last executing test programs: 28.197694561s ago: executing program 1 (id=3319): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000000)=0x5000000, 0x4) 28.123855185s ago: executing program 1 (id=3320): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x20, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'ipvlan1\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) r3 = timerfd_create(0x0, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r4, 0x1, &(0x7f0000000480)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}]) timerfd_settime(r3, 0x3, &(0x7f0000000140), 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0}) clock_settime(0x0, &(0x7f0000000180)={r5}) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) io_setup(0x3, &(0x7f0000000180)=0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/3\x00') io_submit(r6, 0x1, &(0x7f0000000140)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, r7, 0x0}]) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x0, r2}, 0x10) syz_io_uring_setup(0x4a8, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000380)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) open(&(0x7f0000000100)='./file0\x00', 0x80ff, 0x0) r10 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) fcntl$setlease(r10, 0x400, 0x0) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000f0ffffff0000000000000000aeb3607268d739e955d7ec255b75ed32f8f9f87a34c8e675ecdf1e18e032f500ca33c67831c9eb16c0dd5aad995ce92f8c9f5780b6a914d373241e01d1361b46f52c219f8c4af88500000000000100"/104], &(0x7f00000001c0)='GPL\x00'}, 0x90) r12 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x88501) r13 = fcntl$dupfd(r12, 0x0, r12) ioctl$USBDEVFS_SUBMITURB(r13, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0xc1, &(0x7f00000000c0), 0x8, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) ioctl$UI_SET_EVBIT(r13, 0x40045564, 0x1a) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000140)='leases_conflict\x00', r11}, 0x10) 27.867428358s ago: executing program 1 (id=3324): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="040e4e22"], 0x7) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) sysfs$1(0x1, 0x0) sysfs$1(0x1, &(0x7f0000000140)='\x00') syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) r2 = socket$l2tp(0x2, 0x2, 0x73) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYRES64=r2, @ANYBLOB="49dc996f49cc10349b87e0ebcc1e092834eb70eb72e5bf3d6e7b74bf9bf603b4e74d7b7df0a100b6bd4332c51c2337c308146cbc39927429628ac04f9debd9703bde847e79f759bc37c58a916518436e74c4fb3ca20ad2923c188d621f54c5b438223a9fd3199ba51b148817bf8669f0e94d99a75e61ec426933c07a52c0e762fe838013db49960337376270c35623586dc2819835d4e9093016040d454828a5e59a906b828e4ea76e3506d5c47323bcbe2b286ed03d9749fb8eb4a3d20fb963f5793c0dc529686df6633c2992364d", @ANYBLOB="040000a809aa522c00000007000000f0f45ea2175f23fbb15d52352bc3550b0d17fb71f7e75efcca84deef4ed61a80bca1bab5dee40e3ba5eb8709e65dade8f488405f2cce86392966e9c9220c9ccad9fafeeb93d38a501049f60535a7b64920bdf69cb4fa3cde962d32202ec1023a182a208c702d7d38065b3441b7e0fd8f34e57c8fa24c998927a044973c9f6221c7eb81449fb758edb45da1aac345c92af960af3d450a507a3b89e8d6eff026dc65428683455ddfbc1b1e0e60e7e387b1cd59d99b169e9792acadc2c7508507f0b0f77bae6172255141b7c6f586f900"/233], 0x54}, 0x1, 0x0, 0x0, 0x4000064}, 0x4004800) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x4) request_key(0x0, &(0x7f0000001ffb)={'syz', 0x3}, &(0x7f00000012c0)='\xd9j\xff\xabk0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0xc0182101, &(0x7f0000000180)={r3}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000004c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000080)={r4, 0x3, r2, 0x5}) r5 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e24, 0x56, @rand_addr=' \x01\x00', 0x1}, 0x1c) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90124fc60100c020000040000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) 22.909779187s ago: executing program 3 (id=3342): syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x0) connect$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {0x0}], 0x2, &(0x7f0000008640)=[{0x0}], 0x1, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7020000c3000000bf230000000000002703000000fefeff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400011000000404000001007d60b7030000000000006a0a00fe800000008500000026000000b7000000000000009500001000000000acaa8e53a53cb864c300094c07000000000000d94cf0987b00a749a8e53b5c9491cd1f2b94a64f1de23d03a8f0362ebfc44c77511e60070e25510070f7778d3e77ad85319f0113abbac795f8c24abca246150226eb93fe39233add8f68f87699162334343befce832cb8075c5f0ae30cde221371ff00000067e4b75da95370ae6fd2b99ac18f98403494d4a94e95fb8dcd813487b2bdb006c6465c15f04485a9f8c8e49d00000097184c8e9d34b1e382b25e9614634e8e09194f7b83138f5275d9ab463797a2f6dcb45d5f278cd4fb74559575da3560c01cdf1eaa3fc7a3fb4f1689dfd5b626174770e4dfd1c82a694efc62f9ef9c8c0ea1efa5b949ce22827f6fd1dfc69d03482d8ec20bc22573f8594b91781cd8ff7f000000000000299ebf94588e60abe9a565c5bbdc0358226f8580dc1a83c6a44408de23475a74ef0deda8da4089269ccb4e728dee6320444576c87cc576291e5367a5f1a5d5a12f8313ffff0b7f73335279aa2b68c9f045831119881764c71bb65b5138c50e06024e80fd9656bc077e4e259695748989335ba9eeef288de73815f20fefd4acfb6813ffff00000b971aec1a3e618a08a94ecbd401c8109c87ee3f5c0501857538d2a766bfcf4128fbe726903aca577aa8943af747760718dee5a21396dce6f61c6f3c7e000000cb0868b48719e47296f2299df3ecfb5f3f0e42f6f1eb1dc64dcc8e397366d12033f6288edbda3b838100000000000000000000800000edd4e1266dc9d73223fe614f025a7f284de76b3b676a13c57a0ed24f6270c4cbbf93472eb8093d8296c68dfbb03ddedc3e029b08959b145a7b110068ba071e75d75716243052ad24b624fddc2f0f3a018c0085c2319c248d643cd09fa855b20a6d453f2e954ff0e55c010000008547c5a0ecefcc44cc9532f729167f215937357a4bb9746193c1ec000000000000dd43c108c2109d221b7b26b7c9c209000005b7918a6cd856b8fa806c85480443159c6bed51a0e021f05f7caa1b99cdb4d08d9031210ac00e67d8c40a18503cb7aabcc066dfbfd7f87abe1122f00e5454bec3563a19582e0000000000000000000000000084b27fc6a3f95bf02b4eb5f1599dd46edcad432cc216316fe07afe27649c89cf022a90d895a2d70fcde7a9c37ede0c47c27f44595ab4b1fb1ed5b1d91314b2d50f94a768fb605679485041a6376b8344a39af68aed2be39794dd86ae82f9660cf4f935255d71f9fab2e430ac42bba1f54141cf39d4d50c4ded504beacb0de210d7a3716dca7362c134b91cef3efc514fbcb4747e6814ac16449ac02a43d9d4151697b4b7890ec6b481c5f0ca8c52a6322f34a796fa5941d23409ecf73458223baaffb94a89ee2884df00000000000000739370d8dacf8b3ff4049711"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x36}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r1, 0x40000f0, 0xe40, 0xffffffff, &(0x7f0000000280)="7b5515ccc8bca12641e65d58fd1a12f639", 0x0, 0x8001}, 0x28) mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) 22.677762847s ago: executing program 3 (id=3344): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000c00)=@bpf_tracing={0x1a, 0xd, &(0x7f0000000540)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}}], &(0x7f0000000140)='GPL\x00', 0x25e9, 0x0, 0x0, 0x41100, 0x62, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x8, &(0x7f00000005c0)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000600)={0x0, 0xb, 0xb43e, 0x8428}, 0x10, 0x2e70c, 0xffffffffffffffff, 0x3, &(0x7f00000007c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000800)=[{0x4, 0x0, 0x9, 0xa}, {0x3, 0x1, 0x9, 0xc}, {0x4, 0x4, 0xd, 0x2}], 0x10, 0x8000}, 0x90) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c00000000000000000f883816814100000000000000000000000000000000000000000000000000000000000000000000440c0001000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac1414aa00000000ac1e000100000000830b0000000000e000000200000000001c000000000000000000", @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001400000000000018000000000200000000000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="7f0000017f00000a0000000800"/28, @ANYRES32, @ANYBLOB="7f000001ac141400000000011c0e0000000000000000000007006fc946f1f569c01801"], 0x230}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000440)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000340), 0x0, 0x0) getpid() syz_pidfd_open(0x0, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_pidfd_open(0x0, 0x0) ioctl$HCIINQUIRY(r1, 0x400448cb, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) prctl$PR_SET_IO_FLUSHER(0x34, 0x2) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000280)=0x7fff) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000380)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0xc0182101, &(0x7f0000000180)={r3}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000004c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000080)={r4, 0x3, r2, 0x5}) r5 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e24, 0x56, @rand_addr=' \x01\x00', 0x1}, 0x1c) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90124fc60100c020000040000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) 17.440822359s ago: executing program 0 (id=3352): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="040e4e22"], 0x7) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) sysfs$1(0x1, 0x0) sysfs$1(0x1, &(0x7f0000000140)='\x00') syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) r2 = socket$l2tp(0x2, 0x2, 0x73) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYRES64=r2, @ANYBLOB="49dc996f49cc10349b87e0ebcc1e092834eb70eb72e5bf3d6e7b74bf9bf603b4e74d7b7df0a100b6bd4332c51c2337c308146cbc39927429628ac04f9debd9703bde847e79f759bc37c58a916518436e74c4fb3ca20ad2923c188d621f54c5b438223a9fd3199ba51b148817bf8669f0e94d99a75e61ec426933c07a52c0e762fe838013db49960337376270c35623586dc2819835d4e9093016040d454828a5e59a906b828e4ea76e3506d5c47323bcbe2b286ed03d9749fb8eb4a3d20fb963f5793c0dc529686df6633c2992364d", @ANYBLOB="040000a809aa522c00000007000000f0f45ea2175f23fbb15d52352bc3550b0d17fb71f7e75efcca84deef4ed61a80bca1bab5dee40e3ba5eb8709e65dade8f488405f2cce86392966e9c9220c9ccad9fafeeb93d38a501049f60535a7b64920bdf69cb4fa3cde962d32202ec1023a182a208c702d7d38065b3441b7e0fd8f34e57c8fa24c998927a044973c9f6221c7eb81449fb758edb45da1aac345c92af960af3d450a507a3b89e8d6eff026dc65428683455ddfbc1b1e0e60e7e387b1cd59d99b169e9792acadc2c7508507f0b0f77bae6172255141b7c6f586f900"/233], 0x54}, 0x1, 0x0, 0x0, 0x4000064}, 0x4004800) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x4) request_key(0x0, &(0x7f0000001ffb)={'syz', 0x3}, &(0x7f00000012c0)='\xd9j\xff\xabk0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0xc0182101, &(0x7f0000000180)={r3}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000004c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000080)={r4, 0x3, r2, 0x5}) r5 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e24, 0x56, @rand_addr=' \x01\x00', 0x1}, 0x1c) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90124fc60100c020000040000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) 12.096061413s ago: executing program 2 (id=3367): r0 = eventfd2(0x0, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) r2 = dup3(r1, r0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000340)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000140)={0x1d, r3}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r2, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x4c}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x4000000) 11.297643258s ago: executing program 2 (id=3368): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000011c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000020900010073797a30000000000900030073797a320000000040000000060a010400000000000000000100000908000b408000000018000480140001800d00010073796e70726f7879000000000900010073797a3000000000140000001100010000000000000000000000000a"], 0xb4}}, 0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, 0x2}, 0x90) socket$kcm(0x10, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_vhci(&(0x7f0000000480)=ANY=[@ANYBLOB], 0x4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001500)={0x2c, r3, 0x1, 0x0, 0x4, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x98f}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8}]}, 0x2c}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000002c0)={0x0, 0x32a000}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f00000009c0)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, 0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000440)='mm_page_free\x00', r1}, 0x10) inotify_add_watch(0xffffffffffffffff, 0x0, 0x27001091) r6 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r6, 0x0, 0x0, 0x0) sendmmsg$inet_sctp(r6, &(0x7f00000032c0)=[{&(0x7f0000000080)=@in6={0xa, 0x4e22, 0x2fdf, @rand_addr=' \x01\x00'}, 0x1c, &(0x7f0000000300)=[{&(0x7f00000000c0)='cpyG', 0x4}, {&(0x7f0000000140)="c8bcbd97b1a42a58f7934d8a533e0142272d5ab94049edd72a38936b3623c2ae3d5fce6efdfbabf3322571389fc3d979d97687f9d262c8dbd58925ad3e647ac4570a28416fd3e0b2da07a82daae605458e9b6523bd3007cd7f275a66cb85327bdc63d25a3d4b43751e2fb0ec89a7b2d4d9f241fd3933cb53a43ed5b1abf22f62a3a726ac622e6c2a2335f4af512e12", 0x8f}], 0x2, &(0x7f0000000340)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c0000000000000000000000000000000700b6e400000000"], 0x30}], 0x1, 0x4050040) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) 9.504285064s ago: executing program 2 (id=3369): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000011c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000020900010073797a30000000000900030073797a320000000040000000060a010400000000000000000100000908000b408000000018000480140001800d00010073796e70726f7879000000000900010073797a3000000000140000001100010000000000000000000000000a"], 0xb4}}, 0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, 0x2}, 0x90) socket$kcm(0x10, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_vhci(&(0x7f0000000480)=ANY=[@ANYBLOB], 0x4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001500)={0x2c, r3, 0x1, 0x0, 0x4, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x98f}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8}]}, 0x2c}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000002c0)={0x0, 0x32a000}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f00000009c0)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, 0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000440)='mm_page_free\x00', r1}, 0x10) inotify_add_watch(0xffffffffffffffff, 0x0, 0x27001091) r6 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r6, 0x0, 0x0, 0x0) sendmmsg$inet_sctp(r6, &(0x7f00000032c0)=[{&(0x7f0000000080)=@in6={0xa, 0x4e22, 0x2fdf, @rand_addr=' \x01\x00'}, 0x1c, &(0x7f0000000300)=[{&(0x7f00000000c0)='cpyG', 0x4}, {&(0x7f0000000140)="c8bcbd97b1a42a58f7934d8a533e0142272d5ab94049edd72a38936b3623c2ae3d5fce6efdfbabf3322571389fc3d979d97687f9d262c8dbd58925ad3e647ac4570a28416fd3e0b2da07a82daae605458e9b6523bd3007cd7f275a66cb85327bdc63d25a3d4b43751e2fb0ec89a7b2d4d9f241fd3933cb53a43ed5b1abf22f62a3a726ac622e6c2a2335f4af512e12", 0x8f}], 0x2, &(0x7f0000000340)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c0000000000000000000000000000000700b6e400000000"], 0x30}], 0x1, 0x4050040) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) 7.693598794s ago: executing program 2 (id=3370): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB="040e4e22"], 0x7) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) sysfs$1(0x1, 0x0) sysfs$1(0x1, &(0x7f0000000140)='\x00') syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}) r2 = socket$l2tp(0x2, 0x2, 0x73) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYRES64=r2, @ANYBLOB="49dc996f49cc10349b87e0ebcc1e092834eb70eb72e5bf3d6e7b74bf9bf603b4e74d7b7df0a100b6bd4332c51c2337c308146cbc39927429628ac04f9debd9703bde847e79f759bc37c58a916518436e74c4fb3ca20ad2923c188d621f54c5b438223a9fd3199ba51b148817bf8669f0e94d99a75e61ec426933c07a52c0e762fe838013db49960337376270c35623586dc2819835d4e9093016040d454828a5e59a906b828e4ea76e3506d5c47323bcbe2b286ed03d9749fb8eb4a3d20fb963f5793c0dc529686df6633c2992364d", @ANYBLOB="040000a809aa522c00000007000000f0f45ea2175f23fbb15d52352bc3550b0d17fb71f7e75efcca84deef4ed61a80bca1bab5dee40e3ba5eb8709e65dade8f488405f2cce86392966e9c9220c9ccad9fafeeb93d38a501049f60535a7b64920bdf69cb4fa3cde962d32202ec1023a182a208c702d7d38065b3441b7e0fd8f34e57c8fa24c998927a044973c9f6221c7eb81449fb758edb45da1aac345c92af960af3d450a507a3b89e8d6eff026dc65428683455ddfbc1b1e0e60e7e387b1cd59d99b169e9792acadc2c7508507f0b0f77bae6172255141b7c6f586f900"/233], 0x54}, 0x1, 0x0, 0x0, 0x4000064}, 0x4004800) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x4) request_key(0x0, &(0x7f0000001ffb)={'syz', 0x3}, &(0x7f00000012c0)='\xd9j\xff\xabk0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0xc0182101, &(0x7f0000000180)={r3}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000004c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000080)={r4, 0x3, r2, 0x5}) r5 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e24, 0x56, @rand_addr=' \x01\x00', 0x1}, 0x1c) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90124fc60100c020000040000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) 7.057852166s ago: executing program 1 (id=3373): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000c00)=@bpf_tracing={0x1a, 0xd, &(0x7f0000000540)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}}], &(0x7f0000000140)='GPL\x00', 0x25e9, 0x0, 0x0, 0x41100, 0x62, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x8, &(0x7f00000005c0)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000600)={0x0, 0xb, 0xb43e, 0x8428}, 0x10, 0x2e70c, 0xffffffffffffffff, 0x3, &(0x7f00000007c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000800)=[{0x4, 0x1, 0x9, 0xa}, {0x3, 0x1, 0x9, 0xc}, {0x4, 0x4, 0xd, 0x2}]}, 0x90) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c00000000000000000f883816814100000000000000000000000000000000000000000000000000000000000000000000440c0001000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac1414aa00000000ac1e000100000000830b0000000000e000000200000000001c000000000000000000", @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001400000000000018000000000200000000000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="7f0000017f00000a0000000800"/28, @ANYRES32, @ANYBLOB="7f000001ac141400000000011c0e0000000000000000000007006fc946f1f569c01801"], 0x230}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000440)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000340), 0x0, 0x0) getpid() syz_pidfd_open(0x0, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_pidfd_open(0x0, 0x0) ioctl$HCIINQUIRY(r1, 0x400448cb, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) prctl$PR_SET_IO_FLUSHER(0x34, 0x2) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000280)=0x7fff) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000380)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0xc0182101, &(0x7f0000000180)={r3}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f00000004c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000080)={r4, 0x3, r2, 0x5}) r5 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e24, 0x56, @rand_addr=' \x01\x00', 0x1}, 0x1c) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90124fc60100c020000040000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) 3.553591365s ago: executing program 3 (id=3365): io_uring_setup(0x734a, &(0x7f0000000140)) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) socket$kcm(0x10, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f0000000040)={0x3ff}, 0x0, 0x0) 1.67821228s ago: executing program 3 (id=3375): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000011c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000020900010073797a30000000000900030073797a320000000040000000060a010400000000000000000100000908000b408000000018000480140001800d00010073796e70726f7879000000000900010073797a3000000000140000001100010000000000000000000000000a"], 0xb4}}, 0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, 0x2}, 0x90) socket$kcm(0x10, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_vhci(&(0x7f0000000480)=ANY=[@ANYBLOB], 0x4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001500)={0x2c, r3, 0x1, 0x0, 0x4, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x98f}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8}]}, 0x2c}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000002c0)={0x0, 0x32a000}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f00000009c0)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, 0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000440)='mm_page_free\x00', r1}, 0x10) inotify_add_watch(0xffffffffffffffff, 0x0, 0x27001091) r6 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r6, 0x0, 0x0, 0x0) sendmmsg$inet_sctp(r6, &(0x7f00000032c0)=[{&(0x7f0000000080)=@in6={0xa, 0x4e22, 0x2fdf, @rand_addr=' \x01\x00'}, 0x1c, &(0x7f0000000300)=[{&(0x7f00000000c0)='cpyG', 0x4}, {&(0x7f0000000140)="c8bcbd97b1a42a58f7934d8a533e0142272d5ab94049edd72a38936b3623c2ae3d5fce6efdfbabf3322571389fc3d979d97687f9d262c8dbd58925ad3e647ac4570a28416fd3e0b2da07a82daae605458e9b6523bd3007cd7f275a66cb85327bdc63d25a3d4b43751e2fb0ec89a7b2d4d9f241fd3933cb53a43ed5b1abf22f62a3a726ac622e6c2a2335f4af512e12", 0x8f}], 0x2, &(0x7f0000000340)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c0000000000000000000000000000000700b6e400000000"], 0x30}], 0x1, 0x4050040) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) 186.511305ms ago: executing program 3 (id=3376): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x7a, 0x40, &(0x7f00000003c0)=@filter={'filter\x00', 0x42, 0x4, 0x358, 0xffffffff, 0x1e8, 0x0, 0x98, 0xffffffff, 0xffffffff, 0x2c0, 0x2c0, 0x2c0, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @broadcast, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00'}, 0x74000000, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'syz_tun\x00', 'veth1_to_bridge\x00'}, 0x287, 0xf0, 0x150, 0x0, {}, [@common=@unspec=@ipvs={{0x48}, {@ipv4=@local}}, @common=@unspec=@statistic={{0x38}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3150def0ab80946e]}}}}, {{@uncond, 0x0, 0xa0, 0xd8, 0x0, {}, [@common=@addrtype={{0x30}}]}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3b8) 0s ago: executing program 3 (id=3377): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000011c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000020900010073797a30000000000900030073797a320000000040000000060a010400000000000000000100000908000b408000000018000480140001800d00010073796e70726f7879000000000900010073797a3000000000140000001100010000000000000000000000000a"], 0xb4}}, 0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, 0x2}, 0x90) socket$kcm(0x10, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_vhci(&(0x7f0000000480)=ANY=[@ANYBLOB], 0x4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001500)={0x2c, r3, 0x1, 0x0, 0x4, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x98f}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8}]}, 0x2c}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000002c0)={0x0, 0x32a000}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f00000009c0)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, 0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000440)='mm_page_free\x00', r1}, 0x10) inotify_add_watch(0xffffffffffffffff, 0x0, 0x27001091) r6 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r6, 0x0, 0x0, 0x0) sendmmsg$inet_sctp(r6, &(0x7f00000032c0)=[{&(0x7f0000000080)=@in6={0xa, 0x4e22, 0x2fdf, @rand_addr=' \x01\x00'}, 0x1c, &(0x7f0000000300)=[{&(0x7f00000000c0)='cpyG', 0x4}, {&(0x7f0000000140)="c8bcbd97b1a42a58f7934d8a533e0142272d5ab94049edd72a38936b3623c2ae3d5fce6efdfbabf3322571389fc3d979d97687f9d262c8dbd58925ad3e647ac4570a28416fd3e0b2da07a82daae605458e9b6523bd3007cd7f275a66cb85327bdc63d25a3d4b43751e2fb0ec89a7b2d4d9f241fd3933cb53a43ed5b1abf22f62a3a726ac622e6c2a2335f4af512e12", 0x8f}], 0x2, &(0x7f0000000340)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c0000000000000000000000000000000700b6e400000000"], 0x30}], 0x1, 0x4050040) syz_usbip_server_init(0x0) syz_usbip_server_init(0x0) kernel console output (not intermixed with test programs): e: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 626.454174][T14645] RSP: 002b:00007fcc1779d048 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 626.458043][T14645] RAX: ffffffffffffffda RBX: 00007fcc16b04038 RCX: 00007fcc16975bd9 [ 626.461367][T14645] RDX: 0000000000000002 RSI: 0000000020000b40 RDI: 0000000000000008 [ 626.464698][T14645] RBP: 00007fcc1779d0a0 R08: 0000000000000000 R09: 0000000000000000 [ 626.468045][T14645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 626.471419][T14645] R13: 000000000000006e R14: 00007fcc16b04038 R15: 00007fff1083ca88 [ 626.474725][T14645] [ 626.647088][ T39] audit: type=1326 audit(2000000440.930:851): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14652 comm="syz.3.2974" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fcdcf175bd9 code=0x0 [ 626.719498][ T39] audit: type=1326 audit(2000000441.000:852): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14652 comm="syz.3.2974" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fcdcf175bd9 code=0x0 [ 626.788045][ T39] audit: type=1400 audit(2000000441.070:853): avc: denied { setopt } for pid=14657 comm="syz.2.2975" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 626.790241][T14658] netlink: 300 bytes leftover after parsing attributes in process `syz.2.2975'. [ 626.878096][T14660] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2582 sclass=netlink_route_socket pid=14660 comm=syz.2.2976 [ 626.886683][T14660] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2580 sclass=netlink_route_socket pid=14660 comm=syz.2.2976 [ 626.892556][T14660] FAULT_INJECTION: forcing a failure. [ 626.892556][T14660] name failslab, interval 1, probability 0, space 0, times 0 [ 626.897876][T14660] CPU: 1 PID: 14660 Comm: syz.2.2976 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 626.902117][T14660] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 626.906842][T14660] Call Trace: [ 626.908447][T14660] [ 626.909845][T14660] dump_stack_lvl+0x16c/0x1f0 [ 626.911942][T14660] should_fail_ex+0x497/0x5b0 [ 626.913866][T14660] should_failslab+0x9/0x20 [ 626.915795][T14660] kmem_cache_alloc_noprof+0x6e/0x2f0 [ 626.918092][T14660] ? skb_clone+0x190/0x3f0 [ 626.920028][T14660] skb_clone+0x190/0x3f0 [ 626.921981][T14660] netlink_deliver_tap+0xab3/0xd90 [ 626.924554][T14660] netlink_unicast+0x6be/0x820 [ 626.926740][T14660] ? __pfx_netlink_unicast+0x10/0x10 [ 626.929149][T14660] ? rtnetlink_rcv_msg+0x3e6/0xea0 [ 626.931358][T14660] netlink_ack+0x6a6/0xb90 [ 626.933281][T14660] netlink_rcv_skb+0x348/0x440 [ 626.935248][T14660] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 626.937132][T14660] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 626.939180][T14660] ? netlink_deliver_tap+0x1ae/0xd90 [ 626.941331][T14660] netlink_unicast+0x542/0x820 [ 626.943206][T14660] ? __pfx_netlink_unicast+0x10/0x10 [ 626.945413][T14660] netlink_sendmsg+0x8b8/0xd70 [ 626.947498][T14660] ? __pfx_netlink_sendmsg+0x10/0x10 [ 626.949800][T14660] ? __import_iovec+0x1fd/0x6e0 [ 626.951894][T14660] ____sys_sendmsg+0xab5/0xc90 [ 626.953979][T14660] ? copy_msghdr_from_user+0x10b/0x160 [ 626.956333][T14660] ? __pfx_____sys_sendmsg+0x10/0x10 [ 626.958295][T14660] ? find_held_lock+0x2d/0x110 [ 626.959867][T14660] ? __pfx___lock_acquire+0x10/0x10 [ 626.961431][T14660] ___sys_sendmsg+0x135/0x1e0 [ 626.962826][T14660] ? __pfx____sys_sendmsg+0x10/0x10 [ 626.964654][T14660] ? ksys_write+0x21c/0x260 [ 626.966376][T14660] ? __fget_light+0x173/0x210 [ 626.968474][T14660] __sys_sendmsg+0x117/0x1f0 [ 626.970769][T14660] ? __pfx___sys_sendmsg+0x10/0x10 [ 626.973367][T14660] do_syscall_64+0xcd/0x250 [ 626.975356][T14660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.977820][T14660] RIP: 0033:0x7f5cbb975bd9 [ 626.979682][T14660] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 626.987890][T14660] RSP: 002b:00007f5cbc751048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 626.991585][T14660] RAX: ffffffffffffffda RBX: 00007f5cbbb03f60 RCX: 00007f5cbb975bd9 [ 626.994565][T14660] RDX: 0000000000000010 RSI: 0000000020000300 RDI: 0000000000000007 [ 626.997793][T14660] RBP: 00007f5cbc7510a0 R08: 0000000000000000 R09: 0000000000000000 [ 627.001371][T14660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 627.004535][T14660] R13: 000000000000000b R14: 00007f5cbbb03f60 R15: 00007fff21e44fb8 [ 627.007953][T14660] [ 627.399629][T14672] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 627.407759][T14672] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 627.414597][T14672] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 627.421979][T14672] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 627.465118][ T5234] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 627.665090][ T5234] usb 5-1: Using ep0 maxpacket: 8 [ 627.671659][ T5234] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 627.680818][ T5234] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 627.689910][ T5234] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 627.694354][T14672] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 627.700725][ T5234] usb 5-1: config 0 descriptor?? [ 627.702661][T14672] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 627.709078][ T5234] iowarrior 5-1:0.0: no interrupt-in endpoint found [ 627.971929][ T4634] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 628.307626][T14689] netlink: 'syz.3.2984': attribute type 7 has an invalid length. [ 628.311472][T14689] netlink: 'syz.3.2984': attribute type 39 has an invalid length. [ 628.315590][ T828] usb 7-1: new high-speed USB device number 92 using dummy_hcd [ 628.339604][T14689] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14689 comm=syz.3.2984 [ 628.346447][T14689] netlink: 'syz.3.2984': attribute type 7 has an invalid length. [ 628.346789][T14691] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 628.350105][T14689] netlink: 'syz.3.2984': attribute type 39 has an invalid length. [ 628.355353][T14691] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 628.362007][T14691] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 628.367871][T14691] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 628.395948][ T4634] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 628.495197][ T828] usb 7-1: Using ep0 maxpacket: 32 [ 628.499619][ T828] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 628.509130][ T828] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=a6.13 [ 628.514100][ T828] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 628.518714][ T828] usb 7-1: Product: syz [ 628.520855][ T828] usb 7-1: Manufacturer: syz [ 628.523454][ T828] usb 7-1: SerialNumber: syz [ 628.534675][ T828] usb 7-1: config 0 descriptor?? [ 628.542214][ T828] pvrusb2: Hardware description: Terratec Grabster AV400 [ 628.547536][ T828] pvrusb2: ********** [ 628.549319][ T828] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 628.553694][ T828] pvrusb2: Important functionality might not be entirely working. [ 628.557739][ T828] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 628.562730][ T828] pvrusb2: ********** [ 628.615057][T14691] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 628.619761][T14691] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 628.653805][ T4634] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 628.752060][ T2121] pvrusb2: Invalid write control endpoint [ 628.755629][ T828] usb 7-1: USB disconnect, device number 92 [ 628.806255][ T2121] pvrusb2: Invalid write control endpoint [ 628.808958][ T2121] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 628.814306][ T2121] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 628.822195][ T2121] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 628.826594][ T2121] pvrusb2: Device being rendered inoperable [ 628.831103][ T2121] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 628.834184][ T2121] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 628.842108][ T2121] pvrusb2: Attached sub-driver cx25840 [ 628.844518][ T2121] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 628.849525][ T2121] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 629.259450][T14712] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 629.268444][T14712] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 629.274503][T14712] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 629.281270][T14712] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 629.608724][T14712] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 629.618097][T14712] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 629.765528][T14721] FAULT_INJECTION: forcing a failure. [ 629.765528][T14721] name failslab, interval 1, probability 0, space 0, times 0 [ 629.770808][T14721] CPU: 2 PID: 14721 Comm: syz.3.2995 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 629.774471][T14721] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 629.779291][T14721] Call Trace: [ 629.780609][T14721] [ 629.781655][T14721] dump_stack_lvl+0x16c/0x1f0 [ 629.783397][T14721] should_fail_ex+0x497/0x5b0 [ 629.785406][T14721] should_failslab+0x9/0x20 [ 629.787333][T14721] kmem_cache_alloc_node_noprof+0x71/0x310 [ 629.789857][T14721] ? __alloc_skb+0x2b1/0x380 [ 629.791837][T14721] __alloc_skb+0x2b1/0x380 [ 629.793738][T14721] ? __pfx___alloc_skb+0x10/0x10 [ 629.795979][T14721] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 629.798600][T14721] netlink_alloc_large_skb+0x69/0x130 [ 629.800927][T14721] netlink_sendmsg+0x689/0xd70 [ 629.803057][T14721] ? __pfx_netlink_sendmsg+0x10/0x10 [ 629.805417][T14721] ? __import_iovec+0x1fd/0x6e0 [ 629.807599][T14721] ____sys_sendmsg+0xab5/0xc90 [ 629.809721][T14721] ? copy_msghdr_from_user+0x10b/0x160 [ 629.812086][T14721] ? __pfx_____sys_sendmsg+0x10/0x10 [ 629.814335][T14721] ? find_held_lock+0x2d/0x110 [ 629.816387][T14721] ? __pfx___lock_acquire+0x10/0x10 [ 629.818630][T14721] ___sys_sendmsg+0x135/0x1e0 [ 629.820728][T14721] ? __pfx____sys_sendmsg+0x10/0x10 [ 629.822990][T14721] ? ksys_write+0x21c/0x260 [ 629.824769][T14721] ? __fget_light+0x173/0x210 [ 629.826490][T14721] __sys_sendmsg+0x117/0x1f0 [ 629.828145][T14721] ? __pfx___sys_sendmsg+0x10/0x10 [ 629.829982][T14721] do_syscall_64+0xcd/0x250 [ 629.831586][T14721] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 629.834035][T14721] RIP: 0033:0x7fcdcf175bd9 [ 629.835963][T14721] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 629.844585][T14721] RSP: 002b:00007fcdcff6a048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 629.848555][T14721] RAX: ffffffffffffffda RBX: 00007fcdcf303f60 RCX: 00007fcdcf175bd9 [ 629.852093][T14721] RDX: 0000000000000000 RSI: 0000000020000880 RDI: 0000000000000003 [ 629.855522][T14721] RBP: 00007fcdcff6a0a0 R08: 0000000000000000 R09: 0000000000000000 [ 629.858949][T14721] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 629.862398][T14721] R13: 000000000000000b R14: 00007fcdcf303f60 R15: 00007fffff0a8ea8 [ 629.865836][T14721] [ 629.899361][ T39] audit: type=1400 audit(2000000444.180:854): avc: denied { setattr } for pid=14722 comm="syz.3.2996" path="/dev/swradio7" dev="devtmpfs" ino=991 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 629.972329][ T4634] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 630.187005][ T4951] usb 5-1: USB disconnect, device number 76 [ 630.201276][T14732] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 630.213373][T14730] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 630.219444][T14730] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 630.223957][T14732] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 630.241779][T14732] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 630.249475][T14730] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 630.267213][T14732] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 630.267721][T14730] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 630.519870][T14730] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 630.525992][T14730] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 630.572483][T14732] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 630.581519][T14732] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 631.167720][ T39] audit: type=1400 audit(2000000445.450:855): avc: denied { ioctl } for pid=14747 comm="syz.2.3006" path="/dev/rtc0" dev="devtmpfs" ino=865 ioctlcmd=0x700f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 631.354675][ T39] audit: type=1400 audit(2000000445.630:856): avc: denied { ioctl } for pid=14746 comm="syz.0.3005" path="socket:[49068]" dev="sockfs" ino=49068 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 631.421498][T14756] netlink: 2060 bytes leftover after parsing attributes in process `syz.2.3007'. [ 631.427950][T14756] netlink: 'syz.2.3007': attribute type 1 has an invalid length. [ 631.431861][T14756] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.3007'. [ 631.901658][ T4634] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 632.437980][T14779] FAULT_INJECTION: forcing a failure. [ 632.437980][T14779] name failslab, interval 1, probability 0, space 0, times 0 [ 632.443504][T14779] CPU: 2 PID: 14779 Comm: syz.2.3014 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 632.447923][T14779] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 632.452189][T14779] Call Trace: [ 632.453451][T14779] [ 632.454762][T14779] dump_stack_lvl+0x16c/0x1f0 [ 632.457075][T14779] should_fail_ex+0x497/0x5b0 [ 632.459342][T14779] should_failslab+0x9/0x20 [ 632.461426][T14779] __kmalloc_noprof+0xcf/0x410 [ 632.463529][T14779] ? trace_kmalloc+0x2d/0xe0 [ 632.465160][T14779] ? unwind_next_frame+0x51/0x23a0 [ 632.466899][T14779] tomoyo_realpath_from_path+0xb9/0x720 [ 632.468860][T14779] ? tomoyo_fill_path_info+0x233/0x420 [ 632.470966][T14779] tomoyo_mount_acl+0x1af/0x880 [ 632.473138][T14779] ? hlock_class+0x4e/0x130 [ 632.475008][T14779] ? __lock_acquire+0x14f4/0x3b30 [ 632.476903][T14779] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 632.478881][T14779] ? putname+0x12e/0x170 [ 632.480425][T14779] ? __pfx___lock_acquire+0x10/0x10 [ 632.482382][T14779] ? stack_trace_save+0x95/0xd0 [ 632.484330][T14779] ? __pfx_stack_trace_save+0x10/0x10 [ 632.486670][T14779] ? tomoyo_domain+0xbb/0x150 [ 632.488831][T14779] ? tomoyo_profile+0x47/0x60 [ 632.491022][T14779] tomoyo_mount_permission+0x16b/0x410 [ 632.493586][T14779] ? tomoyo_mount_permission+0x146/0x410 [ 632.495511][T14779] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 632.497720][T14779] ? get_current_fs_domain+0x188/0x1f0 [ 632.499571][T14779] security_sb_mount+0x8d/0xe0 [ 632.501509][T14779] path_mount+0x129/0x1f20 [ 632.503406][T14779] ? kmem_cache_free+0x12f/0x3a0 [ 632.505672][T14779] ? __pfx_path_mount+0x10/0x10 [ 632.505808][ T5233] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 632.508106][T14779] ? putname+0x12e/0x170 [ 632.513848][T14779] __x64_sys_mount+0x297/0x320 [ 632.515981][T14779] ? __pfx___x64_sys_mount+0x10/0x10 [ 632.518345][T14779] do_syscall_64+0xcd/0x250 [ 632.520299][T14779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.522953][T14779] RIP: 0033:0x7f5cbb975bd9 [ 632.524735][T14779] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 632.533864][T14779] RSP: 002b:00007f5cbc751048 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 632.537674][T14779] RAX: ffffffffffffffda RBX: 00007f5cbbb03f60 RCX: 00007f5cbb975bd9 [ 632.541095][T14779] RDX: 0000000020000100 RSI: 00000000200000c0 RDI: 0000000000000000 [ 632.544445][T14779] RBP: 00007f5cbc7510a0 R08: 0000000020000080 R09: 0000000000000000 [ 632.547990][T14779] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 632.551704][T14779] R13: 000000000000000b R14: 00007f5cbbb03f60 R15: 00007fff21e44fb8 [ 632.555360][T14779] [ 632.558573][T14779] ERROR: Out of memory at tomoyo_realpath_from_path. [ 632.601795][T14781] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 632.610311][T14781] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 632.616569][T14781] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 632.632468][T14781] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 632.671593][T14786] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 632.677512][T14786] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 632.685183][ T5233] usb 5-1: Using ep0 maxpacket: 8 [ 632.686962][T14786] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 632.698920][ T5233] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 632.705452][ T5233] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 632.706137][T14786] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 632.710477][ T5233] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 632.725158][ T5233] usb 5-1: config 0 descriptor?? [ 632.733405][ T5233] iowarrior 5-1:0.0: no interrupt-in endpoint found [ 632.971900][T14790] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 632.988374][T14790] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 633.275867][T14791] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 633.284477][T14791] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 633.623581][T14794] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2582 sclass=netlink_route_socket pid=14794 comm=syz.3.3019 [ 633.630601][T14794] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2580 sclass=netlink_route_socket pid=14794 comm=syz.3.3019 [ 634.592425][T14804] netlink: 2060 bytes leftover after parsing attributes in process `syz.3.3020'. [ 634.596756][T14804] netlink: 'syz.3.3020': attribute type 1 has an invalid length. [ 634.600468][T14804] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.3020'. [ 635.195655][ T828] usb 5-1: USB disconnect, device number 77 [ 635.236658][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 635.306423][T14828] x_tables: duplicate underflow at hook 1 [ 635.508582][T14834] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3031'. [ 635.582528][T14834] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3031'. [ 635.785859][T14846] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 635.796206][T14846] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 635.803576][T14846] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 635.809622][T14846] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 635.852033][T14851] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2582 sclass=netlink_route_socket pid=14851 comm=syz.1.3036 [ 635.859631][T14851] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2580 sclass=netlink_route_socket pid=14851 comm=syz.1.3036 [ 636.129895][T14852] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 636.134745][T14852] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 636.439935][T14848] netlink: 2060 bytes leftover after parsing attributes in process `syz.0.3033'. [ 636.444109][T14848] netlink: 'syz.0.3033': attribute type 1 has an invalid length. [ 636.448788][T14848] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.3033'. [ 637.009116][T14868] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3041'. [ 637.075098][ T4634] Bluetooth: hci4: Unknown advertising packet type: 0x76 [ 637.316047][T13827] usb 8-1: new high-speed USB device number 79 using dummy_hcd [ 637.505048][T13827] usb 8-1: Using ep0 maxpacket: 16 [ 637.509776][T13827] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 637.513121][T13827] usb 8-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 637.516949][T13827] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 637.522621][T13827] usb 8-1: config 0 descriptor?? [ 637.529707][T13827] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 637.719138][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 637.732745][ T39] audit: type=1400 audit(2000000452.010:857): avc: denied { write } for pid=14869 comm="syz.3.3043" name="snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 637.733412][T14871] random: crng reseeded on system resumption [ 637.743629][ T39] audit: type=1400 audit(2000000452.010:858): avc: denied { open } for pid=14869 comm="syz.3.3043" path="/dev/snapshot" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 638.068995][T14888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 638.075649][T14888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 638.191765][T14898] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 638.200103][T14898] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 638.206331][T14898] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 638.211843][T14898] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 638.443986][T14888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 638.456782][T14888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 638.512486][T14901] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 638.513799][T14901] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 638.531121][ T4634] Bluetooth: hci2: unexpected event for opcode 0x0000 [ 639.095314][ T25] usb 7-1: new high-speed USB device number 93 using dummy_hcd [ 639.228764][ T39] audit: type=1400 audit(2000000453.510:859): avc: denied { write } for pid=14914 comm="syz.1.3056" name="/" dev="9p" ino=36575050 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 639.242537][ T39] audit: type=1400 audit(2000000453.510:860): avc: denied { add_name } for pid=14914 comm="syz.1.3056" name="cgroup.controllers" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 639.255088][ T39] audit: type=1400 audit(2000000453.510:861): avc: denied { create } for pid=14914 comm="syz.1.3056" name="cgroup.controllers" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 639.267877][ T39] audit: type=1400 audit(2000000453.510:862): avc: denied { associate } for pid=14914 comm="syz.1.3056" name="cgroup.controllers" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 639.279275][ T39] audit: type=1400 audit(2000000453.540:863): avc: denied { append } for pid=14914 comm="syz.1.3056" path="/587/file0/cgroup.controllers" dev="9p" ino=36575151 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 639.287252][ T25] usb 7-1: config 0 has an invalid interface number: 199 but max is 1 [ 639.292597][ T25] usb 7-1: config 0 has no interface number 1 [ 639.295412][ T25] usb 7-1: config 0 interface 199 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 639.304000][ T25] usb 7-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 639.310808][ T25] usb 7-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 639.314401][ T25] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 639.318214][ T25] usb 7-1: SerialNumber: syz [ 639.331782][ T25] usb 7-1: config 0 descriptor?? [ 639.342256][ T25] usb 7-1: Found UVC 0.00 device (0002:0000) [ 639.346212][ T25] usb 7-1: No valid video chain found. [ 639.541770][ T4634] Bluetooth: hci2: Unknown advertising packet type: 0x76 [ 639.542734][T14757] usb 7-1: USB disconnect, device number 93 [ 640.069450][ T976] usb 8-1: USB disconnect, device number 79 [ 640.104250][ T4634] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 640.479231][T14940] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 640.485260][T14940] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 640.493137][T14940] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 640.499857][T14940] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 640.773255][T14944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 640.780390][T14944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 640.862977][ T4634] Bluetooth: hci4: Unknown advertising packet type: 0x76 [ 641.151118][ T39] audit: type=1400 audit(2000000455.430:864): avc: denied { unmount } for pid=14956 comm="syz.1.3070" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 641.677537][T12268] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 642.100765][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 642.250264][T14987] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3077'. [ 642.565242][T14757] usb 8-1: new high-speed USB device number 80 using dummy_hcd [ 642.665796][T14999] cgroup: release_agent respecified [ 642.761714][T14757] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 642.769554][T14757] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 642.778877][T14757] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 642.789065][T14757] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 642.793554][T14757] usb 8-1: New USB device found, idVendor=17ef, idProduct=60a3, bcdDevice= 0.00 [ 642.808673][T14757] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 642.816161][T15006] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 642.836342][T14757] usb 8-1: config 0 descriptor?? [ 643.064203][T15018] ceph: Path missing in source [ 643.219588][T15022] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3091'. [ 643.269113][T14757] usb 8-1: USB disconnect, device number 80 [ 643.282906][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 643.577851][ T39] audit: type=1400 audit(2000000457.850:865): avc: denied { write } for pid=15026 comm="syz.1.3093" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 643.916551][T15033] netlink: 2060 bytes leftover after parsing attributes in process `syz.0.3094'. [ 643.920109][T15033] netlink: 'syz.0.3094': attribute type 1 has an invalid length. [ 643.923547][T15033] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.3094'. [ 644.348750][T15048] cgroup: release_agent respecified [ 644.434315][T15060] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 644.442252][T15060] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 644.451700][T15060] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 644.467928][T15060] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 644.500809][T15061] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3101'. [ 644.847577][T15060] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 644.855488][T15060] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 644.989218][T15068] FAULT_INJECTION: forcing a failure. [ 644.989218][T15068] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 644.996542][T15068] CPU: 0 PID: 15068 Comm: syz.0.3104 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 645.001902][T15068] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 645.007523][T15068] Call Trace: [ 645.009052][T15068] [ 645.010319][T15068] dump_stack_lvl+0x16c/0x1f0 [ 645.012595][T15068] should_fail_ex+0x497/0x5b0 [ 645.014572][T15068] _copy_from_user+0x30/0xf0 [ 645.016455][T15068] copy_msghdr_from_user+0x99/0x160 [ 645.018521][T15068] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 645.020908][T15068] ? __lock_acquire+0x14f4/0x3b30 [ 645.023060][T15068] ___sys_sendmsg+0xff/0x1e0 [ 645.025121][T15068] ? __pfx____sys_sendmsg+0x10/0x10 [ 645.027154][T15068] ? __pfx___might_resched+0x10/0x10 [ 645.029341][T15068] ? __might_fault+0xe3/0x190 [ 645.031248][T15068] __sys_sendmmsg+0x1a1/0x450 [ 645.033517][T15068] ? __pfx___sys_sendmmsg+0x10/0x10 [ 645.036259][T15068] ? vfs_write+0x14d/0x1140 [ 645.038338][T15068] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 645.041488][T15068] ? fput+0x32/0x390 [ 645.043481][T15068] ? ksys_write+0x1ab/0x260 [ 645.045812][T15068] ? __pfx_ksys_write+0x10/0x10 [ 645.048333][T15068] __x64_sys_sendmmsg+0x9c/0x100 [ 645.050640][T15068] ? lockdep_hardirqs_on+0x7c/0x110 [ 645.052924][T15068] do_syscall_64+0xcd/0x250 [ 645.054887][T15068] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 645.057531][T15068] RIP: 0033:0x7fcc16975bd9 [ 645.059508][T15068] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 645.068376][T15068] RSP: 002b:00007fcc1779d048 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 645.071815][T15068] RAX: ffffffffffffffda RBX: 00007fcc16b04038 RCX: 00007fcc16975bd9 [ 645.075987][T15068] RDX: 00000000040001b6 RSI: 0000000020001540 RDI: 0000000000000004 [ 645.079761][T15068] RBP: 00007fcc1779d0a0 R08: 0000000000000000 R09: 0000000000000000 [ 645.083638][T15068] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 645.087432][T15068] R13: 000000000000006e R14: 00007fcc16b04038 R15: 00007fff1083ca88 [ 645.103499][T15068] [ 645.264430][ T10] IPVS: starting estimator thread 0... [ 645.375412][T15074] IPVS: using max 17 ests per chain, 40800 per kthread [ 645.537899][T15083] FAULT_INJECTION: forcing a failure. [ 645.537899][T15083] name failslab, interval 1, probability 0, space 0, times 0 [ 645.544377][T15083] CPU: 1 PID: 15083 Comm: syz.0.3108 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 645.548955][T15083] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 645.553981][T15083] Call Trace: [ 645.555574][T15083] [ 645.557053][T15083] dump_stack_lvl+0x16c/0x1f0 [ 645.559415][T15083] should_fail_ex+0x497/0x5b0 [ 645.561682][T15083] should_failslab+0x9/0x20 [ 645.563669][T15083] kmem_cache_alloc_noprof+0x6e/0x2f0 [ 645.566170][T15083] ? ptlock_alloc+0x1f/0x70 [ 645.568201][T15083] ptlock_alloc+0x1f/0x70 [ 645.570158][T15083] pte_alloc_one+0x74/0x370 [ 645.572238][T15083] __pte_alloc+0x6e/0x3a0 [ 645.574180][T15083] ? __pfx___pte_alloc+0x10/0x10 [ 645.576390][T15083] __handle_mm_fault+0x4883/0x5430 [ 645.578821][T15083] ? __pfx_mt_find+0x10/0x10 [ 645.581024][T15083] ? __pfx___handle_mm_fault+0x10/0x10 [ 645.583787][T15083] ? no_page_table+0xc7/0x230 [ 645.586177][T15083] handle_mm_fault+0x476/0xa00 [ 645.588364][T15083] __get_user_pages+0x473/0x1490 [ 645.590272][T15083] ? __pfx___get_user_pages+0x10/0x10 [ 645.592240][T15083] ? down_read_killable+0xcc/0x380 [ 645.594476][T15083] ? __pfx_down_read_killable+0x10/0x10 [ 645.596766][T15083] __gup_longterm_locked+0x243/0x2790 [ 645.599087][T15083] ? __pfx_mark_lock+0x10/0x10 [ 645.601159][T15083] ? find_held_lock+0x2d/0x110 [ 645.603443][T15083] ? __pfx___gup_longterm_locked+0x10/0x10 [ 645.606023][T15083] ? gup_fast_fallback+0x1245/0x25d0 [ 645.608390][T15083] ? __pfx_lock_release+0x10/0x10 [ 645.610619][T15083] ? sanity_check_pinned_pages+0x23/0x11f0 [ 645.613229][T15083] gup_fast_fallback+0x1545/0x25d0 [ 645.615538][T15083] ? __pfx_gup_fast_fallback+0x10/0x10 [ 645.618055][T15083] pin_user_pages_fast+0xa8/0x100 [ 645.620493][T15083] ? __pfx_pin_user_pages_fast+0x10/0x10 [ 645.623048][T15083] ? nh_generic+0x30b/0x990 [ 645.624953][T15083] ? poly1305_core_blocks+0x3bc/0x470 [ 645.627274][T15083] ? iov_iter_advance+0x85/0x3d0 [ 645.629262][T15083] iov_iter_extract_pages+0x388/0x18a0 [ 645.631345][T15083] ? __pfx_iov_iter_extract_pages+0x10/0x10 [ 645.633695][T15083] ? __pfx_nh_generic+0x10/0x10 [ 645.635906][T15083] ? __pfx_nhpoly1305_units+0x10/0x10 [ 645.638162][T15083] extract_iter_to_sg+0xbd7/0x1950 [ 645.640306][T15083] ? crypto_nhpoly1305_update_helper+0x166/0x430 [ 645.642800][T15083] ? sanity_check_pinned_pages+0x372/0x11f0 [ 645.645278][T15083] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 645.647420][T15083] ? gup_put_folio+0x71/0x2a0 [ 645.649411][T15083] ? __pfx_unpin_user_page+0x10/0x10 [ 645.651283][T15083] hash_sendmsg+0x431/0xf30 [ 645.653202][T15083] ? security_socket_sendmsg+0x8c/0xc0 [ 645.655333][T15083] ____sys_sendmsg+0xab5/0xc90 [ 645.657238][T15083] ? copy_msghdr_from_user+0x10b/0x160 [ 645.659195][T15083] ? __pfx_____sys_sendmsg+0x10/0x10 [ 645.661240][T15083] ? find_held_lock+0x2d/0x110 [ 645.663033][T15083] ? __pfx___lock_acquire+0x10/0x10 [ 645.665134][T15083] ___sys_sendmsg+0x135/0x1e0 [ 645.666935][T15083] ? __pfx____sys_sendmsg+0x10/0x10 [ 645.668906][T15083] ? ksys_write+0x21c/0x260 [ 645.670848][T15083] ? __fget_light+0x173/0x210 [ 645.672668][T15083] __sys_sendmsg+0x117/0x1f0 [ 645.674538][T15083] ? __pfx___sys_sendmsg+0x10/0x10 [ 645.676719][T15083] do_syscall_64+0xcd/0x250 [ 645.678470][T15083] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 645.680784][T15083] RIP: 0033:0x7fcc16975bd9 [ 645.682681][T15083] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 645.690525][T15083] RSP: 002b:00007fcc1779d048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 645.693898][T15083] RAX: ffffffffffffffda RBX: 00007fcc16b04038 RCX: 00007fcc16975bd9 [ 645.697379][T15083] RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004 [ 645.700673][T15083] RBP: 00007fcc1779d0a0 R08: 0000000000000000 R09: 0000000000000000 [ 645.703822][T15083] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 645.707235][T15083] R13: 000000000000006e R14: 00007fcc16b04038 R15: 00007fff1083ca88 [ 645.710739][T15083] [ 645.826831][ T39] audit: type=1400 audit(2000000460.110:866): avc: denied { create } for pid=15086 comm="syz.3.3111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 645.979634][T15096] netlink: 2060 bytes leftover after parsing attributes in process `syz.1.3112'. [ 645.983902][T15096] netlink: 'syz.1.3112': attribute type 1 has an invalid length. [ 645.992907][T15096] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.3112'. [ 646.301739][T15098] cgroup: release_agent respecified [ 646.322143][ T39] audit: type=1400 audit(2000000460.600:867): avc: denied { create } for pid=15101 comm="syz.0.3114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 646.368809][ T39] audit: type=1400 audit(2000000460.650:868): avc: denied { setopt } for pid=15101 comm="syz.0.3114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 646.608179][ T4634] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 646.833939][T15113] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 646.845695][T15113] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 646.852978][T15113] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 646.860645][T15113] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 646.873192][T15107] evm: overlay not supported [ 647.168972][T15113] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 647.179433][T15113] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 647.320293][T15130] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3122'. [ 647.376498][ T4634] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 647.754395][ T4634] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 648.040440][T15152] netlink: 2060 bytes leftover after parsing attributes in process `syz.1.3127'. [ 648.046508][T15152] netlink: 'syz.1.3127': attribute type 1 has an invalid length. [ 648.050460][T15152] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.3127'. [ 648.096391][T15156] FAULT_INJECTION: forcing a failure. [ 648.096391][T15156] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 648.108147][T15156] CPU: 2 PID: 15156 Comm: syz.3.3129 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 648.112522][T15156] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 648.117153][T15156] Call Trace: [ 648.118563][T15156] [ 648.120001][T15156] dump_stack_lvl+0x16c/0x1f0 [ 648.122217][T15156] should_fail_ex+0x497/0x5b0 [ 648.124423][T15156] _copy_to_iter+0x44f/0x1140 [ 648.126266][T15156] ? __pfx__copy_to_iter+0x10/0x10 [ 648.128509][T15156] ? __virt_addr_valid+0x5e/0x580 [ 648.130477][T15156] ? __phys_addr_symbol+0x30/0x80 [ 648.132411][T15156] ? __check_object_size+0x48e/0x720 [ 648.134831][T15156] seq_read_iter+0xd06/0x12c0 [ 648.137095][T15156] seq_read+0x390/0x4d0 [ 648.139085][T15156] ? __pfx_seq_read+0x10/0x10 [ 648.141085][T15156] ? __pfx___might_resched+0x10/0x10 [ 648.143117][T15156] ? selinux_file_permission+0x125/0x590 [ 648.145063][T15156] ? __pfx_seq_read+0x10/0x10 [ 648.146828][T15156] proc_reg_read+0x243/0x340 [ 648.148652][T15156] ? __pfx_proc_reg_read+0x10/0x10 [ 648.150988][T15156] vfs_read+0x1d4/0xbd0 [ 648.153160][T15156] ? __fdget_pos+0xeb/0x180 [ 648.155349][T15156] ? __pfx_vfs_read+0x10/0x10 [ 648.157295][T15156] ? __pfx___mutex_lock+0x10/0x10 [ 648.159460][T15156] ? __fget_files+0x256/0x400 [ 648.161483][T15156] ksys_read+0x12f/0x260 [ 648.163313][T15156] ? __pfx_ksys_read+0x10/0x10 [ 648.165163][T15156] do_syscall_64+0xcd/0x250 [ 648.167363][T15156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.169738][T15156] RIP: 0033:0x7fcdcf175bd9 [ 648.171286][T15156] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 648.177528][T15156] RSP: 002b:00007fcdcff6a048 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 648.180872][T15156] RAX: ffffffffffffffda RBX: 00007fcdcf303f60 RCX: 00007fcdcf175bd9 [ 648.183893][T15156] RDX: 0000000000002020 RSI: 00000000200000c0 RDI: 0000000000000004 [ 648.186711][T15156] RBP: 00007fcdcff6a0a0 R08: 0000000000000000 R09: 0000000000000000 [ 648.189924][T15156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 648.193104][T15156] R13: 000000000000000b R14: 00007fcdcf303f60 R15: 00007fffff0a8ea8 [ 648.196323][T15156] [ 648.197822][ C2] vkms_vblank_simulate: vblank timer overrun [ 648.548331][ T10] usb 8-1: new high-speed USB device number 81 using dummy_hcd [ 648.746074][ T10] usb 8-1: Using ep0 maxpacket: 8 [ 648.758249][ T10] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 648.762942][ T10] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 648.785129][ T10] usb 8-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 648.789073][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 648.799454][ T10] usb 8-1: config 0 descriptor?? [ 648.806321][ T10] iowarrior 8-1:0.0: no interrupt-in endpoint found [ 648.809822][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 649.577649][T15188] FAULT_INJECTION: forcing a failure. [ 649.577649][T15188] name failslab, interval 1, probability 0, space 0, times 0 [ 649.582837][T15188] CPU: 1 PID: 15188 Comm: syz.1.3140 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 649.586746][T15188] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 649.591766][T15188] Call Trace: [ 649.593015][T15188] [ 649.594082][T15188] dump_stack_lvl+0x16c/0x1f0 [ 649.596164][T15188] should_fail_ex+0x497/0x5b0 [ 649.598116][T15188] should_failslab+0x9/0x20 [ 649.599778][T15188] __kmalloc_noprof+0xcf/0x410 [ 649.601818][T15188] ? bitmap_find_next_zero_area_off+0xb0/0xd0 [ 649.604798][T15188] __vb2_queue_alloc+0x237/0x1220 [ 649.607192][T15188] ? trace_kmalloc+0x2d/0xe0 [ 649.609306][T15190] FAULT_INJECTION: forcing a failure. [ 649.609306][T15190] name failslab, interval 1, probability 0, space 0, times 0 [ 649.609323][T15188] ? __kmalloc_noprof+0x20b/0x410 [ 649.617213][T15188] vb2_core_reqbufs+0xa73/0xfb0 [ 649.619740][T15188] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 649.622516][T15188] __vb2_init_fileio+0x3f3/0x1110 [ 649.624852][T15188] ? __pfx___mutex_lock+0x10/0x10 [ 649.627118][T15188] vb2_core_poll+0x5e8/0x700 [ 649.629284][T15188] vb2_poll+0x35/0x170 [ 649.631055][T15188] vb2_fop_poll+0x10f/0x2d0 [ 649.633117][T15188] ? __pfx_vb2_fop_poll+0x10/0x10 [ 649.635283][T15188] v4l2_poll+0x166/0x320 [ 649.637115][T15188] do_select+0xca0/0x17b0 [ 649.638624][T15188] ? __pfx_v4l2_poll+0x10/0x10 [ 649.640711][T15188] ? __pfx_do_select+0x10/0x10 [ 649.642935][T15188] ? mark_lock+0xb5/0xc60 [ 649.644960][T15188] ? __pfx_mark_lock+0x10/0x10 [ 649.647287][T15188] ? hlock_class+0x4e/0x130 [ 649.649207][T15188] ? mark_lock+0xb5/0xc60 [ 649.650832][T15188] ? __pfx_pollwake+0x10/0x10 [ 649.652772][T15188] ? __pfx_pollwake+0x10/0x10 [ 649.654657][T15188] ? __pfx_pollwake+0x10/0x10 [ 649.656395][T15188] ? __pfx_pollwake+0x10/0x10 [ 649.658087][T15188] ? __pfx___might_resched+0x10/0x10 [ 649.659950][T15188] ? __pfx_lock_release+0x10/0x10 [ 649.662018][T15188] ? __might_fault+0xe3/0x190 [ 649.663900][T15188] ? core_sys_select+0x459/0xb80 [ 649.665737][T15188] core_sys_select+0x459/0xb80 [ 649.667376][T15188] ? __pfx_core_sys_select+0x10/0x10 [ 649.669253][T15188] ? find_held_lock+0x2d/0x110 [ 649.671191][T15188] ? ksys_write+0x12f/0x260 [ 649.673178][T15188] ? set_user_sigmask+0x217/0x2a0 [ 649.675414][T15188] ? __mutex_unlock_slowpath+0x164/0x650 [ 649.677618][T15188] ? __pfx_set_user_sigmask+0x10/0x10 [ 649.679491][T15188] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 649.681903][T15188] do_pselect.constprop.0+0x1a0/0x1f0 [ 649.683744][T15188] ? __pfx_do_pselect.constprop.0+0x10/0x10 [ 649.686122][T15188] ? fput+0x32/0x390 [ 649.687673][T15188] ? ksys_write+0x1ab/0x260 [ 649.689431][T15188] __x64_sys_pselect6+0x150/0x1d0 [ 649.691638][T15188] do_syscall_64+0xcd/0x250 [ 649.693644][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 649.695957][T15188] RIP: 0033:0x7fc38d975bd9 [ 649.697692][T15188] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 649.705364][T15188] RSP: 002b:00007fc38e7da048 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 649.708644][T15188] RAX: ffffffffffffffda RBX: 00007fc38db03f60 RCX: 00007fc38d975bd9 [ 649.711700][T15188] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000040 [ 649.715055][T15188] RBP: 00007fc38e7da0a0 R08: 0000000000000000 R09: 0000000000000000 [ 649.718429][T15188] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 649.721594][T15188] R13: 000000000000000b R14: 00007fc38db03f60 R15: 00007ffe13cdf928 [ 649.724229][T15188] [ 649.725266][T15190] CPU: 0 PID: 15190 Comm: syz.2.3141 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 649.729680][T15190] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 649.733382][T15190] Call Trace: [ 649.734601][T15190] [ 649.735618][T15190] dump_stack_lvl+0x16c/0x1f0 [ 649.737274][T15190] should_fail_ex+0x497/0x5b0 [ 649.739055][T15190] should_failslab+0x9/0x20 [ 649.740629][T15190] kmalloc_trace_noprof+0x6b/0x300 [ 649.742390][T15190] ? binder_open+0x149/0xcf0 [ 649.744121][T15190] binder_open+0x149/0xcf0 [ 649.746243][T15190] ? __pfx_binder_open+0x10/0x10 [ 649.748438][T15190] ? security_file_open+0x9d/0x8b0 [ 649.750430][T15190] do_dentry_open+0x91f/0x15f0 [ 649.752106][T15190] ? __pfx_binder_open+0x10/0x10 [ 649.753864][T15190] ? inode_permission+0xdd/0x5f0 [ 649.755788][T15190] vfs_open+0x82/0x3f0 [ 649.757293][T15190] ? may_open+0x1f2/0x400 [ 649.758818][T15190] path_openat+0x21fc/0x2e50 [ 649.760449][T15190] ? __pfx_path_openat+0x10/0x10 [ 649.762139][T15190] ? __pfx___lock_acquire+0x10/0x10 [ 649.763945][T15190] ? find_held_lock+0x2d/0x110 [ 649.765702][T15190] do_filp_open+0x1dc/0x430 [ 649.767383][T15190] ? __pfx_do_filp_open+0x10/0x10 [ 649.769172][T15190] ? find_held_lock+0x2d/0x110 [ 649.770832][T15190] ? _raw_spin_unlock+0x28/0x50 [ 649.772573][T15190] ? alloc_fd+0x2d7/0x6c0 [ 649.774083][T15190] do_sys_openat2+0x17a/0x1e0 [ 649.775719][T15190] ? __pfx_do_sys_openat2+0x10/0x10 [ 649.777503][T15190] __x64_sys_openat+0x175/0x210 [ 649.779452][T15190] ? __pfx___x64_sys_openat+0x10/0x10 [ 649.781369][T15190] ? ksys_write+0x1ab/0x260 [ 649.782998][T15190] do_syscall_64+0xcd/0x250 [ 649.784679][T15190] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 649.786768][T15190] RIP: 0033:0x7f5cbb975bd9 [ 649.788357][T15190] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 649.794924][T15190] RSP: 002b:00007f5cbc751048 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 649.798287][T15190] RAX: ffffffffffffffda RBX: 00007f5cbbb03f60 RCX: 00007f5cbb975bd9 [ 649.801363][T15190] RDX: 0000000000000000 RSI: 0000000020000040 RDI: ffffffffffffff9c [ 649.804327][T15190] RBP: 00007f5cbc7510a0 R08: 0000000000000000 R09: 0000000000000000 [ 649.807369][T15190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 649.810844][T15190] R13: 000000000000000b R14: 00007f5cbbb03f60 R15: 00007fff21e44fb8 [ 649.814428][T15190] [ 650.281947][ T4634] Bluetooth: hci2: unexpected event for opcode 0x0000 [ 650.407869][T15209] netlink: 2060 bytes leftover after parsing attributes in process `syz.1.3146'. [ 650.412768][T15209] netlink: 'syz.1.3146': attribute type 1 has an invalid length. [ 650.419700][T15209] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.3146'. [ 650.885154][T13908] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 651.065667][T13908] usb 5-1: Using ep0 maxpacket: 32 [ 651.076286][T13908] usb 5-1: New USB device found, idVendor=1557, idProduct=8150, bcdDevice=29.ed [ 651.079954][T13908] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 651.083052][T13908] usb 5-1: Product: syz [ 651.084850][T13908] usb 5-1: Manufacturer: syz [ 651.087355][T13908] usb 5-1: SerialNumber: syz [ 651.091721][T13908] usb 5-1: config 0 descriptor?? [ 651.244191][ T976] usb 8-1: USB disconnect, device number 81 [ 651.570597][ T4634] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 651.755187][T15245] x_tables: duplicate underflow at hook 1 [ 651.759697][T13908] (unnamed net_device) (uninitialized): Assigned a random MAC address: 5e:c3:d9:9d:54:2d [ 651.789387][ T39] audit: type=1400 audit(2000000466.070:869): avc: denied { ioctl } for pid=15244 comm="syz.1.3159" path="socket:[53346]" dev="sockfs" ino=53346 ioctlcmd=0x8921 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 651.791597][T13908] rtl8150 5-1:0.0: eth2: rtl8150 is detected [ 651.822499][T13908] usb 5-1: USB disconnect, device number 78 [ 652.275186][ T976] usb 8-1: new high-speed USB device number 82 using dummy_hcd [ 652.465925][ T976] usb 8-1: Using ep0 maxpacket: 8 [ 652.470433][ T976] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 652.477124][ T976] usb 8-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 652.483023][ T976] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 652.492812][ T976] usb 8-1: config 0 descriptor?? [ 652.497879][ T976] iowarrior 8-1:0.0: no interrupt-in endpoint found [ 652.656307][T15267] binder: 15266:15267 ioctl 4b47 20000600 returned -22 [ 652.724816][ T39] audit: type=1400 audit(2000000467.000:870): avc: denied { mount } for pid=15268 comm="syz.2.3167" name="/" dev="ramfs" ino=52774 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 652.734850][T15269] overlayfs: conflicting options: nfs_export=on,index=off [ 652.738770][ T39] audit: type=1400 audit(2000000467.000:871): avc: denied { mounton } for pid=15268 comm="syz.2.3167" path="/794/file0/bus" dev="ramfs" ino=52777 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 652.768528][ T39] audit: type=1400 audit(2000000467.040:872): avc: denied { unmount } for pid=5200 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 652.794223][T15273] FAULT_INJECTION: forcing a failure. [ 652.794223][T15273] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 652.794251][T15273] CPU: 1 PID: 15273 Comm: syz.2.3169 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 652.794270][T15273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 652.814722][T15273] Call Trace: [ 652.816487][T15273] [ 652.819171][T15273] dump_stack_lvl+0x16c/0x1f0 [ 652.822328][T15273] should_fail_ex+0x497/0x5b0 [ 652.824708][T15273] _copy_from_user+0x30/0xf0 [ 652.826869][T15273] binder_ioctl+0x56c/0x6b70 [ 652.829245][T15273] ? kfree+0x12a/0x3b0 [ 652.831219][T15273] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 652.834034][T15273] ? do_vfs_ioctl+0x515/0x1ad0 [ 652.836401][T15273] ? __pfx_binder_ioctl+0x10/0x10 [ 652.839843][T15273] ? ioctl_has_perm.constprop.0.isra.0+0x2f0/0x470 [ 652.842772][T15273] ? ioctl_has_perm.constprop.0.isra.0+0x2f9/0x470 [ 652.845564][T15273] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 652.848591][T15273] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 652.851132][T15273] ? selinux_file_ioctl+0x180/0x270 [ 652.854096][T15273] ? selinux_file_ioctl+0xb4/0x270 [ 652.857142][T15273] ? __pfx_binder_ioctl+0x10/0x10 [ 652.861162][T15273] __x64_sys_ioctl+0x193/0x220 [ 652.863729][T15273] do_syscall_64+0xcd/0x250 [ 652.865931][T15273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 652.869179][T15273] RIP: 0033:0x7f5cbb975bd9 [ 652.871242][T15273] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 652.879702][T15273] RSP: 002b:00007f5cbc751048 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 652.883359][T15273] RAX: ffffffffffffffda RBX: 00007f5cbbb03f60 RCX: 00007f5cbb975bd9 [ 652.888815][T15273] RDX: 0000000020000600 RSI: 00000000c0306201 RDI: 0000000000000004 [ 652.892744][T15273] RBP: 00007f5cbc7510a0 R08: 0000000000000000 R09: 0000000000000000 [ 652.896721][T15273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 652.900557][T15273] R13: 000000000000000b R14: 00007f5cbbb03f60 R15: 00007fff21e44fb8 [ 652.904467][T15273] [ 652.943930][T15273] binder: 15272:15273 ioctl c0306201 20000600 returned -14 [ 653.101728][T15281] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 653.107267][T15281] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 653.112163][T15281] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 653.118016][ T39] audit: type=1400 audit(2000000467.390:873): avc: denied { bind } for pid=15277 comm="syz.2.3171" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 653.123283][T15281] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 653.353376][T15285] FAULT_INJECTION: forcing a failure. [ 653.353376][T15285] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 653.366971][T15285] CPU: 3 PID: 15285 Comm: syz.0.3173 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 653.370853][T15285] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 653.376822][T15285] Call Trace: [ 653.378108][T15285] [ 653.379231][T15285] dump_stack_lvl+0x16c/0x1f0 [ 653.381045][T15285] should_fail_ex+0x497/0x5b0 [ 653.382821][T15285] _copy_from_user+0x30/0xf0 [ 653.384572][T15285] copy_msghdr_from_user+0x99/0x160 [ 653.393232][T15285] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 653.395702][T15285] ? __pfx___lock_acquire+0x10/0x10 [ 653.398434][T15285] ___sys_sendmsg+0xff/0x1e0 [ 653.400981][T15285] ? __pfx____sys_sendmsg+0x10/0x10 [ 653.404118][T15285] ? __pfx_lock_release+0x10/0x10 [ 653.406361][T15285] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 653.408873][T15285] ? __fget_light+0x173/0x210 [ 653.410964][T15285] __sys_sendmmsg+0x1a1/0x450 [ 653.413296][T15285] ? __pfx___sys_sendmmsg+0x10/0x10 [ 653.415687][T15285] ? vfs_write+0x14d/0x1140 [ 653.417844][T15285] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 653.420619][T15285] ? fput+0x32/0x390 [ 653.422391][T15285] ? ksys_write+0x1ab/0x260 [ 653.424244][T15285] ? __pfx_ksys_write+0x10/0x10 [ 653.426297][T15285] __x64_sys_sendmmsg+0x9c/0x100 [ 653.428615][T15285] ? lockdep_hardirqs_on+0x7c/0x110 [ 653.430973][T15285] do_syscall_64+0xcd/0x250 [ 653.432877][T15285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.435233][T15285] RIP: 0033:0x7fcc16975bd9 [ 653.437114][T15285] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 653.445244][T15285] RSP: 002b:00007fcc1779d048 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 653.448841][T15285] RAX: ffffffffffffffda RBX: 00007fcc16b04038 RCX: 00007fcc16975bd9 [ 653.452250][T15285] RDX: 0000000000000002 RSI: 0000000020003600 RDI: 0000000000000005 [ 653.455801][T15285] RBP: 00007fcc1779d0a0 R08: 0000000000000000 R09: 0000000000000000 [ 653.459347][T15285] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 653.463015][T15285] R13: 000000000000006e R14: 00007fcc16b04038 R15: 00007fff1083ca88 [ 653.466471][T15285] [ 653.641588][T15281] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 653.656415][T15281] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 653.828254][ T39] audit: type=1400 audit(2000000468.080:874): avc: denied { write } for pid=15293 comm="syz.2.3176" name="event0" dev="devtmpfs" ino=862 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 654.843901][T15320] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 654.987658][T15328] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3185'. [ 654.989056][ T25] usb 8-1: USB disconnect, device number 82 [ 655.052610][T15333] program syz.0.3188 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 655.130158][T15339] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 655.140131][T15339] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 655.145719][T15339] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 655.150838][T15339] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 655.240883][T15341] netlink: 2060 bytes leftover after parsing attributes in process `syz.1.3186'. [ 655.244764][T15341] netlink: 'syz.1.3186': attribute type 1 has an invalid length. [ 655.268108][T15341] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.3186'. [ 655.601366][T15345] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 655.611101][T15345] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 656.758395][T15374] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 656.763024][T15374] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 656.770464][T15372] netlink: 2060 bytes leftover after parsing attributes in process `syz.0.3199'. [ 656.774856][T15372] netlink: 'syz.0.3199': attribute type 1 has an invalid length. [ 656.782212][T15374] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 656.785202][T15372] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.3199'. [ 656.788066][T15374] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 657.068905][T15374] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 657.074263][T15374] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 657.265998][T15380] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 657.275906][T15380] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 657.283480][T15380] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 657.291645][T15380] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 657.537418][T15382] netlink: 2060 bytes leftover after parsing attributes in process `syz.1.3201'. [ 657.541414][T15382] netlink: 'syz.1.3201': attribute type 1 has an invalid length. [ 657.555067][T15382] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.3201'. [ 657.565783][T15380] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 657.572740][T15380] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 658.240803][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0c46 [ 658.308030][ T63] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.309469][T15404] input: syz0 as /devices/virtual/input/input8 [ 658.326367][T15404] input: failed to attach handler leds to device input8, error: -6 [ 658.377704][T12268] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 658.382692][T12268] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 658.387688][T12268] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 658.392158][T12268] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 658.397834][T12268] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 658.408793][T12268] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 658.500479][ T63] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.511119][T15412] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 658.530745][T15412] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 658.535810][T15412] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 658.540541][T15412] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 658.620539][ T63] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.696491][T12268] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 658.729763][ T63] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.769441][T15412] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 658.776217][T15407] chnl_net:caif_netlink_parms(): no params data found [ 658.780446][T15412] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 658.943159][T15407] bridge0: port 1(bridge_slave_0) entered blocking state [ 658.954827][T15407] bridge0: port 1(bridge_slave_0) entered disabled state [ 658.958742][T15407] bridge_slave_0: entered allmulticast mode [ 658.962830][T15407] bridge_slave_0: entered promiscuous mode [ 658.968792][T15407] bridge0: port 2(bridge_slave_1) entered blocking state [ 658.972864][T15407] bridge0: port 2(bridge_slave_1) entered disabled state [ 658.978470][T15407] bridge_slave_1: entered allmulticast mode [ 658.982639][T15407] bridge_slave_1: entered promiscuous mode [ 659.117229][T15407] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 659.149972][T15407] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 659.207391][ T63] bridge_slave_1: left allmulticast mode [ 659.209530][ T63] bridge_slave_1: left promiscuous mode [ 659.211644][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 659.218353][ T63] bridge_slave_0: left allmulticast mode [ 659.220437][ T63] bridge_slave_0: left promiscuous mode [ 659.223408][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 659.472549][T15445] netlink: 2060 bytes leftover after parsing attributes in process `syz.2.3219'. [ 659.477925][T15445] netlink: 'syz.2.3219': attribute type 1 has an invalid length. [ 659.486129][T15445] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.3219'. [ 659.705128][ T5233] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 659.887097][ T5233] usb 5-1: Using ep0 maxpacket: 8 [ 659.905729][ T5233] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 659.910174][ T5233] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 659.914300][ T5233] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 659.929258][ T63] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 659.935593][ T5233] usb 5-1: config 0 descriptor?? [ 659.939797][ T5233] iowarrior 5-1:0.0: no interrupt-in endpoint found [ 659.947927][ T63] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 659.954837][ T63] bond0 (unregistering): Released all slaves [ 659.994734][T15407] team0: Port device team_slave_0 added [ 660.020518][T15407] team0: Port device team_slave_1 added [ 660.032509][T15439] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 660.096900][T15407] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 660.099767][T15407] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 660.110518][T15407] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 660.125969][T15407] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 660.128918][T15407] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 660.138110][T15407] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 660.313884][T15407] hsr_slave_0: entered promiscuous mode [ 660.318465][T15407] hsr_slave_1: entered promiscuous mode [ 660.321861][T15407] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 660.325445][T15407] Cannot create hsr debugfs directory [ 660.383477][T12268] Bluetooth: hci2: unexpected event for opcode 0x0000 [ 660.645982][ T63] hsr_slave_0: left promiscuous mode [ 660.649340][ T63] hsr_slave_1: left promiscuous mode [ 660.652627][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 660.662669][ T63] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 660.668286][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 660.671449][ T63] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 660.734271][ T63] veth1_macvtap: left promiscuous mode [ 660.753394][ T63] veth0_macvtap: left promiscuous mode [ 660.757242][ T63] veth1_vlan: left promiscuous mode [ 660.760334][ T63] veth0_vlan: left promiscuous mode [ 661.021441][ T39] audit: type=1400 audit(2000000475.300:875): avc: denied { getopt } for pid=15486 comm="syz.2.3229" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 661.436366][T15497] netlink: 2060 bytes leftover after parsing attributes in process `syz.2.3231'. [ 661.440210][T15497] netlink: 'syz.2.3231': attribute type 1 has an invalid length. [ 661.443700][T15497] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.3231'. [ 661.926602][ T63] team0 (unregistering): Port device team_slave_1 removed [ 661.998290][T15495] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 662.044602][ T63] team0 (unregistering): Port device team_slave_0 removed [ 662.412649][T10352] usb 5-1: USB disconnect, device number 79 [ 663.111172][ T39] audit: type=1400 audit(2000000477.390:876): avc: denied { write } for pid=15515 comm="syz.2.3237" name="ppp" dev="devtmpfs" ino=714 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 663.796612][T15407] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 663.822814][T15407] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 663.831739][T15407] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 663.846148][T15407] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 663.860811][T15526] team_slave_0: entered promiscuous mode [ 663.863811][T15526] team_slave_1: entered promiscuous mode [ 663.881554][T15525] team_slave_0: left promiscuous mode [ 663.884496][T15525] team_slave_1: left promiscuous mode [ 663.989622][T15407] 8021q: adding VLAN 0 to HW filter on device bond0 [ 664.008692][T15407] 8021q: adding VLAN 0 to HW filter on device team0 [ 664.018381][T14757] bridge0: port 1(bridge_slave_0) entered blocking state [ 664.021428][T14757] bridge0: port 1(bridge_slave_0) entered forwarding state [ 664.050513][T14757] bridge0: port 2(bridge_slave_1) entered blocking state [ 664.053911][T14757] bridge0: port 2(bridge_slave_1) entered forwarding state [ 664.090422][T15407] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 664.234706][T15407] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 664.277161][T15563] input: syz0 as /devices/virtual/input/input9 [ 664.284323][T15407] veth0_vlan: entered promiscuous mode [ 664.296193][T15407] veth1_vlan: entered promiscuous mode [ 664.324397][T15407] veth0_macvtap: entered promiscuous mode [ 664.332506][T15407] veth1_macvtap: entered promiscuous mode [ 664.351122][T15407] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 664.356766][T15407] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.361073][T15407] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 664.365442][T15407] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.369082][T15407] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 664.373294][T15407] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.379082][T15407] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 664.382343][T15566] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3245'. [ 664.394651][T15407] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 664.399384][T15407] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.403400][T15407] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 664.408473][T15407] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.412667][T15407] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 664.417669][T15407] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.423754][T15407] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 664.427542][T15566] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3245'. [ 664.456793][T15407] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.460277][T15407] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.463696][T15407] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.467636][T15407] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.515523][ T76] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 664.518840][ T76] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 664.558153][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 664.565191][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 664.769507][T15575] netlink: 2060 bytes leftover after parsing attributes in process `syz.0.3246'. [ 664.773122][T15575] netlink: 'syz.0.3246': attribute type 1 has an invalid length. [ 664.776249][T15575] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.3246'. [ 664.955316][ T39] audit: type=1400 audit(2000000479.230:877): avc: denied { listen } for pid=15582 comm="syz.2.3250" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 664.965175][ T39] audit: type=1400 audit(2000000479.230:878): avc: denied { accept } for pid=15582 comm="syz.2.3250" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 665.046558][T12268] Bluetooth: hci0: unexpected event for opcode 0x0000 [ 665.163683][T12268] Bluetooth: hci2: Unknown advertising packet type: 0x76 [ 665.163714][T12268] Bluetooth: hci2: Malformed LE Event: 0x0d [ 665.218220][ T39] audit: type=1400 audit(2000000479.500:879): avc: denied { setattr } for pid=15595 comm="syz.1.3254" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=56540 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 665.384852][T15601] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 665.392364][T15601] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 665.402159][T15601] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 665.409030][T15601] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 665.414899][T15569] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 665.791952][T15601] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 665.808983][T15601] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 666.593017][ T4634] Bluetooth: hci0: unexpected event for opcode 0x0000 [ 666.733534][ T4634] Bluetooth: hci4: Unknown advertising packet type: 0x76 [ 666.733564][ T4634] Bluetooth: hci4: Malformed LE Event: 0x0d [ 666.955090][T14757] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 667.155577][T14757] usb 6-1: Using ep0 maxpacket: 8 [ 667.163155][T14757] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 667.168683][T14757] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 667.173625][T14757] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 667.177820][T14757] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 667.185682][T14757] usb 6-1: config 0 descriptor?? [ 667.293410][T15646] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 667.302651][T15646] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 667.303537][T15644] netlink: 2060 bytes leftover after parsing attributes in process `syz.3.3270'. [ 667.316977][T15646] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 667.319800][T15644] netlink: 'syz.3.3270': attribute type 1 has an invalid length. [ 667.325173][T15644] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.3270'. [ 667.325723][T15646] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 667.417895][T14757] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 667.564374][T15646] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 667.570947][T15646] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 667.616365][T15630] iowarrior 6-1:0.0: Error -90 while submitting URB [ 667.622671][T14757] usb 6-1: USB disconnect, device number 74 [ 667.635551][T14757] iowarrior 6-1:0.0: I/O-Warror #0 now disconnected [ 667.670249][T15651] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 667.680645][T15651] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 667.687770][T15651] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 667.699591][T15651] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 667.961050][T15651] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 667.967496][T15651] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 668.712986][ T4634] Bluetooth: hci2: unexpected event for opcode 0x0000 [ 668.752597][T15671] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3278'. [ 668.756943][T15671] openvswitch: netlink: IP tunnel attribute has 3060 unknown bytes. [ 668.771452][ T39] audit: type=1400 audit(2000000483.050:880): avc: denied { write } for pid=15670 comm="syz.1.3278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 669.855641][T15687] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 669.862251][T15687] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 669.869464][T15687] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 669.875129][T15687] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 669.907110][T15689] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 669.912103][T15689] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 669.922263][T15689] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 669.928973][T15689] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 670.134098][T15687] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 670.140691][T15687] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 670.168352][T15689] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 670.172775][T15689] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 670.673353][T15696] netlink: 2060 bytes leftover after parsing attributes in process `syz.2.3285'. [ 670.679322][T15696] netlink: 'syz.2.3285': attribute type 1 has an invalid length. [ 670.682789][T15696] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.3285'. [ 670.742792][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 670.757441][T15700] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3287'. [ 670.762526][T15700] openvswitch: netlink: IP tunnel attribute has 3060 unknown bytes. [ 671.259032][T15707] syz.1.3289 (15707): /proc/15707/oom_adj is deprecated, please use /proc/15707/oom_score_adj instead. [ 672.313863][T15727] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 672.319089][T15727] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 672.323369][T15727] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 672.328763][T15727] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 672.394910][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 672.556882][T15727] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 672.562151][T15727] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 673.149878][T15736] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3298'. [ 673.154408][T15736] openvswitch: netlink: IP tunnel attribute has 3060 unknown bytes. [ 673.514335][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 674.718227][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 674.874235][T15762] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 674.880378][T15762] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 674.885821][T15762] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 674.891713][T15762] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 675.092634][T15762] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 675.097528][T15762] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 675.215214][ T10] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 675.398405][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 675.402745][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 675.408218][ T10] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 675.412109][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 675.416086][ T10] usb 5-1: config 0 descriptor?? [ 675.628238][ T10] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 675.634752][ T10] usb 5-1: USB disconnect, device number 80 [ 675.639754][ T10] iowarrior 5-1:0.0: I/O-Warror #0 now disconnected [ 675.715951][T15769] Illegal XDP return value 1241954787 on prog (id 765) dev N/A, expect packet loss! [ 675.820046][ T39] audit: type=1400 audit(2000000490.000:881): avc: denied { read write } for pid=15770 comm="syz.1.3310" dev="sockfs" ino=56677 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 675.853597][ T39] audit: type=1400 audit(2000000490.030:882): avc: denied { append } for pid=15770 comm="syz.1.3310" name="001" dev="devtmpfs" ino=745 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 675.883435][T15771] usb usb7: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 675.892821][T15771] usb usb7: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 676.076056][T15773] futex_wake_op: syz.1.3311 tries to shift op by 36; fix this program [ 676.473385][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 676.755642][T15786] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 676.760258][T15786] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 676.764405][T15786] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 676.768729][T15786] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 677.020084][T15786] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 677.026939][T15786] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 677.323177][ T5204] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 677.332753][ T5204] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 677.339304][ T5204] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 677.344951][ T5204] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 677.350983][ T5204] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 677.356338][ T5204] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 677.523545][T15792] chnl_net:caif_netlink_parms(): no params data found [ 677.583619][T15800] usb usb7: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 677.588258][T15800] usb usb7: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 677.742842][T15792] bridge0: port 1(bridge_slave_0) entered blocking state [ 677.756814][T15792] bridge0: port 1(bridge_slave_0) entered disabled state [ 677.763240][T15792] bridge_slave_0: entered allmulticast mode [ 677.774424][T15792] bridge_slave_0: entered promiscuous mode [ 677.796361][T15792] bridge0: port 2(bridge_slave_1) entered blocking state [ 677.799211][T15792] bridge0: port 2(bridge_slave_1) entered disabled state [ 677.802138][T15792] bridge_slave_1: entered allmulticast mode [ 677.810403][T15792] bridge_slave_1: entered promiscuous mode [ 677.921396][T15792] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 677.930609][T15792] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 678.020312][T15792] team0: Port device team_slave_0 added [ 678.029256][T15792] team0: Port device team_slave_1 added [ 678.133003][T15792] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 678.137775][T15792] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 678.148166][T15792] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 678.155587][T15792] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 678.158291][T15792] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 678.170801][T15792] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 678.254812][T15792] hsr_slave_0: entered promiscuous mode [ 678.258294][T15792] hsr_slave_1: entered promiscuous mode [ 678.265587][T15792] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 678.268371][T15792] Cannot create hsr debugfs directory [ 678.453728][T15824] netlink: 2060 bytes leftover after parsing attributes in process `syz.1.3326'. [ 678.458522][T15824] netlink: 'syz.1.3326': attribute type 1 has an invalid length. [ 678.462969][T15824] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.3326'. [ 678.507600][T15792] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.588712][T15792] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.671489][T15792] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.784864][T15792] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.947831][T15828] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 678.952545][T15828] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 678.954540][T15792] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 678.962492][T15828] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 678.964366][T15792] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 678.967297][T15828] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 678.978165][T15792] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 678.986177][T15792] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 679.086674][T15792] 8021q: adding VLAN 0 to HW filter on device bond0 [ 679.109362][T15792] 8021q: adding VLAN 0 to HW filter on device team0 [ 679.134134][T13827] bridge0: port 1(bridge_slave_0) entered blocking state [ 679.138272][T13827] bridge0: port 1(bridge_slave_0) entered forwarding state [ 679.159340][T13827] bridge0: port 2(bridge_slave_1) entered blocking state [ 679.163339][T13827] bridge0: port 2(bridge_slave_1) entered forwarding state [ 679.330163][T15828] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 679.334852][T15828] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 679.372001][T15792] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 679.395277][ T5204] Bluetooth: hci3: command tx timeout [ 679.418578][T15792] veth0_vlan: entered promiscuous mode [ 679.429928][T15792] veth1_vlan: entered promiscuous mode [ 679.460822][T15792] veth0_macvtap: entered promiscuous mode [ 679.468466][T15792] veth1_macvtap: entered promiscuous mode [ 679.486700][T15792] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.491298][T15792] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.496301][T15792] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.501256][T15792] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.505922][T15792] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.510436][T15792] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.514722][T15792] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.519473][T15792] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.526228][T15792] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 679.538095][T15792] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 679.543339][T15792] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.550425][T15792] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 679.555884][T15792] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.560362][T15792] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 679.564915][T15792] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.569368][T15792] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 679.573924][T15792] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.580650][T15792] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 679.590010][T15792] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.593906][T15792] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.599419][T15792] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.603433][T15792] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.675704][ T76] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 679.680356][ T76] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 679.709647][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 679.713430][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 679.777042][ T39] audit: type=1400 audit(2000000493.230:883): avc: denied { setopt } for pid=15834 comm="syz.3.3318" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 679.790497][ T39] audit: type=1400 audit(2000000493.230:884): avc: denied { accept } for pid=15834 comm="syz.3.3318" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 680.846005][ T4634] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 680.868429][ T4634] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 680.875775][ T4634] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 680.916215][ T4634] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 680.964612][ T4634] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 680.968589][ T4634] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 681.259934][T15868] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 681.285449][T15868] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 681.290245][T15868] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 681.299810][T15868] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 681.693785][T15857] chnl_net:caif_netlink_parms(): no params data found [ 681.842452][T15868] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 681.847889][T15868] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 682.050510][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0c6d [ 682.074716][T15857] bridge0: port 1(bridge_slave_0) entered blocking state [ 682.083808][T15857] bridge0: port 1(bridge_slave_0) entered disabled state [ 682.087300][T15857] bridge_slave_0: entered allmulticast mode [ 682.093878][T15857] bridge_slave_0: entered promiscuous mode [ 682.113584][T15857] bridge0: port 2(bridge_slave_1) entered blocking state [ 682.125067][T15857] bridge0: port 2(bridge_slave_1) entered disabled state [ 682.128199][T15857] bridge_slave_1: entered allmulticast mode [ 682.143152][T15857] bridge_slave_1: entered promiscuous mode [ 682.276211][ T4634] Bluetooth: hci3: command tx timeout [ 682.295598][T15857] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 682.303116][T15857] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 682.679016][T15857] team0: Port device team_slave_0 added [ 682.706712][T15857] team0: Port device team_slave_1 added [ 682.900551][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 682.928797][T15857] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 682.931874][T15857] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 682.971604][T15857] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 682.997321][T15857] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 683.008786][T15857] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 683.051674][T15857] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 683.131089][ T4634] Bluetooth: hci5: command tx timeout [ 683.281118][T15857] hsr_slave_0: entered promiscuous mode [ 683.325936][T15857] hsr_slave_1: entered promiscuous mode [ 683.359980][T15857] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 683.363213][T15857] Cannot create hsr debugfs directory [ 683.390990][T15894] netlink: 2060 bytes leftover after parsing attributes in process `syz.3.3344'. [ 683.418258][T15894] netlink: 'syz.3.3344': attribute type 1 has an invalid length. [ 683.421696][T15894] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.3344'. [ 684.259056][T15857] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.564163][T15857] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.780796][T15857] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.926701][T15857] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.165173][ T4634] Bluetooth: hci5: command tx timeout [ 685.301915][T15857] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 685.374105][T15857] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 685.400032][T15857] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 685.458979][T15857] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 685.535902][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0c6d [ 685.721633][T15857] 8021q: adding VLAN 0 to HW filter on device bond0 [ 685.754097][T15857] 8021q: adding VLAN 0 to HW filter on device team0 [ 685.765078][ T5234] bridge0: port 1(bridge_slave_0) entered blocking state [ 685.777174][ T5234] bridge0: port 1(bridge_slave_0) entered forwarding state [ 685.807825][T15908] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 685.824326][ T25] bridge0: port 2(bridge_slave_1) entered blocking state [ 685.833907][ T25] bridge0: port 2(bridge_slave_1) entered forwarding state [ 685.841853][T15908] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 685.880315][T15908] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 685.904049][T15908] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 686.048006][ T1357] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.051305][ T1357] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.327301][T15857] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 686.453228][T15857] veth0_vlan: entered promiscuous mode [ 686.469609][T15857] veth1_vlan: entered promiscuous mode [ 686.482313][T15914] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 686.489614][T15914] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 686.551674][T15857] veth0_macvtap: entered promiscuous mode [ 686.590720][T15857] veth1_macvtap: entered promiscuous mode [ 686.641646][T15857] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 686.662897][T15857] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 686.671304][T15857] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 686.693294][T15857] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 686.700116][T15857] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 686.721589][T15857] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 686.728377][T15857] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 686.734389][T15857] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 686.756993][T15857] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 686.762481][T15857] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 686.769832][T15857] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 686.797657][T15857] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 686.823569][T15857] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 686.831627][T15857] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 686.848659][T15857] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 686.871606][T15857] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 686.878661][T15857] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 686.892799][T15857] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 686.904839][T15857] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 686.926461][T15857] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 686.931841][T15857] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 686.940424][T15857] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 686.952106][T15857] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.958317][T15857] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.962743][T15857] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.968057][T15857] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 687.174883][ T3953] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 687.179771][ T3953] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 687.235818][ T4634] Bluetooth: hci5: command tx timeout [ 687.253429][ T3953] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 687.257854][ T3953] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 687.376691][ T39] audit: type=1400 audit(2000000500.830:885): avc: denied { map } for pid=15915 comm="syz.0.3350" path="socket:[57330]" dev="sockfs" ino=57330 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 687.415837][ T39] audit: type=1400 audit(2000000500.860:886): avc: denied { getopt } for pid=15915 comm="syz.0.3350" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 687.993175][T15922] FAULT_INJECTION: forcing a failure. [ 687.993175][T15922] name failslab, interval 1, probability 0, space 0, times 0 [ 688.015067][T15922] CPU: 2 PID: 15922 Comm: syz.0.3351 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 688.033556][T15922] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 688.056437][T15922] Call Trace: [ 688.057742][T15922] [ 688.058933][T15922] dump_stack_lvl+0x16c/0x1f0 [ 688.060981][T15922] should_fail_ex+0x497/0x5b0 [ 688.063072][T15922] should_failslab+0x9/0x20 [ 688.066171][T15922] kmem_cache_alloc_noprof+0x6e/0x2f0 [ 688.069413][T15922] ? prepare_creds+0x2e/0x750 [ 688.072421][T15922] prepare_creds+0x2e/0x750 [ 688.075653][T15922] __sys_setreuid+0x101/0xaf0 [ 688.078536][T15922] do_syscall_64+0xcd/0x250 [ 688.081284][T15922] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.085164][T15922] RIP: 0033:0x7fcc16975bd9 [ 688.088489][T15922] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 688.100542][T15922] RSP: 002b:00007fcc177be048 EFLAGS: 00000246 ORIG_RAX: 0000000000000071 [ 688.105567][T15922] RAX: ffffffffffffffda RBX: 00007fcc16b03f60 RCX: 00007fcc16975bd9 [ 688.110798][T15922] RDX: 0000000000000000 RSI: 000000000000ee01 RDI: 0000000000000000 [ 688.115493][T15922] RBP: 00007fcc177be0a0 R08: 0000000000000000 R09: 0000000000000000 [ 688.120284][T15922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 688.125089][T15922] R13: 000000000000000b R14: 00007fcc16b03f60 R15: 00007fff1083ca88 [ 688.130222][T15922] [ 688.359657][ T4634] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 688.753015][ T5204] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 688.761333][ T5204] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 688.774802][ T5204] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 688.825954][ T5204] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 688.855530][ T5204] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 688.880066][ T5204] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 689.150756][ T25] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 689.334413][ T5204] Bluetooth: hci5: command tx timeout [ 689.385707][ T25] usb 5-1: Using ep0 maxpacket: 8 [ 689.390603][ T25] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 689.396366][ T25] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 689.428151][ T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 689.446749][ T25] usb 5-1: config 0 descriptor?? [ 689.449186][T15929] chnl_net:caif_netlink_parms(): no params data found [ 689.658275][ T25] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 689.850828][T15929] bridge0: port 1(bridge_slave_0) entered blocking state [ 689.853987][T15929] bridge0: port 1(bridge_slave_0) entered disabled state [ 689.857490][T15929] bridge_slave_0: entered allmulticast mode [ 689.876851][T15929] bridge_slave_0: entered promiscuous mode [ 689.882764][T15929] bridge0: port 2(bridge_slave_1) entered blocking state [ 689.894748][ C2] iowarrior 5-1:0.0: iowarrior_callback - usb_submit_urb failed with result -19 [ 689.900468][T15929] bridge0: port 2(bridge_slave_1) entered disabled state [ 689.937227][T15929] bridge_slave_1: entered allmulticast mode [ 689.942305][T15929] bridge_slave_1: entered promiscuous mode [ 689.949798][ T25] usb 5-1: USB disconnect, device number 81 [ 689.984381][ T25] iowarrior 5-1:0.0: I/O-Warror #0 now disconnected [ 690.176768][T15929] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 690.206263][T15929] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 690.462874][T15929] team0: Port device team_slave_0 added [ 690.479404][T15929] team0: Port device team_slave_1 added [ 690.646636][T15944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 690.652436][T15944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 690.664863][T15929] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 690.725778][T15944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 690.725809][T15929] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 690.781272][T15944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 690.784622][T15929] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 690.805351][T15929] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 690.810859][T15929] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 690.874614][T15929] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 690.916123][ T39] audit: type=1400 audit(2000000504.370:887): avc: denied { write } for pid=15945 comm="syz.0.3358" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 690.956556][ T5204] Bluetooth: hci6: command tx timeout [ 691.048304][ T39] audit: type=1400 audit(2000000504.500:888): avc: denied { read } for pid=15949 comm="syz.0.3359" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 691.311661][T15944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 691.318377][T15929] hsr_slave_0: entered promiscuous mode [ 691.377942][T15929] hsr_slave_1: entered promiscuous mode [ 691.383995][T15929] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 691.385831][T15944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 691.388704][T15929] Cannot create hsr debugfs directory [ 691.570985][T15954] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 691.909415][T15929] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.268899][T15929] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.578981][T15929] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.770990][T15929] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.783319][T15964] netlink: 2060 bytes leftover after parsing attributes in process `syz.0.3362'. [ 692.805944][T15964] netlink: 'syz.0.3362': attribute type 1 has an invalid length. [ 692.822409][T15964] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.3362'. [ 692.996356][ T5204] Bluetooth: hci6: command tx timeout [ 693.187197][T15929] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 693.235227][T15929] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 693.247785][T15929] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 693.285586][T15929] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 693.393865][ T4634] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 693.394905][T15974] FAULT_INJECTION: forcing a failure. [ 693.394905][T15974] name failslab, interval 1, probability 0, space 0, times 0 [ 693.421607][T15974] CPU: 0 PID: 15974 Comm: syz.2.3366 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 693.430834][ T4634] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 693.451958][T15974] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 693.451981][T15974] Call Trace: [ 693.451990][T15974] [ 693.451998][T15974] dump_stack_lvl+0x16c/0x1f0 [ 693.452027][T15974] should_fail_ex+0x497/0x5b0 [ 693.452050][T15974] should_failslab+0x9/0x20 [ 693.452074][T15974] __kmalloc_node_noprof+0xd5/0x440 [ 693.452090][T15974] ? kvmalloc_node_noprof+0x9d/0x1a0 [ 693.452114][T15974] kvmalloc_node_noprof+0x9d/0x1a0 [ 693.452137][T15974] bpf_check+0xb9d/0xa210 [ 693.452158][T15974] ? __sys_bpf+0x8e9/0x49a0 [ 693.452175][T15974] ? __x64_sys_bpf+0x78/0xc0 [ 693.452192][T15974] ? do_syscall_64+0xcd/0x250 [ 693.452215][T15974] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.452245][T15974] ? __pfx_bpf_check+0x10/0x10 [ 693.452268][T15974] ? kasan_save_track+0x14/0x30 [ 693.452293][T15974] ? __kasan_kmalloc+0xaa/0xb0 [ 693.452317][T15974] ? selinux_bpf_prog_load+0x15f/0x1c0 [ 693.452340][T15974] bpf_prog_load+0xedb/0x2660 [ 693.452358][T15974] ? __pfx_bpf_prog_load+0x10/0x10 [ 693.452376][T15974] ? avc_has_perm+0x11b/0x1c0 [ 693.452401][T15974] ? selinux_bpf+0xde/0x130 [ 693.452420][T15974] ? security_bpf+0x8c/0xc0 [ 693.452448][T15974] __sys_bpf+0x8e9/0x49a0 [ 693.452464][T15974] ? ksys_write+0x21c/0x260 [ 693.452488][T15974] ? reacquire_held_locks+0x440/0x4c0 [ 693.452514][T15974] ? __pfx___sys_bpf+0x10/0x10 [ 693.452531][T15974] ? vfs_write+0x14d/0x1140 [ 693.452554][T15974] ? __mutex_unlock_slowpath+0x164/0x650 [ 693.452580][T15974] ? fput+0x32/0x390 [ 693.452604][T15974] ? ksys_write+0x1ab/0x260 [ 693.452626][T15974] ? __pfx_ksys_write+0x10/0x10 [ 693.452650][T15974] __x64_sys_bpf+0x78/0xc0 [ 693.452669][T15974] ? lockdep_hardirqs_on+0x7c/0x110 [ 693.452691][T15974] do_syscall_64+0xcd/0x250 [ 693.452714][T15974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.452742][T15974] RIP: 0033:0x7f76f3d75bd9 [ 693.452757][T15974] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 693.452776][T15974] RSP: 002b:00007f76f4c2a048 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 693.452796][T15974] RAX: ffffffffffffffda RBX: 00007f76f3f03f60 RCX: 00007f76f3d75bd9 [ 693.452809][T15974] RDX: 0000000000000037 RSI: 0000000020000340 RDI: 0000000000000005 [ 693.452822][T15974] RBP: 00007f76f4c2a0a0 R08: 0000000000000000 R09: 0000000000000000 [ 693.452834][T15974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 693.452846][T15974] R13: 000000000000000b R14: 00007f76f3f03f60 R15: 00007ffcedf8dd58 [ 693.452860][T15974] [ 693.596993][T15929] 8021q: adding VLAN 0 to HW filter on device bond0 [ 693.649289][T15929] 8021q: adding VLAN 0 to HW filter on device team0 [ 693.658254][ T4634] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 693.672460][T14757] bridge0: port 1(bridge_slave_0) entered blocking state [ 693.711189][ T4634] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 693.713488][T14757] bridge0: port 1(bridge_slave_0) entered forwarding state [ 693.733839][ T4634] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 693.805576][T14757] bridge0: port 2(bridge_slave_1) entered blocking state [ 693.818070][ T4634] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 693.880009][T14757] bridge0: port 2(bridge_slave_1) entered forwarding state [ 694.487183][T15981] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 694.506655][T15981] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 694.530406][T15981] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 694.558272][T15981] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 694.704914][T15929] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 694.769854][T15972] chnl_net:caif_netlink_parms(): no params data found [ 695.055931][T15929] veth0_vlan: entered promiscuous mode [ 695.076064][ T5204] Bluetooth: hci6: command tx timeout [ 695.210764][T15981] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 695.215561][T15981] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 695.228828][T15929] veth1_vlan: entered promiscuous mode [ 695.234930][T15972] bridge0: port 1(bridge_slave_0) entered blocking state [ 695.242531][T15972] bridge0: port 1(bridge_slave_0) entered disabled state [ 695.254727][T15972] bridge_slave_0: entered allmulticast mode [ 695.263652][T15972] bridge_slave_0: entered promiscuous mode [ 695.286746][T15972] bridge0: port 2(bridge_slave_1) entered blocking state [ 695.294406][T15972] bridge0: port 2(bridge_slave_1) entered disabled state [ 695.316957][T15972] bridge_slave_1: entered allmulticast mode [ 695.321383][T15972] bridge_slave_1: entered promiscuous mode [ 695.681752][T15972] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 695.733430][T15972] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 695.944081][T15929] veth0_macvtap: entered promiscuous mode [ 695.964836][T15972] team0: Port device team_slave_0 added [ 695.971455][ T5204] Bluetooth: hci7: command tx timeout [ 695.998618][T15929] veth1_macvtap: entered promiscuous mode [ 696.013293][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 696.055188][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.061055][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 696.070257][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.114146][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 696.136235][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.142624][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 696.155397][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.173923][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 696.197433][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.203761][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 696.211143][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.242575][T15992] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 696.250233][T15992] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 696.264061][T15992] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 696.270190][T15929] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 696.315812][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 696.328632][T15993] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 696.332453][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.332489][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 696.332504][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.332522][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 696.332534][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.332552][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 696.332564][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.332582][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 696.332594][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.332610][T15929] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 696.332621][T15929] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.334500][T15929] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 696.343229][T15972] team0: Port device team_slave_1 added [ 696.711579][T15929] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.725142][T15929] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.749737][T15929] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.758862][T15929] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.893329][T15972] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 696.896773][T15972] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 696.928842][T15972] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 696.960937][T15972] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 696.978332][T15972] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 697.030351][T15972] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 697.113299][T15992] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 697.138808][T15992] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 697.155617][ T5204] Bluetooth: hci6: command tx timeout [ 697.409670][T15972] hsr_slave_0: entered promiscuous mode [ 697.440136][T15972] hsr_slave_1: entered promiscuous mode [ 697.443804][T15972] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 697.461390][T15972] Cannot create hsr debugfs directory [ 697.744702][ T3979] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 697.766043][ T3979] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 698.039523][ T5204] Bluetooth: hci7: command tx timeout [ 698.101354][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 698.150020][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 698.399274][T15972] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.765557][T15972] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.988188][T15972] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.049099][T16013] netlink: 2060 bytes leftover after parsing attributes in process `syz.1.3373'. [ 699.053707][T16013] netlink: 'syz.1.3373': attribute type 1 has an invalid length. [ 699.058402][T16013] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.3373'. [ 699.214015][T15972] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.673099][T15972] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 699.703304][T15972] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 699.726831][T15972] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 699.774577][T15972] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 700.043089][T15972] 8021q: adding VLAN 0 to HW filter on device bond0 [ 700.102577][T15972] 8021q: adding VLAN 0 to HW filter on device team0 [ 700.119092][ T5204] Bluetooth: hci7: command tx timeout [ 700.167353][T13908] bridge0: port 1(bridge_slave_0) entered blocking state [ 700.174199][T13908] bridge0: port 1(bridge_slave_0) entered forwarding state [ 700.227663][T13908] bridge0: port 2(bridge_slave_1) entered blocking state [ 700.232869][T13908] bridge0: port 2(bridge_slave_1) entered forwarding state [ 700.832370][T15972] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 700.953279][T15972] veth0_vlan: entered promiscuous mode [ 700.986935][T15972] veth1_vlan: entered promiscuous mode [ 701.128064][T15972] veth0_macvtap: entered promiscuous mode [ 701.154904][T15972] veth1_macvtap: entered promiscuous mode [ 701.209768][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 701.226632][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.239630][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 701.252332][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.270151][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 701.292217][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.298017][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 701.312211][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.320926][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 701.329813][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.336422][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 701.344863][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.352286][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 701.362218][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.372833][T15972] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 701.392274][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 701.415239][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.419614][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 701.424563][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.428466][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 701.432640][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.464525][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 701.472561][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.485525][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 701.512876][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.529672][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 701.538346][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.557105][T15972] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 701.569851][T15972] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 701.597417][T15972] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 701.640080][T15972] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.643475][T15972] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.647153][T15972] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.663424][T15972] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.857477][ T3979] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 701.861556][ T3979] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 701.943753][ T3979] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 701.973686][ T3979] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 702.205303][ T5204] Bluetooth: hci7: command tx timeout [ 702.470832][ T5233] usb 8-1: new high-speed USB device number 83 using dummy_hcd [ 702.658222][ T5233] usb 8-1: Using ep0 maxpacket: 8 [ 702.680333][ T5233] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 702.688252][ T5233] usb 8-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 702.702191][ T5233] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 702.743140][ T5233] usb 8-1: config 0 descriptor?? [ 702.972187][ T5233] iowarrior 8-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 703.175271][ C2] iowarrior 8-1:0.0: iowarrior_callback - usb_submit_urb failed with result -19 [ 703.183619][ T25] usb 8-1: USB disconnect, device number 83 [ 703.223449][ T25] iowarrior 8-1:0.0: I/O-Warror #0 now disconnected [ 703.629135][ T4634] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 703.643477][ T4634] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 703.669127][ T4634] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 703.737977][ T4634] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 703.754167][ T4634] Bluetooth: hci8: unexpected cc 0x0c25 length: 249 > 3 [ 703.763138][ T4634] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 704.098921][T16028] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 704.114722][T16028] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 704.132434][T16028] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 704.146228][T16028] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 704.329195][T16024] chnl_net:caif_netlink_parms(): no params data found [ 704.360190][T16028] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 704.384362][T16028] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 704.801255][T16024] bridge0: port 1(bridge_slave_0) entered blocking state [ 704.809910][T16024] bridge0: port 1(bridge_slave_0) entered disabled state [ 704.825201][T16024] bridge_slave_0: entered allmulticast mode [ 704.830080][T16024] bridge_slave_0: entered promiscuous mode [ 704.847397][T16024] bridge0: port 2(bridge_slave_1) entered blocking state [ 704.862904][T16024] bridge0: port 2(bridge_slave_1) entered disabled state [ 704.875793][T16024] bridge_slave_1: entered allmulticast mode [ 704.882874][T16024] bridge_slave_1: entered promiscuous mode [ 705.123570][T16024] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 705.166016][T16024] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 705.537931][T16024] team0: Port device team_slave_0 added [ 705.546240][T16024] team0: Port device team_slave_1 added [ 705.675625][T16038] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 705.697680][T16024] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 705.697977][T16038] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 705.715068][T16024] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 705.715101][T16024] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 705.724812][T16024] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 705.747246][T16038] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 705.762813][T16024] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 705.798821][T16038] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 705.813929][T16024] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 705.894664][ T4634] Bluetooth: hci8: command tx timeout [ 705.980977][T15642] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 706.033549][T15694] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 706.240394][T15822] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 706.331472][T15891] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 706.369524][T16024] hsr_slave_0: entered promiscuous mode [ 706.385160][T15960] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 706.512628][T16024] hsr_slave_1: entered promiscuous mode [ 706.529851][T16009] ================================================================== [ 706.534965][T16009] BUG: KASAN: slab-use-after-free in skb_queue_purge_reason+0x37b/0x410 [ 706.540197][T16009] Read of size 8 at addr ffff888107741058 by task syz.1.3373/16009 [ 706.546996][T16009] [ 706.548809][T16009] CPU: 0 PID: 16009 Comm: syz.1.3373 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 706.553222][T16009] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 706.564550][T16009] Call Trace: [ 706.567161][T16009] [ 706.583861][T16009] dump_stack_lvl+0x116/0x1f0 [ 706.587207][T16009] print_report+0xc3/0x620 [ 706.590203][T16009] ? __virt_addr_valid+0x5e/0x580 [ 706.593172][T16009] ? __phys_addr+0xc6/0x150 SYZFAIL: failed to recv rpc fd=3 want=4 sent=0 n=0 (errno 9: Bad file descriptor) [ 706.595638][T16009] kasan_report+0xd9/0x110 [ 706.613271][T16009] ? skb_queue_purge_reason+0x37b/0x410 [ 706.615762][T16009] ? skb_queue_purge_reason+0x37b/0x410 [ 706.618247][T16009] skb_queue_purge_reason+0x37b/0x410 [ 706.625299][T16009] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 706.631645][T16009] ? lockdep_hardirqs_on+0x7c/0x110 [ 706.635930][T16009] ? drain_workqueue+0x309/0x3d0 [ 706.639348][T16009] ? hci_inquiry_cache_flush+0x176/0x2f0 [ 706.642294][T16009] ? __pfx_vhci_flush+0x10/0x10 [ 706.645957][T16009] vhci_flush+0x40/0x50 [ 706.658154][T16009] hci_dev_reset+0x22e/0x530 [ 706.661460][T16009] hci_sock_ioctl+0x3d2/0x880 [ 706.675557][T16009] ? __pfx_hci_sock_ioctl+0x10/0x10 [ 706.676009][ T39] audit: type=1400 audit(2000000520.010:889): avc: denied { write } for pid=5184 comm="syz-executor" path="pipe:[5523]" dev="pipefs" ino=5523 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 706.678725][T16009] sock_do_ioctl+0x116/0x280 [ 706.705142][T16040] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 706.714808][T16040] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 706.728262][T16009] ? __pfx_sock_do_ioctl+0x10/0x10 [ 706.728301][T16009] ? ioctl_has_perm.constprop.0.isra.0+0x2f9/0x470 [ 706.728325][T16009] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 706.728374][T16009] sock_ioctl+0x22e/0x6c0 [ 706.728393][T16009] ? __pfx_sock_ioctl+0x10/0x10 [ 706.728414][T16009] ? selinux_file_ioctl+0x180/0x270 [ 706.728433][T16009] ? selinux_file_ioctl+0xb4/0x270 [ 706.728454][T16009] ? __pfx_sock_ioctl+0x10/0x10 [ 706.728474][T16009] __x64_sys_ioctl+0x193/0x220 [ 706.728499][T16009] do_syscall_64+0xcd/0x250 [ 706.728526][T16009] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.728556][T16009] RIP: 0033:0x7f7170b75bd9 [ 706.728572][T16009] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 706.728591][T16009] RSP: 002b:00007f71718e8048 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 706.728611][T16009] RAX: ffffffffffffffda RBX: 00007f7170d04038 RCX: 00007f7170b75bd9 [ 706.728623][T16009] RDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000007 [ 706.728636][T16009] RBP: 00007f7170be4aa1 R08: 0000000000000000 R09: 0000000000000000 [ 706.728648][T16009] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 706.728661][T16009] R13: 000000000000006e R14: 00007f7170d04038 R15: 00007ffc94f70748 [ 706.728677][T16009] [ 706.728685][T16009] [ 706.728689][T16009] Allocated by task 15407: [ 706.728699][T16009] kasan_save_stack+0x33/0x60 [ 706.728724][T16009] kasan_save_track+0x14/0x30 [ 706.728747][T16009] __kasan_kmalloc+0xaa/0xb0 [ 706.728769][T16009] vhci_open+0x4c/0x440 [ 706.728786][T16009] misc_open+0x3da/0x4c0 [ 706.728812][T16009] chrdev_open+0x26d/0x6f0 [ 706.728837][T16009] do_dentry_open+0x91f/0x15f0 [ 706.728860][T16009] vfs_open+0x82/0x3f0 [ 706.728877][T16009] path_openat+0x21fc/0x2e50 [ 706.728901][T16009] do_filp_open+0x1dc/0x430 [ 706.728925][T16009] do_sys_openat2+0x17a/0x1e0 [ 706.728941][T16009] __x64_sys_openat+0x175/0x210 [ 706.728959][T16009] do_syscall_64+0xcd/0x250 [ 706.728981][T16009] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.729009][T16009] [ 706.729013][T16009] Freed by task 15642: [ 706.729021][T16009] kasan_save_stack+0x33/0x60 [ 706.729044][T16009] kasan_save_track+0x14/0x30 [ 706.729067][T16009] kasan_save_free_info+0x3b/0x60 [ 706.729087][T16009] poison_slab_object+0xf7/0x160 [ 706.729110][T16009] __kasan_slab_free+0x32/0x50 [ 706.729135][T16009] kfree+0x12a/0x3b0 [ 706.729158][T16009] vhci_release+0xc4/0x100 [ 706.729172][T16009] __fput+0x408/0xbb0 [ 706.729188][T16009] task_work_run+0x14e/0x250 [ 706.729204][T16009] do_exit+0xa9b/0x2ba0 [ 706.729228][T16009] do_group_exit+0xd3/0x2a0 [ 706.729251][T16009] get_signal+0x2616/0x2710 [ 706.729269][T16009] arch_do_signal_or_restart+0x90/0x7e0 [ 706.729290][T16009] syscall_exit_to_user_mode+0x14a/0x2a0 [ 706.729313][T16009] do_syscall_64+0xda/0x250 [ 706.729335][T16009] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.729370][T16009] [ 706.729375][T16009] The buggy address belongs to the object at ffff888107741000 [ 706.729375][T16009] which belongs to the cache kmalloc-1k of size 1024 [ 706.729390][T16009] The buggy address is located 88 bytes inside of [ 706.729390][T16009] freed 1024-byte region [ffff888107741000, ffff888107741400) [ 706.729410][T16009] [ 706.729414][T16009] The buggy address belongs to the physical page: [ 706.729422][T16009] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888107747000 pfn:0x107740 [ 706.729441][T16009] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 706.729458][T16009] flags: 0x57ff00000000240(workingset|head|node=1|zone=2|lastcpupid=0x7ff) [ 706.729477][T16009] page_type: 0xffffefff(slab) [ 706.729494][T16009] raw: 057ff00000000240 ffff888015442dc0 ffffea000411b610 ffffea00041d5c10 [ 706.729511][T16009] raw: ffff888107747000 000000000010000b 00000001ffffefff 0000000000000000 [ 706.729529][T16009] head: 057ff00000000240 ffff888015442dc0 ffffea000411b610 ffffea00041d5c10 [ 706.729546][T16009] head: ffff888107747000 000000000010000b 00000001ffffefff 0000000000000000 [ 706.729563][T16009] head: 057ff00000000003 ffffea00041dd001 ffffffffffffffff 0000000000000000 [ 706.729581][T16009] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 706.729591][T16009] page dumped because: kasan: bad access detected [ 706.729601][T16009] page_owner tracks the page as allocated [ 706.729607][T16009] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x352800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 5200, tgid 5200 (syz-executor), ts 59708471427, free_ts 0 [ 706.729640][T16009] post_alloc_hook+0x2d1/0x350 [ 706.729662][T16009] get_page_from_freelist+0x1353/0x2e50 [ 706.729685][T16009] __alloc_pages_noprof+0x22b/0x2460 [ 706.729706][T16009] alloc_slab_page+0x56/0x110 [ 706.729728][T16009] new_slab+0x84/0x260 [ 706.729753][T16009] ___slab_alloc+0xdac/0x1870 [ 706.729778][T16009] __slab_alloc.constprop.0+0x56/0xb0 [ 706.729803][T16009] kmalloc_node_trace_noprof+0xf1/0x350 [ 706.729829][T16009] alloc_fair_sched_group+0x1e6/0x450 [ 706.729852][T16009] sched_create_group+0x2d/0x80 [ 706.729870][T16009] cpu_cgroup_css_alloc+0x15/0x30 [ 706.729887][T16009] cgroup_apply_control_enable+0x4b6/0xc80 [ 706.729915][T16009] cgroup_mkdir+0x39b/0x1120 [ 706.729933][T16009] kernfs_iop_mkdir+0x14a/0x1d0 [ 706.729951][T16009] vfs_mkdir+0x57d/0x860 [ 706.729970][T16009] do_mkdirat+0x301/0x3a0 [ 706.729993][T16009] page_owner free stack trace missing [ 706.730000][T16009] [ 706.730004][T16009] Memory state around the buggy address: [ 706.730014][T16009] ffff888107740f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 706.730026][T16009] ffff888107740f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 706.730038][T16009] >ffff888107741000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 706.730049][T16009] ^ [ 706.730059][T16009] ffff888107741080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 706.730073][T16009] ffff888107741100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 706.730084][T16009] ================================================================== [ 706.776418][T16009] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 706.776436][T16009] CPU: 1 PID: 16009 Comm: syz.1.3373 Not tainted 6.10.0-rc6-syzkaller-00067-g8a9c6c40432e #0 [ 706.776460][T16009] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 706.776473][T16009] Call Trace: [ 706.776483][T16009] [ 706.776491][T16009] dump_stack_lvl+0x3d/0x1f0 [ 706.776521][T16009] panic+0x6f5/0x7a0 [ 706.776551][T16009] ? __pfx_panic+0x10/0x10 [ 706.776577][T16009] ? irqentry_exit+0x3b/0x90 [ 706.776602][T16009] ? lockdep_hardirqs_on+0x7c/0x110 [ 706.776636][T16009] ? preempt_schedule_thunk+0x1a/0x30 [ 706.776658][T16009] ? preempt_schedule_common+0x44/0xc0 [ 706.776685][T16009] check_panic_on_warn+0xab/0xb0 [ 706.776721][T16009] end_report+0x117/0x180 [ 706.776756][T16009] kasan_report+0xe9/0x110 [ 706.776789][T16009] ? skb_queue_purge_reason+0x37b/0x410 [ 706.776824][T16009] ? skb_queue_purge_reason+0x37b/0x410 [ 706.776860][T16009] skb_queue_purge_reason+0x37b/0x410 [ 706.776896][T16009] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 706.776933][T16009] ? lockdep_hardirqs_on+0x7c/0x110 [ 706.776959][T16009] ? drain_workqueue+0x309/0x3d0 [ 706.776978][T16009] ? hci_inquiry_cache_flush+0x176/0x2f0 [ 706.777007][T16009] ? __pfx_vhci_flush+0x10/0x10 [ 706.777028][T16009] vhci_flush+0x40/0x50 [ 706.777049][T16009] hci_dev_reset+0x22e/0x530 [ 706.777079][T16009] hci_sock_ioctl+0x3d2/0x880 [ 706.777104][T16009] ? __pfx_hci_sock_ioctl+0x10/0x10 [ 706.777129][T16009] sock_do_ioctl+0x116/0x280 [ 706.777149][T16009] ? __pfx_sock_do_ioctl+0x10/0x10 [ 706.777168][T16009] ? ioctl_has_perm.constprop.0.isra.0+0x2f9/0x470 [ 706.777196][T16009] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 706.777225][T16009] sock_ioctl+0x22e/0x6c0 [ 706.777247][T16009] ? __pfx_sock_ioctl+0x10/0x10 [ 706.777270][T16009] ? selinux_file_ioctl+0x180/0x270 [ 706.777295][T16009] ? selinux_file_ioctl+0xb4/0x270 [ 706.777321][T16009] ? __pfx_sock_ioctl+0x10/0x10 [ 706.777343][T16009] __x64_sys_ioctl+0x193/0x220 [ 706.777368][T16009] do_syscall_64+0xcd/0x250 [ 706.777397][T16009] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.777430][T16009] RIP: 0033:0x7f7170b75bd9 [ 706.777447][T16009] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 706.777467][T16009] RSP: 002b:00007f71718e8048 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 706.777490][T16009] RAX: ffffffffffffffda RBX: 00007f7170d04038 RCX: 00007f7170b75bd9 [ 706.777504][T16009] RDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000007 [ 706.777518][T16009] RBP: 00007f7170be4aa1 R08: 0000000000000000 R09: 0000000000000000 [ 706.777533][T16009] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 706.777547][T16009] R13: 000000000000006e R14: 00007f7170d04038 R15: 00007ffc94f70748 [ 706.777564][T16009] [ 706.791899][T16009] Kernel Offset: disabled VM DIAGNOSIS: 04:09:17 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000073 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff84fd29b5 RDI=ffffffff94dd91a0 RBP=ffffffff94dd9160 RSP=ffffc90003897580 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3031383838666666 R12=0000000000000000 R13=0000000000000073 R14=ffffffff84fd2950 R15=0000000000000000 RIP=ffffffff84fd29df RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f71718e86c0 ffffffff 00c00000 GS =0000 ffff88806b000000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000001b322e4ff8 CR3=0000000058dd6000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000004080 Opmask01=0000000000000000 Opmask02=00000000ffbfef77 Opmask03=2040000404420020 Opmask04=00000000ffdfffff Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd7d896450 0000003000000010 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 6464646464646464 6464646464646464 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000000000ff00 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000000ff ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000ffffffff ffffff000000ff00 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffff0000 ffffffffffffffff ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 8e8a41d515d3e6c8 7373253de4db0bc1 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 73737373737372a2 7373737373737373 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 656e696c5f706c63 73002a5d392d305b 79747400786d7470 0079747400646461 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 54003d534b4e494c 564544003d4d4554 535953425553003d 4854415056454400 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 540018534b4e494c 56454400184d4554 5359534255530018 4854415056454400 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000038336c6c 696b66722f306963 682f68746f6f7465 756c622f6c617574 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd7d895fe0 0000000000000000 00007ffd7d00312d ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1f77ff2260 00007f1f77ff2260 00000000000098c1 0000003177617264 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 69305f474f5b647c 6930382432273f39 7b27697a787c7a30 23333a3a38263342 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 692054524f50202c 2064696c61696d20 0070253a20252054 524f504d49005452 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 692020520050202c 2025204f504d4900 0061253a20252000 2527204d49005452 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 282b2e2fdf37342d 280bbfbf23243324 26312033fc040f18 1317140d080b0412 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343133bffc121104 1214041204110814 100411bffc040f18 1317140d080b0412 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020 info registers vcpu 1 CPU#1 RAX=ffffc90004760000 RBX=ffff8880233f0000 RCX=ffffffff816f97b1 RDX=1ffff1100467e22d RSI=ffffffff8633b28f RDI=0000000000000016 RBP=0000000000000080 RSP=ffffc900008b0eb8 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000004 R12=0000000000000000 R13=dffffc0000000000 R14=ffff8880233f1168 R15=0000000000000000 RIP=ffffffff8633b2b7 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88806b100000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000020032000 CR3=0000000058dd6000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=000000000001c0d0 Opmask01=00000000001ffffe Opmask02=00000000003fffff Opmask03=2040000404420020 Opmask04=00000000ffdfffff Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000564bf316ff00 0000564bf314f840 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000ff0000000000 00000000ff000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000ff000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffff0000 ffffffffffffffff ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 8e8a41d515d3e6c8 7373253de4db0bc1 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 73737373737372a2 7373737373737373 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000021 0000000000000000 44455a494c414954 494e495f43455355 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6f6f742079617272 61207465756c622f 6c6175747269762f 736563697665642f ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4a4a51055c445757 440540495057055c 5744574a55484051 000f1a005b1a0f00 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000021 0000000000000040 000000003130323a 386963682f386963 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000001e1 00000030726f6972 7261776f692f6373 696d6273752f302e ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1f77ff2260 00007f1f77ff2260 00000000000098c1 0000003177617264 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 69305f474f5b647c 6930382432273f39 7b27697a787c7a30 23333a3a38263342 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 692054524f50202c 2064696c61696d20 0070253a20252054 524f504d49005452 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 692020520050202c 2025204f504d4900 0061253a20252000 2527204d49005452 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 282b2e2fdf37342d 280bbfbf23243324 26312033fc040f18 1317140d080b0412 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343133bffc121104 1214041204110814 100411bffc040f18 1317140d080b0412 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020 info registers vcpu 2 CPU#2 RAX=1ffffffff2886197 RBX=ffffffff9448df48 RCX=1ffffffff2724ec4 RDX=00000000000003fd RSI=1ffffffff27250a6 RDI=ffffffff94430ce8 RBP=ffffffff944109d8 RSP=ffffc900033df060 R8 =0000000000000000 R9 =ffffffff94274488 R10=00000000000000b9 R11=000000000000029a R12=ffffffff816ad3a0 R13=ffffffff944109f8 R14=dffffc0000000000 R15=ffffffff944109c8 RIP=ffffffff816b2238 RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88806b200000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007eff5715b740 CR3=000000002a5cc000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=000000000008c0d0 Opmask01=0000000000000000 Opmask02=000000007fffffff Opmask03=2040000404420020 Opmask04=00000000ffdfffff Opmask05=00000000004007ff Opmask06=0000000007ffe7ff Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000564bf315e1d0 0000564bf317baa0 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00ff000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00ff000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffff0000 ffffffffffffffff ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 8e8a41d515d3e6c8 7373253de4db0bc1 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 73737373737372a2 7373737373737373 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 30706f0030706f6f 6c2f6b636f6c6200 44455a494c414954 494e495f43455355 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6f306963682f6874 6f6f7465756c622f 6c6175747269762f 736563697665642f ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4a4a51055c445757 440540495057055c 5744574a55484051 000f1a005b1a0f00 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000000c1 0000000000306963 682f68746f6f7465 756c622f6c617574 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000001e1 00000030726f6972 7261776f692f6373 696d6273752f302e ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f1f77ff2260 00007f1f77ff2260 00000000000098c1 0000003177617264 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 69305f474f5b647c 6930382432273f39 7b27697a787c7a30 23333a3a38263342 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 692054524f50202c 2064696c61696d20 0070253a20252054 524f504d49005452 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 692020520050202c 2025204f504d4900 0061253a20252000 2527204d49005452 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 282b2e2fdf37342d 280bbfbf23243324 26312033fc040f18 1317140d080b0412 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 343133bffc121104 1214041204110814 100411bffc040f18 1317140d080b0412 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4141414141414141 4141414141414141 4141414141414141 4141414141414141 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a 1a1a1a1a1a1a1a1a ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2020202020202020 2020202020202020 2020202020202020 2020202020202020 info registers vcpu 3 CPU#3 RAX=0000000000000198 RBX=00007eff55c06888 RCX=00007eff55c058e0 RDX=ffffffff81589713 RSI=00000000000000cb RDI=00007eff55c04c20 RBP=0000000000000001 RSP=00007ffe279a2b90 R8 =0000000000000000 R9 =ffffffff8157e0ef R10=00007eff55c05278 R11=00000000000001c6 R12=00007eff55c04c20 R13=0000000000000000 R14=00007eff55c01008 R15=00007eff57304038 RIP=00007eff5704c5a6 RFL=00000216 [----AP-] CPL=3 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 000fffff 00000000 CS =0033 0000000000000000 ffffffff 00a0fb00 DPL=3 CS64 [-RA] SS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] DS =0000 0000000000000000 000fffff 00000000 FS =0000 0000555561d66500 000fffff 00000000 GS =0000 0000000000000000 000fffff 00000000 LDT=0000 0000000000000000 000fffff 00000000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000001b322e3ff8 CR3=000000001af1e000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000040001 Opmask01=0000000000000000 Opmask02=0000000000000fff Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffff8a5cc86c ffffffff8a5cc86c ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffff8a5cc86c ffffffff8a5cc86c ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 ffffffff8a5cc86c ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007eff571e4325 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007eff571e4332 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007eff571e432c ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007eff571e4340 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007eff571e43c6 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007eff571e44a4 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007eff572d4488 00007eff572d4480 00007eff572d4478 00007eff572d4450 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007eff57e3d100 00007eff572d4440 00007eff00040008 0000000f0010000c ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007eff572d4498 00007eff572d4490 00007eff572d4488 00007eff572d4480 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0a00000000000000 0000000000010011 0000001400000000 307a797300010009 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000079786f72 706e79730001000d 8001001480040018 00000080400b0008 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0900000100000000 0000000004010a06 0000004000000000 327a797300030009 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000307a7973 0001000902000001 0000000000000000 02010a030000002c ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000