xc) 180.204307ms ago: executing program 3 (id=290): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) setuid(0xee01) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffc, 0x6, 0x4, @buffer={0x0, 0x5, 0x0}, &(0x7f0000000340)="5bff46a13204", 0x0, 0x9, 0x0, 0x1, 0x0}) 376.342µs ago: executing program 3 (id=291): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd(0x3) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r2 = socket(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x8000}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r7, 0xae9a) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000440)={[0x2, 0x100000000, 0x0, 0x7f, 0x100000, 0x10000000000, 0x2004c8, 0x8000000, 0x0, 0x0, 0x1000000000007, 0x0, 0x5, 0x8, 0x2, 0xffffffffffffffff], 0x0, 0x200}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x8001}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000700)=@newtfilter={0x40, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0x0, 0x8001}, {0x3, 0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xfff2, 0x8001}}]}}]}, 0x40}}, 0x0) r9 = socket$packet(0x11, 0x3, 0x300) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) setresuid(0xee01, 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) sendto$packet(r9, &(0x7f0000000800)='\x00', 0x1, 0x0, &(0x7f0000000900)={0x11, 0x300, r8, 0x1, 0x0, 0x6, @local}, 0x14) r10 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x0, 0x0) ioctl$FIBMAP(r10, 0x401070c9, &(0x7f0000000000)=0x14000000) ioctl$VHOST_VDPA_GET_GROUP_NUM(r10, 0x8004af81, &(0x7f0000000140)) openat$dma_heap(0xffffff9c, &(0x7f0000000000), 0x50000, 0x0) 0s ago: executing program 4 (id=277): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$loop(0x0, 0x1, 0x100) r2 = syz_ublk_setup_io_uring(0x6a53, &(0x7f0000000040)={0x0, 0xeb07, 0x20, 0x8000, 0xa9}, &(0x7f0000000100), &(0x7f0000000180), &(0x7f00000001c0)) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000200), 0x4) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000006080)=@newtfilter={0x24, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x6}, {}, {0x7, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x4084}, 0x24040084) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000001340)=@newtaction={0x898, 0x30, 0x12f, 0x0, 0x0, {}, [{0x884, 0x1, [@m_police={0x880, 0x1, 0x0, 0x0, {{0xb}, {0x854, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}], [@TCA_POLICE_RATE={0x404, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffffe, 0x0, 0x0, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}}}], [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xffffffffffffffff}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x898}}, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x2, 0x80442) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f00000004c0), 0x208e24b) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/keys\x00', 0x0, 0x0) r7 = getpid() syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010903e6e8dc40e1050804d6a40102030109022400010c0bc0090904630e02b912d00109050204080007100109050d0028"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0}) syz_pidfd_open(r7, 0x0) syz_clone3(0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x1b, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r8}}, @printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r9, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) pread64(r6, &(0x7f0000002200)=""/224, 0xe0, 0x8d35) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) cachestat(r5, &(0x7f0000000040), &(0x7f000009de80), 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:2133' (ED25519) to the list of known hosts. [ 33.101943][ T5718] cgroup: Unknown subsys name 'net' [ 33.268885][ T5718] cgroup: Unknown subsys name 'cpuset' [ 33.271586][ T5718] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 34.189493][ T5718] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 38.217343][ T64] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.218920][ T64] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.219365][ T64] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.220097][ T64] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.220551][ T64] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 38.225454][ T5094] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 38.237451][ T5094] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 38.240370][ T5733] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 38.243723][ T5733] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 38.245954][ T5733] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 38.248577][ T5743] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 38.249327][ T5743] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 38.249867][ T5743] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 38.257245][ T5733] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 38.259834][ T5733] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 38.260148][ T5733] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 38.261258][ T5733] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 38.261557][ T5733] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 38.262997][ T5733] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 38.263396][ T5733] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 38.829022][ T5731] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.829439][ T5731] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.829504][ T5731] bridge_slave_0: entered allmulticast mode [ 38.830305][ T5731] bridge_slave_0: entered promiscuous mode [ 38.863883][ T5731] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.863956][ T5731] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.864225][ T5731] bridge_slave_1: entered allmulticast mode [ 38.865444][ T5731] bridge_slave_1: entered promiscuous mode [ 38.951103][ T5731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.951240][ T5734] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.952216][ T5734] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.952308][ T5734] bridge_slave_0: entered allmulticast mode [ 38.953612][ T5734] bridge_slave_0: entered promiscuous mode [ 38.985122][ T5744] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.985193][ T5744] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.985310][ T5744] bridge_slave_0: entered allmulticast mode [ 38.986750][ T5744] bridge_slave_0: entered promiscuous mode [ 38.993246][ T5731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.993355][ T5744] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.993472][ T5744] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.997586][ T5744] bridge_slave_1: entered allmulticast mode [ 38.998902][ T5744] bridge_slave_1: entered promiscuous mode [ 39.000553][ T5734] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.000597][ T5734] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.000663][ T5734] bridge_slave_1: entered allmulticast mode [ 39.001397][ T5734] bridge_slave_1: entered promiscuous mode [ 39.029789][ T5738] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.029864][ T5738] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.029962][ T5738] bridge_slave_0: entered allmulticast mode [ 39.031209][ T5738] bridge_slave_0: entered promiscuous mode [ 39.046670][ T5734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.056787][ T5731] team0: Port device team_slave_0 added [ 39.056871][ T5738] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.056909][ T5738] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.057082][ T5738] bridge_slave_1: entered allmulticast mode [ 39.057819][ T5738] bridge_slave_1: entered promiscuous mode [ 39.059421][ T5731] team0: Port device team_slave_1 added [ 39.069119][ T5744] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.070159][ T5734] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.071618][ T5744] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.095216][ T5738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.138958][ T5738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.145550][ T5734] team0: Port device team_slave_0 added [ 39.147044][ T5734] team0: Port device team_slave_1 added [ 39.154165][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.154176][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.154188][ T5731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.155715][ T5744] team0: Port device team_slave_0 added [ 39.172626][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.172637][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.172649][ T5731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.178694][ T5744] team0: Port device team_slave_1 added [ 39.185582][ T5738] team0: Port device team_slave_0 added [ 39.187057][ T5738] team0: Port device team_slave_1 added [ 39.187448][ T5734] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.187457][ T5734] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.187469][ T5734] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.200674][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.200684][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.200696][ T5744] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.201214][ T5734] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.201223][ T5734] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.201235][ T5734] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.209816][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.209830][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.209849][ T5744] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.221226][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.221237][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.221249][ T5738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.222209][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.222217][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.222229][ T5738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.233907][ T5731] hsr_slave_0: entered promiscuous mode [ 39.234429][ T5731] hsr_slave_1: entered promiscuous mode [ 39.263328][ T5734] hsr_slave_0: entered promiscuous mode [ 39.263735][ T5734] hsr_slave_1: entered promiscuous mode [ 39.264029][ T5734] debugfs: 'hsr0' already exists in 'hsr' [ 39.264074][ T5734] Cannot create hsr debugfs directory [ 39.289238][ T5738] hsr_slave_0: entered promiscuous mode [ 39.290051][ T5738] hsr_slave_1: entered promiscuous mode [ 39.290586][ T5738] debugfs: 'hsr0' already exists in 'hsr' [ 39.290603][ T5738] Cannot create hsr debugfs directory [ 39.293234][ T5744] hsr_slave_0: entered promiscuous mode [ 39.293658][ T5744] hsr_slave_1: entered promiscuous mode [ 39.293949][ T5744] debugfs: 'hsr0' already exists in 'hsr' [ 39.293960][ T5744] Cannot create hsr debugfs directory [ 39.553535][ T5734] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 39.557543][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.557984][ T5734] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 39.562442][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.563640][ T5734] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 39.567330][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.567898][ T5734] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 39.572434][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.624206][ T5731] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.630018][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.631085][ T5731] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.640071][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.640807][ T5731] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.647197][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.649883][ T5734] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.649974][ T5734] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.650634][ T5734] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.650727][ T5734] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.663391][ T37] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.665552][ T37] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.697712][ T5731] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.700939][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.752978][ T5738] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 39.756888][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.769502][ T5738] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 39.773181][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.773829][ T5738] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 39.777397][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.779845][ T5738] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 39.783447][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.846891][ T5734] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.851140][ T5744] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 39.854446][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.855190][ T5744] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 39.858297][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.868224][ T5744] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 39.870937][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.880318][ T5744] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 39.882860][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.887392][ T5734] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.909209][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.909262][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.910753][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.910798][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.921345][ T5731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.978932][ T5731] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.992227][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.992278][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.002028][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.002072][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.005436][ T5738] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.036670][ T5738] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.048568][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.048663][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.052192][ T5744] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.073495][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.073541][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.077188][ T5744] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.085977][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.086022][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.088815][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.088894][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.287421][ T64] Bluetooth: hci0: command tx timeout [ 40.287425][ T5094] Bluetooth: hci3: command tx timeout [ 40.287686][ T64] Bluetooth: hci2: command tx timeout [ 40.297002][ T5733] Bluetooth: hci1: command tx timeout [ 40.372432][ T5731] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.373983][ T5738] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.375801][ T5734] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.409349][ T5744] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.445246][ T5734] veth0_vlan: entered promiscuous mode [ 40.463027][ T5738] veth0_vlan: entered promiscuous mode [ 40.463458][ T5731] veth0_vlan: entered promiscuous mode [ 40.468836][ T5734] veth1_vlan: entered promiscuous mode [ 40.474798][ T5738] veth1_vlan: entered promiscuous mode [ 40.478887][ T5731] veth1_vlan: entered promiscuous mode [ 40.484473][ T5744] veth0_vlan: entered promiscuous mode [ 40.502145][ T5744] veth1_vlan: entered promiscuous mode [ 40.507565][ T5734] veth0_macvtap: entered promiscuous mode [ 40.516821][ T5734] veth1_macvtap: entered promiscuous mode [ 40.541254][ T5731] veth0_macvtap: entered promiscuous mode [ 40.545617][ T5744] veth0_macvtap: entered promiscuous mode [ 40.547040][ T5738] veth0_macvtap: entered promiscuous mode [ 40.548556][ T5734] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.550155][ T5731] veth1_macvtap: entered promiscuous mode [ 40.556907][ T5744] veth1_macvtap: entered promiscuous mode [ 40.558952][ T5734] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.565277][ T5738] veth1_macvtap: entered promiscuous mode [ 40.577594][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.586821][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.591319][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.601158][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.604363][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.615451][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.627393][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.675432][ T1157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.675443][ T1157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.705794][ T4612] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.705807][ T4612] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.725553][ T4612] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.725565][ T4612] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.735624][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.735636][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.751385][ T1157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.751397][ T1157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.769180][ T1157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.769192][ T1157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.771961][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.772236][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.772649][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.774240][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.786978][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.786992][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.803376][ T5734] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 40.816702][ T5805] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.817759][ T74] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.817770][ T74] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.819274][ T5734] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 40.821485][ T5731] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 40.827820][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.827901][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.827919][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.827936][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.827952][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.827968][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.827982][ T5731] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 40.827984][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.828001][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.828018][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.828034][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.858680][ T5731] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 41.024924][ T5884] block nbd1: NBD_DISCONNECT [ 41.178146][ T5892] netlink: 220 bytes leftover after parsing attributes in process `syz.3.4'. [ 41.294350][ T5884] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 41.294980][ T5884] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 41.314948][ T5892] comedi comedi1: Minor 36 could not be opened [ 42.366296][ T5733] Bluetooth: hci2: command tx timeout [ 42.366317][ T5733] Bluetooth: hci0: command tx timeout [ 42.366331][ T5094] Bluetooth: hci1: command tx timeout [ 42.366368][ T5733] Bluetooth: hci3: command tx timeout [ 42.387285][ T72] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 42.536330][ T72] usb 7-1: Using ep0 maxpacket: 16 [ 42.538194][ T72] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 42.539404][ T72] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 42.539437][ T72] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 42.539449][ T72] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 42.540239][ T72] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 42.540252][ T72] usb 7-1: Manufacturer: syz [ 42.569497][ T72] usb 7-1: config 0 descriptor?? [ 42.573961][ T5905] netlink: 220 bytes leftover after parsing attributes in process `syz.3.7'. [ 42.739376][ T5909] netlink: 220 bytes leftover after parsing attributes in process `syz.0.8'. [ 42.798569][ T5910] comedi comedi1: Minor 36 could not be opened [ 43.006153][ T42] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 43.137325][ T5911] Zero length message leads to an empty skb [ 43.146176][ T5911] input: syz0 as /devices/virtual/input/input5 [ 43.176209][ T42] usb 6-1: Using ep0 maxpacket: 16 [ 43.181238][ T42] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 43.184690][ T42] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 43.184715][ T42] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 43.184778][ T42] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 43.187509][ T42] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 43.188281][ T42] usb 6-1: Manufacturer: syz [ 43.256849][ T42] usb 6-1: config 0 descriptor?? [ 43.926642][ T5918] netlink: 'syz.3.9': attribute type 10 has an invalid length. [ 43.932752][ T5920] input: syz0 as /devices/virtual/input/input6 [ 43.942443][ T5918] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 44.140922][ T5923] netlink: 220 bytes leftover after parsing attributes in process `syz.0.11'. [ 44.163517][ T5923] comedi comedi1: Minor 36 could not be opened [ 44.446461][ T64] Bluetooth: hci0: command tx timeout [ 44.458528][ T64] Bluetooth: hci3: command tx timeout [ 44.458550][ T5733] Bluetooth: hci1: command tx timeout [ 44.458560][ T64] Bluetooth: hci2: command tx timeout [ 45.074698][ T42] libceph: connect (1)[c::]:6789 error -101 [ 45.079338][ T42] libceph: mon0 (1)[c::]:6789 connect error [ 45.086505][ T42] libceph: connect (1)[c::]:6789 error -101 [ 45.086948][ T42] libceph: mon0 (1)[c::]:6789 connect error [ 45.347646][ T4772] libceph: connect (1)[c::]:6789 error -101 [ 45.347789][ T4772] libceph: mon0 (1)[c::]:6789 connect error [ 45.625152][ T50] usb 7-1: USB disconnect, device number 2 [ 45.865505][ T4772] libceph: connect (1)[c::]:6789 error -101 [ 45.872238][ T4772] libceph: mon0 (1)[c::]:6789 connect error [ 46.029155][ T854] usb 6-1: USB disconnect, device number 2 [ 46.049238][ T5935] ceph: No mds server is up or the cluster is laggy [ 46.379116][ T5930] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.14'. [ 46.521751][ T5947] block nbd0: Receive control failed (result -32) [ 46.527276][ T5094] Bluetooth: hci1: command tx timeout [ 46.527301][ T5094] Bluetooth: hci3: command tx timeout [ 46.527316][ T5094] Bluetooth: hci0: command tx timeout [ 46.536381][ T5733] Bluetooth: hci2: command tx timeout [ 46.845350][ T6001] ALSA: mixer_oss: invalid OSS volume '' [ 46.996379][ T854] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 47.148657][ T854] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 47.149751][ T854] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.149768][ T854] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.149778][ T854] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 47.149797][ T854] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.153710][ T854] usb 8-1: config 0 descriptor?? [ 47.386433][ T72] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 47.556152][ T72] usb 5-1: Using ep0 maxpacket: 16 [ 47.557283][ T72] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 47.558487][ T72] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 47.558536][ T72] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 47.558548][ T72] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 47.559418][ T72] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 47.559429][ T72] usb 5-1: Manufacturer: syz [ 47.560657][ T72] usb 5-1: config 0 descriptor?? [ 47.618877][ T854] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 47.618912][ T854] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 47.618931][ T854] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 47.618948][ T854] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 47.618965][ T854] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 47.618983][ T854] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 47.619001][ T854] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 47.619018][ T854] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 47.619035][ T854] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 47.619052][ T854] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 47.629504][ T854] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 47.667783][ T6015] ip6gretap1: entered allmulticast mode [ 47.669290][ T6015] batman_adv: batadv0: Adding interface: ip6gretap1 [ 47.669299][ T6015] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.669314][ T6015] batman_adv: batadv0: Interface activated: ip6gretap1 [ 47.725483][ T6022] smpboot: CPU 1 is now offline [ 47.741907][ T6022] 9p: Bad value for 'rfdno' [ 47.744909][ T6022] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 48.009841][ T6033] netlink: 220 bytes leftover after parsing attributes in process `syz.1.26'. [ 48.105289][ T6034] comedi comedi1: Minor 4 could not be opened [ 48.155695][ T6035] input: syz0 as /devices/virtual/input/input7 [ 48.794940][ T6040] netlink: 220 bytes leftover after parsing attributes in process `syz.2.27'. [ 48.920352][ T6041] comedi comedi1: Minor 4 could not be opened [ 48.962005][ T5996] usb 8-1: string descriptor 0 read error: -71 [ 49.096844][ T42] usb 8-1: reset high-speed USB device number 2 using dummy_hcd [ 49.118329][ T6044] netlink: 220 bytes leftover after parsing attributes in process `syz.1.28'. [ 49.220367][ T6045] comedi comedi1: Minor 4 could not be opened [ 49.386176][ T42] usb 8-1: device descriptor read/64, error -32 [ 49.656211][ T42] usb 8-1: reset high-speed USB device number 2 using dummy_hcd [ 49.664780][ T6047] kvm: pic: non byte read [ 49.673520][ T6047] kvm: pic: non byte read [ 49.680043][ T6047] kvm: pic: non byte read [ 49.682390][ T6047] kvm: pic: single mode not supported [ 49.682449][ T6047] kvm: pic: level sensitive irq not supported [ 49.682903][ T6047] kvm: pic: non byte read [ 49.694916][ T6047] kvm: pic: non byte read [ 49.701103][ T6047] kvm: pic: non byte read [ 49.704567][ T6047] kvm: pic: non byte read [ 49.711132][ T6047] kvm: pic: non byte read [ 49.728936][ T6047] kvm: pic: level sensitive irq not supported [ 49.729355][ T6047] kvm: pic: non byte read [ 49.786336][ T42] usb 8-1: device descriptor read/64, error -32 [ 50.026866][ T42] usb 8-1: reset high-speed USB device number 2 using dummy_hcd [ 50.056766][ T42] usb 8-1: device descriptor read/8, error -32 [ 50.177549][ T5806] usb 5-1: USB disconnect, device number 2 [ 50.284515][ T6061] netlink: 220 bytes leftover after parsing attributes in process `syz.0.31'. [ 50.366157][ T42] usb 8-1: reset high-speed USB device number 2 using dummy_hcd [ 50.396471][ T42] usb 8-1: device descriptor read/8, error -32 [ 50.516249][ T42] raw-gadget.0 gadget.3: failed to queue suspend event [ 50.582567][ T5877] usb 8-1: USB disconnect, device number 2 [ 50.654469][ T6065] syz_tun: entered allmulticast mode [ 50.747886][ T6062] comedi comedi1: Minor 4 could not be opened [ 50.769941][ T6065] syz_tun: left allmulticast mode [ 50.855307][ T6067] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.855510][ T6067] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.868512][ T6067] input: syz0 as /devices/virtual/input/input8 [ 51.136603][ T5877] raw-gadget.0 gadget.3: failed to queue reset event [ 51.210048][ T5877] raw-gadget.0 gadget.3: failed to queue resume event [ 51.276155][ T5877] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 51.276360][ C1] raw-gadget.0 gadget.3: ignoring, device is not running [ 51.276443][ T5877] raw-gadget.0 gadget.3: failed to queue reset event [ 51.346223][ T5877] raw-gadget.0 gadget.3: failed to queue resume event [ 51.406297][ T5877] usb 8-1: device descriptor read/64, error -32 [ 51.527424][ T5877] raw-gadget.0 gadget.3: failed to queue suspend event [ 51.528200][ T5877] raw-gadget.0 gadget.3: failed to queue reset event [ 51.636228][ T5877] raw-gadget.0 gadget.3: failed to queue resume event [ 51.713205][ T6076] netlink: 220 bytes leftover after parsing attributes in process `syz.0.36'. [ 51.758623][ T6078] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.759182][ T6078] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.762446][ T6078] input: syz0 as /devices/virtual/input/input9 [ 51.927569][ T6080] comedi comedi1: Minor 4 could not be opened [ 52.456840][ T5877] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 52.457774][ C1] raw-gadget.0 gadget.3: ignoring, device is not running [ 52.458029][ T5877] raw-gadget.0 gadget.3: failed to queue reset event [ 52.536183][ T5877] raw-gadget.0 gadget.3: failed to queue resume event [ 52.606301][ T5877] usb 8-1: device descriptor read/64, error -32 [ 52.625680][ T6088] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 52.627089][ T6088] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 52.629847][ T6089] netlink: 220 bytes leftover after parsing attributes in process `syz.1.40'. [ 52.659146][ T6086] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 52.721846][ T5877] raw-gadget.0 gadget.3: failed to queue suspend event [ 52.722199][ T5877] usb usb8-port1: attempt power cycle [ 52.722826][ T5877] raw-gadget.0 gadget.3: failed to queue disconnect event [ 52.797063][ T5877] raw-gadget.0 gadget.3: failed to queue reset event [ 52.896278][ T5877] raw-gadget.0 gadget.3: failed to queue resume event [ 52.896610][ T5877] raw-gadget.0 gadget.3: failed to queue reset event [ 52.969624][ T6095] syz_tun: entered allmulticast mode [ 53.041519][ T6090] comedi comedi1: Minor 4 could not be opened [ 53.111220][ T5877] raw-gadget.0 gadget.3: failed to queue resume event [ 53.141364][ T6097] syz_tun: left allmulticast mode [ 53.177027][ T5877] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 53.197014][ C1] raw-gadget.0 gadget.3: ignoring, device is not running [ 53.197098][ T5877] usb 8-1: device descriptor read/8, error -32 [ 53.318437][ T5877] raw-gadget.0 gadget.3: failed to queue suspend event [ 53.320775][ T5877] raw-gadget.0 gadget.3: failed to queue reset event [ 53.386699][ T5877] raw-gadget.0 gadget.3: failed to queue resume event [ 53.446343][ T5877] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 53.467100][ C1] raw-gadget.0 gadget.3: ignoring, device is not running [ 53.468724][ T5877] usb 8-1: device descriptor read/8, error -32 [ 53.576329][ T5877] raw-gadget.0 gadget.3: failed to queue suspend event [ 53.577016][ T5877] usb usb8-port1: unable to enumerate USB device [ 53.776348][ T6109] netlink: 64 bytes leftover after parsing attributes in process `syz.3.47'. [ 53.776377][ T6109] netlink: 28 bytes leftover after parsing attributes in process `syz.3.47'. [ 54.001254][ T6105] process 'syz.1.44' launched './file2' with NULL argv: empty string added [ 54.585508][ T6125] netlink: 12 bytes leftover after parsing attributes in process `syz.1.51'. [ 54.639572][ T6125] syz.1.51 uses obsolete (PF_INET,SOCK_PACKET) [ 54.788416][ T6132] loop5: detected capacity change from 0 to 7 [ 54.825673][ T6134] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 54.833817][ T5144] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 54.833861][ T5144] Buffer I/O error on dev loop5, logical block 0, async page read [ 54.835367][ T6132] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 54.835385][ T6132] Buffer I/O error on dev loop5, logical block 0, async page read [ 54.835416][ T6132] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 54.835429][ T6132] Buffer I/O error on dev loop5, logical block 0, async page read [ 54.835448][ T6132] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 54.835462][ T6132] Buffer I/O error on dev loop5, logical block 0, async page read [ 54.835493][ T6132] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 54.835506][ T6132] Buffer I/O error on dev loop5, logical block 0, async page read [ 54.835532][ T6132] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 54.835545][ T6132] Buffer I/O error on dev loop5, logical block 0, async page read [ 54.835564][ T6132] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 54.835577][ T6132] Buffer I/O error on dev loop5, logical block 0, async page read [ 54.835586][ T6132] ldm_validate_partition_table(): Disk read failed. [ 54.835602][ T6132] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 54.835614][ T6132] Buffer I/O error on dev loop5, logical block 0, async page read [ 54.835632][ T6132] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 54.835644][ T6132] Buffer I/O error on dev loop5, logical block 0, async page read [ 54.835663][ T6132] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 54.835675][ T6132] Buffer I/O error on dev loop5, logical block 0, async page read [ 54.835697][ T6132] Dev loop5: unable to read RDB block 0 [ 54.835753][ T6132] loop5: unable to read partition table [ 54.835876][ T6132] loop5: partition table beyond EOD, truncated [ 54.835896][ T6132] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 54.917729][ T6137] xt_IDLETIMER: label is empty or not nul-terminated [ 55.051026][ T6146] netlink: 12 bytes leftover after parsing attributes in process `syz.2.59'. [ 55.182456][ T6157] tipc: Started in network mode [ 55.182499][ T6157] tipc: Node identity ac1414aa, cluster identity 4711 [ 55.183790][ T6157] tipc: New replicast peer: 172.20.20.187 [ 55.184483][ T6157] tipc: Enabled bearer , priority 10 [ 55.186688][ T43] audit: type=1326 audit(1789088212.036:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6154 comm="syz.1.62" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 55.670302][ T6172] netlink: 8 bytes leftover after parsing attributes in process `syz.2.65'. [ 56.030644][ T6179] FAULT_INJECTION: forcing a failure. [ 56.030644][ T6179] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 56.030676][ T6179] CPU: 1 UID: 0 PID: 6179 Comm: syz.1.72 Not tainted syzkaller #0 PREEMPT(full) [ 56.030692][ T6179] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 56.030701][ T6179] Call Trace: [ 56.030706][ T6179] [ 56.030712][ T6179] dump_stack_lvl+0x100/0x190 [ 56.030736][ T6179] should_fail_ex.cold+0x5/0xa [ 56.030756][ T6179] _copy_to_user+0x32/0xd0 [ 56.030776][ T6179] simple_read_from_buffer+0xcb/0x170 [ 56.030796][ T6179] proc_fail_nth_read+0x1af/0x230 [ 56.030813][ T6179] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 56.030830][ T6179] ? rw_verify_area+0xce/0x6d0 [ 56.030853][ T6179] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 56.030868][ T6179] vfs_read+0x1e4/0xb40 [ 56.030884][ T6179] ? lock_acquire+0x1d1/0x380 [ 56.030903][ T6179] ? __fget_files+0x34/0x3d0 [ 56.030934][ T6179] ? __pfx_vfs_read+0x10/0x10 [ 56.030947][ T6179] ? find_held_lock+0x2b/0x80 [ 56.030964][ T6179] ? __fget_files+0x215/0x3d0 [ 56.030983][ T6179] ? __fget_files+0x21f/0x3d0 [ 56.031005][ T6179] ksys_read+0x12a/0x250 [ 56.031019][ T6179] ? __pfx_ksys_read+0x10/0x10 [ 56.031041][ T6179] do_int80_emulation+0x166/0x650 [ 56.031066][ T6179] asm_int80_emulation+0x1a/0x20 [ 56.031081][ T6179] RIP: 0023:0xf71175ab [ 56.031094][ T6179] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 56.031107][ T6179] RSP: 002b:00000000f53cd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 56.031122][ T6179] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53cd5d0 [ 56.031132][ T6179] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 56.031141][ T6179] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 56.031149][ T6179] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 56.031158][ T6179] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 56.031179][ T6179] [ 56.059235][ T6183] sctp: [Deprecated]: syz.3.71 (pid 6183) Use of struct sctp_assoc_value in delayed_ack socket option. [ 56.059235][ T6183] Use struct sctp_sack_info instead [ 56.194016][ T72] tipc: Node number set to 2886997162 [ 56.201427][ T35] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 56.356211][ T5524] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 56.360006][ T35] usb 5-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 56.365686][ T35] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 56.365890][ T35] usb 5-1: config 0 has no interfaces? [ 56.365988][ T35] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.421163][ T35] usb 5-1: config 0 descriptor?? [ 56.429614][ T6189] netlink: 4 bytes leftover after parsing attributes in process `syz.3.75'. [ 56.516255][ T5524] usb 6-1: Using ep0 maxpacket: 16 [ 56.516825][ T5524] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 56.517812][ T5524] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 56.517847][ T5524] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 56.517862][ T5524] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 56.519635][ T5524] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 56.519651][ T5524] usb 6-1: Manufacturer: syz [ 56.523183][ T5524] usb 6-1: config 0 descriptor?? [ 56.660957][ T6194] FAULT_INJECTION: forcing a failure. [ 56.660957][ T6194] name failslab, interval 1, probability 0, space 0, times 0 [ 56.660982][ T6194] CPU: 1 UID: 0 PID: 6194 Comm: syz.2.77 Not tainted syzkaller #0 PREEMPT(full) [ 56.660999][ T6194] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 56.661007][ T6194] Call Trace: [ 56.661013][ T6194] [ 56.661019][ T6194] dump_stack_lvl+0x100/0x190 [ 56.661044][ T6194] should_fail_ex.cold+0x5/0xa [ 56.661064][ T6194] should_failslab+0xc2/0x120 [ 56.661084][ T6194] kmem_cache_alloc_noprof+0x92/0x6a0 [ 56.661102][ T6194] ? __kernfs_new_node+0xd2/0xa10 [ 56.661125][ T6194] __kernfs_new_node+0xd2/0xa10 [ 56.661143][ T6194] ? find_held_lock+0x2b/0x80 [ 56.661162][ T6194] ? __pfx___up_read+0x10/0x10 [ 56.661184][ T6194] ? kernfs_iop_getattr+0xc4/0xf0 [ 56.661201][ T6194] ? __pfx___kernfs_new_node+0x10/0x10 [ 56.661223][ T6194] ? lock_acquire+0x1d1/0x380 [ 56.661241][ T6194] ? kernfs_root+0x23/0x2a0 [ 56.661258][ T6194] ? find_held_lock+0x2b/0x80 [ 56.661273][ T6194] ? kernfs_root+0xee/0x2a0 [ 56.661289][ T6194] ? kernfs_root+0xee/0x2a0 [ 56.661311][ T6194] kernfs_create_dir_ns+0xa6/0x2b0 [ 56.661334][ T6194] internal_create_group+0x36f/0xfb0 [ 56.661355][ T6194] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 56.661380][ T6194] ? __pfx_internal_create_group+0x10/0x10 [ 56.661406][ T6194] loop_configure+0xab9/0x1590 [ 56.661441][ T6194] ? __pfx_loop_configure+0x10/0x10 [ 56.661477][ T6194] lo_ioctl+0xe45/0x1df0 [ 56.661494][ T6194] ? stack_trace_save+0x8e/0xc0 [ 56.661512][ T6194] ? __pfx_stack_trace_save+0x10/0x10 [ 56.661535][ T6194] ? stack_depot_save_flags+0x27/0x9f0 [ 56.661555][ T6194] ? __lock_acquire+0x5c0/0x1f40 [ 56.661576][ T6194] ? tomoyo_path_number_perm+0x46d/0x580 [ 56.661597][ T6194] ? kasan_save_stack+0x3f/0x50 [ 56.661614][ T6194] ? kasan_save_stack+0x30/0x50 [ 56.661629][ T6194] ? kasan_save_track+0x14/0x30 [ 56.661645][ T6194] ? kasan_save_free_info+0x3b/0x70 [ 56.661666][ T6194] ? __kasan_slab_free+0x5f/0x80 [ 56.661683][ T6194] ? kfree+0x22b/0x6d0 [ 56.661702][ T6194] ? tomoyo_path_number_perm+0x46d/0x580 [ 56.661722][ T6194] ? security_file_ioctl_compat+0xd3/0x230 [ 56.661743][ T6194] ? __ia32_compat_sys_ioctl+0xc2/0x360 [ 56.661765][ T6194] ? __do_fast_syscall_32+0x13a/0x8b0 [ 56.661787][ T6194] ? do_fast_syscall_32+0x32/0x70 [ 56.661807][ T6194] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 56.661826][ T6194] ? __pfx_lo_ioctl+0x10/0x10 [ 56.661866][ T6194] ? blk_get_meta_cap+0xd4/0x6c0 [ 56.661885][ T6194] ? lockdep_hardirqs_on+0x7d/0x110 [ 56.661906][ T6194] ? __pfx_blk_get_meta_cap+0x10/0x10 [ 56.661924][ T6194] ? tomoyo_path_number_perm+0x28f/0x580 [ 56.661944][ T6194] ? tomoyo_path_number_perm+0x28f/0x580 [ 56.661997][ T6194] lo_compat_ioctl+0xf3/0x160 [ 56.662015][ T6194] ? __pfx_lo_compat_ioctl+0x10/0x10 [ 56.662031][ T6194] compat_blkdev_ioctl+0x682/0x7b0 [ 56.662053][ T6194] ? __pfx_compat_blkdev_ioctl+0x10/0x10 [ 56.662076][ T6194] ? __pfx_compat_blkdev_ioctl+0x10/0x10 [ 56.662096][ T6194] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 56.662121][ T6194] __do_fast_syscall_32+0x13a/0x8b0 [ 56.662142][ T6194] ? lockdep_hardirqs_on+0x7d/0x110 [ 56.662164][ T6194] do_fast_syscall_32+0x32/0x70 [ 56.662186][ T6194] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 56.662204][ T6194] RIP: 0023:0xf709efec [ 56.662219][ T6194] Code: Unable to access opcode bytes at 0xf709efc2. [ 56.662225][ T6194] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 56.662240][ T6194] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000004c0a [ 56.662249][ T6194] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 56.662258][ T6194] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 56.662266][ T6194] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 56.662275][ T6194] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 56.662295][ T6194] [ 56.662305][ T6194] loop5: detected capacity change from 0 to 7 [ 56.750809][ T6194] Dev loop5: unable to read RDB block 7 [ 56.750838][ T6194] loop5: unable to read partition table [ 56.750979][ T6194] loop5: partition table beyond EOD, truncated [ 56.750990][ T6194] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 56.844914][ T6199] FAULT_INJECTION: forcing a failure. [ 56.844914][ T6199] name failslab, interval 1, probability 0, space 0, times 0 [ 56.844940][ T6199] CPU: 1 UID: 0 PID: 6199 Comm: syz.2.78 Not tainted syzkaller #0 PREEMPT(full) [ 56.844956][ T6199] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 56.844965][ T6199] Call Trace: [ 56.844970][ T6199] [ 56.844976][ T6199] dump_stack_lvl+0x100/0x190 [ 56.845001][ T6199] should_fail_ex.cold+0x5/0xa [ 56.845020][ T6199] should_failslab+0xc2/0x120 [ 56.845040][ T6199] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 56.845059][ T6199] ? __alloc_skb+0x140/0x710 [ 56.845081][ T6199] __alloc_skb+0x140/0x710 [ 56.845099][ T6199] ? __pfx___alloc_skb+0x10/0x10 [ 56.845118][ T6199] ? skb_page_frag_refill+0x309/0x4b0 [ 56.845138][ T6199] tcp_stream_alloc_skb+0x34/0x660 [ 56.845168][ T6199] tcp_sendmsg_locked+0x140f/0x44f0 [ 56.845198][ T6199] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 56.845213][ T6199] ? lock_acquire+0x1d1/0x380 [ 56.845234][ T6199] ? do_raw_spin_lock+0x128/0x260 [ 56.845270][ T6199] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 56.845298][ T6199] ? __local_bh_enable_ip+0xa5/0x120 [ 56.845323][ T6199] tcp_sendmsg+0x2e/0x50 [ 56.845337][ T6199] ? __pfx_tcp_sendmsg+0x10/0x10 [ 56.845351][ T6199] inet_sendmsg+0xb9/0x140 [ 56.845366][ T6199] __sys_sendto+0x453/0x4e0 [ 56.845383][ T6199] ? __pfx_inet_sendmsg+0x10/0x10 [ 56.845397][ T6199] ? __pfx___sys_sendto+0x10/0x10 [ 56.845431][ T6199] ? fput+0x7c/0x100 [ 56.845450][ T6199] ? ksys_write+0x1ac/0x250 [ 56.845468][ T6199] __ia32_sys_sendto+0xdd/0x1b0 [ 56.845486][ T6199] ? __do_fast_syscall_32+0xb3/0x8b0 [ 56.845507][ T6199] ? lockdep_hardirqs_on+0x7d/0x110 [ 56.845528][ T6199] __do_fast_syscall_32+0x13a/0x8b0 [ 56.845548][ T6199] ? lockdep_hardirqs_on+0x7d/0x110 [ 56.845570][ T6199] do_fast_syscall_32+0x32/0x70 [ 56.845593][ T6199] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 56.845611][ T6199] RIP: 0023:0xf709efec [ 56.845628][ T6199] Code: Unable to access opcode bytes at 0xf709efc2. [ 56.845634][ T6199] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 56.845649][ T6199] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800004c0 [ 56.845658][ T6199] RDX: 000000000000fdef RSI: 0000000000000805 RDI: 0000000000000000 [ 56.845667][ T6199] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 56.845676][ T6199] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 56.845684][ T6199] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 56.845704][ T6199] [ 57.090253][ T6203] input: syz0 as /devices/virtual/input/input11 [ 57.178614][ T6205] Invalid ELF header magic: != ELF [ 57.680563][ T6216] FAULT_INJECTION: forcing a failure. [ 57.680563][ T6216] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 57.680588][ T6216] CPU: 1 UID: 0 PID: 6216 Comm: syz.3.82 Not tainted syzkaller #0 PREEMPT(full) [ 57.680606][ T6216] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 57.680614][ T6216] Call Trace: [ 57.680619][ T6216] [ 57.680626][ T6216] dump_stack_lvl+0x100/0x190 [ 57.680649][ T6216] should_fail_ex.cold+0x5/0xa [ 57.680683][ T6216] _copy_from_user+0x2e/0xd0 [ 57.680703][ T6216] ctl_ioctl+0xf3/0xcc0 [ 57.680722][ T6216] ? __pfx_ctl_ioctl+0x10/0x10 [ 57.680757][ T6216] ? __fget_files+0x21f/0x3d0 [ 57.680778][ T6216] dm_compat_ctl_ioctl+0x23/0x30 [ 57.680794][ T6216] ? __pfx_dm_compat_ctl_ioctl+0x10/0x10 [ 57.680808][ T6216] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 57.680833][ T6216] __do_fast_syscall_32+0x13a/0x8b0 [ 57.680856][ T6216] ? lockdep_hardirqs_on+0x7d/0x110 [ 57.680878][ T6216] do_fast_syscall_32+0x32/0x70 [ 57.680900][ T6216] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 57.680919][ T6216] RIP: 0023:0xf7ff8fec [ 57.680936][ T6216] Code: Unable to access opcode bytes at 0xf7ff8fc2. [ 57.680942][ T6216] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 57.680957][ T6216] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c138fd09 [ 57.680967][ T6216] RDX: 0000000080000300 RSI: 0000000000000000 RDI: 0000000000000000 [ 57.680975][ T6216] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 57.680983][ T6216] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 57.680992][ T6216] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 57.681011][ T6216] [ 57.952894][ T50] usb 5-1: USB disconnect, device number 3 [ 57.978146][ T6227] Bluetooth: MGMT ver 1.23 [ 57.984404][ T6227] netlink: 'syz.3.87': attribute type 1 has an invalid length. [ 57.984417][ T6227] netlink: 20 bytes leftover after parsing attributes in process `syz.3.87'. [ 58.140101][ T6229] pci_bus 0000:01: busn_res: [bus 01] is released [ 58.164689][ T6230] pci 0000:00:04.0: [8086:3420] type 01 class 0x060400 PCIe Root Port [ 58.174676][ T6230] pci 0000:00:04.0: PCI bridge to [bus 01] [ 58.174853][ T6230] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 58.174946][ T6230] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 58.176697][ T6230] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 58.177331][ T6230] pci 0000:00:04.0: enabling Extended Tags [ 58.195523][ T6230] pci 0000:00:04.0: Adding to iommu group 4 [ 58.214030][ T6230] pci 0000:00:04.0: PCI bridge to [bus 01] [ 58.218262][ T6230] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff 64bit pref] to [bus 01] add_size 200000 add_align 100000 [ 58.218293][ T6230] pci 0000:00:04.0: bridge window [mem 0x00100000-0x000fffff] to [bus 01] add_size 200000 add_align 100000 [ 58.218362][ T6230] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff]: assigned [ 58.218377][ T6230] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref]: assigned [ 58.218391][ T6230] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff]: assigned [ 58.218480][ T6230] pci 0000:00:04.0: PCI bridge to [bus 01] [ 58.218539][ T6230] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 58.219985][ T6230] pci 0000:00:04.0: bridge window [mem 0x80000000-0x801fffff] [ 58.221295][ T6230] pci 0000:00:04.0: bridge window [mem 0x580000000-0x5801fffff 64bit pref] [ 58.293341][ T6230] pcieport 0000:00:04.0: PME: Signaling with IRQ 25 [ 58.301663][ T6230] pcieport 0000:00:04.0: AER: enabled with IRQ 26 [ 58.610141][ T6244] Invalid ELF header magic: != ELF [ 58.962036][ T6259] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 58.962061][ T6259] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 58.963552][ T6259] vhci_hcd vhci_hcd.0: Device attached [ 58.981004][ T6259] netlink: 8 bytes leftover after parsing attributes in process `syz.2.97'. [ 59.062169][ T6260] vhci_hcd: connection closed [ 59.064981][ T12] vhci_hcd vhci_hcd.2: stop threads [ 59.065421][ T12] vhci_hcd vhci_hcd.2: release socket [ 59.065448][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 59.128992][ T35] usb 6-1: USB disconnect, device number 3 [ 59.204887][ T6264] FAULT_INJECTION: forcing a failure. [ 59.204887][ T6264] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 59.204909][ T6264] CPU: 0 UID: 0 PID: 6264 Comm: syz.1.98 Not tainted syzkaller #0 PREEMPT(full) [ 59.204922][ T6264] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 59.204928][ T6264] Call Trace: [ 59.204933][ T6264] [ 59.204938][ T6264] dump_stack_lvl+0x100/0x190 [ 59.204956][ T6264] should_fail_ex.cold+0x5/0xa [ 59.204971][ T6264] __fpu_restore_sig+0xa92/0x13b0 [ 59.204988][ T6264] ? __lock_acquire+0x5c0/0x1f40 [ 59.205004][ T6264] ? __pfx___fpu_restore_sig+0x10/0x10 [ 59.205021][ T6264] ? __pte_offset_map+0x179/0x310 [ 59.205037][ T6264] ? __might_fault+0xc5/0x140 [ 59.205056][ T6264] fpu__restore_sig+0x151/0x190 [ 59.205085][ T6264] ia32_restore_sigcontext+0x456/0x620 [ 59.205103][ T6264] ? __pfx_ia32_restore_sigcontext+0x10/0x10 [ 59.205126][ T6264] ? rcu_is_watching+0x13/0xc0 [ 59.205137][ T6264] ? _raw_spin_unlock_irq+0x23/0x50 [ 59.205151][ T6264] ? lockdep_hardirqs_on+0x7d/0x110 [ 59.205168][ T6264] __do_compat_sys_rt_sigreturn+0x18c/0x270 [ 59.205186][ T6264] ? __pfx___ia32_compat_sys_rt_sigreturn+0x10/0x10 [ 59.205208][ T6264] do_int80_emulation+0x166/0x650 [ 59.205226][ T6264] asm_int80_emulation+0x1a/0x20 [ 59.205238][ T6264] RIP: 0023:0xf6fdefea [ 59.205247][ T6264] Code: 19 85 d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 80 5d 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 59.205257][ T6264] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 [ 59.205266][ T6264] RAX: 00000000000000f0 RBX: 000000008000cffc RCX: 0000000000000006 [ 59.205272][ T6264] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 59.205278][ T6264] RBP: 00000000fffffffe R08: 0000000000000000 R09: 0000000000000000 [ 59.205285][ T6264] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 59.205294][ T6264] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 59.205314][ T6264] [ 60.048557][ T35] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 60.216383][ T35] usb 5-1: Using ep0 maxpacket: 16 [ 60.219132][ T35] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 60.220252][ T35] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 60.220287][ T35] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 60.220304][ T35] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 60.223717][ T35] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 60.223735][ T35] usb 5-1: Manufacturer: syz [ 60.225754][ T35] usb 5-1: config 0 descriptor?? [ 60.508338][ T6332] netlink: 4 bytes leftover after parsing attributes in process `syz.2.113'. [ 60.552546][ T6335] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 60.606713][ T6347] overlayfs: failed to resolve './file0/file0': -2 [ 60.620138][ T6347] netlink: 'syz.3.114': attribute type 2 has an invalid length. [ 60.801195][ T6352] input: syz0 as /devices/virtual/input/input13 [ 61.066201][ T50] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 61.072320][ T6357] file system registered [ 61.075458][ T6357] unloading [ 61.217822][ T50] usb 6-1: unable to get BOS descriptor or descriptor too short [ 61.217848][ T50] usb 6-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=a4.d6 [ 61.218571][ T50] usb 6-1: config 12 has an invalid interface number: 99 but max is 0 [ 61.218583][ T50] usb 6-1: config 12 has an invalid descriptor of length 0, skipping remainder of the config [ 61.218592][ T50] usb 6-1: config 12 has no interface number 0 [ 61.218608][ T50] usb 6-1: config 12 interface 99 altsetting 14 endpoint 0x2 has invalid wMaxPacketSize 0 [ 61.218625][ T50] usb 6-1: config 12 interface 99 altsetting 14 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 61.218637][ T50] usb 6-1: config 12 interface 99 has no altsetting 0 [ 61.220407][ T50] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.220419][ T50] usb 6-1: Product: syz [ 61.220426][ T50] usb 6-1: Manufacturer: syz [ 61.220433][ T50] usb 6-1: SerialNumber: syz [ 61.325413][ T5738] ffs_data_put(): freeing [ 61.477546][ T50] usb 6-1: no audio or video endpoints found [ 61.479623][ T50] usb 6-1: USB disconnect, device number 4 [ 61.549760][ T6371] warning: `syz.2.124' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 61.915107][ T6382] netlink: 'syz.2.129': attribute type 4 has an invalid length. [ 61.915122][ T6382] netlink: 4 bytes leftover after parsing attributes in process `syz.2.129'. [ 62.031298][ T6387] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input14 [ 62.130067][ T6390] FAULT_INJECTION: forcing a failure. [ 62.130067][ T6390] name failslab, interval 1, probability 0, space 0, times 0 [ 62.130103][ T6390] CPU: 3 UID: 0 PID: 6390 Comm: syz.1.131 Not tainted syzkaller #0 PREEMPT(full) [ 62.130125][ T6390] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 62.130137][ T6390] Call Trace: [ 62.130143][ T6390] [ 62.130150][ T6390] dump_stack_lvl+0x100/0x190 [ 62.130178][ T6390] should_fail_ex.cold+0x5/0xa [ 62.130205][ T6390] should_failslab+0xc2/0x120 [ 62.130234][ T6390] __kmalloc_cache_noprof+0x91/0x6d0 [ 62.130263][ T6390] ? alloc_mnt_ns+0xce/0x520 [ 62.130301][ T6390] alloc_mnt_ns+0xce/0x520 [ 62.130321][ T6390] __do_sys_fsmount+0x848/0xed0 [ 62.130350][ T6390] ? __pfx___do_sys_fsmount+0x10/0x10 [ 62.130375][ T6390] ? ksys_write+0x1ac/0x250 [ 62.130407][ T6390] __do_fast_syscall_32+0x13a/0x8b0 [ 62.130457][ T6390] ? lockdep_hardirqs_on+0x7d/0x110 [ 62.130488][ T6390] do_fast_syscall_32+0x32/0x70 [ 62.130514][ T6390] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 62.130538][ T6390] RIP: 0023:0xf6fdefec [ 62.130557][ T6390] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 62.130565][ T6390] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 00000000000001b0 [ 62.130584][ T6390] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 62.130596][ T6390] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 62.130606][ T6390] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 62.130618][ T6390] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 62.130629][ T6390] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 62.130655][ T6390] [ 62.134884][ T6390] netlink: 4 bytes leftover after parsing attributes in process `syz.1.131'. [ 62.287819][ T6397] tipc: Started in network mode [ 62.287835][ T6397] tipc: Node identity 12c3dddadb8f, cluster identity 4711 [ 62.287943][ T6397] tipc: Enabled bearer , priority 0 [ 62.288374][ T6397] syzkaller0: entered promiscuous mode [ 62.288386][ T6397] syzkaller0: entered allmulticast mode [ 62.301700][ T6397] tipc: Resetting bearer [ 62.303022][ T6397] netlink: 12 bytes leftover after parsing attributes in process `syz.2.134'. [ 62.307566][ T6396] tipc: Resetting bearer [ 62.321542][ T6396] tipc: Disabling bearer [ 62.669977][ T6411] netlink: 8 bytes leftover after parsing attributes in process `syz.2.136'. [ 62.811425][ T1341] usb 5-1: USB disconnect, device number 4 [ 62.834681][ T6428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 62.834867][ T6428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 63.025668][ T6411] netlink: 4 bytes leftover after parsing attributes in process `syz.2.136'. [ 63.050462][ T6411] netlink: 4 bytes leftover after parsing attributes in process `syz.2.136'. [ 63.060484][ T6411] netlink: 4 bytes leftover after parsing attributes in process `syz.2.136'. [ 63.283978][ T6436] syzkaller0: entered promiscuous mode [ 63.283991][ T6436] syzkaller0: entered allmulticast mode [ 63.288854][ T6436] tipc: Started in network mode [ 63.288869][ T6436] tipc: Node identity b2180e66ece5, cluster identity 4711 [ 63.289116][ T6436] tipc: Enabled bearer , priority 0 [ 63.290077][ T6436] syzkaller0: mtu greater than device maximum [ 63.301681][ T6435] tipc: Resetting bearer [ 63.307729][ T6438] openvswitch: netlink: IPv6 tunnel dst address is zero [ 63.371288][ T6435] tipc: Disabling bearer [ 63.769640][ T6464] XFS (nbd2): Invalid device [./loop0], error=-2 [ 63.816281][ T5524] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 63.833699][ T6465] xt_MASQUERADE: bad MAP_IPS. [ 63.966188][ T5524] usb 6-1: Using ep0 maxpacket: 16 [ 63.966936][ T5524] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 63.967865][ T5524] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 63.967898][ T5524] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 63.967916][ T5524] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 63.968847][ T5524] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 63.968863][ T5524] usb 6-1: Manufacturer: syz [ 63.978630][ T5524] usb 6-1: config 0 descriptor?? [ 64.544734][ T6470] input: syz0 as /devices/virtual/input/input16 [ 64.637393][ T6474] netlink: 28 bytes leftover after parsing attributes in process `syz.3.155'. [ 64.659780][ T6478] fuse: Bad value for 'fd' [ 64.755183][ T6474] capability: warning: `syz.3.155' uses 32-bit capabilities (legacy support in use) [ 64.763518][ T6485] netlink: 'syz.2.159': attribute type 12 has an invalid length. [ 64.763530][ T6485] netlink: 'syz.2.159': attribute type 29 has an invalid length. [ 64.763537][ T6485] netlink: 148 bytes leftover after parsing attributes in process `syz.2.159'. [ 64.763546][ T6485] netlink: 59 bytes leftover after parsing attributes in process `syz.2.159'. [ 64.763908][ T6486] netlink: 'syz.2.159': attribute type 12 has an invalid length. [ 64.763919][ T6486] netlink: 'syz.2.159': attribute type 29 has an invalid length. [ 64.763925][ T6486] netlink: 148 bytes leftover after parsing attributes in process `syz.2.159'. [ 64.763933][ T6486] netlink: 59 bytes leftover after parsing attributes in process `syz.2.159'. [ 65.216221][ T1341] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 65.327133][ T6512] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.3276800.0), cmd(6) [ 65.375673][ T6514] capability: warning: `syz.3.170' uses deprecated v2 capabilities in a way that may be insecure [ 65.387773][ T1341] usb 5-1: unable to get BOS descriptor or descriptor too short [ 65.387797][ T1341] usb 5-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=a4.d6 [ 65.389151][ T1341] usb 5-1: config 12 has an invalid interface number: 99 but max is 0 [ 65.389163][ T1341] usb 5-1: config 12 has an invalid descriptor of length 0, skipping remainder of the config [ 65.389172][ T1341] usb 5-1: config 12 has no interface number 0 [ 65.389190][ T1341] usb 5-1: config 12 interface 99 altsetting 14 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 65.389202][ T1341] usb 5-1: config 12 interface 99 has no altsetting 0 [ 65.390744][ T1341] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.390755][ T1341] usb 5-1: Product: syz [ 65.390762][ T1341] usb 5-1: Manufacturer: syz [ 65.390769][ T1341] usb 5-1: SerialNumber: syz [ 65.424946][ T6518] netlink: 24 bytes leftover after parsing attributes in process `syz.3.172'. [ 65.427684][ T6518] veth1_macvtap: left promiscuous mode [ 65.427705][ T6518] macsec0: entered allmulticast mode [ 65.431874][ T6518] veth1_macvtap: entered promiscuous mode [ 65.431885][ T6518] veth1_macvtap: entered allmulticast mode [ 65.433043][ T6518] macsec0: left allmulticast mode [ 65.433057][ T6518] veth1_macvtap: left allmulticast mode [ 65.589269][ T6527] netlink: 4 bytes leftover after parsing attributes in process `syz.2.175'. [ 65.589294][ T6527] FAULT_INJECTION: forcing a failure. [ 65.589294][ T6527] name failslab, interval 1, probability 0, space 0, times 0 [ 65.589309][ T6527] CPU: 1 UID: 0 PID: 6527 Comm: syz.2.175 Not tainted syzkaller #0 PREEMPT(full) [ 65.589321][ T6527] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 65.589327][ T6527] Call Trace: [ 65.589331][ T6527] [ 65.589335][ T6527] dump_stack_lvl+0x100/0x190 [ 65.589352][ T6527] should_fail_ex.cold+0x5/0xa [ 65.589364][ T6527] ? __kvmalloc_node_noprof+0x377/0x9b0 [ 65.589379][ T6527] should_failslab+0xc2/0x120 [ 65.589394][ T6527] kmem_cache_alloc_noprof+0x92/0x6a0 [ 65.589406][ T6527] ? xfrm_state_alloc+0x23/0x5c0 [ 65.589420][ T6527] xfrm_state_alloc+0x23/0x5c0 [ 65.589432][ T6527] __find_acq_core+0x89b/0x2d50 [ 65.589452][ T6527] xfrm_find_acq+0x7b/0xa0 [ 65.589469][ T6527] xfrm_alloc_userspi+0x68e/0xc40 [ 65.589489][ T6527] ? __pfx_xfrm_alloc_userspi+0x10/0x10 [ 65.589506][ T6527] ? __nla_parse+0x40/0x60 [ 65.589517][ T6527] ? __pfx_xfrm_alloc_userspi+0x10/0x10 [ 65.589533][ T6527] xfrm_user_rcv_msg+0x411/0xd00 [ 65.589550][ T6527] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 65.589564][ T6527] ? kfree_skbmem+0x19f/0x210 [ 65.589575][ T6527] ? consume_skb+0xd6/0x110 [ 65.589604][ T6527] ? rcu_is_watching+0x13/0xc0 [ 65.589616][ T6527] ? trace_contention_end+0x126/0x160 [ 65.589634][ T6527] ? __mutex_lock+0x26c/0x1bd0 [ 65.589652][ T6527] netlink_rcv_skb+0x159/0x420 [ 65.589665][ T6527] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 65.589679][ T6527] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 65.589700][ T6527] xfrm_netlink_rcv+0x71/0x90 [ 65.589713][ T6527] netlink_unicast+0x585/0x850 [ 65.589728][ T6527] ? __pfx_netlink_unicast+0x10/0x10 [ 65.589744][ T6527] netlink_sendmsg+0x8b0/0xda0 [ 65.589759][ T6527] ? __pfx_netlink_sendmsg+0x10/0x10 [ 65.589773][ T6527] ? apparmor_socket_sendmsg+0x165/0x280 [ 65.589789][ T6527] ____sys_sendmsg+0xa4d/0xbe0 [ 65.589799][ T6527] ? __pfx_netlink_sendmsg+0x10/0x10 [ 65.589813][ T6527] ? __pfx_____sys_sendmsg+0x10/0x10 [ 65.589829][ T6527] ___sys_sendmsg+0x190/0x1e0 [ 65.589841][ T6527] ? __pfx____sys_sendmsg+0x10/0x10 [ 65.589858][ T6527] ? find_held_lock+0x2b/0x80 [ 65.589877][ T6527] __sys_sendmsg+0x160/0x210 [ 65.589892][ T6527] ? __pfx___sys_sendmsg+0x10/0x10 [ 65.589910][ T6527] ? __pfx_ksys_write+0x10/0x10 [ 65.589924][ T6527] __do_fast_syscall_32+0x13a/0x8b0 [ 65.589940][ T6527] ? lockdep_hardirqs_on+0x7d/0x110 [ 65.589968][ T6527] do_fast_syscall_32+0x32/0x70 [ 65.589985][ T6527] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 65.589999][ T6527] RIP: 0023:0xf709efec [ 65.590011][ T6527] Code: Unable to access opcode bytes at 0xf709efc2. [ 65.590016][ T6527] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 65.590026][ T6527] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 65.590033][ T6527] RDX: 0000000004040888 RSI: 0000000000000000 RDI: 0000000000000000 [ 65.590039][ T6527] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 65.590045][ T6527] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 65.590051][ T6527] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 65.590063][ T6527] [ 65.708567][ T1341] usb 5-1: no audio or video endpoints found [ 65.709841][ T1341] usb 5-1: USB disconnect, device number 5 [ 65.712939][ T5736] udevd[5736]: setting owner of /dev/bus/usb/005/005 to uid=0, gid=0 failed: No such file or directory [ 66.226183][ T35] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 66.403160][ T35] usb 7-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 66.420777][ T6557] PKCS7: Unknown OID: [41] 1.2.840.113553.1.7.1 [ 66.420792][ T6557] PKCS7: Unknown OID: [41] 1.2.840.113553.1.7.1 [ 66.420798][ T6557] PKCS7: Unsupported data type 106 [ 66.425545][ T6557] bridge_slave_0: left allmulticast mode [ 66.425559][ T6557] bridge_slave_0: left promiscuous mode [ 66.425656][ T6557] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.435666][ T6553] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 66.439672][ T35] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 66.439697][ T35] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 66.439709][ T35] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 66.439720][ T35] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 66.439739][ T35] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 66.448949][ T6557] bridge_slave_1: left allmulticast mode [ 66.448969][ T6557] bridge_slave_1: left promiscuous mode [ 66.449095][ T6557] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.467008][ T6542] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 66.467076][ T6542] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 66.469157][ T35] keyspan 7-1:1.0: Keyspan 2 port adapter converter detected [ 66.470980][ T6557] bond0: (slave veth0_to_bond): Releasing backup interface [ 66.472989][ T35] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 84 [ 66.475783][ T35] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 2 [ 66.481711][ T35] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 66.482954][ T35] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 88 [ 66.483021][ T35] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 6 [ 66.484719][ T35] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 66.501863][ T6557] bond0: (slave bond_slave_0): Releasing backup interface [ 66.518249][ T6557] bond0: (slave bond_slave_1): Releasing backup interface [ 66.528586][ T6557] team0: Port device team_slave_0 removed [ 66.536007][ T6557] team0: Port device team_slave_1 removed [ 66.537867][ T6557] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 66.537885][ T6557] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 66.545177][ T6557] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 66.545191][ T6557] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 66.551375][ T6557] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 66.562753][ T6558] team0: Port device xfrm0 added [ 66.575759][ T5877] usb 6-1: USB disconnect, device number 5 [ 66.615756][ T6561] FAULT_INJECTION: forcing a failure. [ 66.615756][ T6561] name failslab, interval 1, probability 0, space 0, times 0 [ 66.615786][ T6561] CPU: 3 UID: 0 PID: 6561 Comm: syz.1.184 Not tainted syzkaller #0 PREEMPT(full) [ 66.615805][ T6561] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 66.615815][ T6561] Call Trace: [ 66.615821][ T6561] [ 66.615828][ T6561] dump_stack_lvl+0x100/0x190 [ 66.615872][ T6561] should_fail_ex.cold+0x5/0xa [ 66.615896][ T6561] should_failslab+0xc2/0x120 [ 66.615919][ T6561] kmem_cache_alloc_noprof+0x92/0x6a0 [ 66.615937][ T6561] ? skb_clone+0x190/0x400 [ 66.615957][ T6561] skb_clone+0x190/0x400 [ 66.615973][ T6561] netlink_deliver_tap+0xaed/0xcc0 [ 66.615989][ T6561] netlink_unicast+0x6a5/0x850 [ 66.616003][ T6561] ? __pfx_netlink_unicast+0x10/0x10 [ 66.616015][ T6561] ? find_held_lock+0x2b/0x80 [ 66.616027][ T6561] ? rtnl_stats_get+0x53f/0x8e0 [ 66.616043][ T6561] ? rtnl_stats_get+0x53f/0x8e0 [ 66.616061][ T6561] rtnl_stats_get+0x68a/0x8e0 [ 66.616077][ T6561] ? __pfx_mpls_get_stats_af_size+0x10/0x10 [ 66.616095][ T6561] ? __pfx_rtnl_stats_get+0x10/0x10 [ 66.616116][ T6561] ? __pfx_rtnl_stats_get+0x10/0x10 [ 66.616133][ T6561] rtnetlink_rcv_msg+0x3c9/0xe90 [ 66.616150][ T6561] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 66.616170][ T6561] ? ref_tracker_free+0x37e/0x6c0 [ 66.616188][ T6561] netlink_rcv_skb+0x159/0x420 [ 66.616201][ T6561] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 66.616218][ T6561] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 66.616235][ T6561] ? netlink_deliver_tap+0x1ae/0xcc0 [ 66.616250][ T6561] netlink_unicast+0x585/0x850 [ 66.616264][ T6561] ? __pfx_netlink_unicast+0x10/0x10 [ 66.616281][ T6561] netlink_sendmsg+0x8b0/0xda0 [ 66.616296][ T6561] ? __pfx_netlink_sendmsg+0x10/0x10 [ 66.616310][ T6561] ? apparmor_socket_sendmsg+0x165/0x280 [ 66.616333][ T6561] sock_write_iter+0x53a/0x5b0 [ 66.616348][ T6561] ? __pfx_netlink_sendmsg+0x10/0x10 [ 66.616367][ T6561] ? __pfx_sock_write_iter+0x10/0x10 [ 66.616392][ T6561] ? bpf_lsm_file_permission+0x9/0x10 [ 66.616410][ T6561] ? security_file_permission+0x76/0x210 [ 66.616427][ T6561] ? rw_verify_area+0xce/0x6d0 [ 66.616446][ T6561] vfs_write+0x6af/0x1050 [ 66.616468][ T6561] ? __pfx_sock_write_iter+0x10/0x10 [ 66.616487][ T6561] ? __pfx_vfs_write+0x10/0x10 [ 66.616503][ T6561] ? find_held_lock+0x2b/0x80 [ 66.616538][ T6561] ksys_write+0x1f8/0x250 [ 66.616556][ T6561] ? __pfx_ksys_write+0x10/0x10 [ 66.616572][ T6561] ? ksys_write+0x1ac/0x250 [ 66.616589][ T6561] ? __pfx_ksys_write+0x10/0x10 [ 66.616610][ T6561] __do_fast_syscall_32+0x13a/0x8b0 [ 66.616637][ T6561] ? lockdep_hardirqs_on+0x7d/0x110 [ 66.616667][ T6561] do_fast_syscall_32+0x32/0x70 [ 66.616694][ T6561] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 66.616716][ T6561] RIP: 0023:0xf6fdefec [ 66.616735][ T6561] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 66.616742][ T6561] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 66.616758][ T6561] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 66.616766][ T6561] RDX: 000000000000001c RSI: 0000000000000000 RDI: 0000000000000000 [ 66.616772][ T6561] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 66.616778][ T6561] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 66.616784][ T6561] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 66.616798][ T6561] [ 66.680990][ T6564] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 66.682619][ T6522] syz.2.171 (6522) used greatest stack depth: 18552 bytes left [ 66.754615][ T35] usb 7-1: USB disconnect, device number 3 [ 66.764154][ T35] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 66.767942][ T35] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 66.768297][ T35] keyspan 7-1:1.0: device disconnected [ 67.510269][ T6578] overlayfs: conflicting options: nfs_export=on,metacopy=on [ 67.563699][ T6579] overlayfs: missing 'lowerdir' [ 67.564990][ T6580] overlayfs: conflicting options: nfs_export=on,metacopy=on [ 67.717247][ T50] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 67.908027][ T50] usb 7-1: unable to get BOS descriptor or descriptor too short [ 67.908051][ T50] usb 7-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=a4.d6 [ 67.908924][ T50] usb 7-1: config 12 has an invalid interface number: 99 but max is 0 [ 67.908936][ T50] usb 7-1: config 12 has an invalid descriptor of length 0, skipping remainder of the config [ 67.908944][ T50] usb 7-1: config 12 has no interface number 0 [ 67.908961][ T50] usb 7-1: config 12 interface 99 altsetting 14 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 67.908974][ T50] usb 7-1: config 12 interface 99 has no altsetting 0 [ 67.911852][ T50] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.911865][ T50] usb 7-1: Product: syz [ 67.911873][ T50] usb 7-1: Manufacturer: syz [ 67.911880][ T50] usb 7-1: SerialNumber: syz [ 67.929522][ T6611] syz.1.194: vmalloc error: size 3449536512, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 67.929645][ T6611] CPU: 0 UID: 0 PID: 6611 Comm: syz.1.194 Not tainted syzkaller #0 PREEMPT(full) [ 67.929666][ T6611] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.929678][ T6611] Call Trace: [ 67.929684][ T6611] [ 67.929692][ T6611] dump_stack_lvl+0x100/0x190 [ 67.929746][ T6611] warn_alloc.cold+0x9e/0xb2 [ 67.929768][ T6611] ? __pfx_warn_alloc+0x10/0x10 [ 67.929787][ T6611] ? kasan_save_stack+0x3f/0x50 [ 67.929852][ T6611] ? kasan_save_track+0x14/0x30 [ 67.929874][ T6611] ? vb2_vmalloc_alloc+0xf9/0x410 [ 67.929895][ T6611] ? __vb2_queue_alloc+0x8d5/0x1160 [ 67.929917][ T6611] ? vidioc_create_bufs+0x7d/0xf0 [ 67.929958][ T6611] ? v4l_create_bufs+0x17d/0x270 [ 67.929982][ T6611] ? __video_do_ioctl+0xb2a/0xdf0 [ 67.930008][ T6611] ? video_usercopy+0x3d3/0x14c0 [ 67.930035][ T6611] ? v4l2_ioctl+0x1bd/0x250 [ 67.930051][ T6611] ? v4l2_compat_ioctl32+0x20f/0x2d0 [ 67.930075][ T6611] ? __ia32_compat_sys_ioctl+0x2cf/0x360 [ 67.930109][ T6611] ? __do_fast_syscall_32+0x13a/0x8b0 [ 67.930140][ T6611] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 67.930173][ T6611] __vmalloc_node_range_noprof+0x123b/0x1420 [ 67.930213][ T6611] ? vb2_vmalloc_alloc+0x135/0x410 [ 67.930243][ T6611] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 67.930274][ T6611] ? __kasan_kmalloc+0xaa/0xb0 [ 67.930300][ T6611] ? vb2_vmalloc_alloc+0x135/0x410 [ 67.930325][ T6611] vmalloc_user_noprof+0x9e/0xe0 [ 67.930350][ T6611] ? vb2_vmalloc_alloc+0x135/0x410 [ 67.930375][ T6611] vb2_vmalloc_alloc+0x135/0x410 [ 67.930398][ T6611] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 67.930448][ T6611] __vb2_queue_alloc+0x8d5/0x1160 [ 67.930485][ T6611] vb2_core_create_bufs+0x5fa/0xa30 [ 67.930514][ T6611] ? __pfx_vb2_core_create_bufs+0x10/0x10 [ 67.930542][ T6611] ? lock_acquire+0x1d1/0x380 [ 67.930569][ T6611] ? __video_do_ioctl+0x50f/0xdf0 [ 67.930601][ T6611] vb2_create_bufs+0x40c/0x830 [ 67.930625][ T6611] ? __pfx_vb2_create_bufs+0x10/0x10 [ 67.930646][ T6611] ? v4l_sanitize_colorspace+0x220/0x410 [ 67.930673][ T6611] vb2_ioctl_create_bufs+0x244/0x3e0 [ 67.930694][ T6611] ? v4l2_compat_get_user+0x883/0x11f0 [ 67.930718][ T6611] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 67.930746][ T6611] vidioc_create_bufs+0x7d/0xf0 [ 67.930774][ T6611] v4l_create_bufs+0x17d/0x270 [ 67.930802][ T6611] __video_do_ioctl+0xb2a/0xdf0 [ 67.930837][ T6611] ? __pfx___video_do_ioctl+0x10/0x10 [ 67.930869][ T6611] ? video_usercopy+0x145/0x14c0 [ 67.930902][ T6611] video_usercopy+0x3d3/0x14c0 [ 67.930932][ T6611] ? __pfx___video_do_ioctl+0x10/0x10 [ 67.930963][ T6611] ? __pfx_video_usercopy+0x10/0x10 [ 67.931001][ T6611] ? __fget_files+0x215/0x3d0 [ 67.931021][ T6611] ? hook_file_ioctl_common+0x140/0x440 [ 67.931056][ T6611] v4l2_ioctl+0x1bd/0x250 [ 67.931077][ T6611] v4l2_compat_ioctl32+0x20f/0x2d0 [ 67.931112][ T6611] ? __pfx_v4l2_compat_ioctl32+0x10/0x10 [ 67.931141][ T6611] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 67.931176][ T6611] __do_fast_syscall_32+0x13a/0x8b0 [ 67.931209][ T6611] ? lockdep_hardirqs_on+0x7d/0x110 [ 67.931236][ T6611] do_fast_syscall_32+0x32/0x70 [ 67.931263][ T6611] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 67.931285][ T6611] RIP: 0023:0xf6fdefec [ 67.931304][ T6611] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 67.931312][ T6611] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 67.931329][ T6611] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0f8565c [ 67.931340][ T6611] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 67.931351][ T6611] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 67.931362][ T6611] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 67.931373][ T6611] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 67.931399][ T6611] [ 67.932387][ T6611] Mem-Info: [ 67.932399][ T6611] active_anon:9163 inactive_anon:489 isolated_anon:0 [ 67.932399][ T6611] active_file:729 inactive_file:32105 isolated_file:0 [ 67.932399][ T6611] unevictable:1000 dirty:517 writeback:0 [ 67.932399][ T6611] slab_reclaimable:6513 slab_unreclaimable:51188 [ 67.932399][ T6611] mapped:24115 shmem:5617 pagetables:1229 [ 67.932399][ T6611] sec_pagetables:300 bounce:0 [ 67.932399][ T6611] kernel_misc_reclaimable:0 [ 67.932399][ T6611] free:45290 free_pcp:3893 free_cma:0 [ 67.932443][ T6611] Node 0 active_anon:5792kB inactive_anon:132kB active_file:72kB inactive_file:1992kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:92kB dirty:4kB writeback:0kB shmem:7632kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:9564kB pagetables:1464kB sec_pagetables:1116kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 67.932485][ T6611] Node 1 active_anon:30860kB inactive_anon:1824kB active_file:2844kB inactive_file:126428kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:96368kB dirty:2064kB writeback:0kB shmem:14836kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:4440kB pagetables:3452kB sec_pagetables:84kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 67.932532][ T6611] Node 0 DMA free:2432kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 67.932581][ T6611] lowmem_reserve[]: 0 277 277 277 277 [ 67.932612][ T6611] Node 0 DMA32 free:17788kB boost:2048kB min:14676kB low:17832kB high:20988kB reserved_highatomic:0kB free_highatomic:0kB active_anon:5792kB inactive_anon:132kB active_file:72kB inactive_file:1992kB unevictable:2000kB writepending:4kB zspages:0kB present:1032196kB managed:284568kB mlocked:0kB bounce:0kB free_pcp:4212kB local_pcp:104kB free_cma:0kB [ 67.932662][ T6611] lowmem_reserve[]: 0 0 0 0 0 [ 67.932691][ T6611] Node 1 DMA32 free:160940kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0kB free_highatomic:0kB active_anon:30860kB inactive_anon:1824kB active_file:2844kB inactive_file:126428kB unevictable:2000kB writepending:2064kB zspages:2640kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:11360kB local_pcp:3168kB free_cma:0kB [ 67.932741][ T6611] lowmem_reserve[]: 0 0 0 0 0 [ 67.932771][ T6611] Node 0 DMA: 125*4kB (U) 28*8kB (U) 7*16kB (U) 14*32kB (U) 10*64kB (U) 2*128kB (U) 1*256kB (U) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2436kB [ 67.932922][ T6611] Node 0 DMA32: 5*4kB (E) 52*8kB (UE) 56*16kB (UE) 184*32kB (UE) 47*64kB (UE) 14*128kB (UME) 8*256kB (UME) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 0*4096kB = 17652kB [ 67.933131][ T6611] Node 1 DMA32: 422*4kB (UE) 162*8kB (UME) 53*16kB (UME) 122*32kB (UME) 203*64kB (UME) 87*128kB (UE) 48*256kB (UME) 28*512kB (UME) 14*1024kB (UM) 7*2048kB (UM) 18*4096kB (U) = 160888kB [ 67.933279][ T6611] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 67.933293][ T6611] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 67.933306][ T6611] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 67.933319][ T6611] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 67.933333][ T6611] 39057 total pagecache pages [ 67.933339][ T6611] 611 pages in swap cache [ 67.933345][ T6611] Free swap = 117792kB [ 67.933351][ T6611] Total swap = 124996kB [ 67.933358][ T6611] 524155 pages RAM [ 67.933364][ T6611] 0 pages HighMem/MovableOnly [ 67.933370][ T6611] 212121 pages reserved [ 67.933376][ T6611] 0 pages cma reserved [ 68.090023][ T6618] ======================================================= [ 68.090023][ T6618] WARNING: The mand mount option has been deprecated and [ 68.090023][ T6618] and is ignored by this kernel. Remove the mand [ 68.090023][ T6618] option from the mount to silence this warning. [ 68.090023][ T6618] ======================================================= [ 68.090114][ T2001] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 68.172446][ T50] usb 7-1: no audio or video endpoints found [ 68.179204][ T50] usb 7-1: USB disconnect, device number 4 [ 68.246189][ T2001] usb 5-1: Using ep0 maxpacket: 16 [ 68.246848][ T2001] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 68.247630][ T2001] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 68.247651][ T2001] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 68.247661][ T2001] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 68.248419][ T2001] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 68.248430][ T2001] usb 5-1: Manufacturer: syz [ 68.255921][ T2001] usb 5-1: config 0 descriptor?? [ 68.833819][ T6624] input: syz0 as /devices/virtual/input/input17 [ 69.037363][ T43] audit: type=1804 audit(1789088225.886:3): pid=6630 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.198" name="/newroot/70/file0" dev="tmpfs" ino=423 res=1 errno=0 [ 69.266476][ T30] cfg80211: failed to load regulatory.db [ 69.817218][ T5806] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 69.850856][ T6658] bridge1: entered promiscuous mode [ 69.850904][ T6658] bridge1: entered allmulticast mode [ 69.968000][ T5806] usb 6-1: unable to get BOS descriptor or descriptor too short [ 69.968025][ T5806] usb 6-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=a4.d6 [ 69.969219][ T5806] usb 6-1: config 12 has an invalid interface number: 99 but max is 0 [ 69.969231][ T5806] usb 6-1: config 12 has no interface number 0 [ 69.969249][ T5806] usb 6-1: config 12 interface 99 altsetting 14 endpoint 0xD has invalid wMaxPacketSize 0 [ 69.969260][ T5806] usb 6-1: config 12 interface 99 has no altsetting 0 [ 69.971316][ T5806] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 69.971328][ T5806] usb 6-1: Product: syz [ 69.971335][ T5806] usb 6-1: Manufacturer: syz [ 69.971342][ T5806] usb 6-1: SerialNumber: syz [ 70.234437][ T5806] usb 6-1: no audio or video endpoints found [ 70.236777][ T5806] usb 6-1: USB disconnect, device number 6 [ 70.827950][ T1341] usb 5-1: USB disconnect, device number 6 [ 70.858481][ T1436] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.858911][ T5806] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 71.031029][ T5806] usb 7-1: unable to get BOS descriptor or descriptor too short [ 71.031660][ T5806] usb 7-1: not running at top speed; connect to a high speed hub [ 71.031674][ T5806] usb 7-1: New USB device found, idVendor=2040, idProduct=b139, bcdDevice=f7.8d [ 71.033785][ T5806] usb 7-1: config 5 has an invalid interface number: 220 but max is 2 [ 71.033798][ T5806] usb 7-1: config 5 contains an unexpected descriptor of type 0x1, skipping [ 71.033807][ T5806] usb 7-1: config 5 has an invalid interface number: 201 but max is 2 [ 71.033817][ T5806] usb 7-1: config 5 has an invalid interface number: 84 but max is 2 [ 71.033827][ T5806] usb 7-1: config 5 has no interface number 0 [ 71.033834][ T5806] usb 7-1: config 5 has no interface number 1 [ 71.033842][ T5806] usb 7-1: config 5 has no interface number 2 [ 71.033868][ T5806] usb 7-1: config 5 interface 220 altsetting 6 has a duplicate endpoint with address 0x9, skipping [ 71.033880][ T5806] usb 7-1: config 5 interface 220 altsetting 6 has a duplicate endpoint with address 0x9, skipping [ 71.033890][ T5806] usb 7-1: config 5 interface 220 altsetting 6 has a duplicate endpoint with address 0x8, skipping [ 71.033901][ T5806] usb 7-1: config 5 interface 220 altsetting 6 endpoint 0xC has invalid maxpacket 528, setting to 64 [ 71.033913][ T5806] usb 7-1: config 5 interface 220 altsetting 6 has a duplicate endpoint with address 0x1, skipping [ 71.033924][ T5806] usb 7-1: config 5 interface 220 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 71.033940][ T5806] usb 7-1: config 5 interface 201 altsetting 0 endpoint 0x5 has invalid maxpacket 1024, setting to 1023 [ 71.033952][ T5806] usb 7-1: config 5 interface 201 altsetting 0 has a duplicate endpoint with address 0xC, skipping [ 71.033964][ T5806] usb 7-1: config 5 interface 201 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 71.033974][ T5806] usb 7-1: config 5 interface 201 altsetting 0 endpoint 0xB has invalid maxpacket 1032, setting to 64 [ 71.033991][ T5806] usb 7-1: config 5 interface 201 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 71.034001][ T5806] usb 7-1: config 5 interface 201 altsetting 0 has a duplicate endpoint with address 0x1, skipping [ 71.034012][ T5806] usb 7-1: config 5 interface 201 altsetting 0 has a duplicate endpoint with address 0x4, skipping [ 71.034028][ T5806] usb 7-1: config 5 interface 84 altsetting 6 has a duplicate endpoint with address 0x2, skipping [ 71.034038][ T5806] usb 7-1: config 5 interface 84 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 71.034048][ T5806] usb 7-1: config 5 interface 84 altsetting 6 has a duplicate endpoint with address 0x5, skipping [ 71.034058][ T5806] usb 7-1: config 5 interface 84 altsetting 6 has an endpoint descriptor with address 0x47, changing to 0x7 [ 71.034070][ T5806] usb 7-1: config 5 interface 84 altsetting 6 endpoint 0x7 has invalid maxpacket 22953, setting to 64 [ 71.034083][ T5806] usb 7-1: config 5 interface 84 altsetting 6 has a duplicate endpoint with address 0x5, skipping [ 71.034093][ T5806] usb 7-1: config 5 interface 84 altsetting 6 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 71.034106][ T5806] usb 7-1: config 5 interface 84 altsetting 6 endpoint 0x6 has an invalid bInterval 19, changing to 4 [ 71.034118][ T5806] usb 7-1: config 5 interface 84 altsetting 6 endpoint 0x6 has invalid maxpacket 1024, setting to 1023 [ 71.034130][ T5806] usb 7-1: config 5 interface 84 altsetting 6 has 7 endpoint descriptors, different from the interface descriptor's value: 6 [ 71.034142][ T5806] usb 7-1: config 5 interface 220 has no altsetting 0 [ 71.034151][ T5806] usb 7-1: config 5 interface 84 has no altsetting 0 [ 71.039238][ T5806] usb 7-1: Dual-Role OTG device on HNP port [ 71.039459][ T5806] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.039470][ T5806] usb 7-1: Product: syz [ 71.039478][ T5806] usb 7-1: Manufacturer: ᰊ [ 71.039488][ T5806] usb 7-1: SerialNumber: syz [ 71.209570][ T6690] __nla_validate_parse: 1 callbacks suppressed [ 71.209589][ T6690] netlink: 48 bytes leftover after parsing attributes in process `syz.0.219'. [ 71.339046][ T6697] dummy0: entered promiscuous mode [ 71.381069][ T6691] dummy0: left promiscuous mode [ 71.456249][ T1341] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 71.606588][ T1341] usb 6-1: Using ep0 maxpacket: 16 [ 71.608643][ T1341] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 71.620544][ T1341] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 71.620841][ T1341] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 71.620877][ T1341] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 71.630032][ T1341] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 71.630181][ T1341] usb 6-1: Manufacturer: syz [ 71.654887][ T1341] usb 6-1: config 0 descriptor?? [ 71.817060][ T10] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 71.908493][ T6703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 71.909607][ T6703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 71.923698][ T6703] input: syz0 as /devices/virtual/input/input19 [ 72.003104][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 72.003470][ T10] usb 5-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=a4.d6 [ 72.009841][ T10] usb 5-1: config 12 has an invalid interface number: 99 but max is 0 [ 72.010010][ T10] usb 5-1: config 12 has no interface number 0 [ 72.010461][ T10] usb 5-1: config 12 interface 99 altsetting 14 endpoint 0xD has invalid wMaxPacketSize 0 [ 72.010548][ T10] usb 5-1: config 12 interface 99 has no altsetting 0 [ 72.017877][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.017914][ T10] usb 5-1: Product: syz [ 72.018039][ T10] usb 5-1: Manufacturer: syz [ 72.018048][ T10] usb 5-1: SerialNumber: syz [ 72.368501][ T6704] input: syz0 as /devices/virtual/input/input18 [ 72.383589][ T10] usb 5-1: no audio or video endpoints found [ 72.449407][ T10] usb 5-1: USB disconnect, device number 7 [ 73.010001][ T6718] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.010235][ T6718] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.649252][ T5806] usb 7-1: USB disconnect, device number 5 [ 73.690218][ T6731] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.690560][ T6731] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.699773][ T6731] input: syz0 as /devices/virtual/input/input20 [ 73.751806][ T6733] netlink: 220 bytes leftover after parsing attributes in process `syz.2.231'. [ 73.759748][ T6733] comedi comedi1: Minor 4 could not be opened [ 74.071170][ T2001] usb 6-1: USB disconnect, device number 7 [ 74.176193][ T50] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 74.339721][ T50] usb 5-1: unable to get BOS descriptor or descriptor too short [ 74.339745][ T50] usb 5-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=a4.d6 [ 74.341823][ T50] usb 5-1: config 12 has an invalid interface number: 99 but max is 0 [ 74.341836][ T50] usb 5-1: config 12 has no interface number 0 [ 74.341854][ T50] usb 5-1: config 12 interface 99 altsetting 14 endpoint 0xD has invalid wMaxPacketSize 0 [ 74.341865][ T50] usb 5-1: config 12 interface 99 has no altsetting 0 [ 74.350487][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.350500][ T50] usb 5-1: Product: syz [ 74.350507][ T50] usb 5-1: Manufacturer: syz [ 74.350515][ T50] usb 5-1: SerialNumber: syz [ 74.632800][ T50] usb 5-1: no audio or video endpoints found [ 74.634342][ T50] usb 5-1: USB disconnect, device number 8 [ 74.676186][ T6760] netlink: 28 bytes leftover after parsing attributes in process `syz.1.243'. [ 74.916208][ T5821] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 74.962169][ T6781] netlink: 220 bytes leftover after parsing attributes in process `syz.3.250'. [ 74.971426][ T6781] comedi comedi1: Minor 4 could not be opened [ 74.986398][ T854] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 75.066189][ T5821] usb 7-1: Using ep0 maxpacket: 32 [ 75.066757][ T5821] usb 7-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 75.067443][ T5821] usb 7-1: config 0 has no interfaces? [ 75.069468][ T5821] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.069487][ T5821] usb 7-1: Product: syz [ 75.069500][ T5821] usb 7-1: Manufacturer: syz [ 75.069511][ T5821] usb 7-1: SerialNumber: syz [ 75.072424][ T5821] usb 7-1: config 0 descriptor?? [ 75.136218][ T854] usb 6-1: Using ep0 maxpacket: 16 [ 75.137325][ T854] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 75.138158][ T854] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 75.138179][ T854] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 75.138190][ T854] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 75.138944][ T854] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 75.138955][ T854] usb 6-1: Manufacturer: syz [ 75.140230][ T854] usb 6-1: config 0 descriptor?? [ 75.273170][ T6783] FAULT_INJECTION: forcing a failure. [ 75.273170][ T6783] name failslab, interval 1, probability 0, space 0, times 0 [ 75.273189][ T6783] CPU: 0 UID: 0 PID: 6783 Comm: syz.0.251 Not tainted syzkaller #0 PREEMPT(full) [ 75.273201][ T6783] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.273207][ T6783] Call Trace: [ 75.273211][ T6783] [ 75.273215][ T6783] dump_stack_lvl+0x100/0x190 [ 75.273233][ T6783] should_fail_ex.cold+0x5/0xa [ 75.273247][ T6783] should_failslab+0xc2/0x120 [ 75.273262][ T6783] kmem_cache_alloc_noprof+0x92/0x6a0 [ 75.273275][ T6783] ? ovs_flow_alloc+0x1e/0x210 [ 75.273291][ T6783] ovs_flow_alloc+0x1e/0x210 [ 75.273305][ T6783] ovs_flow_cmd_new+0x231/0xe10 [ 75.273321][ T6783] ? kasan_save_stack+0x30/0x50 [ 75.273333][ T6783] ? kasan_save_track+0x14/0x30 [ 75.273346][ T6783] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 75.273359][ T6783] ? genl_family_rcv_msg_doit+0xc7/0x300 [ 75.273374][ T6783] ? netlink_rcv_skb+0x159/0x420 [ 75.273386][ T6783] ? genl_rcv+0x28/0x40 [ 75.273398][ T6783] ? netlink_unicast+0x585/0x850 [ 75.273410][ T6783] ? __sys_sendmsg+0x160/0x210 [ 75.273424][ T6783] ? __do_fast_syscall_32+0x13a/0x8b0 [ 75.273440][ T6783] ? do_fast_syscall_32+0x32/0x70 [ 75.273456][ T6783] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 75.273490][ T6783] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 75.273505][ T6783] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 75.273523][ T6783] genl_family_rcv_msg_doit+0x214/0x300 [ 75.273539][ T6783] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 75.273553][ T6783] ? genl_get_cmd+0x3e7/0x760 [ 75.273570][ T6783] ? bpf_lsm_capable+0x9/0x10 [ 75.273585][ T6783] ? security_capable+0x80/0x260 [ 75.273600][ T6783] ? ns_capable+0xd2/0xf0 [ 75.273616][ T6783] genl_rcv_msg+0x560/0x800 [ 75.273632][ T6783] ? __pfx_genl_rcv_msg+0x10/0x10 [ 75.273646][ T6783] ? __lock_acquire+0x5c0/0x1f40 [ 75.273661][ T6783] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 75.273681][ T6783] netlink_rcv_skb+0x159/0x420 [ 75.273693][ T6783] ? __pfx_genl_rcv_msg+0x10/0x10 [ 75.273708][ T6783] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 75.273726][ T6783] ? netlink_deliver_tap+0x1ae/0xcc0 [ 75.273740][ T6783] genl_rcv+0x28/0x40 [ 75.273753][ T6783] netlink_unicast+0x585/0x850 [ 75.273767][ T6783] ? __pfx_netlink_unicast+0x10/0x10 [ 75.273784][ T6783] netlink_sendmsg+0x8b0/0xda0 [ 75.273798][ T6783] ? __pfx_netlink_sendmsg+0x10/0x10 [ 75.273812][ T6783] ? apparmor_socket_sendmsg+0x165/0x280 [ 75.273843][ T6783] ____sys_sendmsg+0xa4d/0xbe0 [ 75.273853][ T6783] ? __pfx_netlink_sendmsg+0x10/0x10 [ 75.273867][ T6783] ? __pfx_____sys_sendmsg+0x10/0x10 [ 75.273883][ T6783] ___sys_sendmsg+0x190/0x1e0 [ 75.273895][ T6783] ? __pfx____sys_sendmsg+0x10/0x10 [ 75.273913][ T6783] ? find_held_lock+0x2b/0x80 [ 75.273933][ T6783] __sys_sendmsg+0x160/0x210 [ 75.273947][ T6783] ? __pfx___sys_sendmsg+0x10/0x10 [ 75.273966][ T6783] ? __pfx_ksys_write+0x10/0x10 [ 75.273981][ T6783] __do_fast_syscall_32+0x13a/0x8b0 [ 75.273998][ T6783] ? lockdep_hardirqs_on+0x7d/0x110 [ 75.274014][ T6783] do_fast_syscall_32+0x32/0x70 [ 75.274031][ T6783] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 75.274044][ T6783] RIP: 0023:0xf6feefec [ 75.274060][ T6783] Code: Unable to access opcode bytes at 0xf6feefc2. [ 75.274065][ T6783] RSP: 002b:00000000f53dd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 75.274076][ T6783] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 75.274082][ T6783] RDX: 000000000000c000 RSI: 0000000000000000 RDI: 0000000000000000 [ 75.274088][ T6783] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 75.274094][ T6783] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 75.274100][ T6783] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 75.274113][ T6783] [ 75.287474][ T1715] usb 7-1: USB disconnect, device number 6 [ 75.697601][ T6789] input: syz0 as /devices/virtual/input/input21 [ 75.833637][ T6795] netlink: 12 bytes leftover after parsing attributes in process `syz.0.254'. [ 75.834179][ T6795] netlink: 12 bytes leftover after parsing attributes in process `syz.0.254'. [ 75.989977][ T6811] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.991614][ T6811] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.025159][ T6805] kvm: requested 16761 ns i8254 timer period limited to 200000 ns [ 76.029458][ T6805] kvm: requested 16761 ns i8254 timer period limited to 200000 ns [ 76.032220][ T6805] kvm: requested 181028 ns i8254 timer period limited to 200000 ns [ 76.044567][ T6805] kvm: requested 23466 ns i8254 timer period limited to 200000 ns [ 76.046171][ T6805] kvm: requested 167619 ns i8254 timer period limited to 200000 ns [ 76.048285][ T6805] kvm: requested 116495 ns i8254 timer period limited to 200000 ns [ 76.052842][ T6805] kvm: requested 16761 ns i8254 timer period limited to 200000 ns [ 76.057609][ T6805] kvm: requested 89676 ns i8254 timer period limited to 200000 ns [ 76.061658][ T6805] kvm: requested 133257 ns i8254 timer period limited to 200000 ns [ 76.062298][ T6805] kvm: requested 151695 ns i8254 timer period limited to 200000 ns [ 76.322324][ T6813] device-mapper: ioctl: Invalid ioctl structure: name ׶zfNUA߫Ba, dev d7a0110dafd49adb [ 76.354952][ T6815] netlink: 16 bytes leftover after parsing attributes in process `syz.2.262'. [ 76.437707][ T6817] IPVS: set_ctl: invalid protocol: 11 100.1.1.0:20004 [ 76.679192][ T6827] netlink: 220 bytes leftover after parsing attributes in process `syz.0.267'. [ 76.700620][ T6827] comedi comedi1: Minor 4 could not be opened [ 76.814302][ T6831] netlink: 54 bytes leftover after parsing attributes in process `syz.3.269'. [ 76.846505][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.944135][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.017797][ T5094] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.022453][ T5094] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.023626][ T5094] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.024500][ T5094] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 77.025527][ T5094] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.055141][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.110423][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.251986][ T12] bridge_slave_1: left allmulticast mode [ 77.252012][ T12] bridge_slave_1: left promiscuous mode [ 77.252614][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.260666][ T12] bridge_slave_0: left allmulticast mode [ 77.260686][ T12] bridge_slave_0: left promiscuous mode [ 77.260794][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.440423][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 77.443548][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 77.444953][ T12] bond0 (unregistering): Released all slaves [ 77.570605][ T12] tipc: Left network mode [ 77.639984][ T5447] 8021q: adding VLAN 0 to HW filter on device eth2 [ 77.669213][ T6856] netlink: 'syz.3.272': attribute type 1 has an invalid length. [ 77.669232][ T6856] netlink: 756 bytes leftover after parsing attributes in process `syz.3.272'. [ 77.754899][ T2001] usb 6-1: USB disconnect, device number 8 [ 77.877923][ T12] hsr_slave_0: left promiscuous mode [ 77.878904][ T12] hsr_slave_1: left promiscuous mode [ 77.879623][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 77.879646][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 77.880876][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 77.880890][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 77.889394][ T12] veth1_macvtap: left promiscuous mode [ 77.889443][ T12] veth0_macvtap: left promiscuous mode [ 77.889609][ T12] veth1_vlan: left promiscuous mode [ 77.889670][ T12] veth0_vlan: left promiscuous mode [ 78.202176][ T12] team0 (unregistering): Port device team_slave_1 removed [ 78.208278][ T6879] FAULT_INJECTION: forcing a failure. [ 78.208278][ T6879] name fail_futex, interval 1, probability 0, space 0, times 1 [ 78.208298][ T6879] CPU: 0 UID: 0 PID: 6879 Comm: syz.0.276 Not tainted syzkaller #0 PREEMPT(full) [ 78.208310][ T6879] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 78.208316][ T6879] Call Trace: [ 78.208320][ T6879] [ 78.208324][ T6879] dump_stack_lvl+0x100/0x190 [ 78.208356][ T6879] should_fail_ex.cold+0x5/0xa [ 78.208371][ T6879] get_futex_key+0x1d0/0x14f0 [ 78.208390][ T6879] ? __pfx_get_futex_key+0x10/0x10 [ 78.208411][ T6879] futex_wait_setup+0x91/0x540 [ 78.208427][ T6879] __futex_wait+0x19f/0x300 [ 78.208441][ T6879] ? __pfx___futex_wait+0x10/0x10 [ 78.208453][ T6879] ? __pfx_try_to_wake_up+0x10/0x10 [ 78.208468][ T6879] ? futex_hash+0x311/0x400 [ 78.208484][ T6879] ? __pfx_futex_wake_mark+0x10/0x10 [ 78.208499][ T6879] ? find_held_lock+0x2b/0x80 [ 78.208509][ T6879] ? futex_wake+0x4ea/0x5e0 [ 78.208525][ T6879] futex_wait+0xe6/0x370 [ 78.208537][ T6879] ? __pfx_futex_wait+0x10/0x10 [ 78.208553][ T6879] ? percpu_counter_add_batch+0xb9/0x230 [ 78.208567][ T6879] ? errseq_sample+0x51/0x70 [ 78.208579][ T6879] ? file_init_path+0x48e/0x670 [ 78.208595][ T6879] do_futex+0x265/0x440 [ 78.208605][ T6879] ? __pfx_do_futex+0x10/0x10 [ 78.208616][ T6879] ? fd_install+0x223/0x580 [ 78.208634][ T6879] __ia32_sys_futex_time32+0x2f4/0x470 [ 78.208648][ T6879] ? xfd_validate_state+0x129/0x190 [ 78.208664][ T6879] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 78.208682][ T6879] __do_fast_syscall_32+0x13a/0x8b0 [ 78.208700][ T6879] ? lockdep_hardirqs_on+0x7d/0x110 [ 78.208717][ T6879] do_fast_syscall_32+0x32/0x70 [ 78.208733][ T6879] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 78.208747][ T6879] RIP: 0023:0xf6feefec [ 78.208759][ T6879] Code: Unable to access opcode bytes at 0xf6feefc2. [ 78.208764][ T6879] RSP: 002b:00000000f53dd5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 78.208774][ T6879] RAX: ffffffffffffffda RBX: 00000000f73e4f88 RCX: 0000000000000080 [ 78.208781][ T6879] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f73e4f8c [ 78.208787][ T6879] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 78.208793][ T6879] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 78.208799][ T6879] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 78.208812][ T6879] [ 78.219371][ T12] team0 (unregistering): Port device team_slave_0 removed [ 78.314276][ T5447] 8021q: adding VLAN 0 to HW filter on device eth3 [ 78.342133][ T6835] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.342206][ T6835] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.342275][ T6835] bridge_slave_0: entered allmulticast mode [ 78.345435][ T6835] bridge_slave_0: entered promiscuous mode [ 78.350259][ T6835] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.350394][ T6835] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.350582][ T6835] bridge_slave_1: entered allmulticast mode [ 78.352376][ T6835] bridge_slave_1: entered promiscuous mode [ 78.388451][ T6835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.390171][ T6835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.439291][ T6835] team0: Port device team_slave_0 added [ 78.447305][ T6835] team0: Port device team_slave_1 added [ 78.490401][ T6835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.490411][ T6835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.490423][ T6835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.491289][ T6835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.491297][ T6835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.491308][ T6835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.500795][ T43] audit: type=1326 audit(1789088235.346:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6895 comm="syz.3.280" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7ff8fec code=0x0 [ 78.577363][ T6899] netlink: 60 bytes leftover after parsing attributes in process `syz.3.280'. [ 78.581499][ T6835] hsr_slave_0: entered promiscuous mode [ 78.582311][ T6835] hsr_slave_1: entered promiscuous mode [ 78.582885][ T6835] debugfs: 'hsr0' already exists in 'hsr' [ 78.582902][ T6835] Cannot create hsr debugfs directory [ 78.593160][ T5447] 8021q: adding VLAN 0 to HW filter on device eth4 [ 78.761706][ T6835] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 78.764250][ T6835] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.764926][ T6835] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 78.769282][ T6835] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.769794][ T6835] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 78.778208][ T6835] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.778668][ T6835] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 78.784264][ T6835] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.843911][ T5447] 8021q: adding VLAN 0 to HW filter on device eth5 [ 78.855793][ T6835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.886515][ T6835] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.889457][ T1211] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.889501][ T1211] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.892598][ T1211] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.892641][ T1211] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.019666][ T6926] netlink: 220 bytes leftover after parsing attributes in process `syz.1.283'. [ 79.039531][ T6926] comedi comedi1: Minor 4 could not be opened [ 79.091109][ T5094] Bluetooth: hci2: command tx timeout [ 79.298042][ T6835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.528911][ T6835] veth0_vlan: entered promiscuous mode [ 79.555793][ T6835] veth1_vlan: entered promiscuous mode [ 79.628519][ T6835] veth0_macvtap: entered promiscuous mode [ 79.633666][ T6835] veth1_macvtap: entered promiscuous mode [ 79.657840][ T6835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.671859][ T6835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.707790][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.707817][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.707834][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.717245][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.745461][ T739] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.745476][ T739] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.782521][ T1211] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.782542][ T1211] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.931955][ T6970] mac80211_hwsim hwsim5 syzkaller0: Caught tx_queue_len zero misconfig [ 79.932046][ T6970] BUG: unable to handle page fault for address: fffffffffffffc10 [ 79.938283][ T6970] #PF: supervisor read access in kernel mode [ 79.941648][ T6970] #PF: error_code(0x0000) - not-present page [ 79.944372][ T6970] PGD eb99067 P4D eb99067 PUD eb9b067 PMD 0 [ 79.946265][ T6970] Oops: Oops: 0000 [#1] SMP KASAN NOPTI [ 79.948033][ T6970] CPU: 2 UID: 0 PID: 6970 Comm: syz.3.291 Not tainted syzkaller #0 PREEMPT(full) [ 79.950885][ T6970] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 79.953983][ T6970] RIP: 0010:strnlen+0x4b/0x80 [ 79.955491][ T6970] Code: 49 89 fc 48 89 f8 eb 09 48 83 c0 01 48 39 e8 74 1e 48 89 c2 48 89 c1 48 c1 ea 03 83 e1 07 0f b6 14 1a 38 ca 7f 04 84 d2 75 15 <80> 38 00 75 d9 4c 29 e0 48 83 c4 08 5b 5d 41 5c c3 cc cc cc cc 48 [ 79.961462][ T6970] RSP: 0018:ffffc9000d7f70e8 EFLAGS: 00010246 [ 79.963370][ T6970] RAX: fffffffffffffc10 RBX: dffffc0000000000 RCX: 0000000000000000 [ 79.965821][ T6970] RDX: 0000000000000000 RSI: 0000000000000010 RDI: fffffffffffffc10 [ 79.968255][ T6970] RBP: fffffffffffffc20 R08: 0000000000000007 R09: 0000000000000000 [ 79.970748][ T6970] R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffc10 [ 79.973218][ T6970] R13: ffff88801c6f3e00 R14: 0000000000000006 R15: 0000000000000010 [ 79.975682][ T6970] FS: 0000000000000000(0000) GS:ffff888096b60000(0063) knlGS:00000000f5495b40 [ 79.978468][ T6970] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 79.980528][ T6970] CR2: fffffffffffffc10 CR3: 000000006ae44000 CR4: 0000000000352ef0 [ 79.982980][ T6970] Call Trace: [ 79.984041][ T6970] [ 79.984985][ T6970] trace_event_raw_event_drv_net_setup_tc+0x101/0x5d0 [ 79.987091][ T6970] ? __pfx_trace_event_raw_event_drv_net_setup_tc+0x10/0x10 [ 79.989373][ T6970] ? __pfx___might_resched+0x10/0x10 [ 79.991060][ T6970] ? __mutex_lock+0x26c/0x1bd0 [ 79.992574][ T6970] ieee80211_netdev_setup_tc+0x2c6/0x3e0 [ 79.994334][ T6970] ? __pfx_ieee80211_netdev_setup_tc+0x10/0x10 [ 79.996273][ T6970] tcf_block_offload_cmd.isra.0+0x1c4/0x310 [ 79.998157][ T6970] ? __pfx_tcf_block_offload_cmd.isra.0+0x10/0x10 [ 80.000168][ T6970] ? __pfx_down_write+0x10/0x10 [ 80.001702][ T6970] tcf_block_get_ext+0x7ed/0x1950 [ 80.003299][ T6970] tcf_block_get+0xa8/0x100 [ 80.004732][ T6970] ? __pfx_tcf_block_get+0x10/0x10 [ 80.006359][ T6970] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 80.008321][ T6970] ? lockdep_init_map_type+0x5c/0x250 [ 80.010018][ T6970] fq_codel_init+0x4a5/0x9d0 [ 80.011495][ T6970] ? qdisc_alloc+0x81b/0xb30 [ 80.012965][ T6970] ? __pfx_fq_codel_init+0x10/0x10 [ 80.014586][ T6970] qdisc_create+0x47b/0x1060 [ 80.016049][ T6970] tc_modify_qdisc+0xdcf/0x2120 [ 80.017580][ T6970] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 80.019275][ T6970] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 80.020932][ T6970] rtnetlink_rcv_msg+0x3c9/0xe90 [ 80.022498][ T6970] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 80.024210][ T6970] ? ref_tracker_free+0x37e/0x6c0 [ 80.025793][ T6970] netlink_rcv_skb+0x159/0x420 [ 80.027305][ T6970] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 80.029026][ T6970] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 80.030699][ T6970] ? netlink_deliver_tap+0x1ae/0xcc0 [ 80.032355][ T6970] netlink_unicast+0x585/0x850 [ 80.033864][ T6970] ? __pfx_netlink_unicast+0x10/0x10 [ 80.035527][ T6970] netlink_sendmsg+0x8b0/0xda0 [ 80.037033][ T6970] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.038711][ T6970] ? apparmor_socket_sendmsg+0x165/0x280 [ 80.040466][ T6970] ____sys_sendmsg+0xa4d/0xbe0 [ 80.041962][ T6970] ? __pfx_netlink_sendmsg+0x10/0x10 [ 80.043597][ T6970] ? __pfx_____sys_sendmsg+0x10/0x10 [ 80.045367][ T6970] ___sys_sendmsg+0x190/0x1e0 [ 80.046891][ T6970] ? __pfx____sys_sendmsg+0x10/0x10 [ 80.048638][ T6970] ? futex_wait+0x11e/0x370 [ 80.050128][ T6970] ? find_held_lock+0x2b/0x80 [ 80.051628][ T6970] __sys_sendmsg+0x160/0x210 [ 80.053095][ T6970] ? __pfx___sys_sendmsg+0x10/0x10 [ 80.054716][ T6970] __do_fast_syscall_32+0x13a/0x8b0 [ 80.056351][ T6970] do_fast_syscall_32+0x32/0x70 [ 80.057913][ T6970] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 80.059894][ T6970] RIP: 0023:0xf7ff8fec [ 80.061185][ T6970] Code: Unable to access opcode bytes at 0xf7ff8fc2. [ 80.063255][ T6970] RSP: 002b:00000000f549550c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 80.065848][ T6970] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000300 [ 80.068314][ T6970] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 80.070778][ T6970] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 80.073257][ T6970] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 80.075713][ T6970] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 80.078171][ T6970] [ 80.079161][ T6970] Modules linked in: [ 80.080402][ T6970] CR2: fffffffffffffc10 [ 80.081708][ T6970] ---[ end trace 0000000000000000 ]--- [ 80.083406][ T6970] RIP: 0010:strnlen+0x4b/0x80 [ 80.083421][ T6970] Code: 49 89 fc 48 89 f8 eb 09 48 83 c0 01 48 39 e8 74 1e 48 89 c2 48 89 c1 48 c1 ea 03 83 e1 07 0f b6 14 1a 38 ca 7f 04 84 d2 75 15 <80> 38 00 75 d9 4c 29 e0 48 83 c4 08 5b 5d 41 5c c3 cc cc cc cc 48 [ 80.083431][ T6970] RSP: 0018:ffffc9000d7f70e8 EFLAGS: 00010246 [ 80.083440][ T6970] RAX: fffffffffffffc10 RBX: dffffc0000000000 RCX: 0000000000000000 [ 80.083447][ T6970] RDX: 0000000000000000 RSI: 0000000000000010 RDI: fffffffffffffc10 [ 80.083454][ T6970] RBP: fffffffffffffc20 R08: 0000000000000007 R09: 0000000000000000 [ 80.083462][ T6970] R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffc10 [ 80.083469][ T6970] R13: ffff88801c6f3e00 R14: 0000000000000006 R15: 0000000000000010 [ 80.083477][ T6970] FS: 0000000000000000(0000) GS:ffff888096b60000(0063) knlGS:00000000f5495b40 [ 80.083499][ T6970] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 80.083509][ T6970] CR2: 00000000f7ff9000 CR3: 000000006ae44000 CR4: 0000000000352ef0 [ 80.083517][ T6970] Kernel panic - not syncing: Fatal exception [ 80.114739][ T6970] Kernel Offset: disabled [ 80.116115][ T6970] Rebooting in 86400 seconds.. VM DIAGNOSIS: 00:57:16 Registers: info registers vcpu 0 CPU#0 RAX=00000002000008fb RBX=ffff88801c0f3f04 RCX=0000000000000830 RDX=0000000000000002 RSI=00000000000000fb RDI=0000000000000001 RBP=ffff888027f50038 RSP=ffffc90000007d00 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=ffffc90000007ff8 R12=1ffff92000000fa5 R13=0000000000000001 R14=1ffff11004fea001 R15=0000000000000000 RIP=ffffffff81b7dbda RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096960000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000008017a000 CR3=0000000073b1b000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffff00000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000002 RBX=0000000000000000 RCX=1ffff110056479e8 RDX=1ffff110056479e2 RSI=ffff888046124b00 RDI=ffff888046124e30 RBP=ffffc9000493f8d8 RSP=ffffc9000493f788 R8 =ffff88802b23cc00 R9 =0000000000000000 R10=ffff88802b23cbd8 R11=000000000000023d R12=ffff88802b23c040 R13=ffff888029a8a580 R14=ffff88802b33c040 R15=ffff88802b23cf10 RIP=ffffffff8bcf6a1a RFL=00000806 [-O---P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096a60000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000000008002b000 CR3=000000004c5de000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000008 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000006000000000 0000000100000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000036 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85aeb445 RDI=ffffffff9bc571e0 RBP=ffffffff9bc571a0 RSP=ffffc9000d7f67f8 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=727265203a465023 R12=0000000000000000 R13=0000000000000036 R14=000000000000000a R15=ffffc9000d7f6b10 RIP=ffffffff85aeb46f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096b60000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=fffffffffffffc10 CR3=000000006ae44000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000001000 RBX=0000000100000000 RCX=0000000000000000 RDX=000000000000007f RSI=0000000000100000 RDI=0000010000000000 RBP=0000000008000000 RSP=ffffc9000da2f7b0 R8 =0000000000000000 R9 =0000000000000000 R10=0001000000000007 R11=0000000000000000 R12=0000000000000005 R13=0000000000000008 R14=0000000000000002 R15=ffffffffffffffff RIP=ffffffff8bce0160 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] FS =0000 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] GS =0000 ffff888096c60000 ffffffff 00c09300 DPL=0 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000ffff IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000000000000 CR3=000000006ae44000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=ff MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 ffff FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000