last executing test programs: 3.518551055s ago: executing program 2 (id=1152): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0xe8, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000000)=@x86={0x8, 0x3, 0x8, 0x0, 0x3, 0x1, 0xe, 0x2, 0x8, 0x4, 0x6, 0xfb, 0x0, 0x7, 0x8, 0x5, 0x6, 0x4, 0x5, '\x00', 0x7, 0xf54}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.470461568s ago: executing program 2 (id=1155): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0xa8}) syz_usb_connect(0x0, 0x36, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r5, &(0x7f00000002c0)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(r5, 0x0, 0x0) splice(r2, 0x0, r4, 0x0, 0x39000, 0x0) memfd_create(&(0x7f0000000180)='J=\t\xeb\xf8\xa7\x04\x9f\xe1hO\x8e\xd7\xb5\x93}\x8d\xed\x01L`\x93\xcd^2P\x00$x\"\xda\xf1Az\xfe_\xc5\xb3\x9b`;\x1c\xfc\xaf9\x98\x91\xe7', 0x1) write$binfmt_elf64(r3, &(0x7f0000000000)=ANY=[], 0xfffffe3e) 3.199106552s ago: executing program 1 (id=1158): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x1000000) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='1\n', 0x2) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000480)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r4, &(0x7f0000000540)='tcp\n', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r5, &(0x7f00000005c0)='ipv4\n', 0x5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r6, &(0x7f0000000640)='127.0.0.1\n', 0xa) r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r7, &(0x7f00000006c0)='4420\n', 0x5) r8 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0) write(r8, &(0x7f0000000740)='1024\n', 0x5) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/nvmet/ports/1/subsystems/testsubsys\x00') 3.076643374s ago: executing program 1 (id=1160): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) socket$can_bcm(0x1d, 0x2, 0x2) socket$can_bcm(0x1d, 0x2, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0x18e}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) r1 = socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x10}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="10", 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4020845) syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) 3.06551359s ago: executing program 2 (id=1161): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = add_key$keyring(&(0x7f0000000240), &(0x7f00000002c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000140), &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, r4) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) userfaultfd(0x1) r5 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0xa6f81, 0x0) r6 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x20002) ioctl$VIDIOC_G_FMT(r6, 0xc0d05604, 0x0) socket$inet6(0xa, 0x80002, 0x0) r7 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0xc0101) unshare(0x24020400) socket$nl_generic(0x10, 0x3, 0x10) ioctl$VIDIOC_SUBSCRIBE_EVENT(r7, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2eae0342ca72d7e8}) r8 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r8, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2}) ioctl$VIDIOC_QUERYMENU(r8, 0xc008561c, &(0x7f0000000000)={0x980900, 0x3, @name="51da06bc7338e17dfebb1580e15b95473b09f0d1fb8aa1e9959ef9dc00"}) dup2(r5, r0) 2.580836554s ago: executing program 0 (id=1164): r0 = syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)='270', 0x3) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000100)={0x410000, 0x2, 0x1}) 2.450431318s ago: executing program 1 (id=1165): sendmsg$netlink(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0, 0x0, 0x100058d1}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0xc0041}, 0x0) r0 = msgget(0x2, 0x200) msgctl$IPC_RMID(r0, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) syz_usb_connect(0x4, 0x226, &(0x7f0000000800)={{0x12, 0x1, 0x200, 0x51, 0x14, 0x4b, 0x10, 0x545, 0x8080, 0x30a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x214, 0x2, 0x0, 0x5b, 0x20, 0x5, "", [{{0x9, 0x4, 0x35, 0x2, 0x2, 0xe, 0xca, 0xb9, 0x7, [@cdc_ecm={{0x9, 0x24, 0x6, 0x0, 0x0, "79bb5e53"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x3, 0x10, 0x2c}, [@call_mgmt={0x5, 0x24, 0x1, 0x1, 0x3d}, @network_terminal={0x7, 0x24, 0xa, 0xd, 0x10, 0xe6, 0x81}, @obex={0x5, 0x24, 0x15, 0x1}, @call_mgmt={0x5, 0x24, 0x1, 0x3, 0x81}, @dmm={0x7, 0x24, 0x14, 0x8, 0x6}, @mbim_extended={0x8, 0x24, 0x1c, 0x8, 0x8, 0x1}]}, @cdc_ncm={{0xb, 0x24, 0x6, 0x0, 0x1, "0045a53b03d7"}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x8000, 0x3, 0x8}, {0x6, 0x24, 0x1a, 0x7, 0x24}}], [{{0x9, 0x5, 0x3, 0x8, 0x8, 0x4, 0x0, 0x2}}, {{0x9, 0x5, 0xd, 0x8, 0x10, 0x0, 0x4, 0xb, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x2a, 0x8}]}}]}}, {{0x9, 0x4, 0xf0, 0x5, 0x9, 0xb6, 0xeb, 0xa7, 0x9d, [@generic={0xa, 0x9, "fc2f2df2afea8265"}, @hid_hid={0x9, 0x21, 0x7fff, 0x1, 0x1, {0x22, 0x995}}], [{{0x9, 0x5, 0x4, 0x0, 0x400, 0x62, 0x5, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x9, 0x4}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x6, 0xffff}]}}, {{0x9, 0x5, 0x1, 0x3, 0x10, 0x9, 0x30, 0x1, [@generic={0x89, 0xe, "d1a2238a1eda6d71260d21d15b60497363b5a405fceae082fa5b6f21ad7a8234154b63032a67c7617ed47b2835ef10daf69b387931bdbea1bedc5b9c67f1be79b7051113545d3cb21c9332d4ef20710059571d97bc1af614b4af5ec3b7a711a8cfa5d91283ac78c2e38eb80608d1fd6bef4b09140a47b012474f8e88180e68e72ea4130a40b60c"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x5, 0x3}]}}, {{0x9, 0x5, 0xa, 0x0, 0x20, 0xc, 0x8, 0x90, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x78, 0x9}, @generic={0x8, 0x22, "2d317c3a1e79"}]}}, {{0x9, 0x5, 0x7, 0x10, 0x400, 0x6, 0x6, 0x6}}, {{0x9, 0x5, 0x1, 0x0, 0x10, 0xe, 0x8, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x3, 0x1}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0xa}]}}, {{0x9, 0x5, 0x8, 0x3, 0x10, 0x7, 0x3, 0xeb, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x4, 0x200}]}}, {{0x9, 0x5, 0x7, 0x1, 0x200, 0x2, 0x2, 0x1, [@generic={0x1e, 0x8, "91e5219a992b485b07963db3cc7f85af98488b5db3d1f096e5594233"}, @generic={0x32, 0x2, "4822422b334aba6512eef4452b4d90398c5093e709d1b771308915d40d72edafadbb19b4e431481ad1ddbd4423be466d"}]}}, {{0x9, 0x5, 0x80, 0x4, 0x40, 0x1, 0xc7, 0xff}}, {{0x9, 0x5, 0xe, 0x0, 0x10, 0x0, 0x6, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x1, 0x800}]}}]}}]}}]}}, &(0x7f0000000e00)={0xa, &(0x7f0000000cc0)={0xa, 0x6, 0x140, 0x5, 0x9, 0x71, 0xff, 0xfa}, 0xb7, &(0x7f0000000d00)={0x5, 0xf, 0xb7, 0x4, [@ssp_cap={0x14, 0x10, 0xa, 0x6, 0x2, 0x3, 0xf0f, 0x1000, [0x30, 0xc000]}, @generic={0x98, 0x10, 0x3, "b0dfd01dbcb317ec1f2b648ddd865df202ff7e52e00fa34e3cf1566dbeeb898577493b31d1e76446900e932d63cbcb432c083ccc566f72d3ce1a7c045dae5f1fd9b7fdd75192918065c2407c519eca9bf25ea3ceab088fd72245290f2dafaea682edd9b05aadce8e7d82eb3565c7ce26f3f1828c08ea7dd8020241e4c5a5db907449801839dd4e05988ef92c95c6cc5cb09189ade5"}, @ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x1, [{0x0, 0x0}]}) msgget(0x0, 0x323) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x10, 0x0, 0x0, 0xe, 0x0, 0x0, 0x41100, 0xd}, 0x94) msgget(0x2, 0x624) msgget(0x1, 0x240) msgget(0x3, 0x606) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) ioctl$SIOCX25GCALLUSERDATA(0xffffffffffffffff, 0x89e4, &(0x7f0000000400)={0x51, "640ec1be19b5b96ec6a632d8953fad341e42ecf4e6c1485dd8f6f63bfef8552754e778be1421e268b5ec9dd7d446176613deb03a4fc93bb6cd5c1fc31fb1dc511f8dbcc1398255083099b8577a0fb118997749faeffe3b0e25ac4c0ca3e21a9edda7e7c076879a17eb1c844f2d38403813fb54165204ca2288bd2f77508d08e6"}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000080) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000040)=""/225, 0xe1}, {&(0x7f00000001c0)=""/72, 0x48}, {0x0}, {&(0x7f00000002c0)=""/105, 0x69}], 0x4, 0x0, 0x0, 0x80c1}, 0x20000000) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r2, 0x5607, 0x4) ioctl$VT_ACTIVATE(r2, 0x5606, 0x4) ioctl$TIOCL_UNBLANKSCREEN(r2, 0x541c, &(0x7f00000005c0)) 2.240685699s ago: executing program 0 (id=1166): setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="fc0000001900e1f6ddedabc4ac5c000000000000000000000000000000000001ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=r0, @ANYRES32=0x0, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000100000006000000000000000000000000000000010000000000000044000500ac1414aa000000000000000000000000000000003c000000020000000a0101020000000000000000000000000600000004030000"], 0xfc}}, 0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x36, 0x0, 0x0, 0x20000000}, 0xa}], 0x400000000000172, 0x0) 2.085440481s ago: executing program 2 (id=1169): syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6cb, 0x73f4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0x3, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x4, 0x4, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0xa7, 0xbc}}}}}]}}]}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x50000000}, 0x1c, &(0x7f0000000680)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x40440c0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000002c0)=ANY=[@ANYBLOB="12e01b3989dd", @ANYRES32=r0], 0x1000f) 2.010333751s ago: executing program 3 (id=1170): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000002c80)={0xa, 0x14e24, 0x0, @rand_addr, 0xfffffffc}, 0x1c) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24, 0x0, @loopback, 0x1}, 0x1c) recvmmsg(r0, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10000, 0x0) open(0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 1.850754874s ago: executing program 1 (id=1171): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x21, 0x0, &(0x7f0000000080)="259a302a767ed3d1feddfe0e5a53f271a8914d5a0347679417111700cef8fb1b84", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe}, 0x50) prctl$PR_SET_MM(0x23, 0x1c, &(0x7f0000ffa000/0x4000)=nil) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000010040b7080000000000007b8af8ff00000000b7080000000000107b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb7020000080000001821", @ANYRES32=r2, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], &(0x7f00000001c0)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0xa}, 0x94) socket$packet(0x11, 0x2, 0x300) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000070900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000004540000000c0a090000000000000000000a0000060900020073797a31000000000900010073797a310000000028000380180000800c00018006000100d103000008000340000000010c00008008000340000000022c0000000e0a010200000000000000000a0000000900020073797a31000000000900010073797a31"], 0xec}, 0x1, 0x0, 0x0, 0x4000850}, 0x4040) bind$802154_dgram(r0, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r4 = inotify_init() inotify_add_watch(r4, &(0x7f0000000000)='.\x00', 0x400017e) mkdir(&(0x7f0000000040)='proc_dir\x00', 0x16) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x68cd42, 0x4) openat$cgroup_ro(r5, &(0x7f0000000900)='net_prio.prioidx\x00', 0x275a, 0xb) read$FUSE(r4, &(0x7f0000001fc0)={0x2020}, 0x2020) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) connect$802154_dgram(r0, &(0x7f0000000240)={0x24, @short}, 0x14) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @local}, 0x10, 0x0}}], 0x1, 0x8000004) 1.850492959s ago: executing program 1 (id=1172): r0 = socket$netlink(0x10, 0x3, 0x10) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="640000000009ec0300000000000000000a0000084400020006000340000200000c00028005000100880000002c0001801400030000000000000000000000ffff"], 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x4000080) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r0) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) sendmsg$unix(0xffffffffffffffff, 0x0, 0x26048040) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) 1.818552557s ago: executing program 3 (id=1173): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x11, 0x2}, 0x0, 0x0, &(0x7f0000000000)) ioctl$VT_DISALLOCATE(r2, 0x5608) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="fc0000001900e1f6ddedabc4ac5c000000000000000000000000000000000001ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=r1, @ANYRES32=0x0, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000100000006000000000000000000000000000000010000000000000044000500ac1414aa000000000000000000000000000000003c000000020000000a0101020000000000000000000000000600000004030000"], 0xfc}}, 0x0) r6 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x36, 0x0, 0x0, 0x20000000}, 0xa}], 0x400000000000172, 0x0) 1.510535787s ago: executing program 2 (id=1174): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2aa}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r1, 0x0) ftruncate(r1, 0x51a9497) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f00000002c0)={0x0, 0xa, 0xddc0, 0x7f, 0x15, "cf8476513d7d661c3a4c144d36ceed08ea4781"}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) futex(&(0x7f000000cffc)=0x1, 0xd, 0x2, 0x0, 0x0, 0x400000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 1.328574433s ago: executing program 0 (id=1175): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000000a010400000000000000000100000320000000030a01010000000000000000010000000900030073797a32000000009c000000060a010400000000000000000100000208000b400000000074004f80340001800b000100657874686472000024000280080001400000000c0800034000000002080004400000002205000200070000003c0001800c00010062697477697365002c000280080003400000000208000140000000140800024000000012080007800400010008000640000000020900010073797a300000000014000400110001000000000000000000073572f8d38342200f00d3f36232c7e581dbcccb6c99715c18b2fadb7af0ce57192573fa1be5973d03e0557a5e6cb4dbd2f229a3993e82ceaaea625a1720f6bdd8f3239bc0c59033a98535e760f909bd7dab085ce51d8130dda653522cae60b6ec08f9c0757441030613eb8b69df52d739d5c5c4dbc39a00a3afa388b442411f759c96554f9d3b02829a1edf156b1328cf37189d5132"], 0xf8}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x109180) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f0000000140)=0x8) 1.210706879s ago: executing program 0 (id=1176): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={0xffffffffffffffff, 0x18000000000002a0, 0x9, 0x0, &(0x7f0000000040)="76ea09000000000000", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x28000) 1.138872427s ago: executing program 0 (id=1177): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r0, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14) connect$802154_dgram(r0, 0x0, 0x0) 1.138643621s ago: executing program 0 (id=1178): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xd) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = add_key$keyring(&(0x7f0000000240), &(0x7f00000002c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000140), &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, r4) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) userfaultfd(0x1) r5 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0xa6f81, 0x0) r6 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x20002) ioctl$VIDIOC_G_FMT(r6, 0xc0d05604, 0x0) socket$inet6(0xa, 0x80002, 0x0) r7 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0xc0101) unshare(0x24020400) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x98}, 0x1, 0x0, 0x0, 0x409d6}, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r7, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2eae0342ca72d7e8}) r8 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r8, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2}) ioctl$VIDIOC_QUERYMENU(r8, 0xc008561c, &(0x7f0000000000)={0x980900, 0x3, @name="51da06bc7338e17dfebb1580e15b95473b09f0d1fb8aa1e9959ef9dc00"}) dup2(r5, r0) 870.124771ms ago: executing program 3 (id=1179): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000540)='cdg', 0x3) sendmmsg$inet(r0, &(0x7f0000006b80)=[{{0x0, 0x0, &(0x7f0000001700)=[{&(0x7f00000000c0)="84f5", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000001ac0)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f00000020c0)=[{&(0x7f0000001c80)='1', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000002840)=[{&(0x7f0000002740)='C', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000002ec0)=[{&(0x7f0000002980)="ff", 0x1}], 0x1}}], 0x5, 0x4040801) 814.423977ms ago: executing program 3 (id=1180): sendmsg$netlink(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0, 0x0, 0x100058d1}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0xc0041}, 0x0) r0 = msgget(0x2, 0x200) msgctl$IPC_RMID(r0, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) syz_usb_connect(0x4, 0x226, &(0x7f0000000800)={{0x12, 0x1, 0x200, 0x51, 0x14, 0x4b, 0x10, 0x545, 0x8080, 0x30a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x214, 0x2, 0x0, 0x5b, 0x20, 0x5, "", [{{0x9, 0x4, 0x35, 0x2, 0x2, 0xe, 0xca, 0xb9, 0x7, [@cdc_ecm={{0x9, 0x24, 0x6, 0x0, 0x0, "79bb5e53"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x3, 0x10, 0x2c}, [@call_mgmt={0x5, 0x24, 0x1, 0x1, 0x3d}, @network_terminal={0x7, 0x24, 0xa, 0xd, 0x10, 0xe6, 0x81}, @obex={0x5, 0x24, 0x15, 0x1}, @call_mgmt={0x5, 0x24, 0x1, 0x3, 0x81}, @dmm={0x7, 0x24, 0x14, 0x8, 0x6}, @mbim_extended={0x8, 0x24, 0x1c, 0x8, 0x8, 0x1}]}, @cdc_ncm={{0xb, 0x24, 0x6, 0x0, 0x1, "0045a53b03d7"}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x8000, 0x3, 0x8}, {0x6, 0x24, 0x1a, 0x7, 0x24}}], [{{0x9, 0x5, 0x3, 0x8, 0x8, 0x4, 0x0, 0x2}}, {{0x9, 0x5, 0xd, 0x8, 0x10, 0x0, 0x4, 0xb, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x2a, 0x8}]}}]}}, {{0x9, 0x4, 0xf0, 0x5, 0x9, 0xb6, 0xeb, 0xa7, 0x9d, [@generic={0xa, 0x9, "fc2f2df2afea8265"}, @hid_hid={0x9, 0x21, 0x7fff, 0x1, 0x1, {0x22, 0x995}}], [{{0x9, 0x5, 0x4, 0x0, 0x400, 0x62, 0x5, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x9, 0x4}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x6, 0xffff}]}}, {{0x9, 0x5, 0x1, 0x3, 0x10, 0x9, 0x30, 0x1, [@generic={0x89, 0xe, "d1a2238a1eda6d71260d21d15b60497363b5a405fceae082fa5b6f21ad7a8234154b63032a67c7617ed47b2835ef10daf69b387931bdbea1bedc5b9c67f1be79b7051113545d3cb21c9332d4ef20710059571d97bc1af614b4af5ec3b7a711a8cfa5d91283ac78c2e38eb80608d1fd6bef4b09140a47b012474f8e88180e68e72ea4130a40b60c"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x5, 0x3}]}}, {{0x9, 0x5, 0xa, 0x0, 0x20, 0xc, 0x8, 0x90, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x78, 0x9}, @generic={0x8, 0x22, "2d317c3a1e79"}]}}, {{0x9, 0x5, 0x7, 0x10, 0x400, 0x6, 0x6, 0x6}}, {{0x9, 0x5, 0x1, 0x0, 0x10, 0xe, 0x8, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x3, 0x1}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0xa}]}}, {{0x9, 0x5, 0x8, 0x3, 0x10, 0x7, 0x3, 0xeb, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x4, 0x200}]}}, {{0x9, 0x5, 0x7, 0x1, 0x200, 0x2, 0x2, 0x1, [@generic={0x1e, 0x8, "91e5219a992b485b07963db3cc7f85af98488b5db3d1f096e5594233"}, @generic={0x32, 0x2, "4822422b334aba6512eef4452b4d90398c5093e709d1b771308915d40d72edafadbb19b4e431481ad1ddbd4423be466d"}]}}, {{0x9, 0x5, 0x80, 0x4, 0x40, 0x1, 0xc7, 0xff}}, {{0x9, 0x5, 0xe, 0x0, 0x10, 0x0, 0x6, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x1, 0x800}]}}]}}]}}]}}, &(0x7f0000000e00)={0xa, &(0x7f0000000cc0)={0xa, 0x6, 0x140, 0x5, 0x9, 0x71, 0xff, 0xfa}, 0xb7, &(0x7f0000000d00)={0x5, 0xf, 0xb7, 0x4, [@ssp_cap={0x14, 0x10, 0xa, 0x6, 0x2, 0x3, 0xf0f, 0x1000, [0x30, 0xc000]}, @generic={0x98, 0x10, 0x3, "b0dfd01dbcb317ec1f2b648ddd865df202ff7e52e00fa34e3cf1566dbeeb898577493b31d1e76446900e932d63cbcb432c083ccc566f72d3ce1a7c045dae5f1fd9b7fdd75192918065c2407c519eca9bf25ea3ceab088fd72245290f2dafaea682edd9b05aadce8e7d82eb3565c7ce26f3f1828c08ea7dd8020241e4c5a5db907449801839dd4e05988ef92c95c6cc5cb09189ade5"}, @ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x1, [{0x0, 0x0}]}) msgget(0x0, 0x323) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x10, 0x0, 0x0, 0xe, 0x0, 0x0, 0x41100, 0xd}, 0x94) msgget(0x2, 0x624) msgget(0x1, 0x240) msgget(0x3, 0x606) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) ioctl$SIOCX25GCALLUSERDATA(0xffffffffffffffff, 0x89e4, &(0x7f0000000400)={0x51, "640ec1be19b5b96ec6a632d8953fad341e42ecf4e6c1485dd8f6f63bfef8552754e778be1421e268b5ec9dd7d446176613deb03a4fc93bb6cd5c1fc31fb1dc511f8dbcc1398255083099b8577a0fb118997749faeffe3b0e25ac4c0ca3e21a9edda7e7c076879a17eb1c844f2d38403813fb54165204ca2288bd2f77508d08e6"}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000080) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000040)=""/225, 0xe1}, {&(0x7f00000001c0)=""/72, 0x48}, {0x0}, {&(0x7f00000002c0)=""/105, 0x69}], 0x4, 0x0, 0x0, 0x80c1}, 0x20000000) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSIGACCEPT(r2, 0x5607, 0x4) ioctl$VT_ACTIVATE(r2, 0x5606, 0x4) ioctl$TIOCL_UNBLANKSCREEN(r2, 0x541c, &(0x7f00000005c0)) 665.184363ms ago: executing program 2 (id=1181): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x40000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x34, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x22, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x89, 0x0, @empty, @broadcast}}}}}, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) munmap(&(0x7f0000583000/0x4000)=nil, 0x4000) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d00000000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000007608000000c0000018000000000000000000000000000000950000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) symlink(0x0, &(0x7f0000000300)='./file0/file0\x00') read$FUSE(0xffffffffffffffff, &(0x7f0000001180)={0x2020}, 0x2020) rename(&(0x7f0000000580)='./file0\x00', 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x7313}, [@call={0x85, 0x0, 0x0, 0x11}, @printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x11}, 0x94) 100.857558ms ago: executing program 3 (id=1182): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000180)="3300000008000102030405060101", 0xe) write(r0, &(0x7f0000000200)="34000000070001", 0x7) 83.725064ms ago: executing program 1 (id=1183): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) write$binfmt_format(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/devices/system/cpu/smt/control\x00', 0x801, 0x0) write(r0, &(0x7f0000000140)='off', 0x3) write(r0, &(0x7f0000000180)='on', 0x2) 0s ago: executing program 3 (id=1184): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000000a010400000000000000000100000320000000030a01010000000000000000010000000900030073797a32000000009c000000060a010400000000000000000100000208000b400000000074004f80340001800b000100657874686472000024000280080001400000000c0800034000000002080004400000002205000200070000003c0001800c00010062697477697365002c000280080003400000000208000140000000140800024000000012080007800400010008000640000000020900010073797a300000000014000400110001000000000000000000073572f8d38342200f00d3f36232c7e581dbcccb6c99715c18b2fadb7af0ce57192573fa1be5973d03e0557a5e6cb4dbd2f229a3993e82ceaaea625a1720f6bdd8f3239bc0c59033a98535e760f909bd7dab085ce51d8130dda653522cae60b6ec08f9c0757441030613eb8b69df52d739d5c5c4dbc39a00a3afa388b442411f759c96554f9d3b02829a1edf156b1328cf37189d5132"], 0xf8}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x109180) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f0000000140)=0x8) kernel console output (not intermixed with test programs): ][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.398957][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.404696][ T5746] veth1_vlan: entered promiscuous mode [ 39.415702][ T5739] veth0_vlan: entered promiscuous mode [ 39.417895][ T5745] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 39.421321][ T5745] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 39.430174][ T5739] veth1_vlan: entered promiscuous mode [ 39.430235][ T5745] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 39.431633][ T5745] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 39.438414][ T5745] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 39.450071][ T5738] veth0_vlan: entered promiscuous mode [ 39.457042][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.458490][ T5746] veth0_macvtap: entered promiscuous mode [ 39.461085][ T5738] veth1_vlan: entered promiscuous mode [ 39.467611][ T5746] veth1_macvtap: entered promiscuous mode [ 39.484592][ T5739] veth0_macvtap: entered promiscuous mode [ 39.492136][ T5739] veth1_macvtap: entered promiscuous mode [ 39.495332][ T5746] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.500898][ T5738] veth0_macvtap: entered promiscuous mode [ 39.504480][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.505201][ T5746] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.505934][ T5738] veth1_macvtap: entered promiscuous mode [ 39.513259][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.517855][ T5818] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.517975][ T5818] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.551027][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.556221][ T5792] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.589170][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.616379][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.616406][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.616423][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.616440][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.616457][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.619073][ T72] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.619085][ T72] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.636223][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.636250][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.636268][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.636286][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.638236][ T72] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.638247][ T72] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.675274][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.675286][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.693847][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.693861][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.715032][ T1172] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.715047][ T1172] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.733823][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.733836][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.857545][ T5898] Bluetooth: MGMT ver 1.23 [ 39.965800][ T5909] netlink: 128 bytes leftover after parsing attributes in process `syz.2.9'. [ 40.209709][ T5930] netlink: 128 bytes leftover after parsing attributes in process `syz.1.20'. [ 41.330004][ T6004] Zero length message leads to an empty skb [ 41.406635][ T5747] Bluetooth: hci0: command tx timeout [ 41.406657][ T5747] Bluetooth: hci3: command tx timeout [ 41.406668][ T5747] Bluetooth: hci1: command tx timeout [ 41.406681][ T5747] Bluetooth: hci2: command tx timeout [ 41.495083][ T6012] netlink: 164 bytes leftover after parsing attributes in process `syz.3.59'. [ 41.781851][ T6030] netlink: 164 bytes leftover after parsing attributes in process `syz.0.68'. [ 41.783060][ T6030] netlink: 36 bytes leftover after parsing attributes in process `syz.0.68'. [ 41.965265][ T6048] netlink: 164 bytes leftover after parsing attributes in process `syz.0.78'. [ 41.965528][ T6048] netlink: 36 bytes leftover after parsing attributes in process `syz.0.78'. [ 42.247631][ T6076] netlink: 164 bytes leftover after parsing attributes in process `syz.1.89'. [ 42.248855][ T6076] netlink: 36 bytes leftover after parsing attributes in process `syz.1.89'. [ 42.433737][ T6096] netlink: 164 bytes leftover after parsing attributes in process `syz.3.99'. [ 42.563725][ T6112] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 42.579887][ T6112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 43.276050][ T6152] FAULT_INJECTION: forcing a failure. [ 43.276050][ T6152] name failslab, interval 1, probability 0, space 0, times 1 [ 43.276070][ T6152] CPU: 0 UID: 0 PID: 6152 Comm: syz.2.126 Not tainted syzkaller #0 PREEMPT(full) [ 43.276097][ T6152] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 43.276104][ T6152] Call Trace: [ 43.276108][ T6152] [ 43.276113][ T6152] dump_stack_lvl+0x100/0x190 [ 43.276142][ T6152] should_fail_ex.cold+0x5/0xa [ 43.276158][ T6152] should_failslab+0xc2/0x120 [ 43.276177][ T6152] __kmalloc_noprof+0xfc/0x840 [ 43.276193][ T6152] ? rfkill_alloc+0xb1/0x300 [ 43.276210][ T6152] rfkill_alloc+0xb1/0x300 [ 43.276224][ T6152] wiphy_new_nm+0x14ca/0x2350 [ 43.276244][ T6152] ? __pfx_ieee80211_emulate_remove_chanctx+0x10/0x10 [ 43.276265][ T6152] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 43.276280][ T6152] ? __pfx_mac80211_hwsim_link_info_changed+0x10/0x10 [ 43.276292][ T6152] ieee80211_alloc_hw_nm+0x1b2e/0x2310 [ 43.276306][ T6152] ? __local_bh_enable_ip+0xa5/0x120 [ 43.276326][ T6152] mac80211_hwsim_new_radio+0x1de/0x6510 [ 43.276345][ T6152] ? __asan_memset+0x23/0x50 [ 43.276359][ T6152] ? __nla_validate_parse+0x1e7/0x28b0 [ 43.276375][ T6152] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 43.276393][ T6152] hwsim_new_radio_nl+0xc6b/0x13f0 [ 43.276405][ T6152] ? trace_kmalloc+0xeb/0x110 [ 43.276421][ T6152] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 43.276437][ T6152] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 43.276449][ T6152] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 43.276467][ T6152] genl_family_rcv_msg_doit+0x214/0x300 [ 43.276486][ T6152] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 43.276502][ T6152] ? genl_get_cmd+0x3e7/0x760 [ 43.276522][ T6152] ? bpf_lsm_capable+0x9/0x10 [ 43.276540][ T6152] ? security_capable+0x80/0x260 [ 43.276566][ T6152] ? ns_capable+0xd2/0xf0 [ 43.276595][ T6152] genl_rcv_msg+0x560/0x800 [ 43.276615][ T6152] ? __pfx_genl_rcv_msg+0x10/0x10 [ 43.276625][ T6152] ? __lock_acquire+0x5c0/0x1f40 [ 43.276641][ T6152] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 43.276658][ T6152] netlink_rcv_skb+0x159/0x420 [ 43.276674][ T6152] ? __pfx_genl_rcv_msg+0x10/0x10 [ 43.276685][ T6152] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 43.276707][ T6152] ? netlink_deliver_tap+0x1ae/0xcc0 [ 43.276724][ T6152] genl_rcv+0x28/0x40 [ 43.276733][ T6152] netlink_unicast+0x585/0x850 [ 43.276752][ T6152] ? __pfx_netlink_unicast+0x10/0x10 [ 43.276766][ T6152] ? aa_sk_perm+0x389/0xab0 [ 43.276782][ T6152] netlink_sendmsg+0x8b0/0xda0 [ 43.276800][ T6152] ? __pfx_netlink_sendmsg+0x10/0x10 [ 43.276818][ T6152] ? apparmor_socket_sendmsg+0x165/0x280 [ 43.276837][ T6152] ____sys_sendmsg+0xa4d/0xbe0 [ 43.276850][ T6152] ? __pfx_netlink_sendmsg+0x10/0x10 [ 43.276867][ T6152] ? __pfx_____sys_sendmsg+0x10/0x10 [ 43.276886][ T6152] ___sys_sendmsg+0x190/0x1e0 [ 43.276901][ T6152] ? __pfx____sys_sendmsg+0x10/0x10 [ 43.276916][ T6152] ? futex_wait+0x11e/0x370 [ 43.276935][ T6152] ? find_held_lock+0x2b/0x80 [ 43.276956][ T6152] __sys_sendmsg+0x160/0x210 [ 43.276967][ T6152] ? __pfx___sys_sendmsg+0x10/0x10 [ 43.276986][ T6152] __do_fast_syscall_32+0x13a/0x8b0 [ 43.277000][ T6152] ? lockdep_hardirqs_on+0x7d/0x110 [ 43.277014][ T6152] do_fast_syscall_32+0x32/0x70 [ 43.277028][ T6152] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 43.277042][ T6152] RIP: 0023:0xf703efec [ 43.277055][ T6152] Code: Unable to access opcode bytes at 0xf703efc2. [ 43.277060][ T6152] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 43.277071][ T6152] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 43.277078][ T6152] RDX: 0000000004044084 RSI: 0000000000000000 RDI: 0000000000000000 [ 43.277084][ T6152] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 43.277090][ T6152] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 43.277096][ T6152] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 43.277110][ T6152] [ 43.487051][ T5752] Bluetooth: hci2: command tx timeout [ 43.487073][ T5752] Bluetooth: hci1: command tx timeout [ 43.487085][ T5752] Bluetooth: hci3: command tx timeout [ 43.487097][ T5752] Bluetooth: hci0: command tx timeout [ 43.816295][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 43.826192][ T42] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 43.875108][ T6192] FAULT_INJECTION: forcing a failure. [ 43.875108][ T6192] name failslab, interval 1, probability 0, space 0, times 0 [ 43.875127][ T6192] CPU: 1 UID: 0 PID: 6192 Comm: syz.0.145 Not tainted syzkaller #0 PREEMPT(full) [ 43.875140][ T6192] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 43.875146][ T6192] Call Trace: [ 43.875150][ T6192] [ 43.875154][ T6192] dump_stack_lvl+0x100/0x190 [ 43.875177][ T6192] should_fail_ex.cold+0x5/0xa [ 43.875192][ T6192] should_failslab+0xc2/0x120 [ 43.875210][ T6192] __kmalloc_noprof+0xfc/0x840 [ 43.875224][ T6192] ? rfkill_alloc+0xb1/0x300 [ 43.875238][ T6192] rfkill_alloc+0xb1/0x300 [ 43.875251][ T6192] wiphy_new_nm+0x14ca/0x2350 [ 43.875275][ T6192] ? __pfx_ieee80211_emulate_remove_chanctx+0x10/0x10 [ 43.875291][ T6192] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 43.875305][ T6192] ? __pfx_mac80211_hwsim_link_info_changed+0x10/0x10 [ 43.875318][ T6192] ieee80211_alloc_hw_nm+0x1b2e/0x2310 [ 43.875332][ T6192] ? __local_bh_enable_ip+0xa5/0x120 [ 43.875351][ T6192] mac80211_hwsim_new_radio+0x1de/0x6510 [ 43.875368][ T6192] ? __asan_memset+0x23/0x50 [ 43.875381][ T6192] ? __nla_validate_parse+0x1e7/0x28b0 [ 43.875396][ T6192] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 43.875412][ T6192] hwsim_new_radio_nl+0xc6b/0x13f0 [ 43.875423][ T6192] ? trace_kmalloc+0xeb/0x110 [ 43.875439][ T6192] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 43.875455][ T6192] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 43.875467][ T6192] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 43.875481][ T6192] genl_family_rcv_msg_doit+0x214/0x300 [ 43.875493][ T6192] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 43.875505][ T6192] ? genl_get_cmd+0x3e7/0x760 [ 43.875517][ T6192] ? bpf_lsm_capable+0x9/0x10 [ 43.875528][ T6192] ? security_capable+0x80/0x260 [ 43.875544][ T6192] ? ns_capable+0xd2/0xf0 [ 43.875560][ T6192] genl_rcv_msg+0x560/0x800 [ 43.875591][ T6192] ? __pfx_genl_rcv_msg+0x10/0x10 [ 43.875605][ T6192] ? __lock_acquire+0x5c0/0x1f40 [ 43.875622][ T6192] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 43.875641][ T6192] netlink_rcv_skb+0x159/0x420 [ 43.875658][ T6192] ? __pfx_genl_rcv_msg+0x10/0x10 [ 43.875670][ T6192] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 43.875693][ T6192] ? netlink_deliver_tap+0x1ae/0xcc0 [ 43.875711][ T6192] genl_rcv+0x28/0x40 [ 43.875722][ T6192] netlink_unicast+0x585/0x850 [ 43.875742][ T6192] ? __pfx_netlink_unicast+0x10/0x10 [ 43.875758][ T6192] ? aa_sk_perm+0x389/0xab0 [ 43.875774][ T6192] netlink_sendmsg+0x8b0/0xda0 [ 43.875793][ T6192] ? __pfx_netlink_sendmsg+0x10/0x10 [ 43.875811][ T6192] ? apparmor_socket_sendmsg+0x165/0x280 [ 43.875829][ T6192] ____sys_sendmsg+0xa4d/0xbe0 [ 43.875842][ T6192] ? __pfx_netlink_sendmsg+0x10/0x10 [ 43.875859][ T6192] ? __pfx_____sys_sendmsg+0x10/0x10 [ 43.875879][ T6192] ___sys_sendmsg+0x190/0x1e0 [ 43.875894][ T6192] ? __pfx____sys_sendmsg+0x10/0x10 [ 43.875909][ T6192] ? futex_wait+0x11e/0x370 [ 43.875928][ T6192] ? find_held_lock+0x2b/0x80 [ 43.875949][ T6192] __sys_sendmsg+0x160/0x210 [ 43.875960][ T6192] ? __pfx___sys_sendmsg+0x10/0x10 [ 43.875979][ T6192] __do_fast_syscall_32+0x13a/0x8b0 [ 43.875993][ T6192] ? lockdep_hardirqs_on+0x7d/0x110 [ 43.876007][ T6192] do_fast_syscall_32+0x32/0x70 [ 43.876022][ T6192] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 43.876036][ T6192] RIP: 0023:0xf6fdefec [ 43.876049][ T6192] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 43.876054][ T6192] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 43.876065][ T6192] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 43.876072][ T6192] RDX: 0000000004044084 RSI: 0000000000000000 RDI: 0000000000000000 [ 43.876078][ T6192] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 43.876084][ T6192] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 43.876090][ T6192] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 43.876103][ T6192] [ 44.046165][ T42] usb 7-1: Using ep0 maxpacket: 8 [ 44.047507][ T42] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 44.048908][ T42] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 44.048924][ T42] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 44.048935][ T42] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 44.048946][ T42] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 44.048964][ T42] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.280516][ T42] usb 7-1: GET_CAPABILITIES returned 0 [ 44.280540][ T42] usbtmc 7-1:16.0: can't read capabilities [ 44.300068][ T6228] FAULT_INJECTION: forcing a failure. [ 44.300068][ T6228] name failslab, interval 1, probability 0, space 0, times 0 [ 44.300087][ T6228] CPU: 0 UID: 0 PID: 6228 Comm: syz.0.160 Not tainted syzkaller #0 PREEMPT(full) [ 44.300101][ T6228] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 44.300108][ T6228] Call Trace: [ 44.300112][ T6228] [ 44.300116][ T6228] dump_stack_lvl+0x100/0x190 [ 44.300136][ T6228] should_fail_ex.cold+0x5/0xa [ 44.300150][ T6228] should_failslab+0xc2/0x120 [ 44.300168][ T6228] kmem_cache_alloc_noprof+0x92/0x6a0 [ 44.300184][ T6228] ? __kernfs_new_node+0xd2/0xa10 [ 44.300203][ T6228] __kernfs_new_node+0xd2/0xa10 [ 44.300221][ T6228] ? __pfx___kernfs_new_node+0x10/0x10 [ 44.300239][ T6228] ? lock_acquire+0x1d1/0x380 [ 44.300254][ T6228] ? kernfs_root+0x23/0x2a0 [ 44.300268][ T6228] ? find_held_lock+0x2b/0x80 [ 44.300281][ T6228] ? kernfs_root+0xee/0x2a0 [ 44.300294][ T6228] ? kernfs_root+0xee/0x2a0 [ 44.300311][ T6228] kernfs_new_node+0x117/0x150 [ 44.300329][ T6228] __kernfs_create_file+0x53/0x350 [ 44.300343][ T6228] sysfs_add_file_mode_ns+0x207/0x3c0 [ 44.300360][ T6228] sysfs_merge_group+0x194/0x340 [ 44.300376][ T6228] ? __pfx_sysfs_merge_group+0x10/0x10 [ 44.300391][ T6228] ? bus_add_device+0x2e2/0x6c0 [ 44.300407][ T6228] ? __pfx_bus_add_device+0x10/0x10 [ 44.300421][ T6228] ? __pfx_dev_add_physical_location+0x10/0x10 [ 44.300437][ T6228] dpm_sysfs_add+0x237/0x280 [ 44.300449][ T6228] device_add+0x9f4/0x1970 [ 44.300462][ T6228] ? __pfx_device_add+0x10/0x10 [ 44.300474][ T6228] ? kfree_const+0x5a/0x70 [ 44.300485][ T6228] ? kfree+0x1e5/0x6d0 [ 44.300499][ T6228] device_create_groups_vargs+0x1f8/0x270 [ 44.300514][ T6228] device_create+0xed/0x130 [ 44.300527][ T6228] ? __pfx_device_create+0x10/0x10 [ 44.300538][ T6228] ? lockdep_init_map_type+0x5c/0x250 [ 44.300554][ T6228] ? timer_init_key+0x150/0x310 [ 44.300572][ T6228] ? ieee80211_roc_setup+0x136/0x270 [ 44.300583][ T6228] ? ieee80211_alloc_hw_nm+0x1a2a/0x2310 [ 44.300599][ T6228] mac80211_hwsim_new_radio+0x37c/0x6510 [ 44.300618][ T6228] ? __asan_memset+0x23/0x50 [ 44.300630][ T6228] ? __nla_validate_parse+0x1e7/0x28b0 [ 44.300652][ T6228] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 44.300669][ T6228] hwsim_new_radio_nl+0xc6b/0x13f0 [ 44.300682][ T6228] ? trace_kmalloc+0xeb/0x110 [ 44.300698][ T6228] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 44.300715][ T6228] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 44.300728][ T6228] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 44.300743][ T6228] genl_family_rcv_msg_doit+0x214/0x300 [ 44.300756][ T6228] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 44.300768][ T6228] ? genl_get_cmd+0x3e7/0x760 [ 44.300782][ T6228] ? bpf_lsm_capable+0x9/0x10 [ 44.300793][ T6228] ? security_capable+0x80/0x260 [ 44.300809][ T6228] ? ns_capable+0xd2/0xf0 [ 44.300827][ T6228] genl_rcv_msg+0x560/0x800 [ 44.300839][ T6228] ? __pfx_genl_rcv_msg+0x10/0x10 [ 44.300850][ T6228] ? __lock_acquire+0x5c0/0x1f40 [ 44.300865][ T6228] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 44.300882][ T6228] netlink_rcv_skb+0x159/0x420 [ 44.300898][ T6228] ? __pfx_genl_rcv_msg+0x10/0x10 [ 44.300909][ T6228] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 44.300931][ T6228] ? netlink_deliver_tap+0x1ae/0xcc0 [ 44.300948][ T6228] genl_rcv+0x28/0x40 [ 44.300957][ T6228] netlink_unicast+0x585/0x850 [ 44.300976][ T6228] ? __pfx_netlink_unicast+0x10/0x10 [ 44.300995][ T6228] netlink_sendmsg+0x8b0/0xda0 [ 44.301013][ T6228] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.301031][ T6228] ? apparmor_socket_sendmsg+0x165/0x280 [ 44.301054][ T6228] ____sys_sendmsg+0xa4d/0xbe0 [ 44.301068][ T6228] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.301085][ T6228] ? __pfx_____sys_sendmsg+0x10/0x10 [ 44.301106][ T6228] ? plist_check_list+0x1b8/0x280 [ 44.301118][ T6228] ? plist_del+0x308/0x510 [ 44.301133][ T6228] ___sys_sendmsg+0x190/0x1e0 [ 44.301149][ T6228] ? __pfx____sys_sendmsg+0x10/0x10 [ 44.301166][ T6228] ? futex_wake+0x220/0x5e0 [ 44.301186][ T6228] ? find_held_lock+0x2b/0x80 [ 44.301209][ T6228] __sys_sendmsg+0x160/0x210 [ 44.301220][ T6228] ? __pfx___sys_sendmsg+0x10/0x10 [ 44.301238][ T6228] __do_fast_syscall_32+0x13a/0x8b0 [ 44.301256][ T6228] do_fast_syscall_32+0x32/0x70 [ 44.301271][ T6228] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 44.301285][ T6228] RIP: 0023:0xf6fdefec [ 44.301299][ T6228] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 44.301304][ T6228] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 44.301318][ T6228] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 44.301325][ T6228] RDX: 0000000004044084 RSI: 0000000000000000 RDI: 0000000000000000 [ 44.301331][ T6228] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 44.301337][ T6228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 44.301343][ T6228] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 44.301356][ T6228] [ 44.512301][ T42] usb 7-1: USB disconnect, device number 2 [ 44.645819][ T6244] jffs2: notice: (6244) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 45.212342][ T6251] uprobe: syz.2.171:6251 failed to unregister, leaking uprobe [ 45.212380][ T6251] uprobe: syz.2.171:6251 failed to unregister, leaking uprobe [ 45.493738][ T6275] FAULT_INJECTION: forcing a failure. [ 45.493738][ T6275] name failslab, interval 1, probability 0, space 0, times 0 [ 45.493759][ T6275] CPU: 0 UID: 0 PID: 6275 Comm: syz.2.181 Not tainted syzkaller #0 PREEMPT(full) [ 45.493773][ T6275] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 45.493779][ T6275] Call Trace: [ 45.493784][ T6275] [ 45.493789][ T6275] dump_stack_lvl+0x100/0x190 [ 45.493808][ T6275] should_fail_ex.cold+0x5/0xa [ 45.493823][ T6275] should_failslab+0xc2/0x120 [ 45.493841][ T6275] kmem_cache_alloc_noprof+0x92/0x6a0 [ 45.493856][ T6275] ? __kernfs_new_node+0xd2/0xa10 [ 45.493874][ T6275] __kernfs_new_node+0xd2/0xa10 [ 45.493892][ T6275] ? __pfx___kernfs_new_node+0x10/0x10 [ 45.493910][ T6275] ? lock_acquire+0x1d1/0x380 [ 45.493926][ T6275] ? kernfs_root+0x23/0x2a0 [ 45.493941][ T6275] ? find_held_lock+0x2b/0x80 [ 45.493953][ T6275] ? kernfs_root+0xee/0x2a0 [ 45.493967][ T6275] ? kernfs_root+0xee/0x2a0 [ 45.493983][ T6275] kernfs_new_node+0x117/0x150 [ 45.494002][ T6275] __kernfs_create_file+0x53/0x350 [ 45.494017][ T6275] sysfs_add_file_mode_ns+0x207/0x3c0 [ 45.494048][ T6275] sysfs_merge_group+0x194/0x340 [ 45.494065][ T6275] ? kernfs_add_one+0x214/0xaa0 [ 45.494082][ T6275] ? __pfx_sysfs_merge_group+0x10/0x10 [ 45.494098][ T6275] ? bus_add_device+0x2e2/0x6c0 [ 45.494117][ T6275] ? __pfx_bus_add_device+0x10/0x10 [ 45.494131][ T6275] ? __pfx_dev_add_physical_location+0x10/0x10 [ 45.494147][ T6275] dpm_sysfs_add+0x237/0x280 [ 45.494160][ T6275] device_add+0x9f4/0x1970 [ 45.494173][ T6275] ? __pfx_device_add+0x10/0x10 [ 45.494184][ T6275] ? kfree_const+0x5a/0x70 [ 45.494195][ T6275] ? kfree+0x1e5/0x6d0 [ 45.494209][ T6275] device_create_groups_vargs+0x1f8/0x270 [ 45.494224][ T6275] device_create+0xed/0x130 [ 45.494237][ T6275] ? __pfx_device_create+0x10/0x10 [ 45.494248][ T6275] ? lockdep_init_map_type+0x5c/0x250 [ 45.494264][ T6275] ? timer_init_key+0x150/0x310 [ 45.494282][ T6275] ? ieee80211_roc_setup+0x136/0x270 [ 45.494294][ T6275] ? ieee80211_alloc_hw_nm+0x1a2a/0x2310 [ 45.494310][ T6275] mac80211_hwsim_new_radio+0x37c/0x6510 [ 45.494329][ T6275] ? __asan_memset+0x23/0x50 [ 45.494341][ T6275] ? __nla_validate_parse+0x1e7/0x28b0 [ 45.494377][ T6275] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 45.494395][ T6275] hwsim_new_radio_nl+0xc6b/0x13f0 [ 45.494408][ T6275] ? trace_kmalloc+0xeb/0x110 [ 45.494426][ T6275] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 45.494443][ T6275] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 45.494457][ T6275] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 45.494473][ T6275] genl_family_rcv_msg_doit+0x214/0x300 [ 45.494486][ T6275] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 45.494521][ T6275] ? genl_get_cmd+0x3e7/0x760 [ 45.494537][ T6275] ? bpf_lsm_capable+0x9/0x10 [ 45.494549][ T6275] ? security_capable+0x80/0x260 [ 45.494566][ T6275] ? ns_capable+0xd2/0xf0 [ 45.494584][ T6275] genl_rcv_msg+0x560/0x800 [ 45.494599][ T6275] ? __pfx_genl_rcv_msg+0x10/0x10 [ 45.494611][ T6275] ? __lock_acquire+0x5c0/0x1f40 [ 45.494628][ T6275] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 45.494646][ T6275] netlink_rcv_skb+0x159/0x420 [ 45.494662][ T6275] ? __pfx_genl_rcv_msg+0x10/0x10 [ 45.494674][ T6275] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 45.494696][ T6275] ? netlink_deliver_tap+0x1ae/0xcc0 [ 45.494713][ T6275] genl_rcv+0x28/0x40 [ 45.494722][ T6275] netlink_unicast+0x585/0x850 [ 45.494741][ T6275] ? __pfx_netlink_unicast+0x10/0x10 [ 45.494760][ T6275] netlink_sendmsg+0x8b0/0xda0 [ 45.494779][ T6275] ? __pfx_netlink_sendmsg+0x10/0x10 [ 45.494796][ T6275] ? apparmor_socket_sendmsg+0x165/0x280 [ 45.494815][ T6275] ____sys_sendmsg+0xa4d/0xbe0 [ 45.494829][ T6275] ? __pfx_netlink_sendmsg+0x10/0x10 [ 45.494846][ T6275] ? __pfx_____sys_sendmsg+0x10/0x10 [ 45.494866][ T6275] ___sys_sendmsg+0x190/0x1e0 [ 45.494882][ T6275] ? __pfx____sys_sendmsg+0x10/0x10 [ 45.494896][ T6275] ? futex_wait+0x11e/0x370 [ 45.494916][ T6275] ? find_held_lock+0x2b/0x80 [ 45.494937][ T6275] __sys_sendmsg+0x160/0x210 [ 45.494949][ T6275] ? __pfx___sys_sendmsg+0x10/0x10 [ 45.494967][ T6275] __do_fast_syscall_32+0x13a/0x8b0 [ 45.494984][ T6275] do_fast_syscall_32+0x32/0x70 [ 45.494999][ T6275] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 45.495012][ T6275] RIP: 0023:0xf703efec [ 45.495031][ T6275] Code: Unable to access opcode bytes at 0xf703efc2. [ 45.495037][ T6275] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 45.495049][ T6275] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 45.495056][ T6275] RDX: 0000000004044084 RSI: 0000000000000000 RDI: 0000000000000000 [ 45.495063][ T6275] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 45.495070][ T6275] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 45.495076][ T6275] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 45.495092][ T6275] [ 45.512297][ T6277] __nla_validate_parse: 4 callbacks suppressed [ 45.512309][ T6277] netlink: 4 bytes leftover after parsing attributes in process `syz.0.182'. [ 45.578139][ T5747] Bluetooth: hci0: command tx timeout [ 45.578161][ T5747] Bluetooth: hci3: command tx timeout [ 45.578173][ T5747] Bluetooth: hci1: command tx timeout [ 45.578185][ T5747] Bluetooth: hci2: command tx timeout [ 45.600144][ T6285] netlink: 256 bytes leftover after parsing attributes in process `syz.2.184'. [ 45.600158][ T6285] netlink: 32 bytes leftover after parsing attributes in process `syz.2.184'. [ 45.771351][ T6302] netlink: 4 bytes leftover after parsing attributes in process `syz.2.194'. [ 46.360225][ T6371] netlink: 144 bytes leftover after parsing attributes in process `syz.2.225'. [ 46.503613][ T6388] netlink: 256 bytes leftover after parsing attributes in process `syz.2.233'. [ 46.503634][ T6388] netlink: 32 bytes leftover after parsing attributes in process `syz.2.233'. [ 46.697777][ T6417] netlink: 256 bytes leftover after parsing attributes in process `syz.1.245'. [ 46.697791][ T6417] netlink: 32 bytes leftover after parsing attributes in process `syz.1.245'. [ 46.723893][ T6423] netlink: 4 bytes leftover after parsing attributes in process `syz.2.248'. [ 46.727788][ T6423] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 46.734378][ T6423] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 46.960348][ T6459] loop0: detected capacity change from 0 to 4096 [ 47.001986][ T6459] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 47.002000][ T6459] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 47.002045][ T6459] loop0: [ 47.230240][ T5152] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 47.230254][ T5152] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 47.230280][ T5152] loop0: [ 47.289878][ T6504] loop5: detected capacity change from 0 to 7 [ 47.292332][ T6504] Dev loop5: unable to read RDB block 7 [ 47.292361][ T6504] loop5: unable to read partition table [ 47.292500][ T6504] loop5: partition table beyond EOD, truncated [ 47.292523][ T6504] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 47.388735][ T5531] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 47.410752][ T6525] loop0: detected capacity change from 0 to 4096 [ 47.470353][ T6525] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 47.470368][ T6525] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 47.470395][ T6525] loop0: [ 47.484368][ T6528] loop5: detected capacity change from 0 to 7 [ 47.494589][ T6528] Dev loop5: unable to read RDB block 7 [ 47.494610][ T6528] loop5: unable to read partition table [ 47.494692][ T6528] loop5: partition table beyond EOD, truncated [ 47.494710][ T6528] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 47.556918][ T5531] usb 8-1: Using ep0 maxpacket: 8 [ 47.558531][ T5531] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 47.560771][ T5531] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 47.560797][ T5531] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 47.560817][ T5531] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 47.560836][ T5531] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 47.560868][ T5531] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.768188][ T5531] usb 8-1: GET_CAPABILITIES returned 0 [ 47.768211][ T5531] usbtmc 8-1:16.0: can't read capabilities [ 47.776258][ T10] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 47.926265][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 47.926727][ T10] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 47.928371][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.928386][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.928397][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 47.928415][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.930035][ T10] usb 7-1: config 0 descriptor?? [ 47.956842][ T2392] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 47.970164][ T30] usb 8-1: USB disconnect, device number 2 [ 48.136614][ T2392] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 48.139508][ T2392] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.139522][ T2392] usb 5-1: Product: syz [ 48.139531][ T2392] usb 5-1: Manufacturer: syz [ 48.139538][ T2392] usb 5-1: SerialNumber: syz [ 48.140915][ T2392] usb 5-1: config 0 descriptor?? [ 48.143309][ T2392] i2c-tiny-usb 5-1:0.0: version 6d.cc found at bus 005 address 002 [ 48.339719][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 48.339740][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 48.339752][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 48.339763][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 48.339775][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 48.339786][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 48.339797][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 48.339809][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 48.339820][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 48.339831][ T10] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 48.347226][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.0/0003:045E:07DA.0002/input/input5 [ 48.433716][ T10] microsoft 0003:045E:07DA.0002: input,hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 48.536038][ T57] usb 7-1: USB disconnect, device number 3 [ 48.551730][ T2392] (null): failure reading functionality [ 48.561671][ T2392] i2c i2c-2: connected i2c-tiny-usb device [ 48.757422][ T10] usb 5-1: USB disconnect, device number 2 [ 48.904215][ T6571] loop5: detected capacity change from 0 to 7 [ 48.905185][ T6571] Dev loop5: unable to read RDB block 7 [ 48.905205][ T6571] loop5: unable to read partition table [ 48.905290][ T6571] loop5: partition table beyond EOD, truncated [ 48.905321][ T6571] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 49.219692][ T6594] loop5: detected capacity change from 0 to 7 [ 49.221169][ T6594] Dev loop5: unable to read RDB block 7 [ 49.221190][ T6594] loop5: unable to read partition table [ 49.221276][ T6594] loop5: partition table beyond EOD, truncated [ 49.222799][ T6594] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 49.252996][ T6598] loop0: detected capacity change from 0 to 4096 [ 49.266171][ T57] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 49.288889][ T6598] loop0: [ 49.322496][ T5752] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 49.381740][ T6611] jffs2: notice: (6611) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 49.426456][ T57] usb 6-1: Using ep0 maxpacket: 8 [ 49.427426][ T57] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 49.428256][ T57] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 49.428272][ T57] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 49.428283][ T57] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 49.428295][ T57] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 49.428313][ T57] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.513863][ T6622] loop5: detected capacity change from 0 to 7 [ 49.519168][ T6622] Dev loop5: unable to read RDB block 7 [ 49.519236][ T6622] loop5: unable to read partition table [ 49.519327][ T6622] loop5: partition table beyond EOD, truncated [ 49.519401][ T6622] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 49.633156][ T57] usb 6-1: usb_control_msg returned -71 [ 49.633180][ T57] usbtmc 6-1:16.0: can't read capabilities [ 49.643977][ T57] usb 6-1: USB disconnect, device number 2 [ 49.718446][ T6632] loop0: detected capacity change from 0 to 4096 [ 49.769047][ T6632] loop0: [ 49.911334][ T6640] loop5: detected capacity change from 0 to 7 [ 49.912471][ T6640] Dev loop5: unable to read RDB block 7 [ 49.912501][ T6640] loop5: unable to read partition table [ 49.912700][ T6640] loop5: partition table beyond EOD, truncated [ 49.912714][ T6640] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 50.422725][ T6654] loop0: [ 50.742809][ T6664] Dev loop5: unable to read RDB block 7 [ 50.742842][ T6664] loop5: unable to read partition table [ 50.742988][ T6664] loop5: partition table beyond EOD, truncated [ 50.743001][ T6664] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 50.774614][ T6668] __nla_validate_parse: 18 callbacks suppressed [ 50.774627][ T6668] netlink: 216 bytes leftover after parsing attributes in process `syz.2.361'. [ 50.801937][ T6671] netlink: 4 bytes leftover after parsing attributes in process `syz.1.363'. [ 50.802015][ T6671] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 50.809260][ T6671] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 50.990615][ T6691] Dev loop5: unable to read RDB block 7 [ 50.990639][ T6691] loop5: unable to read partition table [ 50.990739][ T6691] loop5: partition table beyond EOD, truncated [ 50.990788][ T6691] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 51.060106][ T6696] netlink: 216 bytes leftover after parsing attributes in process `syz.3.374'. [ 51.246272][ T1729] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 51.256707][ T6709] netlink: 4 bytes leftover after parsing attributes in process `syz.3.379'. [ 51.396181][ T1729] usb 5-1: Using ep0 maxpacket: 8 [ 51.397096][ T1729] usb 5-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 51.398199][ T1729] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 51.402910][ T1729] usb 5-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 51.402929][ T1729] usb 5-1: Product: syz [ 51.402942][ T1729] usb 5-1: Manufacturer: syz [ 51.402954][ T1729] usb 5-1: SerialNumber: syz [ 51.415134][ T1729] usb 5-1: config 0 descriptor?? [ 51.421187][ T1729] imon_raw 5-1:0.0: IR endpoint missing [ 51.494932][ T6721] Dev loop5: unable to read RDB block 7 [ 51.494954][ T6721] loop5: unable to read partition table [ 51.495037][ T6721] loop5: partition table beyond EOD, truncated [ 51.495047][ T6721] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 51.593084][ T6725] netlink: 204 bytes leftover after parsing attributes in process `syz.3.385'. [ 51.630304][ T1729] usb 5-1: USB disconnect, device number 3 [ 51.732703][ T6731] netlink: 176 bytes leftover after parsing attributes in process `syz.3.388'. [ 51.848226][ T6737] FAULT_INJECTION: forcing a failure. [ 51.848226][ T6737] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 51.848252][ T6737] CPU: 0 UID: 0 PID: 6737 Comm: syz.3.391 Not tainted syzkaller #0 PREEMPT(full) [ 51.848265][ T6737] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 51.848271][ T6737] Call Trace: [ 51.848275][ T6737] [ 51.848280][ T6737] dump_stack_lvl+0x100/0x190 [ 51.848298][ T6737] should_fail_ex.cold+0x5/0xa [ 51.848314][ T6737] _copy_from_user+0x2e/0xd0 [ 51.848331][ T6737] __ia32_compat_sys_socketcall+0x187/0x770 [ 51.848350][ T6737] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 51.848374][ T6737] do_int80_emulation+0x166/0x650 [ 51.848392][ T6737] asm_int80_emulation+0x1a/0x20 [ 51.848404][ T6737] RIP: 0023:0xf72075ab [ 51.848413][ T6737] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 51.848424][ T6737] RSP: 002b:00000000f54bc34c EFLAGS: 00000246 ORIG_RAX: 0000000000000066 [ 51.848434][ T6737] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000f54bc3f4 [ 51.848441][ T6737] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 51.848447][ T6737] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 51.848453][ T6737] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 51.848459][ T6737] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 51.848471][ T6737] [ 52.141189][ T6751] netlink: 4 bytes leftover after parsing attributes in process `syz.1.398'. [ 52.210258][ T6760] FAULT_INJECTION: forcing a failure. [ 52.210258][ T6760] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 52.210289][ T6760] CPU: 0 UID: 0 PID: 6760 Comm: syz.1.401 Not tainted syzkaller #0 PREEMPT(full) [ 52.210310][ T6760] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 52.210321][ T6760] Call Trace: [ 52.210334][ T6760] [ 52.210341][ T6760] dump_stack_lvl+0x100/0x190 [ 52.210378][ T6760] should_fail_ex.cold+0x5/0xa [ 52.210400][ T6760] _copy_from_user+0x2e/0xd0 [ 52.210433][ T6760] __ia32_compat_sys_socketcall+0x187/0x770 [ 52.210503][ T6760] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 52.210545][ T6760] do_int80_emulation+0x166/0x650 [ 52.210579][ T6760] asm_int80_emulation+0x1a/0x20 [ 52.210598][ T6760] RIP: 0023:0xf71575ab [ 52.210614][ T6760] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 52.210631][ T6760] RSP: 002b:00000000f540c34c EFLAGS: 00000246 ORIG_RAX: 0000000000000066 [ 52.210655][ T6760] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000f540c3f4 [ 52.210667][ T6760] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 52.210677][ T6760] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 52.210688][ T6760] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 52.210699][ T6760] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 52.210722][ T6760] [ 52.297079][ T1729] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 52.456315][ T1729] usb 8-1: Using ep0 maxpacket: 8 [ 52.457501][ T1729] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 52.458580][ T1729] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 52.458606][ T1729] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 52.458626][ T1729] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 52.458645][ T1729] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 52.458678][ T1729] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 52.560265][ T6774] netlink: 4 bytes leftover after parsing attributes in process `syz.1.407'. [ 52.670902][ T1729] usb 8-1: usb_control_msg returned -71 [ 52.670926][ T1729] usbtmc 8-1:16.0: can't read capabilities [ 52.678742][ T1729] usb 8-1: USB disconnect, device number 3 [ 53.328813][ T6803] netlink: 176 bytes leftover after parsing attributes in process `syz.1.417'. [ 53.343978][ T6798] netlink: 4 bytes leftover after parsing attributes in process `syz.3.416'. [ 53.467896][ T6816] FAULT_INJECTION: forcing a failure. [ 53.467896][ T6816] name fail_futex, interval 1, probability 0, space 0, times 1 [ 53.467963][ T6816] CPU: 1 UID: 0 PID: 6816 Comm: syz.0.424 Not tainted syzkaller #0 PREEMPT(full) [ 53.467977][ T6816] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 53.467984][ T6816] Call Trace: [ 53.467988][ T6816] [ 53.467993][ T6816] dump_stack_lvl+0x100/0x190 [ 53.468011][ T6816] should_fail_ex.cold+0x5/0xa [ 53.468024][ T6816] ? kmem_cache_free+0x43b/0x6c0 [ 53.468038][ T6816] get_futex_key+0x1d0/0x14f0 [ 53.468051][ T6816] ? __pfx_get_futex_key+0x10/0x10 [ 53.468067][ T6816] futex_wake+0xf4/0x5e0 [ 53.468082][ T6816] ? __pfx_futex_wake+0x10/0x10 [ 53.468099][ T6816] ? __call_rcu_common.constprop.0+0x3f2/0x9b0 [ 53.468119][ T6816] do_futex+0x2b2/0x440 [ 53.468132][ T6816] ? __pfx_do_futex+0x10/0x10 [ 53.468143][ T6816] ? kmem_cache_free+0x43b/0x6c0 [ 53.468155][ T6816] ? percpu_counter_add_batch+0xb9/0x230 [ 53.468175][ T6816] __ia32_sys_futex_time32+0x2f4/0x470 [ 53.468196][ T6816] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 53.468223][ T6816] __do_fast_syscall_32+0x13a/0x8b0 [ 53.468245][ T6816] ? lockdep_hardirqs_on+0x7d/0x110 [ 53.468269][ T6816] do_fast_syscall_32+0x32/0x70 [ 53.468286][ T6816] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 53.468301][ T6816] RIP: 0023:0xf6fdefec [ 53.468312][ T6816] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 53.468317][ T6816] RSP: 002b:00000000f53cd5cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 53.468328][ T6816] RAX: ffffffffffffffda RBX: 00000000f73d4f8c RCX: 0000000000000081 [ 53.468334][ T6816] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 53.468341][ T6816] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 53.468347][ T6816] R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000 [ 53.468353][ T6816] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 53.468366][ T6816] [ 53.675706][ T6833] set_capacity_and_notify: 4 callbacks suppressed [ 53.675725][ T6833] loop5: detected capacity change from 0 to 7 [ 53.681669][ T6833] Dev loop5: unable to read RDB block 7 [ 53.681700][ T6833] loop5: unable to read partition table [ 53.681855][ T6833] loop5: partition table beyond EOD, truncated [ 53.681869][ T6833] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 53.761672][ T6845] FAULT_INJECTION: forcing a failure. [ 53.761672][ T6845] name fail_futex, interval 1, probability 0, space 0, times 0 [ 53.761693][ T6845] CPU: 0 UID: 0 PID: 6845 Comm: syz.0.436 Not tainted syzkaller #0 PREEMPT(full) [ 53.761706][ T6845] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 53.761712][ T6845] Call Trace: [ 53.761717][ T6845] [ 53.761721][ T6845] dump_stack_lvl+0x100/0x190 [ 53.761739][ T6845] should_fail_ex.cold+0x5/0xa [ 53.761755][ T6845] get_futex_key+0x1d0/0x14f0 [ 53.761767][ T6845] ? __pfx_get_futex_key+0x10/0x10 [ 53.761782][ T6845] futex_wait_setup+0x91/0x540 [ 53.761800][ T6845] __futex_wait+0x19f/0x300 [ 53.761816][ T6845] ? __pfx___futex_wait+0x10/0x10 [ 53.761831][ T6845] ? __pfx_try_to_wake_up+0x10/0x10 [ 53.761846][ T6845] ? futex_hash+0x311/0x400 [ 53.761858][ T6845] ? __pfx_futex_wake_mark+0x10/0x10 [ 53.761874][ T6845] ? find_held_lock+0x2b/0x80 [ 53.761887][ T6845] ? futex_wake+0x4ea/0x5e0 [ 53.761903][ T6845] futex_wait+0xe6/0x370 [ 53.761919][ T6845] ? __pfx_futex_wait+0x10/0x10 [ 53.761937][ T6845] ? find_held_lock+0x2b/0x80 [ 53.761949][ T6845] ? __fget_files+0x215/0x3d0 [ 53.761962][ T6845] ? __fget_files+0x215/0x3d0 [ 53.761977][ T6845] do_futex+0x265/0x440 [ 53.762005][ T6845] ? __pfx_do_futex+0x10/0x10 [ 53.762019][ T6845] ? fput+0x7c/0x100 [ 53.762036][ T6845] __ia32_sys_futex_time32+0x2f4/0x470 [ 53.762054][ T6845] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 53.762074][ T6845] __do_fast_syscall_32+0x13a/0x8b0 [ 53.762089][ T6845] ? lockdep_hardirqs_on+0x7d/0x110 [ 53.762104][ T6845] do_fast_syscall_32+0x32/0x70 [ 53.762118][ T6845] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 53.762133][ T6845] RIP: 0023:0xf6fdefec [ 53.762145][ T6845] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 53.762149][ T6845] RSP: 002b:00000000f53cd5bc EFLAGS: 00000292 ORIG_RAX: 00000000000000f0 [ 53.762161][ T6845] RAX: ffffffffffffffda RBX: 00000000f73d4f88 RCX: 0000000000000080 [ 53.762169][ T6845] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f73d4f8c [ 53.762176][ T6845] RBP: 0000000000000081 R08: 0000000000000000 R09: 0000000000000000 [ 53.762182][ T6845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 53.762188][ T6845] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 53.762201][ T6845] [ 54.061810][ T6866] loop5: detected capacity change from 0 to 7 [ 54.075626][ T6866] Dev loop5: unable to read RDB block 7 [ 54.075647][ T6866] loop5: unable to read partition table [ 54.075738][ T6866] loop5: partition table beyond EOD, truncated [ 54.075749][ T6866] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 54.240997][ T6873] FAULT_INJECTION: forcing a failure. [ 54.240997][ T6873] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 54.241028][ T6873] CPU: 3 UID: 0 PID: 6873 Comm: syz.2.449 Not tainted syzkaller #0 PREEMPT(full) [ 54.241050][ T6873] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 54.241061][ T6873] Call Trace: [ 54.241068][ T6873] [ 54.241076][ T6873] dump_stack_lvl+0x100/0x190 [ 54.241107][ T6873] should_fail_ex.cold+0x5/0xa [ 54.241133][ T6873] _copy_from_user+0x2e/0xd0 [ 54.241162][ T6873] __ia32_compat_sys_socketcall+0x187/0x770 [ 54.241194][ T6873] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 54.241235][ T6873] do_int80_emulation+0x166/0x650 [ 54.241264][ T6873] asm_int80_emulation+0x1a/0x20 [ 54.241284][ T6873] RIP: 0023:0xf71775ab [ 54.241301][ T6873] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 54.241319][ T6873] RSP: 002b:00000000f542c34c EFLAGS: 00000246 ORIG_RAX: 0000000000000066 [ 54.241340][ T6873] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000f542c3f4 [ 54.241352][ T6873] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 54.241364][ T6873] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 54.241377][ T6873] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 54.241388][ T6873] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 54.241412][ T6873] [ 54.528546][ T6891] loop5: detected capacity change from 0 to 7 [ 54.529583][ T6891] Dev loop5: unable to read RDB block 7 [ 54.529603][ T6891] loop5: unable to read partition table [ 54.529703][ T6891] loop5: partition table beyond EOD, truncated [ 54.529712][ T6891] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 54.597899][ T6895] FAULT_INJECTION: forcing a failure. [ 54.597899][ T6895] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 54.597929][ T6895] CPU: 2 UID: 0 PID: 6895 Comm: syz.3.460 Not tainted syzkaller #0 PREEMPT(full) [ 54.597950][ T6895] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 54.597959][ T6895] Call Trace: [ 54.597965][ T6895] [ 54.597972][ T6895] dump_stack_lvl+0x100/0x190 [ 54.598000][ T6895] should_fail_ex.cold+0x5/0xa [ 54.598024][ T6895] _copy_from_user+0x2e/0xd0 [ 54.598055][ T6895] __ia32_compat_sys_socketcall+0x187/0x770 [ 54.598084][ T6895] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 54.598125][ T6895] do_int80_emulation+0x166/0x650 [ 54.598151][ T6895] asm_int80_emulation+0x1a/0x20 [ 54.598168][ T6895] RIP: 0023:0xf72075ab [ 54.598181][ T6895] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 54.598197][ T6895] RSP: 002b:00000000f54bc34c EFLAGS: 00000246 ORIG_RAX: 0000000000000066 [ 54.598214][ T6895] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000f54bc3f4 [ 54.598225][ T6895] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 54.598236][ T6895] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 54.598246][ T6895] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 54.598256][ T6895] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 54.598278][ T6895] [ 55.082503][ T6915] tipc: Started in network mode [ 55.082517][ T6915] tipc: Node identity 2000004, cluster identity 4711 [ 55.082524][ T6915] tipc: Node number set to 33554436 [ 55.108998][ T6929] loop5: detected capacity change from 0 to 7 [ 55.109633][ T6929] Dev loop5: unable to read RDB block 7 [ 55.109653][ T6929] loop5: unable to read partition table [ 55.109840][ T6929] loop5: partition table beyond EOD, truncated [ 55.109893][ T6929] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 55.709728][ T6944] kernel profiling enabled (shift: 23) [ 55.779555][ T6955] __nla_validate_parse: 11 callbacks suppressed [ 55.779569][ T6955] netlink: 4 bytes leftover after parsing attributes in process `syz.1.484'. [ 55.933669][ T6964] loop5: detected capacity change from 0 to 7 [ 55.938577][ T6964] Dev loop5: unable to read RDB block 7 [ 55.938598][ T6964] loop5: unable to read partition table [ 55.938682][ T6964] loop5: partition table beyond EOD, truncated [ 55.938698][ T6964] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 55.989359][ T6966] netlink: 'syz.2.490': attribute type 4 has an invalid length. [ 55.989373][ T6966] netlink: 144 bytes leftover after parsing attributes in process `syz.2.490'. [ 56.015698][ T6968] kAFS: bad VL server IP address [ 56.045814][ T6968] kAFS: No cell specified [ 56.348644][ T6983] netlink: 4 bytes leftover after parsing attributes in process `syz.0.498'. [ 56.348743][ T6983] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 56.509811][ T6983] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 56.564184][ T6991] loop5: detected capacity change from 0 to 7 [ 56.582321][ T6991] Dev loop5: unable to read RDB block 7 [ 56.582343][ T6991] loop5: unable to read partition table [ 56.582427][ T6991] loop5: partition table beyond EOD, truncated [ 56.582438][ T6991] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 56.674368][ T6997] netlink: 164 bytes leftover after parsing attributes in process `syz.2.504'. [ 56.802269][ T43] audit: type=1326 audit(1791183651.184:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7008 comm="syz.2.512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 56.804644][ T43] audit: type=1326 audit(1791183651.184:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7008 comm="syz.2.512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 56.804677][ T43] audit: type=1326 audit(1791183651.184:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7008 comm="syz.2.512" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf703efec code=0x7ffc0000 [ 56.804702][ T43] audit: type=1326 audit(1791183651.184:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7008 comm="syz.2.512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 56.804720][ T43] audit: type=1326 audit(1791183651.184:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7008 comm="syz.2.512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 56.811179][ T43] audit: type=1326 audit(1791183651.194:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7008 comm="syz.2.512" exe="/syz-executor" sig=0 arch=40000003 syscall=431 compat=1 ip=0xf703efec code=0x7ffc0000 [ 56.811208][ T43] audit: type=1326 audit(1791183651.194:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7008 comm="syz.2.512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 56.811226][ T43] audit: type=1326 audit(1791183651.194:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7008 comm="syz.2.512" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 56.887959][ T7015] loop5: detected capacity change from 0 to 7 [ 56.888750][ T7015] Dev loop5: unable to read RDB block 7 [ 56.888781][ T7015] loop5: unable to read partition table [ 56.888951][ T7015] loop5: partition table beyond EOD, truncated [ 56.888966][ T7015] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 56.903239][ T7019] netlink: 256 bytes leftover after parsing attributes in process `syz.0.516'. [ 56.903255][ T7019] netlink: 80 bytes leftover after parsing attributes in process `syz.0.516'. [ 56.983405][ T7025] netlink: 164 bytes leftover after parsing attributes in process `syz.2.517'. [ 57.001110][ T7021] netlink: 4 bytes leftover after parsing attributes in process `syz.0.518'. [ 57.201118][ T7040] netlink: 144 bytes leftover after parsing attributes in process `syz.0.524'. [ 57.201133][ T7040] netlink: 12 bytes leftover after parsing attributes in process `syz.0.524'. [ 57.215546][ T7043] loop0: detected capacity change from 0 to 4096 [ 57.271503][ T7043] loop0: [ 57.605638][ T7049] JFS: charset not found [ 57.772198][ T7055] loop5: detected capacity change from 0 to 7 [ 57.774511][ T7055] Dev loop5: unable to read RDB block 7 [ 57.774532][ T7055] loop5: unable to read partition table [ 57.774620][ T7055] loop5: partition table beyond EOD, truncated [ 57.775685][ T7055] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 58.212565][ T7074] FAULT_INJECTION: forcing a failure. [ 58.212565][ T7074] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 58.212586][ T7074] CPU: 1 UID: 0 PID: 7074 Comm: syz.1.536 Not tainted syzkaller #0 PREEMPT(full) [ 58.212598][ T7074] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 58.212604][ T7074] Call Trace: [ 58.212608][ T7074] [ 58.212613][ T7074] dump_stack_lvl+0x100/0x190 [ 58.212631][ T7074] should_fail_ex.cold+0x5/0xa [ 58.212645][ T7074] _copy_from_user+0x2e/0xd0 [ 58.212662][ T7074] __ia32_compat_sys_socketcall+0x187/0x770 [ 58.212679][ T7074] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 58.212695][ T7074] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 58.212709][ T7074] ? ksys_write+0x1ac/0x250 [ 58.212721][ T7074] ? __pfx_ksys_write+0x10/0x10 [ 58.212739][ T7074] do_int80_emulation+0x166/0x650 [ 58.212755][ T7074] asm_int80_emulation+0x1a/0x20 [ 58.212766][ T7074] RIP: 0023:0xf71575ab [ 58.212775][ T7074] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 58.212784][ T7074] RSP: 002b:00000000f540c34c EFLAGS: 00000246 ORIG_RAX: 0000000000000066 [ 58.212795][ T7074] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000f540c3f4 [ 58.212802][ T7074] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 58.212808][ T7074] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 58.212814][ T7074] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 58.212820][ T7074] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 58.212832][ T7074] [ 58.289015][ T7077] loop5: detected capacity change from 0 to 7 [ 58.289721][ T7077] Dev loop5: unable to read RDB block 7 [ 58.289741][ T7077] loop5: unable to read partition table [ 58.289831][ T7077] loop5: partition table beyond EOD, truncated [ 58.289849][ T7077] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 58.485621][ T7099] process 'syz.2.549' launched './file1' with NULL argv: empty string added [ 58.495378][ T7100] FAULT_INJECTION: forcing a failure. [ 58.495378][ T7100] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 58.495399][ T7100] CPU: 1 UID: 0 PID: 7100 Comm: syz.3.548 Not tainted syzkaller #0 PREEMPT(full) [ 58.495412][ T7100] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 58.495418][ T7100] Call Trace: [ 58.495422][ T7100] [ 58.495427][ T7100] dump_stack_lvl+0x100/0x190 [ 58.495446][ T7100] should_fail_ex.cold+0x5/0xa [ 58.495461][ T7100] _copy_from_user+0x2e/0xd0 [ 58.495484][ T7100] move_addr_to_kernel+0x65/0x170 [ 58.495501][ T7100] __sys_sendto+0x1b8/0x4e0 [ 58.495520][ T7100] ? __pfx___sys_sendto+0x10/0x10 [ 58.495541][ T7100] ? lock_acquire+0x1d1/0x380 [ 58.495564][ T7100] __ia32_compat_sys_socketcall+0x59a/0x770 [ 58.495582][ T7100] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 58.495606][ T7100] do_int80_emulation+0x166/0x650 [ 58.495623][ T7100] asm_int80_emulation+0x1a/0x20 [ 58.495634][ T7100] RIP: 0023:0xf72075ab [ 58.495643][ T7100] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 58.495653][ T7100] RSP: 002b:00000000f54bc34c EFLAGS: 00000246 ORIG_RAX: 0000000000000066 [ 58.495664][ T7100] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000f54bc3f4 [ 58.495671][ T7100] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 58.495678][ T7100] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 58.495684][ T7100] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 58.495691][ T7100] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 58.495704][ T7100] [ 59.317759][ T7143] FAULT_INJECTION: forcing a failure. [ 59.317759][ T7143] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 59.317780][ T7143] CPU: 3 UID: 0 PID: 7143 Comm: syz.0.566 Not tainted syzkaller #0 PREEMPT(full) [ 59.317792][ T7143] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 59.317798][ T7143] Call Trace: [ 59.317802][ T7143] [ 59.317807][ T7143] dump_stack_lvl+0x100/0x190 [ 59.317839][ T7143] should_fail_ex.cold+0x5/0xa [ 59.317855][ T7143] _copy_from_user+0x2e/0xd0 [ 59.317872][ T7143] __ia32_compat_sys_socketcall+0x187/0x770 [ 59.317889][ T7143] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 59.317913][ T7143] do_int80_emulation+0x166/0x650 [ 59.317930][ T7143] asm_int80_emulation+0x1a/0x20 [ 59.317941][ T7143] RIP: 0023:0xf71175ab [ 59.317951][ T7143] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 59.317961][ T7143] RSP: 002b:00000000f53cc34c EFLAGS: 00000246 ORIG_RAX: 0000000000000066 [ 59.317972][ T7143] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000f53cc3f4 [ 59.317978][ T7143] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 59.317984][ T7143] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 59.317990][ T7143] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 59.317996][ T7143] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 59.318009][ T7143] [ 60.794788][ T7208] __nla_validate_parse: 16 callbacks suppressed [ 60.794806][ T7208] netlink: 256 bytes leftover after parsing attributes in process `syz.2.589'. [ 60.794819][ T7208] netlink: 48 bytes leftover after parsing attributes in process `syz.2.589'. [ 60.915791][ T7215] loop5: detected capacity change from 0 to 7 [ 60.918744][ T7215] Dev loop5: unable to read RDB block 7 [ 60.918764][ T7215] loop5: unable to read partition table [ 60.918851][ T7215] loop5: partition table beyond EOD, truncated [ 60.918859][ T7215] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 62.011437][ T7232] loop0: detected capacity change from 0 to 4096 [ 62.069535][ T7232] loop0: [ 62.532722][ T7243] netlink: 256 bytes leftover after parsing attributes in process `syz.3.600'. [ 62.532737][ T7243] netlink: 48 bytes leftover after parsing attributes in process `syz.3.600'. [ 64.103851][ T7256] netlink: 256 bytes leftover after parsing attributes in process `syz.2.617'. [ 64.103873][ T7256] netlink: 40 bytes leftover after parsing attributes in process `syz.2.617'. [ 64.132167][ T7258] FAULT_INJECTION: forcing a failure. [ 64.132167][ T7258] name failslab, interval 1, probability 0, space 0, times 0 [ 64.132198][ T7258] CPU: 0 UID: 0 PID: 7258 Comm: syz.1.609 Not tainted syzkaller #0 PREEMPT(full) [ 64.132220][ T7258] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 64.132231][ T7258] Call Trace: [ 64.132237][ T7258] [ 64.132244][ T7258] dump_stack_lvl+0x100/0x190 [ 64.132275][ T7258] should_fail_ex.cold+0x5/0xa [ 64.132300][ T7258] should_failslab+0xc2/0x120 [ 64.132329][ T7258] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 64.132356][ T7258] ? snd_pcm_hw_rule_add+0x3b3/0x510 [ 64.132381][ T7258] krealloc_node_align_noprof+0x321/0x3e0 [ 64.132408][ T7258] snd_pcm_hw_rule_add+0x3b3/0x510 [ 64.132428][ T7258] ? __pfx_snd_pcm_hw_rule_format+0x10/0x10 [ 64.132452][ T7258] ? __pfx_snd_pcm_hw_rule_add+0x10/0x10 [ 64.132473][ T7258] ? mutex_init_lockdep+0xf1/0x120 [ 64.132499][ T7258] ? snd_pcm_attach_substream+0x287/0xd20 [ 64.132532][ T7258] snd_pcm_open_substream+0x54a/0x1850 [ 64.132555][ T7258] ? __kasan_kmalloc+0x60/0xb0 [ 64.132578][ T7258] ? __pfx_snd_pcm_open_substream+0x10/0x10 [ 64.132599][ T7258] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 64.132619][ T7258] ? snd_pcm_oss_open+0x5c5/0x1380 [ 64.132641][ T7258] snd_pcm_oss_open+0x715/0x1380 [ 64.132669][ T7258] ? __pfx_snd_pcm_oss_open+0x10/0x10 [ 64.132686][ T7258] ? __pfx_default_wake_function+0x10/0x10 [ 64.132704][ T7258] ? __lock_acquire+0x5c0/0x1f40 [ 64.132724][ T7258] ? do_raw_spin_lock+0x128/0x260 [ 64.132736][ T7258] ? soundcore_open+0x231/0x5a0 [ 64.132748][ T7258] ? __pfx_snd_pcm_oss_open+0x10/0x10 [ 64.132760][ T7258] soundcore_open+0x2e3/0x5a0 [ 64.132772][ T7258] ? __pfx_soundcore_open+0x10/0x10 [ 64.132783][ T7258] chrdev_open+0x234/0x6a0 [ 64.132799][ T7258] ? __pfx_chrdev_open+0x10/0x10 [ 64.132816][ T7258] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 64.132845][ T7258] do_dentry_open+0x6ab/0x14d0 [ 64.132865][ T7258] ? __pfx_chrdev_open+0x10/0x10 [ 64.132892][ T7258] vfs_open+0x82/0x3f0 [ 64.132920][ T7258] path_openat+0x19fa/0x2440 [ 64.132946][ T7258] ? __pfx_path_openat+0x10/0x10 [ 64.132977][ T7258] do_file_open+0x20e/0x430 [ 64.133001][ T7258] ? __pfx_do_file_open+0x10/0x10 [ 64.133041][ T7258] ? _raw_spin_unlock+0x28/0x50 [ 64.133066][ T7258] ? alloc_fd+0x471/0x7a0 [ 64.133097][ T7258] do_sys_openat2+0x10f/0x1e0 [ 64.133126][ T7258] ? __pfx_do_sys_openat2+0x10/0x10 [ 64.133163][ T7258] __ia32_compat_sys_openat+0x12d/0x210 [ 64.133181][ T7258] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 64.133210][ T7258] __do_fast_syscall_32+0x13a/0x8b0 [ 64.133258][ T7258] do_fast_syscall_32+0x32/0x70 [ 64.133284][ T7258] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 64.133307][ T7258] RIP: 0023:0xf701efec [ 64.133327][ T7258] Code: Unable to access opcode bytes at 0xf701efc2. [ 64.133335][ T7258] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 64.133352][ T7258] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000300 [ 64.133365][ T7258] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 64.133374][ T7258] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 64.133384][ T7258] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 64.133392][ T7258] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 64.133413][ T7258] [ 64.640421][ T7264] netlink: 4 bytes leftover after parsing attributes in process `syz.3.608'. [ 67.012452][ T7283] nvme nvme0: failed to connect socket: -111 [ 67.056204][ T5531] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 67.206243][ T5531] usb 8-1: Using ep0 maxpacket: 8 [ 67.211383][ T5531] usb 8-1: unable to get BOS descriptor or descriptor too short [ 67.211407][ T5531] usb 8-1: New USB device found, idVendor=05ac, idProduct=0230, bcdDevice=32.07 [ 67.212291][ T5531] usb 8-1: config 4 has an invalid interface number: 202 but max is 0 [ 67.212305][ T5531] usb 8-1: config 4 has no interface number 0 [ 67.212319][ T5531] usb 8-1: config 4 interface 202 has no altsetting 0 [ 67.233587][ T5531] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.233644][ T5531] usb 8-1: Product: syz [ 67.233652][ T5531] usb 8-1: Manufacturer: syz [ 67.233659][ T5531] usb 8-1: SerialNumber: syz [ 67.318376][ T7292] netlink: 4 bytes leftover after parsing attributes in process `syz.1.616'. [ 67.389697][ T7294] netlink: 144 bytes leftover after parsing attributes in process `syz.1.618'. [ 67.480381][ T7298] loop0: detected capacity change from 0 to 4096 [ 67.550880][ T7298] loop0: [ 67.680245][ T7303] nvmet: adding nsid 1 to subsystem testsubsys [ 67.703723][ T7286] faux_driver vgem: [drm] Unknown color mode 9; guessing buffer size. [ 67.759550][ T7305] nvme nvme0: failed to connect socket: -111 [ 67.873404][ T7310] nvmet: disable ns before setting buffered_io value. [ 67.923507][ T7312] nvmet: disable ns before setting buffered_io value. [ 67.927251][ T7312] nvmet_tcp: enabling port 1 (127.0.0.1:4420) [ 67.975735][ T7314] netlink: 144 bytes leftover after parsing attributes in process `syz.1.632'. [ 68.089264][ T7321] netlink: 256 bytes leftover after parsing attributes in process `syz.1.635'. [ 68.089279][ T7321] netlink: 40 bytes leftover after parsing attributes in process `syz.1.635'. [ 68.090897][ T7322] loop5: detected capacity change from 0 to 7 [ 68.102131][ T7322] Dev loop5: unable to read RDB block 7 [ 68.102152][ T7322] loop5: unable to read partition table [ 68.102243][ T7322] loop5: partition table beyond EOD, truncated [ 68.102590][ T7322] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 68.169377][ T7330] nvmet: disable ns before setting buffered_io value. [ 68.192248][ T5115] nvmet: Created nvm controller 1 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:1275ba05-e9c2-49fc-9121-51642bfe8362. [ 68.227360][ T7326] nvme nvme0: creating 4 I/O queues. [ 68.233995][ T7326] nvme nvme0: mapped 4/0/0 default/read/poll queues. [ 68.254509][ T7326] nvme nvme0: new ctrl: NQN "testsubsys", addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:1275ba05-e9c2-49fc-9121-51642bfe8362 [ 68.279416][ T7335] netlink: 144 bytes leftover after parsing attributes in process `syz.2.641'. [ 68.399423][ T7342] netlink: 4 bytes leftover after parsing attributes in process `syz.2.644'. [ 68.443723][ T7348] netlink: 256 bytes leftover after parsing attributes in process `syz.3.645'. [ 68.443737][ T7348] netlink: 32 bytes leftover after parsing attributes in process `syz.3.645'. [ 68.444464][ T7347] loop0: detected capacity change from 0 to 4096 [ 68.484039][ T7347] loop0: [ 68.581811][ T7356] loop5: detected capacity change from 0 to 7 [ 68.582299][ T7356] Dev loop5: unable to read RDB block 7 [ 68.582318][ T7356] loop5: unable to read partition table [ 68.582424][ T7356] loop5: partition table beyond EOD, truncated [ 68.582434][ T7356] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 68.632943][ T7360] netlink: 132 bytes leftover after parsing attributes in process `syz.0.653'. [ 69.104194][ T5531] input: bcm5974 as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:4.202/input/input6 [ 69.111828][ T5137] bcm5974 8-1:4.202: could not read from device [ 69.141226][ T5531] usb 8-1: USB disconnect, device number 4 [ 69.174205][ T7394] nvmet: disable ns before setting buffered_io value. [ 69.174929][ T7394] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 69.175128][ T7394] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 69.175324][ T7394] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 69.175519][ T7394] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 69.175757][ T7394] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 69.246905][ T2392] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 69.252662][ T7398] loop5: detected capacity change from 0 to 7 [ 69.253128][ T7398] Dev loop5: unable to read RDB block 7 [ 69.253147][ T7398] loop5: unable to read partition table [ 69.253233][ T7398] loop5: partition table beyond EOD, truncated [ 69.253261][ T7398] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 69.407151][ T2392] usb 5-1: Using ep0 maxpacket: 8 [ 69.407606][ T2392] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 69.408596][ T2392] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 69.408612][ T2392] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 69.408623][ T2392] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 69.408634][ T2392] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 69.408652][ T2392] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 69.641845][ T7420] nvmet: disable ns before setting buffered_io value. [ 69.642624][ T7420] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 69.642828][ T7420] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 69.644705][ T7420] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 69.644914][ T7420] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 69.645210][ T7420] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 69.645438][ T2392] usb 5-1: GET_CAPABILITIES returned 0 [ 69.645459][ T2392] usbtmc 5-1:16.0: can't read capabilities [ 69.857307][ C3] usbtmc 5-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 69.859878][ T854] usb 5-1: USB disconnect, device number 4 [ 69.893756][ T7430] nvmet: disable ns before setting buffered_io value. [ 69.899466][ T7430] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 69.899679][ T7430] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 69.899882][ T7430] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 69.900092][ T7430] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 69.997284][ T7435] nvmet: disable ns before setting buffered_io value. [ 69.998096][ T7435] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 69.998358][ T7435] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 69.998622][ T7435] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 69.998837][ T7435] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 69.999045][ T7435] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 70.172623][ T7443] nvmet: disable ns before setting buffered_io value. [ 70.173331][ T7443] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 70.173580][ T7443] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 70.173781][ T7443] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 70.173981][ T7443] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 70.174236][ T7443] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 70.401065][ T7453] nvmet: disable ns before setting buffered_io value. [ 70.402542][ T7453] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 70.402932][ T7453] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 70.404070][ T7453] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 70.404474][ T7453] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 70.404884][ T7453] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 70.416388][ T7457] nvmet: disable ns before setting buffered_io value. [ 70.417113][ T7457] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 70.417317][ T7457] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 70.417531][ T7457] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 70.417781][ T7457] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 70.496048][ T7462] nvmet: disable ns before setting buffered_io value. [ 70.500757][ T7462] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 70.501169][ T7462] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 70.501590][ T7462] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 70.501990][ T7462] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 70.502405][ T7462] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 70.714405][ T7480] nvmet: disable ns before setting buffered_io value. [ 70.717790][ T7480] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 70.718055][ T7480] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 70.718267][ T7480] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 70.718494][ T7480] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 70.744732][ T7482] nvmet: disable ns before setting buffered_io value. [ 70.749122][ T7482] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 70.749541][ T7482] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 70.749996][ T7482] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 70.750368][ T7482] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 70.751636][ T7482] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 70.859620][ T1438] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.860095][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 70.865456][ T1334] cfg80211: failed to load regulatory.db [ 70.886853][ T2392] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 70.891954][ T7488] nvmet: disable ns before setting buffered_io value. [ 70.894124][ T7488] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 70.894594][ T7488] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 70.894974][ T7488] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 70.895327][ T7488] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 70.895749][ T7488] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 71.036640][ T2392] usb 6-1: Using ep0 maxpacket: 8 [ 71.039314][ T2392] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 71.040179][ T2392] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 71.040203][ T2392] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 71.040218][ T2392] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 71.040229][ T2392] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 71.040249][ T2392] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.115188][ T7503] nvmet: disable ns before setting buffered_io value. [ 71.118312][ T7503] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 71.118559][ T7503] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 71.118765][ T7503] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 71.118962][ T7503] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 71.191694][ T7507] nvmet: disable ns before setting buffered_io value. [ 71.199840][ T7507] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 71.200387][ T7507] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 71.200896][ T7507] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 71.201504][ T7507] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 71.204624][ T7507] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 71.247164][ T2392] usb 6-1: GET_CAPABILITIES returned 0 [ 71.247187][ T2392] usbtmc 6-1:16.0: can't read capabilities [ 71.381391][ T7514] nvmet: disable ns before setting buffered_io value. [ 71.382778][ T7514] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 71.383168][ T7514] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 71.383533][ T7514] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 71.383976][ T7514] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 71.448831][ C2] usbtmc 6-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 71.448874][ C2] usbtmc 6-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 71.448904][ C2] usbtmc 6-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 71.448933][ C2] usbtmc 6-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 71.450587][ T2392] usb 6-1: USB disconnect, device number 3 [ 71.824014][ T7529] nvmet: disable ns before setting buffered_io value. [ 71.828083][ T7529] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 71.828660][ T7529] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 71.829434][ T7529] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 71.829921][ T7529] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 71.830497][ T7529] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 72.956327][ T2392] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 73.018110][ T7575] nvmet: disable ns before setting buffered_io value. [ 73.019039][ T7575] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 73.019248][ T7575] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 73.019501][ T7575] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 73.019805][ T7575] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 73.020018][ T7575] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 73.108257][ T7580] nvmet: disable ns before setting buffered_io value. [ 73.109899][ T7580] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 73.110279][ T7580] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 73.110778][ T7580] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 73.113977][ T7580] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 73.126784][ T2392] usb 6-1: Using ep0 maxpacket: 8 [ 73.131806][ T2392] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 73.135524][ T2392] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 73.135540][ T2392] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 73.135551][ T2392] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 73.135562][ T2392] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 73.135581][ T2392] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 73.342846][ T7598] kAFS: bad VL server IP address [ 73.362667][ T2392] usb 6-1: GET_CAPABILITIES returned 0 [ 73.362690][ T2392] usbtmc 6-1:16.0: can't read capabilities [ 73.407563][ T7603] nvmet: disable ns before setting buffered_io value. [ 73.409319][ T7603] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 73.411838][ T7603] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 73.412243][ T7603] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 73.412768][ T7603] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 73.518907][ T7606] nvmet: disable ns before setting buffered_io value. [ 73.521929][ T7606] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 73.522146][ T7606] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 73.522354][ T7606] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 73.525093][ T7606] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 73.565077][ C2] usbtmc 6-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 73.565152][ C2] usbtmc 6-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 73.565218][ C2] usbtmc 6-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 73.569023][ T2392] usb 6-1: USB disconnect, device number 4 [ 73.772692][ T7627] nvmet: disable ns before setting buffered_io value. [ 73.773452][ T7627] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 73.773663][ T7627] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 73.773860][ T7627] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 73.774056][ T7627] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 73.774253][ T7627] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 73.858791][ T7635] nvmet: disable ns before setting buffered_io value. [ 73.861922][ T7635] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 73.862265][ T7635] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 73.862604][ T7635] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 73.864251][ T7635] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 73.951423][ T7645] nvmet: disable ns before setting buffered_io value. [ 73.952132][ T7645] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 73.952331][ T7645] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 73.952527][ T7645] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 73.952865][ T7645] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 74.020266][ T7652] nvmet: disable ns before setting buffered_io value. [ 74.032099][ T7652] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 74.034521][ T7652] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 74.034756][ T7652] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 74.034975][ T7652] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 74.120191][ T7662] nvmet: disable ns before setting buffered_io value. [ 74.120891][ T7662] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 74.121090][ T7662] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 74.121282][ T7662] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 74.123918][ T7662] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 74.132371][ T7661] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 74.331203][ T7690] nvmet: disable ns before setting buffered_io value. [ 74.332913][ T7690] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 74.333125][ T7690] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 74.333413][ T7690] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 74.333634][ T7690] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 74.409102][ T7697] nvmet: disable ns before setting buffered_io value. [ 74.411647][ T7697] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 74.411975][ T7697] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 74.413012][ T7697] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 74.414104][ T7697] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 74.495289][ T7703] tmpfs: Invalid gid '0x00000000ffffffff' [ 74.804414][ T7719] nvmet: disable ns before setting buffered_io value. [ 74.805272][ T7719] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 74.805476][ T7719] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 74.805674][ T7719] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 74.805896][ T7719] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 74.875807][ T7725] nvmet: disable ns before setting buffered_io value. [ 74.882498][ T7725] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 74.882711][ T7725] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 74.882920][ T7725] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 74.883285][ T7725] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 74.895687][ T43] audit: type=1800 audit(1791183669.274:10): pid=7727 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.816" name="file0" dev="overlay" ino=948 res=0 errno=0 [ 74.968412][ T5888] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 74.970443][ T7732] __nla_validate_parse: 6 callbacks suppressed [ 74.970459][ T7732] netlink: 4 bytes leftover after parsing attributes in process `syz.1.818'. [ 75.106706][ T7742] nvmet: disable ns before setting buffered_io value. [ 75.108176][ T7742] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 75.108709][ T7742] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 75.109376][ T7742] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 75.109771][ T7742] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 75.129391][ T5888] usb 7-1: not running at top speed; connect to a high speed hub [ 75.129418][ T5888] usb 7-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 75.131148][ T5888] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 75.131189][ T5888] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.142876][ T7744] nvmet: disable ns before setting buffered_io value. [ 75.145890][ T7744] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 75.149334][ T7744] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 75.149723][ T7744] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 75.150004][ T7744] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 75.155705][ T5888] uvcvideo 7-1:1.0: Found UVC 1.00 device (046d:0825) [ 75.155753][ T5888] uvcvideo 7-1:1.0: No streaming interface found for terminal 32770. [ 75.631099][ T7759] null_blk: disk my_zoned_dev created [ 76.185168][ T7772] futex_wake_op: syz.0.832 tries to shift op by 144; fix this program [ 76.359049][ T7778] nvmet: disable ns before setting buffered_io value. [ 76.365453][ T7778] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 76.365664][ T7778] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 76.368429][ T7778] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 76.376536][ T7778] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 76.380955][ T7780] loop0: detected capacity change from 0 to 4096 [ 76.451595][ T7783] nvmet: disable ns before setting buffered_io value. [ 76.452332][ T7783] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 76.452531][ T7783] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 76.452874][ T7783] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 76.453090][ T7783] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 76.659543][ T7795] nvmet: disable ns before setting buffered_io value. [ 76.660307][ T7795] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 76.660554][ T7795] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 76.660908][ T7795] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 76.661256][ T7795] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 76.713390][ T7799] nvmet: disable ns before setting buffered_io value. [ 76.714697][ T7799] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 76.715048][ T7799] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 76.715312][ T7799] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 76.715591][ T7799] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 76.780588][ T7802] nvmet: disable ns before setting buffered_io value. [ 76.782015][ T7802] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 76.782928][ T7802] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 76.784973][ T7802] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 76.785513][ T7802] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 76.867514][ T7807] FAULT_INJECTION: forcing a failure. [ 76.867514][ T7807] name failslab, interval 1, probability 0, space 0, times 0 [ 76.867543][ T7807] CPU: 3 UID: 0 PID: 7807 Comm: syz.3.849 Not tainted syzkaller #0 PREEMPT(full) [ 76.867562][ T7807] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.867573][ T7807] Call Trace: [ 76.867579][ T7807] [ 76.867585][ T7807] dump_stack_lvl+0x100/0x190 [ 76.867613][ T7807] should_fail_ex.cold+0x5/0xa [ 76.867636][ T7807] should_failslab+0xc2/0x120 [ 76.867661][ T7807] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 76.867683][ T7807] ? kernel_text_address+0x8d/0x100 [ 76.867704][ T7807] ? kstrdup_const+0x63/0x80 [ 76.867726][ T7807] kstrdup+0x51/0xe0 [ 76.867744][ T7807] kstrdup_const+0x63/0x80 [ 76.867762][ T7807] __kernfs_new_node+0x9b/0xa10 [ 76.867789][ T7807] ? __pfx___kernfs_new_node+0x10/0x10 [ 76.867814][ T7807] ? lock_acquire+0x1d1/0x380 [ 76.867836][ T7807] ? kernfs_root+0x23/0x2a0 [ 76.867858][ T7807] ? find_held_lock+0x2b/0x80 [ 76.867875][ T7807] ? kernfs_root+0xee/0x2a0 [ 76.867895][ T7807] ? kernfs_root+0xee/0x2a0 [ 76.867921][ T7807] kernfs_create_dir_ns+0xa6/0x2b0 [ 76.867949][ T7807] sysfs_create_dir_ns+0x13a/0x2b0 [ 76.867971][ T7807] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 76.867998][ T7807] ? find_held_lock+0x2b/0x80 [ 76.868017][ T7807] ? kobject_add_internal+0x25f/0x930 [ 76.868043][ T7807] ? kobject_add_internal+0x25f/0x930 [ 76.868073][ T7807] ? class_dir_child_ns_type+0xd/0x60 [ 76.868094][ T7807] kobject_add_internal+0x2c8/0x930 [ 76.868122][ T7807] kobject_add+0x16a/0x1e0 [ 76.868147][ T7807] ? __pfx_kobject_add+0x10/0x10 [ 76.868172][ T7807] ? get_device_parent+0x1b3/0x4c0 [ 76.868188][ T7807] ? kobject_put+0xb9/0x640 [ 76.868217][ T7807] device_add+0x294/0x1970 [ 76.868237][ T7807] ? __pfx_device_add+0x10/0x10 [ 76.868255][ T7807] ? kfree_const+0x5a/0x70 [ 76.868271][ T7807] ? kfree+0x1e5/0x6d0 [ 76.868294][ T7807] device_create_groups_vargs+0x1f8/0x270 [ 76.868317][ T7807] device_create+0xed/0x130 [ 76.868357][ T7807] ? __pfx_device_create+0x10/0x10 [ 76.868379][ T7807] ? lockdep_init_map_type+0x5c/0x250 [ 76.868404][ T7807] ? timer_init_key+0x150/0x310 [ 76.868431][ T7807] ? ieee80211_roc_setup+0x136/0x270 [ 76.868449][ T7807] ? ieee80211_alloc_hw_nm+0x1a2a/0x2310 [ 76.868473][ T7807] mac80211_hwsim_new_radio+0x37c/0x6510 [ 76.868503][ T7807] ? __asan_memset+0x23/0x50 [ 76.868523][ T7807] ? __nla_validate_parse+0x1e7/0x28b0 [ 76.868545][ T7807] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 76.868570][ T7807] hwsim_new_radio_nl+0xc6b/0x13f0 [ 76.868588][ T7807] ? trace_kmalloc+0xeb/0x110 [ 76.868612][ T7807] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 76.868637][ T7807] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 76.868656][ T7807] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 76.868678][ T7807] genl_family_rcv_msg_doit+0x214/0x300 [ 76.868700][ T7807] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 76.868719][ T7807] ? genl_get_cmd+0x3e7/0x760 [ 76.868740][ T7807] ? bpf_lsm_capable+0x9/0x10 [ 76.868755][ T7807] ? security_capable+0x80/0x260 [ 76.868779][ T7807] ? ns_capable+0xd2/0xf0 [ 76.868804][ T7807] genl_rcv_msg+0x560/0x800 [ 76.868824][ T7807] ? __pfx_genl_rcv_msg+0x10/0x10 [ 76.868841][ T7807] ? __lock_acquire+0x5c0/0x1f40 [ 76.868863][ T7807] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 76.868890][ T7807] netlink_rcv_skb+0x159/0x420 [ 76.868914][ T7807] ? __pfx_genl_rcv_msg+0x10/0x10 [ 76.868932][ T7807] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 76.868965][ T7807] ? netlink_deliver_tap+0x1ae/0xcc0 [ 76.868998][ T7807] genl_rcv+0x28/0x40 [ 76.869014][ T7807] netlink_unicast+0x585/0x850 [ 76.869043][ T7807] ? __pfx_netlink_unicast+0x10/0x10 [ 76.869077][ T7807] netlink_sendmsg+0x8b0/0xda0 [ 76.869104][ T7807] ? __pfx_netlink_sendmsg+0x10/0x10 [ 76.869130][ T7807] ? apparmor_socket_sendmsg+0x165/0x280 [ 76.869158][ T7807] ____sys_sendmsg+0xa4d/0xbe0 [ 76.869179][ T7807] ? __pfx_netlink_sendmsg+0x10/0x10 [ 76.869205][ T7807] ? __pfx_____sys_sendmsg+0x10/0x10 [ 76.869235][ T7807] ___sys_sendmsg+0x190/0x1e0 [ 76.869258][ T7807] ? __pfx____sys_sendmsg+0x10/0x10 [ 76.869280][ T7807] ? futex_wait+0x11e/0x370 [ 76.869310][ T7807] ? find_held_lock+0x2b/0x80 [ 76.869343][ T7807] __sys_sendmsg+0x160/0x210 [ 76.869360][ T7807] ? __pfx___sys_sendmsg+0x10/0x10 [ 76.869389][ T7807] __do_fast_syscall_32+0x13a/0x8b0 [ 76.869415][ T7807] do_fast_syscall_32+0x32/0x70 [ 76.869437][ T7807] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 76.869457][ T7807] RIP: 0023:0xf70cefec [ 76.869477][ T7807] Code: Unable to access opcode bytes at 0xf70cefc2. [ 76.869484][ T7807] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 76.869502][ T7807] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 76.869514][ T7807] RDX: 0000000004044084 RSI: 0000000000000000 RDI: 0000000000000000 [ 76.869524][ T7807] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 76.869535][ T7807] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 76.869544][ T7807] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 76.869566][ T7807] [ 76.869698][ T7807] kobject: kobject_add_internal failed for hwsim35 (error: -12 parent: mac80211_hwsim) [ 77.565654][ T5888] usb 7-1: USB disconnect, device number 4 [ 77.781233][ T7826] netlink: 44 bytes leftover after parsing attributes in process `syz.2.856'. [ 78.113284][ T7841] loop0: detected capacity change from 0 to 4096 [ 78.264854][ T7849] netlink: 44 bytes leftover after parsing attributes in process `syz.3.866'. [ 78.599108][ T7865] nvmet: disable ns before setting buffered_io value. [ 78.603023][ T7865] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 78.603464][ T7865] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 78.603939][ T7865] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 78.604315][ T7865] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 79.020946][ T7877] netlink: 44 bytes leftover after parsing attributes in process `syz.0.876'. [ 79.099113][ T7873] netlink: 4 bytes leftover after parsing attributes in process `syz.3.873'. [ 79.516525][ T7895] loop0: detected capacity change from 0 to 4096 [ 79.581468][ T7899] netlink: 176 bytes leftover after parsing attributes in process `syz.3.887'. [ 80.353741][ T7920] nvmet: disable ns before setting buffered_io value. [ 80.355221][ T7920] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 80.359775][ T7920] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 80.360192][ T7920] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 80.360614][ T7920] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 80.650055][ T7928] nvme_fcloop: unknown parameter or missing value 'lp' [ 80.891011][ T7934] kAFS: bad VL server IP address [ 81.156943][ T7945] nvmet: disable ns before setting buffered_io value. [ 81.157685][ T7945] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 81.158053][ T7945] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 81.159060][ T7945] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 81.159352][ T7945] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 81.255206][ T7948] nvmet: disable ns before setting buffered_io value. [ 81.256669][ T7948] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 81.257030][ T7948] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 81.257943][ T7948] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 81.258158][ T7948] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 81.418600][ T7957] nvme_fcloop: unknown parameter or missing value 'l' [ 81.424329][ T7958] busy [ 81.653409][ T7964] nvmet: disable ns before setting buffered_io value. [ 81.656810][ T7964] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 81.657355][ T7964] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 81.659000][ T7964] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 81.659468][ T7964] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 81.822372][ T7972] nvmet: disable ns before setting buffered_io value. [ 81.827540][ T7972] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 81.832226][ T7972] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 81.832540][ T7972] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 81.832877][ T7972] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 82.437314][ T7985] netlink: 4 bytes leftover after parsing attributes in process `syz.1.918'. [ 82.686529][ T5531] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 82.846230][ T5531] usb 5-1: Using ep0 maxpacket: 8 [ 82.850501][ T5531] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 82.854970][ T5531] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 82.855360][ T5531] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 82.855404][ T5531] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 82.855432][ T5531] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 82.855479][ T5531] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 82.855556][ T5531] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.114291][ T5531] usb 5-1: usb_control_msg returned -32 [ 83.114401][ T5531] usbtmc 5-1:16.0: can't read capabilities [ 83.466313][ T8005] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 83.466976][ T42] usb 5-1: USB disconnect, device number 5 [ 83.709562][ T8011] nvmet: disable ns before setting buffered_io value. [ 83.711110][ T8011] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 83.711452][ T8011] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 83.711753][ T8011] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 83.712031][ T8011] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 83.812087][ T8015] nvmet: disable ns before setting buffered_io value. [ 83.817624][ T8015] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 83.818164][ T8015] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 83.818851][ T8015] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 83.820819][ T8015] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 84.070542][ T8024] nvmet: disable ns before setting buffered_io value. [ 84.071534][ T8024] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 84.071735][ T8024] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 84.071940][ T8024] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 84.072849][ T8024] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 84.736449][ T2392] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 84.907132][ T2392] usb 8-1: Using ep0 maxpacket: 8 [ 84.910175][ T2392] usb 8-1: New USB device found, idVendor=097b, idProduct=61f6, bcdDevice=d4.9a [ 84.912113][ T2392] usb 8-1: config 10 has an invalid interface number: 91 but max is 0 [ 84.912130][ T2392] usb 8-1: config 10 has no interface number 0 [ 84.912148][ T2392] usb 8-1: config 10 interface 91 has no altsetting 0 [ 84.920015][ T2392] usb 8-1: string descriptor 0 read error: -22 [ 84.920076][ T2392] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.931408][ T2392] uvcvideo 8-1:10.91: Found Unit with invalid ID 0 [ 84.931451][ T2392] uvcvideo 8-1:10.91: Found UVC 0.40 device (097b:61f6) [ 84.931496][ T2392] uvcvideo 8-1:10.91: Entity type for entity Output 32771 was not initialized! [ 84.931522][ T2392] uvcvideo 8-1:10.91: Entity type for entity Media 2 was not initialized! [ 85.620625][ T5531] usb 8-1: USB disconnect, device number 5 [ 85.711532][ T8074] netlink: 72 bytes leftover after parsing attributes in process `syz.1.953'. [ 86.336836][ T8096] nvmet: disable ns before setting buffered_io value. [ 86.337988][ T8096] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 86.338215][ T8096] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 86.338680][ T8096] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 86.338899][ T8096] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 89.218317][ T8146] nvmet: disable ns before setting buffered_io value. [ 89.221774][ T8146] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 89.222034][ T8146] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 89.222233][ T8146] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 89.223012][ T8146] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 89.567330][ T5888] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 89.702740][ T8121] syz.0.972 (8121) used greatest stack depth: 18136 bytes left [ 89.726221][ T5888] usb 5-1: Using ep0 maxpacket: 8 [ 89.730582][ T5888] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 89.733425][ T5888] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 89.733450][ T5888] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 89.733462][ T5888] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 89.733473][ T5888] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 89.733485][ T5888] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 89.733504][ T5888] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.955153][ T5888] usb 5-1: usb_control_msg returned -32 [ 89.955177][ T5888] usbtmc 5-1:16.0: can't read capabilities [ 90.609107][ T8179] netlink: 4 bytes leftover after parsing attributes in process `syz.2.995'. [ 90.692714][ T43] audit: type=1807 audit(1791183685.074:11): action=appraise func=FIRMWARE_CHECK res=1 [ 90.716159][ T43] audit: type=1807 audit(1791183685.094:12): action=appraise func=MODULE_CHECK res=1 [ 90.717393][ T43] audit: type=1807 audit(1791183685.104:13): action=appraise func=POLICY_CHECK res=1 [ 90.717741][ T8187] ima: policy update completed [ 90.718047][ T43] audit: type=1802 audit(1791183685.104:14): pid=8187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=completed comm="syz.1.998" res=1 errno=0 [ 90.728763][ T8185] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 90.843466][ T8192] nvmet: disable ns before setting buffered_io value. [ 90.848678][ T8192] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 90.850447][ T8192] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 90.854348][ T8192] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 90.855601][ T8192] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 90.876547][ T2322] usb 5-1: USB disconnect, device number 6 [ 91.078240][ T8205] FAULT_INJECTION: forcing a failure. [ 91.078240][ T8205] name failslab, interval 1, probability 0, space 0, times 0 [ 91.078259][ T8205] CPU: 3 UID: 0 PID: 8205 Comm: syz.3.1006 Not tainted syzkaller #0 PREEMPT(full) [ 91.078273][ T8205] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 91.078305][ T8205] Call Trace: [ 91.078312][ T8205] [ 91.078320][ T8205] dump_stack_lvl+0x100/0x190 [ 91.078351][ T8205] should_fail_ex.cold+0x5/0xa [ 91.078373][ T8205] should_failslab+0xc2/0x120 [ 91.078391][ T8205] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 91.078407][ T8205] ? kstrdup_const+0x63/0x80 [ 91.078424][ T8205] kstrdup+0x51/0xe0 [ 91.078436][ T8205] kstrdup_const+0x63/0x80 [ 91.078448][ T8205] __kernfs_new_node+0x9b/0xa10 [ 91.078467][ T8205] ? __pfx___kernfs_new_node+0x10/0x10 [ 91.078484][ T8205] ? lock_acquire+0x1d1/0x380 [ 91.078500][ T8205] ? kernfs_root+0x23/0x2a0 [ 91.078515][ T8205] ? find_held_lock+0x2b/0x80 [ 91.078527][ T8205] ? kernfs_root+0xee/0x2a0 [ 91.078540][ T8205] ? kernfs_root+0xee/0x2a0 [ 91.078558][ T8205] kernfs_new_node+0x117/0x150 [ 91.078576][ T8205] kernfs_create_link+0xcc/0x240 [ 91.078589][ T8205] sysfs_do_create_link_sd+0x90/0x140 [ 91.078605][ T8205] sysfs_create_link+0x61/0xc0 [ 91.078619][ T8205] driver_sysfs_add+0x91/0x2d0 [ 91.078636][ T8205] really_probe+0x146/0xa60 [ 91.078654][ T8205] __driver_probe_device+0x210/0x460 [ 91.078670][ T8205] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 91.078685][ T8205] driver_probe_device+0x4a/0x140 [ 91.078695][ T8205] __driver_attach+0x21f/0x5b0 [ 91.078705][ T8205] ? __pfx___driver_attach+0x10/0x10 [ 91.078715][ T8205] bus_for_each_dev+0x13e/0x1d0 [ 91.078730][ T8205] ? __pfx_bus_for_each_dev+0x10/0x10 [ 91.078743][ T8205] ? bus_add_driver+0x2b5/0x5b0 [ 91.078762][ T8205] bus_add_driver+0x305/0x5b0 [ 91.078778][ T8205] driver_register+0x1e2/0x360 [ 91.078789][ T8205] ? rcu_is_watching+0x13/0xc0 [ 91.078802][ T8205] usb_gadget_register_driver_owner+0x132/0x210 [ 91.078821][ T8205] raw_ioctl+0x1a85/0x2b80 [ 91.078838][ T8205] ? __pfx_raw_ioctl+0x10/0x10 [ 91.078855][ T8205] ? __pfx_raw_ioctl+0x10/0x10 [ 91.078870][ T8205] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 91.078884][ T8205] __do_fast_syscall_32+0x13a/0x8b0 [ 91.078901][ T8205] do_fast_syscall_32+0x32/0x70 [ 91.078916][ T8205] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 91.078929][ T8205] RIP: 0023:0xf70cefec [ 91.078943][ T8205] Code: Unable to access opcode bytes at 0xf70cefc2. [ 91.078948][ T8205] RSP: 002b:00000000f54bb424 EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 91.078959][ T8205] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000005501 [ 91.078966][ T8205] RDX: 0000000000000000 RSI: 00000000f7498ff4 RDI: 00000000f54bc4c0 [ 91.078972][ T8205] RBP: 00000000f7498ff4 R08: 0000000000000000 R09: 0000000000000000 [ 91.078979][ T8205] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 91.078985][ T8205] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 91.079005][ T8205] [ 91.079013][ T8205] raw-gadget.0 gadget.3: really_probe: driver_sysfs_add failed [ 91.079323][ T8205] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 91.087384][ T8205] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 91.399048][ T8207] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1005'. [ 91.691197][ T8216] team0: Port device vlan0 added [ 91.989397][ T38] IPVS: starting estimator thread 0... [ 92.015664][ T8225] No source specified [ 92.089793][ T8231] IPVS: using max 44 ests per chain, 105600 per kthread [ 92.093192][ T8235] nvmet: disable ns before setting buffered_io value. [ 92.095909][ T8235] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 92.096237][ T8235] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 92.096451][ T8235] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 92.096644][ T8235] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 92.096844][ T8235] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 92.800334][ T8262] nvmet: disable ns before setting buffered_io value. [ 92.809767][ T8262] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 92.812001][ T8262] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 92.815760][ T8262] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 92.818064][ T8262] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 92.823725][ T8262] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 93.009091][ T8263] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1027'. [ 93.837406][ T8293] nvmet: disable ns before setting buffered_io value. [ 93.842162][ T8293] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 93.842968][ T8293] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 93.843885][ T8293] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 93.864020][ T8293] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 93.943363][ T8300] nvmet: disable ns before setting buffered_io value. [ 93.944776][ T8300] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 93.945293][ T8300] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 93.945671][ T8300] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 93.946050][ T8300] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 93.946841][ T8300] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 94.296640][ T1158] IPVS: starting estimator thread 0... [ 94.406214][ T8315] IPVS: using max 29 ests per chain, 69600 per kthread [ 94.739506][ T8323] nvmet: disable ns before setting buffered_io value. [ 94.752701][ T8323] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 94.753282][ T8323] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 94.753670][ T8323] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 94.755538][ T8323] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 95.149511][ T8345] overlayfs: failed to clone upperpath [ 95.243608][ T8353] nvmet: disable ns before setting buffered_io value. [ 95.244291][ T8353] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 95.244496][ T8353] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 95.244702][ T8353] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 95.244929][ T8353] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 95.245136][ T8353] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 95.567121][ T8368] tipc: Started in network mode [ 95.567139][ T8368] tipc: Node identity 2000004, cluster identity 4711 [ 95.567148][ T8368] tipc: Node number set to 33554436 [ 95.643405][ T8385] nvmet: disable ns before setting buffered_io value. [ 95.644190][ T8385] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 95.644432][ T8385] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 95.644632][ T8385] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 95.645151][ T8385] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 95.649697][ T8385] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 96.184887][ T8408] FAULT_INJECTION: forcing a failure. [ 96.184887][ T8408] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 96.184909][ T8408] CPU: 0 UID: 0 PID: 8408 Comm: syz.1.1090 Not tainted syzkaller #0 PREEMPT(full) [ 96.184923][ T8408] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.184929][ T8408] Call Trace: [ 96.184933][ T8408] [ 96.184937][ T8408] dump_stack_lvl+0x100/0x190 [ 96.184956][ T8408] should_fail_ex.cold+0x5/0xa [ 96.184970][ T8408] _copy_to_user+0x32/0xd0 [ 96.184988][ T8408] bpf_log_attr_finalize+0x169/0x1a0 [ 96.185003][ T8408] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 96.185018][ T8408] btf_new_fd+0x9c7/0x5d40 [ 96.185028][ T8408] ? __lock_acquire+0x5c0/0x1f40 [ 96.185047][ T8408] ? __lock_acquire+0x5c0/0x1f40 [ 96.185066][ T8408] ? __pfx_btf_new_fd+0x10/0x10 [ 96.185077][ T8408] ? lock_acquire+0x1d1/0x380 [ 96.185092][ T8408] ? rcu_is_watching+0x13/0xc0 [ 96.185106][ T8408] ? apparmor_capable+0x1d7/0x4d0 [ 96.185118][ T8408] ? bpf_lsm_capable+0x9/0x10 [ 96.185129][ T8408] ? security_capable+0x80/0x260 [ 96.185145][ T8408] ? ns_capable+0xd2/0xf0 [ 96.185162][ T8408] __sys_bpf+0x13ef/0x4a30 [ 96.185177][ T8408] ? __pfx___sys_bpf+0x10/0x10 [ 96.185188][ T8408] ? find_held_lock+0x2b/0x80 [ 96.185201][ T8408] ? futex_wake+0x4ea/0x5e0 [ 96.185223][ T8408] ? rcu_read_lock_any_held+0x6a/0x90 [ 96.185235][ T8408] ? find_held_lock+0x2b/0x80 [ 96.185248][ T8408] ? ksys_write+0x190/0x250 [ 96.185260][ T8408] ? ksys_write+0x190/0x250 [ 96.185280][ T8408] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 96.185292][ T8408] ? __ia32_sys_futex_time32+0x2fd/0x470 [ 96.185306][ T8408] ? fput+0x7c/0x100 [ 96.185321][ T8408] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 96.185334][ T8408] ? ksys_write+0x1ac/0x250 [ 96.185348][ T8408] ? __ia32_sys_bpf+0xcc/0x170 [ 96.185360][ T8408] __ia32_sys_bpf+0xcc/0x170 [ 96.185373][ T8408] ? __do_fast_syscall_32+0xb3/0x8b0 [ 96.185388][ T8408] __do_fast_syscall_32+0x13a/0x8b0 [ 96.185409][ T8408] do_fast_syscall_32+0x32/0x70 [ 96.185425][ T8408] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 96.185440][ T8408] RIP: 0023:0xf701efec [ 96.185454][ T8408] Code: Unable to access opcode bytes at 0xf701efc2. [ 96.185460][ T8408] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 96.185473][ T8408] RAX: ffffffffffffffda RBX: 0000000000000012 RCX: 0000000080000540 [ 96.185481][ T8408] RDX: 0000000000000028 RSI: 0000000000000000 RDI: 0000000000000000 [ 96.185487][ T8408] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 96.185493][ T8408] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 96.185499][ T8408] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 96.185512][ T8408] [ 96.252394][ T8412] kAFS: No cell specified [ 96.384107][ T8420] nvmet: disable ns before setting buffered_io value. [ 96.390628][ T8420] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 96.391656][ T8420] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 96.392066][ T8420] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 96.392897][ T8420] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 96.393645][ T8420] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 96.550674][ T8433] device-mapper: ioctl: Invalid ioctl structure: name snap0, dev f800 [ 96.618479][ T8442] nvmet: disable ns before setting buffered_io value. [ 96.619352][ T8442] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 96.619557][ T8442] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 96.619754][ T8442] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 96.619955][ T8442] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 96.748368][ T8450] nvmet: disable ns before setting buffered_io value. [ 96.761410][ T8450] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 96.766576][ T8450] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 96.768701][ T8450] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 96.775030][ T8450] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 96.775277][ T8450] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 96.776709][ T8454] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1112'. [ 96.953035][ T8461] capability: warning: `syz.0.1113' uses deprecated v2 capabilities in a way that may be insecure [ 97.734645][ T8489] »»»»»»: renamed from vlan0 (while UP) [ 98.928293][ T8539] FAULT_INJECTION: forcing a failure. [ 98.928293][ T8539] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 98.928313][ T8539] CPU: 0 UID: 0 PID: 8539 Comm: syz.3.1146 Not tainted syzkaller #0 PREEMPT(full) [ 98.928325][ T8539] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.928331][ T8539] Call Trace: [ 98.928335][ T8539] [ 98.928340][ T8539] dump_stack_lvl+0x100/0x190 [ 98.928358][ T8539] should_fail_ex.cold+0x5/0xa [ 98.928374][ T8539] _copy_from_user+0x2e/0xd0 [ 98.928392][ T8539] bpf_vlog_reverse_ubuf+0xda/0x470 [ 98.928408][ T8539] bpf_vlog_finalize+0x2bf/0x360 [ 98.928421][ T8539] bpf_log_attr_finalize+0x86/0x1a0 [ 98.928433][ T8539] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 98.928449][ T8539] btf_new_fd+0x390a/0x5d40 [ 98.928460][ T8539] ? __lock_acquire+0x5c0/0x1f40 [ 98.928482][ T8539] ? __pfx_btf_new_fd+0x10/0x10 [ 98.928492][ T8539] ? lock_acquire+0x1d1/0x380 [ 98.928508][ T8539] ? rcu_is_watching+0x13/0xc0 [ 98.928522][ T8539] ? apparmor_capable+0x1d7/0x4d0 [ 98.928533][ T8539] ? security_capable+0x80/0x260 [ 98.928549][ T8539] ? ns_capable+0xd2/0xf0 [ 98.928567][ T8539] __sys_bpf+0x13ef/0x4a30 [ 98.928582][ T8539] ? __pfx___sys_bpf+0x10/0x10 [ 98.928593][ T8539] ? __pfx_futex_hash+0x10/0x10 [ 98.928604][ T8539] ? get_pid_task+0xfc/0x250 [ 98.928615][ T8539] ? get_pid_task+0xfc/0x250 [ 98.928630][ T8539] ? find_held_lock+0x2b/0x80 [ 98.928646][ T8539] ? rcu_read_lock_any_held+0x6a/0x90 [ 98.928658][ T8539] ? find_held_lock+0x2b/0x80 [ 98.928670][ T8539] ? ksys_write+0x190/0x250 [ 98.928683][ T8539] ? ksys_write+0x190/0x250 [ 98.928703][ T8539] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 98.928717][ T8539] ? xfd_validate_state+0x129/0x190 [ 98.928736][ T8539] ? __ia32_sys_bpf+0xcc/0x170 [ 98.928748][ T8539] __ia32_sys_bpf+0xcc/0x170 [ 98.928761][ T8539] ? __do_fast_syscall_32+0xb3/0x8b0 [ 98.928778][ T8539] __do_fast_syscall_32+0x13a/0x8b0 [ 98.928794][ T8539] do_fast_syscall_32+0x32/0x70 [ 98.928808][ T8539] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 98.928822][ T8539] RIP: 0023:0xf70cefec [ 98.928841][ T8539] Code: Unable to access opcode bytes at 0xf70cefc2. [ 98.928847][ T8539] RSP: 002b:00000000f54bd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 98.928859][ T8539] RAX: ffffffffffffffda RBX: 0000000000000012 RCX: 0000000080001b40 [ 98.928866][ T8539] RDX: 0000000000000028 RSI: 0000000000000000 RDI: 0000000000000000 [ 98.928874][ T8539] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 98.928881][ T8539] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 98.928887][ T8539] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 98.928901][ T8539] [ 99.364112][ T8552] MTD: Couldn't look up './dev/mtdblock0': -2 [ 99.738704][ T8571] nvmet: disable ns before setting buffered_io value. [ 99.742549][ T8571] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 99.743000][ T8571] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 99.743461][ T8571] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 99.743936][ T8571] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 99.744562][ T8571] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 100.794019][ T8594] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1166'. [ 100.803528][ T8596] nvmet: disable ns before setting buffered_io value. [ 100.804404][ T8596] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 100.804810][ T8596] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 100.805263][ T8596] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 100.805646][ T8596] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 100.805961][ T8596] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 101.196825][ T8609] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1173'. [ 102.933494][ T8636] smpboot: CPU 1 is now offline [ 102.981490][ T8636] smpboot: CPU 3 is now offline [ 103.050565][ T8638] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 103.065240][ T8623] ------------[ cut here ]------------ [ 103.065247][ T8623] debug_locks && !(lock_is_held(&(__rq_lockp(rq))->dep_map) != 0) [ 103.065253][ T8623] WARNING: kernel/sched/sched.h:1666 at update_rq_clock+0x40a/0xd20, CPU#0: syz.0.1178/8623 [ 103.072605][ T8623] Modules linked in: [ 103.074018][ T8623] CPU: 0 UID: 0 PID: 8623 Comm: syz.0.1178 Not tainted syzkaller #0 PREEMPT(full) [ 103.076923][ T8623] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.080026][ T8623] RIP: 0010:update_rq_clock+0x40a/0xd20 [ 103.081803][ T8623] Code: ab c8 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d8 f6 fc 09 a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 c0 0b 00 00 48 b8 00 00 00 00 00 [ 103.088272][ T8623] RSP: 0000:ffffc900043172d8 EFLAGS: 00010046 [ 103.090468][ T8623] RAX: 0000000000000000 RBX: ffff88802b33c040 RCX: 0000000000000001 [ 103.092889][ T8623] RDX: 0000000000000046 RSI: ffffffff8e36c6ac RDI: ffffffff8c624080 [ 103.095279][ T8623] RBP: ffffc90004317478 R08: 0000000000000001 R09: 0000000000000001 [ 103.097704][ T8623] R10: ffff88802b23cbd8 R11: 0000000000000000 R12: ffffffff9145bde4 [ 103.100194][ T8623] R13: ffff88802b33cf20 R14: ffff88802b33c040 R15: 0000000000000001 [ 103.102674][ T8623] FS: 0000000000000000(0000) GS:ffff888096952000(0000) knlGS:0000000000000000 [ 103.105463][ T8623] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 103.107531][ T8623] CR2: 0000000080202018 CR3: 00000000480eb000 CR4: 0000000000352ef0 [ 103.109996][ T8623] Call Trace: [ 103.111072][ T8623] [ 103.112014][ T8623] __schedule+0x1c69/0x6920 [ 103.113475][ T8623] ? __pfx___schedule+0x10/0x10 [ 103.115007][ T8623] ? irqentry_exit+0x24d/0xa10 [ 103.116523][ T8623] ? preempt_schedule_thunk+0x16/0x40 [ 103.118203][ T8623] preempt_schedule_common+0x3c/0xb0 [ 103.119871][ T8623] preempt_schedule_thunk+0x16/0x40 [ 103.121491][ T8623] _raw_spin_unlock+0x3e/0x50 [ 103.123009][ T8623] __zap_vma_range+0x16b0/0x48e0 [ 103.124607][ T8623] ? __pfx___zap_vma_range+0x10/0x10 [ 103.126265][ T8623] ? mas_next_slot+0xc05/0x13a0 [ 103.127818][ T8623] unmap_vmas+0x299/0x5f0 [ 103.129096][ T8623] ? __pfx_unmap_vmas+0x10/0x10 [ 103.130539][ T8623] ? mas_next_slot+0xc05/0x13a0 [ 103.132015][ T8623] exit_mmap+0x1ef/0xa00 [ 103.133360][ T8623] ? __pfx_exit_mmap+0x10/0x10 [ 103.134907][ T8623] ? rcu_is_watching+0x13/0xc0 [ 103.136400][ T8623] ? find_held_lock+0x2b/0x80 [ 103.137841][ T8623] ? uprobe_clear_state+0x5f/0x250 [ 103.139461][ T8623] ? __mutex_unlock_slowpath+0x35d/0x930 [ 103.141222][ T8623] __mmput+0x12a/0x410 [ 103.142540][ T8623] mmput+0x67/0x80 [ 103.143729][ T8623] do_exit+0x83b/0x2a50 [ 103.145034][ T8623] ? __pfx___might_resched+0x10/0x10 [ 103.146700][ T8623] ? __pfx_do_exit+0x10/0x10 [ 103.148150][ T8623] ? do_raw_spin_lock+0x128/0x260 [ 103.149724][ T8623] ? find_held_lock+0x2b/0x80 [ 103.151209][ T8623] ? get_signal+0x7e0/0x21e0 [ 103.152670][ T8623] do_group_exit+0xd5/0x2a0 [ 103.154099][ T8623] get_signal+0x1ec7/0x21e0 [ 103.155550][ T8623] ? __pfx_do_recvmmsg+0x10/0x10 [ 103.157098][ T8623] ? __pfx_get_signal+0x10/0x10 [ 103.158636][ T8623] arch_do_signal_or_restart+0x91/0x7a0 [ 103.160353][ T8623] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 103.162285][ T8623] ? __pfx___sys_recvmmsg+0x10/0x10 [ 103.163898][ T8623] exit_to_user_mode_loop+0x139/0x700 [ 103.165581][ T8623] ? rcu_is_watching+0x13/0xc0 [ 103.166997][ T8623] __do_fast_syscall_32+0x59f/0x8b0 [ 103.168654][ T8623] do_fast_syscall_32+0x32/0x70 [ 103.170181][ T8623] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 103.172183][ T8623] RIP: 0023:0xf6fdefec [ 103.173463][ T8623] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 103.175539][ T8623] RSP: 002b:00000000f53ac50c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 103.178098][ T8623] RAX: 0000000000010106 RBX: 0000000000000006 RCX: 00000000800000c0 [ 103.180577][ T8623] RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000 [ 103.182993][ T8623] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 103.185377][ T8623] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 103.187790][ T8623] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 103.190212][ T8623] [ 103.191197][ T8623] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 103.193387][ T8623] CPU: 0 UID: 0 PID: 8623 Comm: syz.0.1178 Not tainted syzkaller #0 PREEMPT(full) [ 103.196124][ T8623] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.199102][ T8623] Call Trace: [ 103.200124][ T8623] [ 103.201036][ T8623] dump_stack_lvl+0x100/0x190 [ 103.202514][ T8623] vpanic+0x553/0x970 [ 103.203714][ T8623] ? __pfx_vpanic+0x10/0x10 [ 103.205119][ T8623] panic+0xd1/0xe0 [ 103.206281][ T8623] ? __pfx_panic+0x10/0x10 [ 103.207633][ T8623] check_panic_on_warn.cold+0x19/0x34 [ 103.209245][ T8623] ? update_rq_clock+0x40a/0xd20 [ 103.210806][ T8623] __warn.cold+0x191/0x318 [ 103.212169][ T8623] __report_bug+0x30f/0x440 [ 103.213728][ T8623] ? update_rq_clock+0x40a/0xd20 [ 103.215432][ T8623] ? __pfx___report_bug+0x10/0x10 [ 103.217235][ T8623] ? __lock_acquire+0x5c0/0x1f40 [ 103.219079][ T8623] ? update_rq_clock+0x40a/0xd20 [ 103.221047][ T8623] report_bug+0xb3/0x220 [ 103.222725][ T8623] ? update_rq_clock+0x40a/0xd20 [ 103.224351][ T8623] handle_bug+0x16a/0x2a0 [ 103.225726][ T8623] exc_invalid_op+0x17/0x50 [ 103.227155][ T8623] asm_exc_invalid_op+0x1a/0x20 [ 103.228686][ T8623] RIP: 0010:update_rq_clock+0x40a/0xd20 [ 103.230443][ T8623] Code: ab c8 0b 00 00 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d8 f6 fc 09 a8 04 0f 84 df fc ff ff 90 0f 0b 90 e9 d6 fc ff ff 90 <0f> 0b 90 e9 92 fc ff ff 4c 8d 83 c0 0b 00 00 48 b8 00 00 00 00 00 [ 103.236341][ T8623] RSP: 0000:ffffc900043172d8 EFLAGS: 00010046 [ 103.238260][ T8623] RAX: 0000000000000000 RBX: ffff88802b33c040 RCX: 0000000000000001 [ 103.240714][ T8623] RDX: 0000000000000046 RSI: ffffffff8e36c6ac RDI: ffffffff8c624080 [ 103.243204][ T8623] RBP: ffffc90004317478 R08: 0000000000000001 R09: 0000000000000001 [ 103.245669][ T8623] R10: ffff88802b23cbd8 R11: 0000000000000000 R12: ffffffff9145bde4 [ 103.248124][ T8623] R13: ffff88802b33cf20 R14: ffff88802b33c040 R15: 0000000000000001 [ 103.250596][ T8623] ? update_rq_clock+0x9c/0xd20 [ 103.252136][ T8623] __schedule+0x1c69/0x6920 [ 103.253579][ T8623] ? __pfx___schedule+0x10/0x10 [ 103.255124][ T8623] ? irqentry_exit+0x24d/0xa10 [ 103.256640][ T8623] ? preempt_schedule_thunk+0x16/0x40 [ 103.258330][ T8623] preempt_schedule_common+0x3c/0xb0 [ 103.259981][ T8623] preempt_schedule_thunk+0x16/0x40 [ 103.261594][ T8623] _raw_spin_unlock+0x3e/0x50 [ 103.263124][ T8623] __zap_vma_range+0x16b0/0x48e0 [ 103.264694][ T8623] ? __pfx___zap_vma_range+0x10/0x10 [ 103.266351][ T8623] ? mas_next_slot+0xc05/0x13a0 [ 103.267887][ T8623] unmap_vmas+0x299/0x5f0 [ 103.269255][ T8623] ? __pfx_unmap_vmas+0x10/0x10 [ 103.270790][ T8623] ? mas_next_slot+0xc05/0x13a0 [ 103.272349][ T8623] exit_mmap+0x1ef/0xa00 [ 103.273685][ T8623] ? __pfx_exit_mmap+0x10/0x10 [ 103.275212][ T8623] ? rcu_is_watching+0x13/0xc0 [ 103.276717][ T8623] ? find_held_lock+0x2b/0x80 [ 103.278200][ T8623] ? uprobe_clear_state+0x5f/0x250 [ 103.279796][ T8623] ? __mutex_unlock_slowpath+0x35d/0x930 [ 103.281550][ T8623] __mmput+0x12a/0x410 [ 103.282859][ T8623] mmput+0x67/0x80 [ 103.284050][ T8623] do_exit+0x83b/0x2a50 [ 103.285358][ T8623] ? __pfx___might_resched+0x10/0x10 [ 103.287016][ T8623] ? __pfx_do_exit+0x10/0x10 [ 103.288461][ T8623] ? do_raw_spin_lock+0x128/0x260 [ 103.290025][ T8623] ? find_held_lock+0x2b/0x80 [ 103.291506][ T8623] ? get_signal+0x7e0/0x21e0 [ 103.292982][ T8623] do_group_exit+0xd5/0x2a0 [ 103.294419][ T8623] get_signal+0x1ec7/0x21e0 [ 103.295851][ T8623] ? __pfx_do_recvmmsg+0x10/0x10 [ 103.297403][ T8623] ? __pfx_get_signal+0x10/0x10 [ 103.298959][ T8623] arch_do_signal_or_restart+0x91/0x7a0 [ 103.300669][ T8623] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 103.302592][ T8623] ? __pfx___sys_recvmmsg+0x10/0x10 [ 103.304236][ T8623] exit_to_user_mode_loop+0x139/0x700 [ 103.305909][ T8623] ? rcu_is_watching+0x13/0xc0 [ 103.307417][ T8623] __do_fast_syscall_32+0x59f/0x8b0 [ 103.309045][ T8623] do_fast_syscall_32+0x32/0x70 [ 103.310578][ T8623] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 103.312541][ T8623] RIP: 0023:0xf6fdefec [ 103.313952][ T8623] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 103.316105][ T8623] RSP: 002b:00000000f53ac50c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 103.318932][ T8623] RAX: 0000000000010106 RBX: 0000000000000006 RCX: 00000000800000c0 [ 103.321525][ T8623] RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000 [ 103.324661][ T8623] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 103.327417][ T8623] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 103.329880][ T8623] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 103.332366][ T8623] [ 104.411519][ T8623] Shutting down cpus with NMI [ 104.414077][ T8623] Kernel Offset: disabled [ 104.415853][ T8623] Rebooting in 86400 seconds..