last executing test programs: 3m22.951173027s ago: executing program 2 (id=1186): r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) r1 = openat$comedi(0xffffffffffffff9c, 0x0, 0x20000, 0x0) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="440f20c0350b000000440f22c0360f09c4217d700c9d0000000028b8010000000f01c166b82e000f00d80f20d835080000000f22d82e0f019885000000b9b1060000b86f8d0000ba0000000066b8b5008ec036363ef3420f51a600000000b9e30b0000b8f233278fba000000000f30", 0x6f}], 0x1, 0x11, 0x0, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) close_range(r3, r1, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x800) r5 = epoll_create1(0x0) shutdown(0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, 0xffffffffffffffff, &(0x7f0000000140)={0x2000200b}) ioctl$EVIOCGKEYCODE_V2(r4, 0x80284504, &(0x7f0000000140)=""/210) 3m21.655583203s ago: executing program 2 (id=1198): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000004c0)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$full(0xffffff9c, 0x0, 0x214000, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x10a942, 0x9f667fd378a54ed4) write$P9_RREADLINK(r2, &(0x7f0000000040)={0x10, 0x17, 0x2, {0xffffffffffffffc1, './file0'}}, 0xfffffdab) socket(0x1e, 0x4, 0x0) syz_io_uring_setup(0x110, 0x0, &(0x7f0000000040)=0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x0, 0xc3) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x80, &(0x7f0000000200)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000240)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file1\x00', 0x208142, 0x1ce) r4 = socket$inet_tcp(0x2, 0x1, 0x0) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0xf000, 0x3, &(0x7f0000009000/0xf000)=nil) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e21, @loopback}}, 0x0, 0x0, 0x24, 0x0, "e83ae75240d9d6d8ec87bb53fab0910000000000000007a5922406b64cddaeb9d339ba3c35dc0208df8e61740b7cf2d4e499d586ed9fcf0fa0ce1f930c3079cffcfd0000000000db7291f100"}, 0xd8) syz_emit_ethernet(0x4a, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa4386dd600a3ff200140600fe8000000000000000000000000000bbfe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRESDEC=r3, @ANYBLOB="2f95000090780000"], 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000100)=0x6) 3m20.194583182s ago: executing program 2 (id=1202): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sched_setscheduler(0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000003"], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x161d02) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0x100000f}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x2, 0x20}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) setgroups(0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000200)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) gettid() timer_create(0x5, &(0x7f00000003c0)={0x0, 0xa1, 0x2, @thr={&(0x7f0000000340)="ad", &(0x7f0000000400)="05a7a4e71b95cd8d2c1a62c2d48c60ee6d2f62c0a2909ba1470ded00a37eaf430944d487fa30b47416d2a54ac75b"}}, &(0x7f0000000300)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xa, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3m18.564061419s ago: executing program 2 (id=1210): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240), 0x48100, 0x0) ioctl$TIOCSETD(r2, 0x5423, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000040)=0xfe) r3 = openat$userio(0xffffff9c, &(0x7f0000000000), 0x200000, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r3, &(0x7f0000000100)={0x1, 0x5}, 0x2) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x40440, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x4000000) ioctl$int_in(r4, 0x5452, &(0x7f0000000180)=0x3) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x123202, 0x0) ioctl$TIOCVHANGUP(r4, 0x5437, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1f, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000001000000000000000000000085000000a8000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000001040), 0x2, 0x0) r8 = eventfd(0xfffffff9) ioctl$VHOST_SET_VRING_KICK(r7, 0x4008af20, &(0x7f0000000400)={0x1, r8}) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6}, 0xc) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9eaafdc0a00e9bfde908990817b364e51afe9c81a97f0570759f1cae63487ff68fffffffffffe8e3932e2b7185a25a4cf8a9456aa8a701c318c67edb6e9330b53c0eeba8644311ba75411890700000000000000d8e5b1dc91c5499bea0977"], &(0x7f0000000000)='GPL\x00', 0x5, 0x487, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r9, 0x0, 0xd00, 0x0, &(0x7f0000000380)="263abd030e98ff4dc870bd6688a8640888a8", 0x0, 0x1200, 0x60000000}, 0x28) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000200)=0x7e) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NET_GET(r10, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000340)={0x0}}, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB, @ANYRES32=r11, @ANYBLOB="0a00340002020202020200000800"], 0x38}}, 0x0) 3m18.500491745s ago: executing program 2 (id=1212): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = openat$hpet(0xffffff9c, &(0x7f0000000000), 0x103000, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0x6801, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) (async) mount$fuse(0x0, 0x0, 0x0, 0x2b18094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) (async) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) (async) chdir(&(0x7f0000000140)='./file1\x00') syncfs(r0) (async) r2 = open(&(0x7f0000000000)='.\x00', 0x0, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) (async) mkdirat(r2, &(0x7f00000002c0)='./file1\x00', 0x42) mount$bind(&(0x7f0000000540)='./file1\x00', &(0x7f0000000500)='./file0\x00', 0x0, 0x5040, 0x0) (async) ioctl$AUTOFS_IOC_PROTOSUBVER(r2, 0x40049366, 0x0) (async) r3 = fcntl$dupfd(r0, 0x0, r0) (async) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) (async) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000002000010300000000400000a29baf52c0b4c136e696cd000200000000000004a9"], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x4044044) (async) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) futimesat(r3, &(0x7f00000000c0)='./file1\x00', &(0x7f00000003c0)={{0x77359400}, {r13, r14/1000+10000}}) (async) socket$alg(0x26, 0x5, 0x0) (async) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x3b4, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x149}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x200, 0x3, 0x0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r11, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r8, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) r15 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000040)={'veth0\x00', 0x0}) (async) r17 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r17, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r16, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) (async) sendmsg$nl_route_sched(r17, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0xfffbffff, {0x0, 0x0, 0x0, r16, {0x0, 0x8}, {0xffff, 0xffff}, {0x8, 0x4}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x2, 0x30, 0x6ce7f4a5, 0x6, 0x15ec}, 0x7, 0x0, 0x4, 0x9, 0xffffce01, 0x5, 0x16, 0x20, 0x4, 0x10003, {0x4, 0x84a, 0x6, 0x3, 0x7, 0x1ff}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40005}, 0x4040010) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) 3m18.432447905s ago: executing program 2 (id=1213): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000180)=""/97, 0x61) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r2, 0xe) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) close_range(r3, 0xffffffffffffffff, 0x0) 3m3.237007886s ago: executing program 32 (id=1213): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000180)=""/97, 0x61) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r2, 0xe) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) close_range(r3, 0xffffffffffffffff, 0x0) 31.121859419s ago: executing program 3 (id=2176): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, 0x0) getpid() socket$inet(0x2, 0x4000000000000001, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') lseek(r2, 0x2000, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000019080)='syz0\x00', 0x1ff) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240), 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r5, 0x8955, 0x0) r6 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000000700)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb4900", 0x70) connect$inet6(r6, &(0x7f0000000240)={0xa, 0x4e23, 0x8020000c, @loopback, 0xffffffff}, 0x1c) write(r0, &(0x7f0000000000)="29000000140005b7ff000000040860eb01cb02fcb2e4e6589b3e0ed7283f14b912685e684c42b9eeb9", 0x29) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="5c000000020601080000000000000000000000000d0003006c6973743a736574000000000500050000000000050001000700000005000400000000000900020073797a320000000014000780080006400000021c080017"], 0x5c}}, 0x0) 30.044363949s ago: executing program 3 (id=2182): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f00000002c0), 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000240)='./file0\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYRES16=r1], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r3, r1}, 0x14) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x19, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000004000000000000feffffff18110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000808500000082000000850000000e000000bf91000000000000b7020000020000008500000084000000b70000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r5, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000f80), 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r6, 0xc018937e, &(0x7f0000001040)={{0x1, 0x1, 0x1018, 0xffffffffffffffff, {0x80000}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00'}) r8 = io_uring_setup(0x143, &(0x7f0000000100)={0x0, 0x301e, 0x400, 0x3, 0x10064}) r9 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0), 0x345a42, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000200), 0x4400, 0x0) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0x80400, 0x0) ioctl$IOMMU_IOAS_ALLOC(r10, 0x3b81, &(0x7f0000000280)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r10, 0x3b82, &(0x7f0000000300)={0x18, r11, 0x4, 0x0, &(0x7f0000000240)=[{0x0, 0x1}, {0x5, 0x6}, {0x4, 0x7}, {0x424, 0x8001}]}) ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r9, 0x3ba0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYRESDEC, @ANYRES32=r8, @ANYBLOB="137c0300231a05002c0012800e0001006970366772657461700000001800028014000700000000000000000000000000020000000d0001"], 0x60}, 0x1, 0x0, 0x0, 0x41}, 0x20040840) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) io_uring_register$IORING_REGISTER_PBUF_RING(r8, 0x16, &(0x7f00000000c0)={0x0, 0x0, 0x1}, 0x1) syz_emit_ethernet(0x1e, &(0x7f0000000300)=ANY=[@ANYBLOB="bbbbbbbbbbbb0180c200000e000c0e0000600405000040d5eddf10b3928729aafafaef6eaa38604fcaa49dae1c4734315086ebdb07eebc1dce8b2afd0aa08e9417cf16f77962a395"], 0x0) ioctl$TUNSETIFINDEX(r7, 0x400454da, &(0x7f00000002c0)=r1) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r12, 0x29, 0x40, &(0x7f0000000680)=@raw={'raw\x00', 0x3c1, 0x3, 0x29c, 0xc8, 0x111, 0x4b4, 0xc8, 0xd4feffff, 0x1d4, 0x20a, 0x278, 0x1d4, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [0x0, 0xffffff00, 0xff], [0x0, 0x0, 0x0, 0xffffffff], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6, 0xfe}, 0x0, 0xa4, 0xc8}, @common=@inet=@TCPMSS={0x24, 'TCPMSS\x00', 0x0, {0x7}}}, {{@ipv6={@loopback, @loopback, [0x0, 0xffffffff, 0xffffffff], [0x0, 0x0, 0x0, 0xff], 'veth1_to_hsr\x00', 'pim6reg1\x00'}, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x20, 0x0, 0x0, 0x0, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x2f8) socket$nl_netfilter(0x10, 0x3, 0xc) getsockname$unix(r7, &(0x7f0000000000)=@abs, &(0x7f0000000280)=0x6e) 28.921698194s ago: executing program 3 (id=2185): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, 0x0) getpid() socket$inet(0x2, 0x4000000000000001, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x2000, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket(0x840000000002, 0x3, 0x100) connect$inet(r3, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r3, &(0x7f0000005240), 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, 0x0) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000000700)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988", 0xe0) connect$inet6(r5, &(0x7f0000000240)={0xa, 0x4e23, 0x8020000c, @loopback, 0xffffffff}, 0x1c) write(r0, &(0x7f0000000000)="29000000140005b7ff000000040860eb01cb02fcb2e4e6589b3e0ed7283f14b912685e684c42b9eeb9", 0x29) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="5c000000020601080000000000000000000000000d0003006c6973743a736574000000000500050000000000050001000700000005000400000000000900020073797a320000000014000780080006400000021c080017"], 0x5c}}, 0x0) 27.904527393s ago: executing program 3 (id=2190): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x0, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) mount$bind(&(0x7f0000000140)='./file0/file0\x00', &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x5202, 0x0) ptrace$peekuser(0x3, 0x0, 0x1) r0 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000440), 0x121980, 0x0) ioctl$KVM_CREATE_VM(r0, 0x40086806, 0x3c) read$usbfs(r0, &(0x7f0000000280)=""/155, 0x9b) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) rmdir(&(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00') 27.755874748s ago: executing program 3 (id=2191): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, 0x0) getpid() socket$inet(0x2, 0x4000000000000001, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') lseek(r2, 0x2000, 0x0) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240), 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r5, 0x8955, 0x0) r6 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000000700)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988", 0xe0) connect$inet6(r6, &(0x7f0000000240)={0xa, 0x4e23, 0x8020000c, @loopback, 0xffffffff}, 0x1c) write(r0, &(0x7f0000000000)="29000000140005b7ff000000040860eb01cb02fcb2e4e6589b3e0ed7283f14b912685e684c42b9eeb9", 0x29) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="5c000000020601080000000000000000000000000d0003006c6973743a736574000000000500050000000000050001000700000005000400000000000900020073797a320000000014000780080006400000021c080017"], 0x5c}}, 0x0) 27.531876923s ago: executing program 3 (id=2193): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40046304, {0x1, 0x0, 0x1058, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x21}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x3f}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x13}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 27.480057423s ago: executing program 33 (id=2193): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40046304, {0x1, 0x0, 0x1058, 0x0, 0x20, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x21}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x3f}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x13}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 4.839050594s ago: executing program 0 (id=2321): r0 = userfaultfd(0x80001) write$P9_RSTATu(0xffffffffffffffff, &(0x7f00000004c0)={0x293, 0x7d, 0x0, {{0x500, 0xf0, 0x0, 0x5000000, {}, 0x0, 0x0, 0x0, 0x0, 0x1f, '\x04nodev{cvfox\x92\xff\xff\xff\x81\x02\x00\x00\x00\x00\x001\xff\xce\xbc\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05\xf7\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x12, '\xcf\xc2\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf3\x13\xf6\x00', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xd4\x89\xdad\x9a7\x00'}, 0x12c, 'odev-n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x232) r1 = syz_open_dev$midi(&(0x7f00000001c0), 0x2, 0x2) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r1, 0xc0205710, &(0x7f0000000180)={0x0, 0x83e56, 0x0, 0x0, 0x3}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x30f4, 0x0, 0x40000000}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='blkio.bfq.empty_time\x00', 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x20002, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r5, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r6, &(0x7f0000000000)="0a000000010001", 0x7) r7 = openat$cdrom(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$CDROMRESET(r7, 0x5312) ftruncate(r7, 0x8) ioctl$KVM_SET_GSI_ROUTING(r5, 0x4008ae6a, &(0x7f0000000000)={0x1, 0x0, [{0x4, 0x5, 0x0, 0x0, @adapter={0x7, 0x6, 0xaaca, 0x80000001, 0x2}}]}) recvfrom$inet(r3, &(0x7f0000000500)=""/4096, 0x1000, 0x40012000, &(0x7f0000002540)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) r8 = add_key$keyring(&(0x7f0000000240), &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r8, &(0x7f0000000000)='cifs.idmap\x00', &(0x7f0000000140)) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r2, &(0x7f00000064c0), 0x0, 0x30100, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x111, 0x3}}, 0x20) 4.461737649s ago: executing program 0 (id=2323): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newqdisc={0x194, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x5}, {0xffff, 0xffff}}, [@TCA_STAB={0x170, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0xf, 0xe46, 0x7, 0x0, 0x9, 0x7b, 0x7}}, {0x8, 0x2, [0x8000, 0x6, 0xe1f, 0x8, 0x684, 0x50aa, 0x807]}}, {{0x1c, 0x1, {0x4, 0xf2, 0xd8, 0xfffffff8, 0x1, 0x9, 0x9, 0x2}}, {0x8, 0x2, [0xf0, 0xf1]}}, {{0x1c, 0x1, {0x2b, 0x66, 0x8, 0xe3a4, 0x0, 0x20000, 0xfffffffa, 0x1}}, {0x6, 0x2, [0x3]}}, {{0x1c, 0x1, {0x7, 0xa, 0x3800, 0x3, 0x1, 0x8, 0x0, 0x1}}, {0x6, 0x2, [0x0]}}, {{0x1c, 0x1, {0x7, 0x2, 0x81, 0x3, 0x2, 0x3, 0x9, 0x6}}, {0x10, 0x2, [0x7f, 0x3, 0x0, 0x0, 0x8003, 0x2]}}, {{0x1c, 0x1, {0x5, 0xad, 0xc547, 0x5, 0x2, 0xf1e, 0x9, 0x8}}, {0x14, 0x2, [0x8, 0x65, 0x0, 0xffc0, 0x2, 0x6, 0x7, 0x1]}}, {{0x1c, 0x1, {0xfb, 0x9, 0x0, 0xfffffffd, 0x1, 0xec77102, 0x6b, 0x5}}, {0xe, 0x2, [0xc, 0x0, 0x2, 0xfffb, 0x7]}}, {{0x1c, 0x1, {0x0, 0x7, 0x8, 0x7, 0x2, 0x2, 0xe5, 0x1}}, {0x6, 0x2, [0x8]}}, {{0x1c, 0x1, {0x7, 0x8, 0xbdc, 0xccf, 0x2, 0x8, 0xc5, 0x2}}, {0x8, 0x2, [0xd, 0x1ff]}}]}]}, 0x194}}, 0x20000000) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x9defcb4}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0xb}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x8010) 3.941353753s ago: executing program 1 (id=2329): unshare(0x20000000) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket(0x2d, 0x2, 0x0) read(r3, &(0x7f0000000240)=""/77, 0x4d) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r6, @ANYBLOB="0a000100aa05000000160000"], 0x50}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000580)={0x2, 0xfc}, 0x2) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)=@o_path={&(0x7f0000000000)='./file0\x00', 0x0, 0x8, r1}, 0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000003000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r7 = io_uring_setup(0x115c, &(0x7f0000000440)={0x0, 0x8270, 0x0, 0x3, 0x117}) io_uring_register$IORING_REGISTER_BUFFERS(r7, 0x0, &(0x7f0000000640)=[{0x0}], 0x178) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="6a0ac4ff02"], 0x0}, 0x94) io_uring_register$IORING_REGISTER_FILES(r7, 0x1e, &(0x7f0000000000)=[r7], 0x1) r8 = syz_open_procfs(0x0, &(0x7f0000000b40)='task\x00') fchdir(r8) r9 = syz_clone(0x4200, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r9, 0x0, 0x0, 0x0) 3.731774422s ago: executing program 0 (id=2332): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000f500008500000006000000850000000800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCPKT(r2, 0x5420, &(0x7f0000000000)=0xf22) (async) r3 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000180)=0x3) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'veth0_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@deltfilter={0x64, 0x2d, 0x1, 0x78bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff3, 0x8}, {0xfff2, 0xffff}, {0x0, 0xf}}, [@filter_kind_options=@f_flower={{0xb}, {0x34, 0x2, [@TCA_FLOWER_KEY_TCP_DST={0x6}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x8}]}]}, @TCA_FLOWER_KEY_TCP_DST_MASK={0x6}, @TCA_FLOWER_KEY_ENC_IPV4_DST_MASK={0x8, 0x1e, 0xff000000}]}}]}, 0x64}}, 0x20044800) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(r5, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0) (async) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = dup(r6) ioctl$TCXONC(r6, 0x540a, 0x0) write$P9_RREADDIR(r7, 0x0, 0x0) (async) r8 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, r8, 0x4}, 0x38) (async) write$char_usb(r7, &(0x7f0000000000)="ef", 0x1) msgctl$IPC_INFO(0x0, 0x3, 0x0) (async) r9 = add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_PKEY_QUERY(0x18, r9, 0x0, 0x0, &(0x7f0000000100)) (async) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x4, 0x8001, 0x0, 0x80000000b49, 0x2, 0x4, 0xa, 0x3}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007008500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r10, 0x107, 0xf, &(0x7f0000000040)=0x80000001, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000280)={'bridge0\x00'}) 3.05132617s ago: executing program 5 (id=2333): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x6600, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000200000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e64000000080002400000000084000000160a0101000b000000000000010000000900020073797a31000000000900010073797a30000000005800038054000380140001007663616e3000000000000000000000001400010076657468315f746f5f626f6e64"], 0x124}}, 0x0) 2.98776064s ago: executing program 1 (id=2334): r0 = socket$l2tp(0x2, 0x2, 0x73) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(0x0, r1) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}, {0x0}], 0x2) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r3 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, 0x0) read$FUSE(r3, &(0x7f0000002980)={0x2020}, 0x2020) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40081, 0x0) socket$packet(0x11, 0x2, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000080), 0x2, 0x121102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = add_key$keyring(&(0x7f0000002280), &(0x7f00000022c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000002300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r6, 0x6f) r7 = add_key$fscrypt_provisioning(&(0x7f0000002a40), &(0x7f0000002a80)={'syz', 0x2}, &(0x7f00000003c0)=ANY=[@ANYRES64=r2, @ANYBLOB="dab2623c55471cd44d5923ba431dbbf404578711773f1f42ecf75ab5341c50f388e4d8d2c3033fd743"], 0x48, 0x0) keyctl$KEYCTL_MOVE(0x1e, r7, r5, 0xfffffffffffffffb, 0x1) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4038587a, &(0x7f00000002c0)={{0xffffffffffffffff, 0x0, 0x440400, &(0x7f00000000c0)={@align=0x80000000, {0x8, 0x8, 0x8, 0x8000000000000003}}, 0x2, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x9}, {[0xffffffff, 0x5, 0x6, 0x5]}, 0x800000, 0xd0, &(0x7f0000000180)=""/208}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94) 2.96512549s ago: executing program 5 (id=2335): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setreuid(0x0, 0xee00) fsmount(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000040)=0x3, 0x4) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x7, 0x1, 0x701, 0x0, 0x0, {0x0, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x80) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x300, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c00000003010101"], 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x8880) close(r0) r5 = epoll_create(0x6) epoll_wait(r5, &(0x7f00000002c0)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, 0xb) 2.76377591s ago: executing program 5 (id=2337): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$radio(&(0x7f0000000340), 0x2, 0x2) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f0000003840)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x6, 0xa68d7c51df802ff5, 0xffbc, 0x6, 0x1d46, 0x0, 0x0, 0x0, 0x40}}, 0x50) syz_fuse_handle_req(r2, &(0x7f0000008380)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20, 0x0, 0x68cc, {0x0, 0x14}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) pipe2(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) splice(r6, 0x0, r5, 0x0, 0x6, 0x0) write(r5, &(0x7f00000002c0)="fe", 0xfdef) mount$9p_fd(0xffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r4, @ANYBLOB=',wfdno=', @ANYRESHEX=r5]) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) io_uring_register$IORING_REGISTER_SEND_MSG_RING(r4, 0x1f, &(0x7f00000003c0)={0x28, 0x3, 0x0, r7, &(0x7f0000000280)="994993d6ad0093031eaffcf1590efabf0a55d7d2408d803a94e51e7b9baec32b554d1def0688b53dea1c676b217a4a991757c1a3705f517533edf0", 0x0, 0x8, 0x3, 0x1, {0x0, 0x0, r2, 0xd}}, 0x1) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x5, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) 2.763640376s ago: executing program 0 (id=2338): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) mkdir(&(0x7f0000000100)='./file0\x00', 0x115) r1 = openat$rdma_cm(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080), 0x106, 0x3}}, 0x20) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd600a843500280600fe8000000000000000000000000000bbfe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a0000000000029c2ff6a8a9a68281302956b62950000"], 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x4, &(0x7f0000006680)) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x2c000010) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) process_mrelease(0xffffffffffffffff, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x6) ioctl$KVM_SET_DEVICE_ATTR_vm(r3, 0x4018aee1, &(0x7f0000001780)=@attr_other={0x0, 0x366, 0x0, &(0x7f0000000180)=0x1}) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000400000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7020000140000feb7030000000000008500000008000000bf0900000000000055090100000000009500000000000000b7020000000000007baa00fe00000000b5090800000000007baaf0ff00000000bf8700000000000007070000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004602010076000000bf98000000000000be080000000000008500000072440000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.730608898s ago: executing program 4 (id=2339): socket$l2tp(0x2, 0x2, 0x73) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(0x0, r0) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r2 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, 0x0) read$FUSE(r2, &(0x7f0000002980)={0x2020}, 0x2020) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x40081, 0x0) socket$packet(0x11, 0x3, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000080), 0x2, 0x121102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = add_key$keyring(&(0x7f0000002280), &(0x7f00000022c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000002300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r5, 0x6f) r6 = add_key$fscrypt_provisioning(&(0x7f0000002a40), &(0x7f0000002a80)={'syz', 0x2}, &(0x7f0000002ac0)=ANY=[@ANYBLOB="02000000000000006161616161616161616161616161616161616161616161616161"], 0x48, r4) keyctl$KEYCTL_MOVE(0x1e, r6, r4, 0xfffffffffffffffb, 0x1) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4038587a, &(0x7f00000002c0)={{0xffffffffffffffff, 0x0, 0x440400, &(0x7f00000000c0)={@align=0x80000000, {0x8, 0x8, 0x8, 0x8000000000000003}}, 0x2, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x9}, {[0xffffffff, 0x5, 0x6, 0x5]}, 0x800000, 0xd0, &(0x7f0000000180)=""/208}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x0, 0x0, &(0x7f0000000680)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) 2.72709722s ago: executing program 1 (id=2340): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x4c0142, 0x161) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {0x8}}, './cgroup.cpu/cgroup.procs\x00'}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000001c0)) readv(r2, &(0x7f0000001f40)=[{0x0}, {&(0x7f00000004c0)=""/36, 0x24}, {&(0x7f0000000540)=""/35, 0x23}, {0x0, 0x2424}, {0x0}], 0x5) r3 = openat$panthor(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000100)={0x13}) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) listen(r4, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) ioctl$TUNSETNOCSUM(r5, 0xc0189436, 0x1ffffffe) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000005c0)=0xd) ioctl$sock_SIOCADDDLCI(r6, 0x5452, &(0x7f0000000100)={'veth1\x00'}) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000200)) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) 1.621755675s ago: executing program 4 (id=2341): unshare(0x20000000) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000002c0)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket(0x2d, 0x2, 0x0) read(r3, &(0x7f0000000240)=""/77, 0x4d) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15010000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r6, @ANYBLOB="0a000100aa05000000160000"], 0x50}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000580)={0x2, 0xfc}, 0x2) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)=@o_path={&(0x7f0000000000)='./file0\x00', 0x0, 0x8, r1}, 0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000003000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r8 = io_uring_setup(0x115c, &(0x7f0000000440)={0x0, 0x8270, 0x0, 0x3, 0x117}) io_uring_register$IORING_REGISTER_BUFFERS(r8, 0x0, &(0x7f0000000640)=[{0x0}], 0x178) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="6a0ac4ff02"], 0x0}, 0x94) io_uring_register$IORING_REGISTER_FILES(r8, 0x1e, &(0x7f0000000000)=[r8], 0x1) r9 = syz_open_procfs(0x0, &(0x7f0000000b40)='task\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1e0000001a000000b6466e445baaab9504000000", @ANYRES32=r7, @ANYBLOB='\b\x00'/20, @ANYRES32=0x0, @ANYRES32=r9, @ANYBLOB="0500000003000000030000000a00"/28], 0x50) r10 = syz_clone(0x4200, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r10, 0x0, 0x0, 0x0) 1.369321055s ago: executing program 5 (id=2342): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x4010) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) preadv(r3, 0x0, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r3, 0xc010643a, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r4, 0x0, 0x200048c4) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_DEL_PMK(r3, 0x0, 0x2000050) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, 0x0, 0x4000000) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f00000001c0)={0x1000000, 0x20000, 0x9, 0x2, 0x200, &(0x7f0000003c40)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a73090000000000001b0f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) 1.277812873s ago: executing program 5 (id=2343): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$radio(&(0x7f0000000340), 0x2, 0x2) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0x14, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000f00000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0x10, 0x38, &(0x7f00000006c0)="0000000000000080", &(0x7f0000000700)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) read$FUSE(r1, &(0x7f0000003840)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x6, 0xa68d7c51df802ff5, 0xffbc, 0x6, 0x1d46, 0x0, 0x0, 0x0, 0x40}}, 0x50) pipe2(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(0xffffffffffffffff, 0x0, r6, 0x0, 0x6, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r5, @ANYBLOB=',wfdno=', @ANYRESHEX=r6]) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, 0x0) io_uring_register$IORING_REGISTER_SEND_MSG_RING(r5, 0x1f, &(0x7f00000003c0)={0x28, 0x3, 0x0, 0xffffffffffffffff, &(0x7f0000000280)="994993d6ad0093031eaffcf1590efabf0a55d7d2408d803a94e51e7b9bae", 0x0, 0x8, 0x3, 0x1, {0x0, 0x0, r1, 0xd}}, 0x1) pselect6(0x40, &(0x7f0000000240)={0x3, 0x1, 0x205, 0x2, 0x10000, 0x4, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) 1.277377312s ago: executing program 0 (id=2344): syz_open_dev$hidraw(&(0x7f0000000280), 0x4, 0x90743) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc854}, 0x50) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) epoll_create(0x5) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$vim2m(0x0, 0x0, 0x2) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r2, 0x501, 0x70bd2c, 0x25dfdbf8}, 0x14}, 0x1, 0x0, 0x0, 0x20008001}, 0x40) sendmsg$NL80211_CMD_DEL_KEY(r1, 0x0, 0x24002000) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4001) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x22200, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_SREGS2(r5, 0x4140aecd, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000200)={@remote}, 0x14) 201.163418ms ago: executing program 1 (id=2345): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="ad43f8fffffffbdbdf2504"], 0x14}, 0x1, 0x0, 0x0, 0x8886}, 0x80) (fail_nth: 2) 200.580117ms ago: executing program 4 (id=2346): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) socket$netlink(0x10, 0x3, 0xb) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08fb48"], 0x30}}, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) (async) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000880)=ANY=[@ANYRESDEC, @ANYRES16=r3, @ANYBLOB="050427bd7000fedbdf2501000000080001003cda2a275b5da033475e25db902cbbf15206fd99f5bb525b116f89b9cc109df01270d3c05bb72b39fb6c2fc907d1dc58aecf5d83eefa455ab01f5e9cd1de8938d95300b050f73f3b651c6dc4e30ac198451bd2df0c8f2c4fc1a0160667656f370bf8669284b62676b6ab88315a226d5b3c1edffdd527d3f5edff0256ab14d409b017632ce3040cd08f9bf5d1d41f9f9e5c65ff1f4072d41429fa7af5e67648e234b03142ad33a4c708d7d9d779eafd1570", @ANYBLOB="9db0fb41a229d7db0828316052ef32b34f8229bef9cf6e28a7a9e5ca5f9ff641c21df89fa34151160d26516fac9d26385e945804cd5a85061cf3d4df0c174b24269ec8823f98b27aeae44b6d343b841dc1bb1fe65f00ead6366e857dd07d0f59e73283b8d8a3c8a4b603368f5235c40ae619233c4a2dc732fbaf3623585cb000"/141, @ANYBLOB="4800028044000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000110004006163746976656261636b757000000000"], 0x64}, 0x1, 0x0, 0x0, 0x4000401}, 0x4c004) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000000)) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000440)={0x0, 0xa1ff, &(0x7f0000000400)={&(0x7f00000007c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000ffdbdf2501000000000000000141000000180017000000000000e1006574683a7465616d3000000076cb79d31ccc89070cdd38efc6bea2b1f00110d39bcb403af540a846138451175949b5598493232fdab0210d98233bfcb8fd8089456f257a1ce8f3967eaa60934788a051a7e6b136a80a887952bfa1709b"], 0x34}}, 0x0) (async) r8 = socket(0x400000000010, 0x3, 0x0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = socket(0x400000000010, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, {0xb, 0xfff1}, {0xffff, 0x3}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x4010) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mincore(&(0x7f0000301000/0x1000)=nil, 0x1000, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001340)=@newtfilter={0x4e8, 0x2c, 0x8, 0x70bd21, 0x25dfdbff, {0x0, 0x0, 0x0, r11, {0xc, 0xfff2}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_route={{0xa}, {0x4b8, 0x2, [@TCA_ROUTE4_ACT={0x4b4, 0x6, [@m_connmark={0x19c, 0x1c, 0x0, 0x0, {{0xd}, {0x100, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xb1, 0x8, 0x0, 0x8e9, 0x7fff}, 0xffff}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0xffffff08, 0x0, 0xb4, 0x5}, 0x401}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3ab2, 0x8001, 0x1, 0x4, 0x3}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xffffffff, 0x9, 0x5, 0x4442, 0x1}, 0x100}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0xca4, 0x0, 0x6, 0xd0}, 0x2}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x3, 0x30000009, 0x0, 0xfff}, 0xffff}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x2, 0xc33, 0xffffffffffffffff, 0x6, 0xfffffffb}, 0x3}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x18b5, 0x7f, 0x1, 0x10001, 0x100}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x80000000, 0x3, 0x7, 0x80000001}, 0x1}}]}, {0x6d, 0x6, "c4673db3eb84ebc8a47574926706ab2ba40cdd7e08567ac9e224c5781985d9896636914485e0bde494766506261912063c5a4f2964a3430a47cf66866e8a435d3f0bec673f63a4d70964c132264af63a3af76f38da0df9e5f28e9a6bbe89dbbb4e638b9194d5ed18d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_mpls={0x138, 0x5, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x1, 0xffffffff, 0x3, 0x101}, 0x4}}, @TCA_MPLS_LABEL={0x8, 0x5, 0x26468}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0xc5, 0x3, 0x10000000, 0x6, 0x80000000}, 0x3}}]}, {0xca, 0x6, "23d3aba4f1574400db9e930fe120f1c41666ecfbe489fb8f3df8d6d9a1f3603029d62b590703722c8bca43587c00167fe06fc86f737c29583886612808fa5f8ff0ef4c4312bbcb76b3f45a56f1521987102fb42a16bd381b7ce1502b31154f8928f981d96edc8eb74771bb66930d28b1907dc7cd1af0971edf067279b4455e735047f21c8be6e6d350ddd18e25378d80eeee8182580d6ceb0d8207a9771481f805681842c5d610f2adec898e445f3884ac4e5cb285554cc6168d199b1419946e467afa9ce3ec"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_simple={0x1dc, 0x10, 0x0, 0x0, {{0xb}, {0xc0, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x8001, 0x3, 0x8, 0x1, 0x1}}, @TCA_DEF_DATA={0x9, 0x3, 'TIPC\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x8, 0x4, 0x4, 0x401, 0x3}}, @TCA_DEF_DATA={0x9, 0x3, 'team\x00'}, @TCA_DEF_DATA={0x7, 0x3, '{\\\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x2fae, 0x2, 0x5, 0x2, 0x80000001}}, @TCA_DEF_PARMS={0x18, 0x2, {0x9, 0xfffffffa, 0x20000000, 0x1, 0xfffffffc}}, @TCA_DEF_PARMS={0x18, 0x2, {0xffffffff, 0x6, 0xffffffffffffffff, 0x3}}, @TCA_DEF_PARMS={0x18, 0x2, {0x5, 0xf23, 0x8, 0xb7c4, 0x1}}, @TCA_DEF_DATA={0x9, 0x3, 'flow\x00'}]}, {0xf1, 0x6, "749684f6ed507786827ae7885322bd2f5ac0fc7fa7160042b4a344badc0e60327534ec94f228663c1f54450e47d27275e65a51d07bbd3640dfa7c6b6b2ddc22f0b80048488ba6317bc156502d3e4aaa266edb968f94188ec38d1169f24414d59fbc9884be39603708bcc5492bdc5a1da0cb36d0ebe2c0e8b82e7db0774d941d13ea2521a9e5667621a1d670a2ca6d2c4e201ff1e0290dd971e52f5bb5058e5be6d6efee3ac26ba813bfe7dcb7b05006c996bc66b36023a3dde86aeba507eb9fd286bd77b146c0074d4c3f9da83d589c55a565486d0f1fc3b29e81063f3e6e100899c7fcdaecfe4870dbbf57eb1"}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}}]}, 0x4e8}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) (async) sendmsg$nl_route_sched(r8, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@getchain={0x2c, 0x66, 0x800, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x10, 0x2}, {0xe, 0xb}, {0xffe5, 0xfff3}}, [{0x8, 0xb, 0xffff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8848}, 0x8804) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x12, 0x16, &(0x7f0000000240)=ANY=[@ANYRES8=r1], &(0x7f0000000100)='GPL\x00', 0x5, 0x0, 0x0, 0x41100}, 0x94) (async) r12 = msgget$private(0x0, 0x1c0) msgctl$IPC_SET(r12, 0x1, &(0x7f0000000280)={{0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x96}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) (async) msgsnd(r12, &(0x7f0000000300)=ANY=[@ANYBLOB="00001c"], 0x8, 0x0) (async) msgctl$IPC_RMID(r12, 0x0) 140.093875ms ago: executing program 1 (id=2347): landlock_create_ruleset(&(0x7f0000000000)={0x10, 0x9, 0x3, 0x4200}, 0x30, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, 0x0, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a38000000060a010400000000000000000a0000010900010073797a3100000000040004800900020073797a3200000000370007401cf03902b4d96b5ac32ef8a14ff650ac442a50451f8bbb1eb02471b9e2e02f23b26836318a36ee0369ebf520818de86139188a9ac0ecbf88c863a1571db86933f9be56ca86586c2de3e76f8ed4db85c82c7197dfdf833b9c88f1ccefaf4ae266001e129a5c7adab367c1d8a39cde44f625d321911c22e55c3de79318ba5cbfe2496ed4cf5b44ee0403e96d642ba7ea733bcf47994c9bce500f40162f20757788700689e5f376abf69cba2786dd2b351f71ef49bd56b9c26ca35ed15bb05bd2075cc630c6722450348d702d5a7e66978e89bdc681571f8555db37805a3afcd2509bcc8db169b503ec882b752ee5ea201743500000140000001100010000000100000000000500000a"], 0x60}, 0x1, 0x0, 0x0, 0x6040850}, 0x20000040) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) socket$inet_mptcp(0x2, 0x1, 0x106) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x1a6c42) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000001ac0)={0xffffffffffffffff, 0x2000, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0x1e, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200", [0x0, 0x400]}}) r6 = dup(r5) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x13, r7, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r8, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r8, &(0x7f00000005c0)="114353012008babe00004c510800", 0xe, 0x4008015, &(0x7f00000000c0)={0x11, 0xe5, r9, 0x1, 0x7}, 0x14) write$UHID_INPUT(r6, &(0x7f0000001c00)={0x8, {"b0476b76ba5d044f65271519727e4ff1ff0d12c0e6bdf3ea1f52e24f60ca698457b32832b83d7e96694c1feb5809bd67002f71e0b97c0d5270c04ffa64f63b2e18ee4b7b572fe2f4d03cad38bcd106ff12f53b443ac6fc81da518f54b9004a44859529c07a2b1b8feddc0180a0f37b13babba1dd0813b7ea56dac4b7ffe9a2ef54221439ecc55223ef2d40f4ba8108c10387ddffbaed25d41e7692bf26ddfa747a666caff49843e38c86cac7323f784a17df6beaa49c3f4a98fb4013f4e573e2ef77b0965d4bfbdf7d5eada69406ca93f422495e00addfca1518085a40f10284ff59388ecf476a12ef1a540163922098d600519ae8cf3ef544344e9d968f341af618503b455f3976b76975270e94d714302382c63de5b7c1fad1fa373b369916cb3b4d583a9ebbaeb262884d25a0e1d9fb141de60df7e64cb38b6f7167991f8fba06bffe2d49133bbb462cd8a9493177eee5f03875b15c7a92c3cd6a3fdfc64f236e14fa05a0e8d3c45f13eecd22e13528c74186dc50e0e2af44177e26bded1161e5533375508dadb83db5126cc810f4e30d4e24ec12c3b99e5220aacf42c58f2960bd43c337dbd318aeeb5c9a6cd5ffd3bf1497bb48ab7bcb32c9c33c9f5b9bc4645b96f23f9e0d826b780030444ffb925f55df587ef5ca5ea74ccd66afc7981da496d6f037efbb0b08f3f5078c60ffb4db18d1b59996bd9b1513442785bf4ece8587b39d8176dc9c735d5ea25133b2053bba227b81faab7220326f8814a9df4eba4ecc6acdd82f70b653b56a18cc9dfa4deb0a112c797ab89a51a103c3a9085d828523370c4d79d9484f4dc910735a2c9b5b85197cd9c073df7a54b40df8e1bf595bab957900c2a1a7dc40e88ed0c55c362ffbb7f88a0725a6ae73b936a639e951faf9c45ae74a2ece2f6f88e425ee41d2c60cb083a2fd6d07381908a7f629e32f89a553cf0794f54b8bdc7bd541d88464a4f80ac0b8b625a803a55de4b05a95fc7f8fc3d6d79858ccb269b7b8b21657654164a9aa29f4e8462377e9d234a41ea69841a4aaa1e5f89f9b074f6f71cb1ffaa450c3160b0e319ec81ad30101db66218b0c69f97c234465dc45849fcfd62d396f2b50ddcc0ed7dd8651431534232ab6d1186d7760770a1fc6c77553a79d0297194f794997ee47781094a76d9dccf632dcbb527b3e68950d9bb534245c7f08ae1d6ef2750292ae28e5e6dcfe2a69737dd7a1e453f3902ae90789e98c212905422099904d3bfb949bde187682a59c01aa8e6a9972a63d6aaef4d4139b10a24e063707f1aba79bd59e3f9709a873dff401d1f356c4be5e449ae0e2633a1fe50ed367fe56b0499957c3b6cabb42256547995ea998f3937d153897d1c83f1ad922d6835bdfa3b986dc6f4bd927a4ca13fbaa99b7b43758e2329d588f40fac718b16cca855468643f3818496b4915fe9a2bdd3e68889fea24bc1dfa6287a801d49a7bb84654147448550d2919e4df3a943a88cf616befea4e7a4fddb7969311c6837f9529966241be1e57ed2d773debc542986d09866905a3f63b6e1820086d52a70f039154e839da7ea852c33bf3722a048f61bbf068519e050b8788370fb130a42e9f5322dfff65b15d588f9e926b70e4530e8b66697cabb1e8514831431fa0eaecb49f9613ed5fd7bc50f897bda36d24d4296e143e2480e325ec09a77c03a07b4f86eb703085313ebeee94ef5b1cde3f6a7efd785772eb4034039f598c07819b769416a223fab824c4ac50086e78042a1ccf47b6c7ede8540cded4bd4c920ce6c2b7493a5634c5e96bb761373623ab473b121d555bfd5a8bc3f5c5418bed83ffd0d6492840550fccc0c35746370396d0190b7b1d2cadcc150877e0d197f692f97cec790c95e3d3959dc7c68aca37306c1bc13ad33848395dba5e3c9ce8090bc0e7e8312091773641be56411921e3d473321c6d8bd10b7d3f5aedd6620bcaa06474bbb298bc77297b8b5dcb9e6b33dbe676460cca825609857724cee245306d07fda287d5fe57c424c27cf9b6cf0f16d2c6a8071bd57c826d7371841cf43dab1b42421ce416d0d3a9c80bc807d2e6761e53f06b3e63c0af1b4548d820118421205f040f4ab35307871e4c7a21ff28082c29e02e89486064661898c0eb1811c70a6124c1f25d62c38794a3e87c312c870db7b60d0df8b57860c94d1a9c561b327fae3a68ce9ff4551e418eb00766f0341c5e796e3cbbbe6b4864928b966110256d5475eb1fd7b2893b60e19e859baaf23c9233a1b064771671ee2d07c151e2e99c37a116a338788052a726a8519b8335e9ff4f71d00ab634543c20ddea1bf57d4f2b797182ff19618b6974d2b69d9f052934d527a1830bf2785842f35eaf32b65b7c9fdd6f0c41756072a59c0cce0b7305740729f1daa14e0092da9d022321b726d658fcef55affa2bbf36ad788f1f423b7dfd328435b4d5df315143d8b8028ba4bea6134a3dc9720c73d5e66b8b8168752eea6b78c75f04efd9677dbe419f13f5e1c9764276a83821b710307d8f85359b34d038ff17de45e8739d4b647fd1a8d794a3273d922af3374f5d3c75b8345b9dfdabb2c0418a358921e0e73d0fe88caab1741b913673e22ff4b59afa0f653a423d9b2bb20cbf07951a349eea18a891b4f4dc6df8e42a6181284f643de5fd2924ae54f672a1920343476c67333e1e8205bf4877b1251a83f417936714edb1c6975ba7969d2fcc2e69024a4669ac2f998116ade1bd84568b8f3f1fccbe95df9ed21db77315b7469f30bfae418415d9cb5aeea627ba6811e30d56d4f4bfe5f794ea4243e3cdfad3ef55199699b8433083b6f72f95effc5f2f613cfcefaf0b94e801ebcb7095a1474ee93142b82c9bf9886617b6bf69d08c83c76cd21d4cce5872d99de8e54bbff915ab923b2d24bb3aa178dd50b44fd0eb880ef33ca51d4bf5f0fbc8ffe18afe4245397f277e4efad955baa10cf56613481253d69c02e7661714b68be0fd64f29bdafbc8b4a0b30bd6709c67fe8e8915d0479b3902b1d0169fb5486b02e966ad5d8a2bcf42ecba59177cd85e17239667f6b045d1f873ce24733ae17e2d8432709062e786a32ac925121f1b0d46c66d4fb9088f4aa0cfe2149f6c2cb5b75d45349bc88fbd47e01ea07e7cd573335aab8d389846566800dd084bc3caa95f7632719c651f2d33be0fb56347c063b3c6e3e75c5e58caeb4c37574859b78c1ed018fbeed788a4305a9ee1c1ef65a0c83a7cd717a8c08ecd4e86370ffffd6d40a89a0b1e8c15a10ad5406e867e49319ad83bfbb925d5e240b4bd44fd751e7510d5ea03a6cab95f37155d1fd69aaea1db4a1f53714eb90e669209cf634f84a50c85bdc51838ebbb545b4387790df67f0122740c2abc910cf83230394172a56c9ffda6675bb8bb39846730a1bf764aeb92407c90a194da880cb8a4efb5b57a8311d864209c7fd226b93582b6b11eec559abfbba653c0569c219d3a2e60555cb739f9d32d564f23c4e98be78aa553610822af426f961df0df2185c61ccaa22b2a6aa6fb3e917bdfb2be9c3ffb8a50821321119c4cf4917db39548abc17bfba267fa50f6af15c560a21055f967f1ca6f656ddb556f9c7e17a771eeef7e80940d1c14ddf2c27647686fd0526460036aeea395fb10abef2be2ea96c9bb380370c08d1568d30eea0f3e6b7cf8f7edc7b36d4d0affd249330707b54ee620f208d885791171eb67a25a80fcc6922e0258c9673b6576564949dfa5bed9a0299bf952aade654de16e22d54fcd391ded6adab94ff621efcd91ef69acf8dfa1b22692ba3e49cd1d3fbed6db1402065ab37e457056877977ebac33ef566f28a19b9acb67a9cc53feb156814e880b3dd5a9119ffdbc5a45c20ea375f2882575b9a28740eebf63f2895d9ffac1ec33cbdcdede98a201424d000df1efd64dd7268cc1b2366ccfb09754822dafdb1821de5e6ebee09608e82e679fafb7a5100172f26998d31d7f27c2b310f0372c3b5e888f8e6efb56074177bf6a2a5bbd9ed070ad5aaf23ce144d1ac86cad110e5916a8a57e1e7fc3d37353f84f2f6d43d92ab8b35040467f3f8b1d23fac021bbac3710edc8e2e26d794db38e48020f63e94d4b4dca3e015537a8e3008274d55f81af931a0faf1a438444b6a0489b93f7b88f81f761eae0f82e60cb0cf2745ca8c9e30d3cc189c1405b1994ed71b00d90ea7a94102916cdc915620c363d04e51eabaaca6c2814a7c1e7aaeec80bdc13135b813e6d0eea83446a5c57ec29695c302c0d8da65b61fe8ada51a36e1aff34d449f9eb70cb94931226121ab121a971c2fc070ca84272d122c1696f52fbd5ed06783abe188dcf133c4d41e10295f6ffda69fa8c5a7c0fec3425a2d60523a60d280b5ce34eac5911268172e772fefba63a6f5c6dafa9e500a5e1355fb614613f8fc1ef5e5466fa19212bcdc349a865f4cee6ea80b11a410bb6e4ad677393973e38621d25ff6c4876ef8a8d2ba651be4a78d2ba9fafadcea8eff9cca3f4ab71a0b84917794e521220dad099ac8aaf32abd162348879e4299e4d46395f9d55267b635e18ca2e2fc96146b96c8a8055130b8d8cb10cc31382df34057bd8637f86e48adc854af408226752a04df8d0362db263e0959f2bd7e8a4d33a8c4b257e19d308280baf40cced1b3cd3a86ee22df0da49d750539eee1104e99a9f8a065e5499c73125a8a8430eda7aee156821a97c237611b50f682a2cccd0969304f0a50ae98800dfb32ee1bcfeab98182c34a51e67fa5bd738c22c44fc1269ce73f464edd2f31296e92e62df51cf55798ae2e3c33c57b09f4ecd13469122095a3563f95f0a04cf58dcea4aed5e8bdda7617863cbc37a97ebadb46d679f7e30014d96d0ac7ce9484368fa5fd19cbc3d139410a2bd7ffacef1bdf76dd1d5f34d2392fcb91c7585fc1ae7d8ba2aa8ded9645d5a5e76e2279b6e0692101137da946dfbd3836476f5dad7fed70115d716dce87b5ad755e5653a709f5aa42265ec9657ed406cc9256af3628c0116b8e1d23306983e9adbc19dec354870c98e2e76566895df933a80c4c36b617db4bbda1a4ca7d6c80a43734471fc92d0bdeacfc125dddd73febd8f7ef84f221d52ae71372cee802d59013a15958e850f8fdf46d8fd3b874633daf3b1f346470456c05722258480959dd6afcffa1f3f2ca033011339c5cb85b7d1c9b5916fb8dc9c2783df64eb5cca5af83a74fe5bb259f93722842eb4ac851e71f3cfd67a39590e7f8e20f018744b9277e6eb46b5f211df5f767ef29dc9a972e14c40ea2d4624f187f301c1116d3a61adeb5c6f7ccc021ac5e18d8b40d7f1f19daf4445c06e72db8701c267c0144c92cddd49af7a87aca5aa05d0e380dd27cc780d2f7db3bef26cc4fd358543e19d73179b879f7bdc702ab405270c93a3ed64153e20b5b663773a2ad4e8e3e1e8eaf39ec80d75d02f74ff94f0e095240a564eeece4fc9bcf19bf2243c700e1dae14a1b0217013977bfa05f681abc37714fe462d0a632044ce52fdaa1c1a806b1eb4370e23ca0247e536165aa9f1c2af8adfea369ee1f4a2c7823a7baef028a1e77501db48db6aa0d7e30969f7197368db02d443803b53b2899315f7e2ba9c5ae952a3866b4ea60f3d669e0a91f7ef640cd938646bf8822fe455f0302fccf87c7fad6daf38fde038fa596b83a9fd5bf675669a6cb2bab44c6617f07950bf34edb93bbcb4174630f275dbda7a0631c4b456e5f80eb6258c1874e77d426743e478917fe44b73dc203baa2cc442b84b5818409abae99d97a28754969bd393df", 0x1000}}, 0xfffffe38) 114.979467ms ago: executing program 4 (id=2348): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x11, &(0x7f0000001080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe}, [@call={0x85, 0x0, 0x0, 0xe}, @snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}, {}, {0x85, 0x0, 0x0, 0xa7}}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc) setsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000001700)=0x7ff, 0x4) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_mute_present\x00', 0x0, 0x0) 47.561371ms ago: executing program 4 (id=2349): socket$nl_route(0x10, 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x1b}, &(0x7f0000000100), 0x0, &(0x7f00000001c0)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r0, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) creat(&(0x7f0000000080)='./bus\x00', 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r0, &(0x7f00000005c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000400)=ANY=[@ANYBLOB="abcc0000121408002abd7000ffdbdf250800030002000000080001000000000008004f0000000000080001000100000008004f0003000000080001000000000008004b00130000000800010002000000"], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8040) mount(&(0x7f0000000240)=@filename='./bus\x00', &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x0, &(0x7f0000000100)='trans=rdma,') bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$kcm(0xa, 0xf, 0x106) sendmsg$kcm(r4, &(0x7f0000000480)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r3, 0x7}, 0x80, 0x0}, 0x4000011) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c0000001000030400000000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="a5fdad88000000001cfa11800100ffff66656e65766500000c0002800600050000ef0000d1b7759bcfcdc562f4ed92416463f6ce009cbf231e5fcdd794137329f98dbf7531fed4cde3c4fc0a28632e222c663674fac25a8b759afcafdc8b1b0a8d9b9355470a27e7ff50a2f7370aacf6a2cc0e22f4160d41647ac5146357d632974554f3d85ae5f22bb45f3e46d1f97ba43c7d965c26ba91d108d769fda449707d770128c32fc691bd3aaeec928fc000e5d4ebddc547d91e76b7ef7a4d8c7b3e46"], 0x3c}}, 0x404c840) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[@ANYBLOB="15000000", @ANYRES32=r3, @ANYBLOB="e794010d5c2c0103420000000000"], 0x14}, 0x1, 0x0, 0x0, 0x448c5}, 0x2010) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x20008004) sendmsg$RDMA_NLDEV_CMD_DELLINK(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000015c0)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a08786eb807e0000000000000000000009fe70ba83a7a66e67a0bae5cfaccbbb81e28d7b568", @ANYRESHEX, @ANYRESOCT], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) io_uring_register$IORING_REGISTER_RING_FDS(r1, 0x14, &(0x7f0000008580)=[{0x4, 0x0, 0x0}, {0x2, 0x0, 0x0}, {0x2, 0x0, 0x0}, {0x3, 0x0, 0x0}, {0x5, 0x1, 0x0}, {0x2, 0x0, 0x0}, {0x4, 0x0, 0x0}, {0x8, 0x0, 0x0}, {0x9, 0x1, 0x0}], 0x9) 47.131149ms ago: executing program 5 (id=2350): io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, &(0x7f00000004c0)=[@ioring_restriction_sqe_flags_required={0x3, 0x1a}], 0x1) r0 = socket$inet6(0xa, 0xa, 0xfffffffd) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@private2, 0x800, 0x0, 0x2, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@mcast2, 0x800, 0x0, 0x2, 0x0, 0x6109, 0xc2}, 0x20) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@mcast2, 0x800, 0x0, 0x2, 0x0, 0x6109, 0xc2}, 0x20) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4, 0x0, 0xff, 0x0, 0x9, 0xfd8c}, &(0x7f0000000100)=0x3d) r1 = socket(0x1, 0x1, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) epoll_create1(0x80000) socket$tipc(0x1e, 0x5, 0x0) (async) r2 = socket$tipc(0x1e, 0x5, 0x0) mknod(&(0x7f0000000080)='./bus\x00', 0x8000, 0x6) (async) mknod(&(0x7f0000000080)='./bus\x00', 0x8000, 0x6) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='./bus\x00', &(0x7f0000000180)='jfs\x00', 0x400080, &(0x7f00000001c0)='discard') bind$tipc(r2, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) (async) bind$tipc(r2, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) (async) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r3, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCXONC(r4, 0x4b45, 0x3) r5 = socket$inet(0x2, 0xa, 0x4) r6 = fcntl$dupfd(r5, 0x406, r5) write$binfmt_elf64(r6, 0x0, 0x540) (async) write$binfmt_elf64(r6, 0x0, 0x540) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a34000000090a01040000000000000000010000000900020073797a32000000000900010073797a300000000008000540000000211400000010000100000000000000000000000061"], 0x5c}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x4014}, 0x4080) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000203050000000080000000000a000003080003400000008cef9e9912d18c670409000200000000010200000008000540000000000800010001000027090002000000093101000000"], 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) r9 = socket$inet(0x2, 0x2, 0x1) recvmmsg(r9, &(0x7f0000004ac0)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x1, 0x0) signalfd(r4, &(0x7f0000000240)={[0x400, 0x81]}, 0x8) (async) signalfd(r4, &(0x7f0000000240)={[0x400, 0x81]}, 0x8) openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) (async) openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)='net/snmp6\x00') (async) r10 = syz_open_procfs(0x0, &(0x7f0000000140)='net/snmp6\x00') read$FUSE(r10, &(0x7f00000040c0)={0x2020}, 0x2020) 35.581379ms ago: executing program 4 (id=2351): socket$inet6_tcp(0xa, 0x1, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000001c0)=0x80000) r1 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpu.stat\x00', 0x275a, 0x0) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f0000000000)={0xfff, 0x0, 0x3, 0x5, 0x4}) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x7, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x80000000, 0xfffdffffffffffff, 0x9, 0x2000000000003, 0xf, 0x80000006, 0x4}, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) r3 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f000000a780)=[{{&(0x7f0000000300)=@nl=@proc, 0x80, &(0x7f00000032c0)=[{&(0x7f0000000380)=""/152, 0x98}, {&(0x7f000000a8c0)=""/4096, 0x1000}, {&(0x7f0000003080)=""/112, 0x70}, {&(0x7f0000003100)=""/163, 0xa3}, {&(0x7f00000031c0)=""/98, 0x62}, {&(0x7f0000003240)=""/125, 0x7d}], 0x6}, 0x1}, {{&(0x7f0000003300)=@x25, 0x80, &(0x7f0000003500)=[{&(0x7f0000003380)=""/81, 0x51}, {&(0x7f0000003400)=""/208, 0xd0}], 0x2, &(0x7f0000003540)=""/4096, 0x1000}, 0x9}, {{&(0x7f0000004540)=@phonet, 0x80, &(0x7f0000004740)=[{&(0x7f00000045c0)=""/79, 0x4f}, {&(0x7f0000004640)=""/190, 0xbe}, {&(0x7f0000004700)=""/16, 0x10}], 0x3, &(0x7f0000004780)=""/4096, 0x1000}, 0x2}, {{&(0x7f0000005780)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000005980)=[{&(0x7f0000005800)=""/163, 0xa3}, {&(0x7f00000058c0)=""/161, 0xa1}], 0x2, &(0x7f00000059c0)=""/222, 0xde}, 0xfffffff9}, {{&(0x7f0000005ac0)=@l2tp6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000006e40)=[{&(0x7f0000005b40)=""/203, 0xcb}, {&(0x7f0000005c40)=""/221, 0xdd}, {&(0x7f0000005d40)=""/4096, 0x1000}, {&(0x7f0000006d40)=""/19, 0x13}, {&(0x7f0000006d80)=""/76, 0x4c}, {&(0x7f0000006e00)=""/14, 0xe}], 0x6}, 0x4}, {{&(0x7f0000006e80)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000000500)=[{&(0x7f0000006f00)=""/143, 0x8f}, {&(0x7f0000000440)=""/143, 0x8f}], 0x2, &(0x7f0000007000)=""/85, 0x55}, 0x8000004}, {{&(0x7f0000007080)=@alg, 0x80, &(0x7f0000009440)=[{&(0x7f0000007100)=""/221, 0xdd}, {&(0x7f0000007200)=""/213, 0xd5}, {&(0x7f0000007300)=""/203, 0xcb}, {&(0x7f0000007400)=""/38, 0x26}, {&(0x7f0000007440)=""/4096, 0x1000}, {&(0x7f0000008440)=""/4096, 0x1000}], 0x6}}, {{&(0x7f0000000540)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f000000a500)=[{&(0x7f0000009500)=""/4096, 0x1000}], 0x1}, 0x101}, {{&(0x7f000000a540)=@pppol2tpv3, 0x80, &(0x7f000000a6c0)=[{&(0x7f000000a5c0)=""/94, 0x5e}, {&(0x7f000000a640)=""/125, 0x7d}], 0x2, &(0x7f000000a700)=""/118, 0x76}, 0x7}], 0x9, 0x2, 0x0) epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r5, &(0x7f0000000100)={0x20000014}) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x8084) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) unshare(0x22020400) r7 = memfd_create(&(0x7f00000001c0)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\v\x14d\xa2\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xce\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\xd5)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb7\xe6_M\xbe\x19\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xac\rP\xf42\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xf4\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)', 0x0) execveat(r7, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r8 = dup(r6) write$UHID_INPUT(r8, &(0x7f0000001040)={0xfc, {"a2e3ad09ed1a09f91b37090987f70e06d038e7ff7fc6e5539b0d3d0e8b089b3f383b6c090890e0879b0a0ac6e70a9b3361959b509a240d5b0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d07640936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4040aea0, &(0x7f0000000040)=@x86={0x5, 0x13, 0x6, 0x0, 0x8, 0xdc, 0x16, 0x0, 0x4, 0x9, 0x48, 0x9, 0x0, 0x7, 0x4, 0xa, 0x1, 0x40, 0x10, '\x00', 0x4d, 0x8}) 35.121441ms ago: executing program 1 (id=2352): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') open_by_handle_at(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="20000000f100000008"], 0x870) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_configfs\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./my_configfs/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./my_configfs/usb_gadget/g1\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) chdir(&(0x7f0000000b00)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000001800)='streaming/header/h\x00', &(0x7f0000001900)='streaming/class/hs/h\x00') fchdir(r1) symlink(&(0x7f0000001c00)='functions/uvc.usb0\x00', &(0x7f0000001d00)='configs/c.1/uvc.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001e00)='UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000001f00)='usbip-vudc.0', 0xc) openat$audio(0xffffff9c, &(0x7f0000000500), 0x200, 0x0) getresuid(&(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x4, 0x6, 0x0) bind$netlink(r4, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) setxattr$security_evm(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180), &(0x7f00000001c0)=@sha1={0x1, "f8422926cd8ec42cd2de2c0475929f79b1ec2589"}, 0x15, 0x2) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c000010000d042dbd7000fcffff1f0000000000", @ANYRES32=r5, @ANYBLOB="46000600000400001c00128009000100626f6e64000000000c0002800500010002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x80) sendmsg$nl_route(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="0000007334ffe90008000a00", @ANYRES32=r5, @ANYBLOB="08001b0000000000"], 0x30}}, 0x0) ioctl$BTRFS_IOC_DEFRAG_RANGE(r2, 0x40309410, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000140)) 0s ago: executing program 0 (id=2353): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x4c0142, 0x161) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {0x8}}, './cgroup.cpu/cgroup.procs\x00'}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000001c0)) readv(r2, &(0x7f0000001f40)=[{0x0}, {&(0x7f00000004c0)=""/36, 0x24}, {&(0x7f0000000540)=""/35, 0x23}, {0x0, 0x2424}, {0x0}], 0x5) r3 = openat$panthor(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000100)={0x13}) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) listen(r4, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) ioctl$TUNSETNOCSUM(r5, 0xc0189436, 0x1ffffffe) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCADDDLCI(r6, 0x5452, &(0x7f0000000100)={'veth1\x00'}) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000080)=0x7) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000200)) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) kernel console output (not intermixed with test programs): aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 361.509017][T11492] syzkaller0: entered promiscuous mode [ 361.546568][T11492] syzkaller0: entered allmulticast mode [ 361.882104][T11505] loop2: detected capacity change from 0 to 7 [ 361.902799][T11505] Dev loop2: unable to read RDB block 7 [ 361.904796][T11505] loop2: AHDI p1 p2 p3 [ 361.906250][T11505] loop2: partition table partially beyond EOD, truncated [ 361.933814][T11505] loop2: p1 start 1601398130 is beyond EOD, truncated [ 361.936201][T11505] loop2: p2 start 1702059890 is beyond EOD, truncated [ 362.328073][ T41] ath9k_htc 9-1:1.0: ath9k_htc: Target is unresponsive [ 362.335369][ T41] ath9k_htc: Failed to initialize the device [ 362.488102][ T41] usb 9-1: ath9k_htc: USB layer deinitialized [ 362.728014][ T5832] usb 44-1: device descriptor read/8, error -110 [ 363.129468][ T5832] usb usb44-port1: attempt power cycle [ 363.215915][ T7187] usb 9-1: USB disconnect, device number 12 [ 363.231136][T11499] lo speed is unknown, defaulting to 1000 [ 363.296733][T11548] netlink: 'syz.1.1520': attribute type 1 has an invalid length. [ 363.302107][T11548] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1520'. [ 363.421225][T11574] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1521'. [ 363.431304][T11574] siw: device registration error -23 [ 363.670871][T11579] fuse: fd is not a fuse device [ 363.822520][ T42] audit: type=1326 audit(1785044683.108:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11590 comm="syz.0.1528" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc7fec code=0x0 [ 364.065973][T11598] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 364.074527][T11598] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 364.144798][ T5832] usb usb44-port1: unable to enumerate USB device [ 364.161499][T11598] gretap1: left promiscuous mode [ 364.167274][ T13] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.173861][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.180432][ T13] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.188191][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.275284][ T41] hid_parser_main: 5 callbacks suppressed [ 364.275302][ T41] hid-generic 0000:0004:261D.0005: unknown main item tag 0x0 [ 364.282249][ T41] hid-generic 0000:0004:261D.0005: unknown main item tag 0x0 [ 364.284822][ T41] hid-generic 0000:0004:261D.0005: unknown main item tag 0x0 [ 364.287269][ T41] hid-generic 0000:0004:261D.0005: unknown main item tag 0x0 [ 364.290019][ T41] hid-generic 0000:0004:261D.0005: unknown main item tag 0x0 [ 364.292559][ T41] hid-generic 0000:0004:261D.0005: unknown main item tag 0x0 [ 364.295048][ T41] hid-generic 0000:0004:261D.0005: unknown main item tag 0x0 [ 364.297592][ T41] hid-generic 0000:0004:261D.0005: unknown main item tag 0x0 [ 364.300292][ T41] hid-generic 0000:0004:261D.0005: unknown main item tag 0x0 [ 364.302848][ T41] hid-generic 0000:0004:261D.0005: unknown main item tag 0x0 [ 364.322083][ T41] hid-generic 0000:0004:261D.0005: hidraw0: HID v0.03 Device [syz1] on syz0 [ 364.581209][T11631] Failed to enqueue queue_pair DETACH event datagram for context (ID=0x4d4) [ 364.920158][T11634] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1534'. [ 366.068765][T11685] fuse: Bad value for 'group_id' [ 366.076957][T11685] fuse: Bad value for 'group_id' [ 366.252353][T11688] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1545'. [ 366.334971][T11691] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 366.339756][T11691] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 45771 - 0 [ 366.344187][T11691] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 366.384685][T11694] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1547'. [ 366.418627][T11691] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 366.422343][T11691] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 45771 - 0 [ 366.426363][T11691] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 366.482938][T11691] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 366.486748][T11691] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 45771 - 0 [ 366.490073][T11691] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 366.543173][T11691] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 366.550388][T11691] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 45771 - 0 [ 366.554517][T11691] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 366.931471][T11713] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1550'. [ 367.001634][ T13] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 367.001668][ T13] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 45771 - 0 [ 367.001691][ T13] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 367.082945][ T13] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 367.086632][ T13] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 45771 - 0 [ 367.092488][ T13] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 367.110720][ T13] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 367.114384][ T13] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 45771 - 0 [ 367.119651][ T13] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 367.139632][ T13] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 367.143546][ T13] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 45771 - 0 [ 367.146943][ T13] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 367.204750][T11724] 9pnet_virtio: no channels available for device syz [ 368.042016][T11732] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1552'. [ 368.201958][T11735] nfs: Deprecated parameter 'nointr' [ 368.596372][T11757] openvswitch: netlink: Duplicate key (type 6). [ 368.828891][T11769] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1561'. [ 368.842667][T11769] siw: device registration error -23 [ 370.357121][T11784] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1564'. [ 370.398489][T11784] IPv6: Can't replace route, no match found [ 370.627079][T11791] netlink: 'syz.4.1566': attribute type 12 has an invalid length. [ 371.000791][T11820] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1572'. [ 371.074800][T11822] siw: device registration error -23 [ 371.796353][T11830] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1573'. [ 371.943375][T11838] netlink: 13054 bytes leftover after parsing attributes in process `syz.4.1575'. [ 373.377977][T11898] openvswitch: netlink: Duplicate key (type 6). [ 373.390063][T11900] bridge0: entered promiscuous mode [ 373.391705][T11900] bridge0: entered allmulticast mode [ 373.444550][T11868] syzkaller0: entered promiscuous mode [ 373.446334][T11868] syzkaller0: entered allmulticast mode [ 373.515089][T11907] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1584'. [ 373.569931][T11912] fuse: fd is not a fuse device [ 373.686354][T11931] syzkaller0: entered promiscuous mode [ 373.698451][T11931] syzkaller0: entered allmulticast mode [ 373.728796][T11934] bond1: peer notification delay (512) is not a multiple of miimon (5), value rounded to 510 ms [ 373.737146][T11934] bond1 (unregistering): Released all slaves [ 373.779598][T12001] FAULT_INJECTION: forcing a failure. [ 373.779598][T12001] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 373.786726][T12001] CPU: 2 UID: 0 PID: 12001 Comm: syz.1.1590 Tainted: G L syzkaller #0 PREEMPT(full) [ 373.786754][T12001] Tainted: [L]=SOFTLOCKUP [ 373.786761][T12001] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 373.786770][T12001] Call Trace: [ 373.786776][T12001] [ 373.786783][T12001] dump_stack_lvl+0x100/0x190 [ 373.786808][T12001] should_fail_ex.cold+0x5/0xa [ 373.786828][T12001] _copy_from_iter+0x1f4/0x1690 [ 373.786854][T12001] ? _copy_from_iter+0x350/0x1690 [ 373.786878][T12001] ? _copy_from_iter+0x270/0x1690 [ 373.786902][T12001] ? __pfx__copy_from_iter+0x10/0x10 [ 373.786928][T12001] ? __pfx__copy_from_iter+0x10/0x10 [ 373.786951][T12001] ? _copy_from_iter+0x270/0x1690 [ 373.786999][T12001] copy_page_from_iter+0x238/0x300 [ 373.787026][T12001] skb_copy_datagram_from_iter+0x399/0x720 [ 373.787054][T12001] packet_sendmsg+0x227e/0x5100 [ 373.787088][T12001] ? aa_sk_perm+0x309/0xaa0 [ 373.787113][T12001] ? __pfx_aa_sk_perm+0x10/0x10 [ 373.787134][T12001] ? __pfx_packet_sendmsg+0x10/0x10 [ 373.787153][T12001] ? __might_fault+0xc5/0x140 [ 373.787178][T12001] ? apparmor_socket_sendmsg+0x15b/0x270 [ 373.787200][T12001] __sys_sendto+0x48b/0x4e0 [ 373.787219][T12001] ? __pfx_packet_sendmsg+0x10/0x10 [ 373.787239][T12001] ? __pfx___sys_sendto+0x10/0x10 [ 373.787276][T12001] ? fput+0x79/0x100 [ 373.787295][T12001] ? ksys_write+0x1ac/0x250 [ 373.787314][T12001] __ia32_sys_sendto+0xdd/0x1b0 [ 373.787334][T12001] ? __do_fast_syscall_32+0x98/0x970 [ 373.787356][T12001] ? lockdep_hardirqs_on+0x78/0x100 [ 373.787375][T12001] __do_fast_syscall_32+0xe7/0x970 [ 373.787395][T12001] ? lockdep_hardirqs_on+0x78/0x100 [ 373.787416][T12001] do_fast_syscall_32+0x32/0x70 [ 373.787437][T12001] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 373.787458][T12001] RIP: 0023:0xf70aefec [ 373.787476][T12001] Code: Unable to access opcode bytes at 0xf70aefc2. [ 373.787484][T12001] RSP: 002b:00000000f547c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 373.787523][T12001] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 373.787534][T12001] RDX: 000000000000fdef RSI: 0000000000000004 RDI: 0000000080000140 [ 373.787545][T12001] RBP: 0000000000000014 R08: 0000000000000000 R09: 0000000000000000 [ 373.787554][T12001] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 373.787564][T12001] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 373.787586][T12001] [ 373.880818][T12003] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1591'. [ 373.891290][T12003] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 373.937101][T12017] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 374.020335][T12024] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1594'. [ 374.115026][T12035] openvswitch: netlink: Duplicate key (type 6). [ 375.586043][T12065] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1604'. [ 376.279807][T12080] nfs: Deprecated parameter 'nointr' [ 376.425460][T12083] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 376.427436][T12083] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 376.431655][T12083] vhci_hcd vhci_hcd.0: Device attached [ 376.584976][T12093] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 376.588832][T12093] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 376.718594][ T5832] usb 46-1: SetAddress Request (6) to port 0 [ 376.723222][ T5832] usb 46-1: new SuperSpeed USB device number 6 using vhci_hcd [ 376.727204][T12099] openvswitch: netlink: Duplicate key (type 6). [ 377.020074][T12084] vhci_hcd: connection reset by peer [ 377.022484][T11249] vhci_hcd vhci_hcd.4: stop threads [ 377.024434][T11249] vhci_hcd vhci_hcd.4: release socket [ 377.026611][T11249] vhci_hcd vhci_hcd.4: disconnect device [ 377.047256][T12107] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1616'. [ 377.051619][T12107] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1616'. [ 377.342181][T12120] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 377.410782][T12120] lo speed is unknown, defaulting to 1000 [ 378.170931][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.173705][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.310756][T12160] No source specified [ 378.673745][T12173] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1625'. [ 378.852776][T12163] ebtables: wrong size: *len 168, entries_size 48, replsz 48 [ 379.271837][T12194] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 379.274244][T12194] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 379.277596][T12194] vhci_hcd vhci_hcd.0: Device attached [ 379.475581][T12200] vhci_hcd: connection closed [ 379.475866][ T13] vhci_hcd vhci_hcd.4: stop threads [ 379.479770][ T13] vhci_hcd vhci_hcd.4: release socket [ 379.481541][ T13] vhci_hcd vhci_hcd.4: disconnect device [ 379.539404][T12225] netlink: 'syz.1.1639': attribute type 1 has an invalid length. [ 379.563591][T12229] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1637'. [ 379.592577][T12225] bond2: entered promiscuous mode [ 379.594967][T12225] 8021q: adding VLAN 0 to HW filter on device bond2 [ 379.654386][T12266] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1637'. [ 379.660441][T12266] netlink: 30 bytes leftover after parsing attributes in process `syz.3.1637'. [ 379.669264][T12266] netlink: 30 bytes leftover after parsing attributes in process `syz.3.1637'. [ 379.814830][T12282] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 379.816454][T12281] fuse: fd is not a fuse device [ 379.878965][T12286] tipc: Enabled bearer , priority 0 [ 379.881682][T12286] syzkaller0: entered promiscuous mode [ 379.883526][T12286] syzkaller0: entered allmulticast mode [ 379.890159][T12286] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 379.998130][ T5747] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 380.004222][ T5747] CPU: 3 UID: 0 PID: 5747 Comm: kworker/u34:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 380.004255][ T5747] Tainted: [L]=SOFTLOCKUP [ 380.004262][ T5747] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 380.004275][ T5747] Workqueue: hci2 hci_rx_work [ 380.004302][ T5747] Call Trace: [ 380.004309][ T5747] [ 380.004316][ T5747] dump_stack_lvl+0x100/0x190 [ 380.004342][ T5747] sysfs_warn_dup.cold+0x1c/0x28 [ 380.004372][ T5747] sysfs_create_dir_ns+0x24b/0x2b0 [ 380.004400][ T5747] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 380.004427][ T5747] ? find_held_lock+0x2b/0x80 [ 380.004449][ T5747] ? kobject_add_internal+0x25f/0x930 [ 380.004493][ T5747] ? kobject_add_internal+0x25f/0x930 [ 380.004525][ T5747] ? do_raw_spin_unlock+0x145/0x1e0 [ 380.004549][ T5747] kobject_add_internal+0x2c8/0x930 [ 380.004595][ T5747] kobject_add+0x16a/0x1e0 [ 380.004622][ T5747] ? __pfx_kobject_add+0x10/0x10 [ 380.004641][ T5747] ? class_to_subsys+0x10f/0x150 [ 380.004654][ T5747] ? kobject_put+0xb9/0x640 [ 380.004668][ T5747] ? _raw_spin_unlock+0x28/0x50 [ 380.004683][ T5747] device_add+0x294/0x1970 [ 380.004700][ T5747] ? __pfx_dev_set_name+0x10/0x10 [ 380.004711][ T5747] ? __pfx_device_add+0x10/0x10 [ 380.004731][ T5747] ? mgmt_send_event_skb+0x2fb/0x460 [ 380.004753][ T5747] hci_conn_add_sysfs+0x1a3/0x260 [ 380.004768][ T5747] le_conn_complete_evt+0x11eb/0x1f60 [ 380.004785][ T5747] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 380.004796][ T5747] ? hci_event_packet+0x186/0xcd0 [ 380.004811][ T5747] hci_le_conn_complete_evt+0x23c/0x3a0 [ 380.004824][ T5747] ? skb_pull_data+0x15f/0x1e0 [ 380.004837][ T5747] hci_le_meta_evt+0x34a/0x5f0 [ 380.004851][ T5747] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 380.004865][ T5747] hci_event_packet+0x51c/0xcd0 [ 380.004878][ T5747] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 380.004892][ T5747] ? __pfx_hci_event_packet+0x10/0x10 [ 380.004906][ T5747] ? kcov_remote_start+0x384/0x670 [ 380.004920][ T5747] ? lockdep_hardirqs_on+0x78/0x100 [ 380.004937][ T5747] hci_rx_work+0x451/0xfc0 [ 380.004952][ T5747] process_one_work+0xa23/0x1940 [ 380.004974][ T5747] ? __pfx_process_one_work+0x10/0x10 [ 380.004994][ T5747] ? __pfx_hci_rx_work+0x10/0x10 [ 380.005007][ T5747] worker_thread+0x5ef/0xe50 [ 380.005037][ T5747] ? kthread+0x13a/0x450 [ 380.005056][ T5747] ? __pfx_worker_thread+0x10/0x10 [ 380.005081][ T5747] kthread+0x370/0x450 [ 380.005104][ T5747] ? __pfx_kthread+0x10/0x10 [ 380.005130][ T5747] ret_from_fork+0x72b/0xd50 [ 380.005153][ T5747] ? __pfx_ret_from_fork+0x10/0x10 [ 380.005176][ T5747] ? native_load_gs_index+0x1e/0xc0 [ 380.005203][ T5747] ? __switch_to+0x800/0x10f0 [ 380.005232][ T5747] ? __pfx_kthread+0x10/0x10 [ 380.005256][ T5747] ret_from_fork_asm+0x1a/0x30 [ 380.005295][ T5747] [ 380.005417][ T5747] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 380.081390][T12294] tipc: Resetting bearer [ 380.082721][ T5747] Bluetooth: hci2: failed to register connection device [ 380.191665][T12285] tipc: Resetting bearer [ 380.221056][T12285] tipc: Disabling bearer [ 380.496762][T12306] openvswitch: netlink: Duplicate key (type 6). [ 381.170051][T12317] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1652'. [ 381.670966][T12356] fuse: Unknown parameter 'f`' [ 381.740727][T12360] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1664'. [ 381.757985][ T5832] usb 46-1: device descriptor read/8, error -110 [ 381.827177][T12362] netlink: 'syz.0.1665': attribute type 5 has an invalid length. [ 381.927706][T12366] 9pnet_virtio: no channels available for device syz [ 382.057033][ T42] audit: type=1804 audit(1785044701.338:92): pid=12367 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1667" name="cgroup.controllers" dev="tmpfs" ino=2467 res=1 errno=0 [ 382.065841][ T42] audit: type=1800 audit(1785044701.338:93): pid=12367 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1667" name="cgroup.controllers" dev="tmpfs" ino=2467 res=0 errno=0 [ 382.220601][ T5832] usb usb46-port1: attempt power cycle [ 382.417893][T12372] nfs: Deprecated parameter 'nointr' [ 382.447710][T12374] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 382.457145][T12374] CIFS mount error: No usable UNC path provided in device string! [ 382.457145][T12374] [ 382.461584][T12374] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 382.632774][T12383] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 382.634824][T12383] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 382.651189][T12383] vhci_hcd vhci_hcd.0: Device attached [ 382.929058][ T57] usb 40-1: SetAddress Request (30) to port 0 [ 382.938199][ T57] usb 40-1: new SuperSpeed USB device number 30 using vhci_hcd [ 382.958375][ T5832] usb usb46-port1: unable to enumerate USB device [ 383.137394][T12384] vhci_hcd: connection reset by peer [ 383.142300][ T13] vhci_hcd vhci_hcd.1: stop threads [ 383.144630][ T13] vhci_hcd vhci_hcd.1: release socket [ 383.146963][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 383.834506][T12400] syzkaller0: entered promiscuous mode [ 383.836770][T12400] syzkaller0: entered allmulticast mode [ 384.241942][T12409] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1674'. [ 384.306425][T12405] syzkaller0: entered promiscuous mode [ 384.308777][T12405] syzkaller0: entered allmulticast mode [ 384.438128][T12427] nfs: Deprecated parameter 'nointr' [ 384.453868][T12425] lo speed is unknown, defaulting to 1000 [ 384.599155][T12458] netlink: 'syz.4.1680': attribute type 12 has an invalid length. [ 384.607043][T12458] FAULT_INJECTION: forcing a failure. [ 384.607043][T12458] name failslab, interval 1, probability 0, space 0, times 0 [ 384.621152][T12458] CPU: 0 UID: 0 PID: 12458 Comm: syz.4.1680 Tainted: G L syzkaller #0 PREEMPT(full) [ 384.621172][T12458] Tainted: [L]=SOFTLOCKUP [ 384.621175][T12458] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 384.621182][T12458] Call Trace: [ 384.621185][T12458] [ 384.621190][T12458] dump_stack_lvl+0x100/0x190 [ 384.621206][T12458] should_fail_ex.cold+0x5/0xa [ 384.621219][T12458] should_failslab+0xc2/0x120 [ 384.621234][T12458] __kmalloc_noprof+0xfc/0x820 [ 384.621248][T12458] ? rfkill_alloc+0xb1/0x300 [ 384.621269][T12458] rfkill_alloc+0xb1/0x300 [ 384.621293][T12458] wiphy_new_nm+0x136a/0x21a0 [ 384.621310][T12458] ? __pfx_ieee80211_emulate_remove_chanctx+0x10/0x10 [ 384.621325][T12458] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 384.621339][T12458] ? __pfx_mac80211_hwsim_link_info_changed+0x10/0x10 [ 384.621354][T12458] ieee80211_alloc_hw_nm+0x1afc/0x22e0 [ 384.621368][T12458] ? __local_bh_enable_ip+0x9e/0x120 [ 384.621383][T12458] mac80211_hwsim_new_radio+0x1de/0x64c0 [ 384.621398][T12458] ? __pfx__printk+0x10/0x10 [ 384.621408][T12458] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 384.621424][T12458] ? __nla_validate_parse+0x4f9/0x28b0 [ 384.621436][T12458] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 384.621453][T12458] ? __nla_validate_parse+0x1e7/0x28b0 [ 384.621466][T12458] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 384.621485][T12458] hwsim_new_radio_nl+0xc6b/0x13f0 [ 384.621501][T12458] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 384.621520][T12458] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 384.621535][T12458] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 384.621552][T12458] genl_family_rcv_msg_doit+0x214/0x300 [ 384.621580][T12458] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 384.621594][T12458] ? genl_get_cmd+0x3e7/0x760 [ 384.621609][T12458] ? bpf_lsm_capable+0x9/0x10 [ 384.621622][T12458] ? security_capable+0x80/0x260 [ 384.621634][T12458] ? ns_capable+0xd2/0xf0 [ 384.621647][T12458] genl_rcv_msg+0x560/0x800 [ 384.621662][T12458] ? __pfx_genl_rcv_msg+0x10/0x10 [ 384.621676][T12458] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 384.621696][T12458] netlink_rcv_skb+0x159/0x420 [ 384.621707][T12458] ? __pfx_genl_rcv_msg+0x10/0x10 [ 384.621721][T12458] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 384.621739][T12458] ? netlink_deliver_tap+0x1ae/0xcc0 [ 384.621759][T12458] genl_rcv+0x28/0x40 [ 384.621770][T12458] netlink_unicast+0x585/0x850 [ 384.621784][T12458] ? __pfx_netlink_unicast+0x10/0x10 [ 384.621799][T12458] netlink_sendmsg+0x8b0/0xda0 [ 384.621813][T12458] ? __pfx_netlink_sendmsg+0x10/0x10 [ 384.621826][T12458] ? apparmor_socket_sendmsg+0x15b/0x270 [ 384.621841][T12458] ____sys_sendmsg+0xa4d/0xbe0 [ 384.621851][T12458] ? __pfx_netlink_sendmsg+0x10/0x10 [ 384.621863][T12458] ? __pfx_____sys_sendmsg+0x10/0x10 [ 384.621880][T12458] ___sys_sendmsg+0x190/0x1e0 [ 384.621892][T12458] ? __pfx____sys_sendmsg+0x10/0x10 [ 384.621910][T12458] ? find_held_lock+0x2b/0x80 [ 384.621933][T12458] __sys_sendmsg+0x160/0x210 [ 384.621949][T12458] ? __pfx___sys_sendmsg+0x10/0x10 [ 384.621967][T12458] ? __pfx_ksys_write+0x10/0x10 [ 384.621980][T12458] __do_fast_syscall_32+0xe7/0x970 [ 384.621994][T12458] ? lockdep_hardirqs_on+0x78/0x100 [ 384.622007][T12458] do_fast_syscall_32+0x32/0x70 [ 384.622022][T12458] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 384.622036][T12458] RIP: 0023:0xf70aefec [ 384.622050][T12458] Code: Unable to access opcode bytes at 0xf70aefc2. [ 384.622055][T12458] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 384.622066][T12458] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 384.622073][T12458] RDX: 0000000000080000 RSI: 0000000000000000 RDI: 0000000000000000 [ 384.622079][T12458] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 384.622085][T12458] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 384.622091][T12458] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 384.622105][T12458] [ 385.845319][T12491] syzkaller0: entered promiscuous mode [ 385.847097][T12491] syzkaller0: entered allmulticast mode [ 386.121798][T12520] nfs: Deprecated parameter 'nointr' [ 386.298350][ T24] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 386.422209][T12532] syzkaller0: entered promiscuous mode [ 386.426664][T12532] syzkaller0: entered allmulticast mode [ 386.463481][ T24] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 386.472543][ T24] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 386.482446][ T5747] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 386.484439][ T24] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 386.486253][ T5747] Bluetooth: hci2: Injecting HCI hardware error event [ 386.493214][ T5747] Bluetooth: hci2: hardware error 0x00 [ 386.495145][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 386.523230][T12511] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 386.539688][ T24] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 386.692580][T12561] netlink: 204 bytes leftover after parsing attributes in process `syz.0.1695'. [ 386.757046][ T24] usb 9-1: USB disconnect, device number 13 [ 387.190643][T12572] fuse: Unknown parameter '' [ 387.718597][T12613] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1699'. [ 387.741028][T12614] openvswitch: netlink: Duplicate key (type 6). [ 387.859229][T12613] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1699'. [ 387.998946][ T57] usb 40-1: device descriptor read/8, error -110 [ 388.182667][T12621] kAFS: unparsable volume name [ 388.408427][ T57] usb usb40-port1: attempt power cycle [ 388.472849][T12626] netlink: 'syz.1.1702': attribute type 4 has an invalid length. [ 388.573391][ T5747] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 388.870811][T12625] syzkaller0: entered promiscuous mode [ 388.872664][T12625] syzkaller0: entered allmulticast mode [ 389.144736][ T57] usb usb40-port1: unable to enumerate USB device [ 389.543236][T12649] openvswitch: netlink: Duplicate key (type 6). [ 390.362277][T12659] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1707'. [ 390.368874][T12661] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 390.562229][T12667] netlink: 'syz.1.1707': attribute type 12 has an invalid length. [ 392.753657][T12725] binder: 12721:12725 ioctl 6628 0 returned -22 [ 394.043599][T12767] 9pnet_virtio: no channels available for device syz [ 394.063043][T12770] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1729'. [ 394.149409][T12767] FAULT_INJECTION: forcing a failure. [ 394.149409][T12767] name failslab, interval 1, probability 0, space 0, times 0 [ 394.154635][T12767] CPU: 1 UID: 0 PID: 12767 Comm: syz.1.1728 Tainted: G L syzkaller #0 PREEMPT(full) [ 394.154653][T12767] Tainted: [L]=SOFTLOCKUP [ 394.154657][T12767] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 394.154663][T12767] Call Trace: [ 394.154681][T12767] [ 394.154686][T12767] dump_stack_lvl+0x100/0x190 [ 394.154703][T12767] should_fail_ex.cold+0x5/0xa [ 394.154716][T12767] should_failslab+0xc2/0x120 [ 394.154734][T12767] __kmalloc_noprof+0xfc/0x820 [ 394.154749][T12767] ? security_inode_init_security+0x113/0x370 [ 394.154770][T12767] security_inode_init_security+0x113/0x370 [ 394.154789][T12767] ? __pfx_shmem_initxattrs+0x10/0x10 [ 394.154805][T12767] ? __pfx_security_inode_init_security+0x10/0x10 [ 394.154824][T12767] ? privileged_wrt_inode_uidgid+0xc1/0x1d0 [ 394.154837][T12767] ? bpf_lsm_capable+0x9/0x10 [ 394.154852][T12767] shmem_mknod+0x2ce/0x480 [ 394.154869][T12767] ? __pfx_shmem_mknod+0x10/0x10 [ 394.154884][T12767] ? security_inode_permission+0xbf/0x250 [ 394.154899][T12767] ? inode_permission+0x374/0x620 [ 394.154916][T12767] shmem_mkdir+0x31/0x80 [ 394.154932][T12767] vfs_mkdir+0x361/0x850 [ 394.154949][T12767] filename_mkdirat+0x48b/0x5e0 [ 394.154963][T12767] ? __pfx_filename_mkdirat+0x10/0x10 [ 394.154975][T12767] ? strncpy_from_user+0x19d/0x2d0 [ 394.154993][T12767] ? do_getname+0x191/0x390 [ 394.155007][T12767] __ia32_sys_mkdirat+0x88/0xc0 [ 394.155020][T12767] __do_fast_syscall_32+0xe7/0x970 [ 394.155035][T12767] ? lockdep_hardirqs_on+0x78/0x100 [ 394.155048][T12767] do_fast_syscall_32+0x32/0x70 [ 394.155063][T12767] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 394.155078][T12767] RIP: 0023:0xf70aefec [ 394.155090][T12767] Code: Unable to access opcode bytes at 0xf70aefc2. [ 394.155095][T12767] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000128 [ 394.155111][T12767] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800004c0 [ 394.155118][T12767] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 394.155124][T12767] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 394.155130][T12767] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 394.155137][T12767] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 394.155150][T12767] [ 394.268135][T12778] lo: entered allmulticast mode [ 394.271295][T12778] lo: left allmulticast mode [ 394.515424][T12778] bond0: entered promiscuous mode [ 394.524666][T12778] dummy0: entered promiscuous mode [ 394.545355][T12778] batadv0: entered promiscuous mode [ 394.570360][T12778] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 394.589544][T12778] bond0: left promiscuous mode [ 394.591245][T12778] dummy0: left promiscuous mode [ 394.594131][T12778] batadv0: left promiscuous mode [ 394.740160][T12798] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1734'. [ 394.754919][T12796] bridge3: entered promiscuous mode [ 394.757222][T12796] bridge3: entered allmulticast mode [ 394.884513][T12809] syz.4.1736 (12809): drop_caches: 0 [ 394.896839][T12809] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1736'. [ 394.900843][T12809] IPv6: NLM_F_CREATE should be specified when creating new route [ 394.904500][T12809] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 394.906808][T12809] IPv6: NLM_F_CREATE should be set when creating new route [ 394.909501][T12809] IPv6: NLM_F_CREATE should be set when creating new route [ 395.855372][T12846] 9pnet_virtio: no channels available for device syz [ 396.740480][T12865] siw: device registration error -23 [ 397.051243][T12868] syz_tun: entered allmulticast mode [ 398.292681][T12900] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1761'. [ 398.305452][T12900] netlink: 341 bytes leftover after parsing attributes in process `syz.3.1761'. [ 399.374958][T12945] netlink: 'syz.1.1776': attribute type 3 has an invalid length. [ 399.602620][T12956] netlink: 'syz.4.1775': attribute type 10 has an invalid length. [ 399.605448][T12956] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1775'. [ 399.762516][T12959] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1775'. [ 400.629690][T12989] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1784'. [ 401.270382][T13002] fuse: fd is not a fuse device [ 407.641806][T13136] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1813'. [ 407.641856][T13125] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1813'. [ 407.712590][T13136] 8021q: adding VLAN 0 to HW filter on device bond1 [ 407.769262][T13138] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 407.775725][T13138] bond1: (slave batadv0): Enslaving as an active interface with an up link [ 407.918832][T13191] siw: device registration error -23 [ 408.373139][T13194] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1817'. [ 409.501505][T13208] comedi comedi3: comedi_config --init_data is deprecated [ 410.256135][T13234] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 410.842419][T13306] team0: left allmulticast mode [ 410.844545][T13306] team_slave_0: left allmulticast mode [ 410.846354][T13306] team_slave_1: left allmulticast mode [ 410.852855][T13306] team0: left promiscuous mode [ 410.855549][T13306] team_slave_0: left promiscuous mode [ 410.857590][T13306] team_slave_1: left promiscuous mode [ 410.861395][T13306] bridge0: port 3(team0) entered disabled state [ 410.871007][T13306] bond0: (slave dummy0): Releasing active interface [ 410.882698][T13306] bridge_slave_0: left allmulticast mode [ 410.884995][T13306] bridge_slave_0: left promiscuous mode [ 410.887369][T13306] bridge0: port 1(bridge_slave_0) entered disabled state [ 410.904387][T13306] bridge_slave_1: left allmulticast mode [ 410.920270][T13306] bridge_slave_1: left promiscuous mode [ 410.926363][T13306] bridge0: port 2(bridge_slave_1) entered disabled state [ 410.950645][T13306] team0: Port device team_slave_0 removed [ 410.959749][T13306] team0: Port device team_slave_1 removed [ 410.963199][T13306] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 410.966394][T13306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 410.973589][T13306] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 410.976720][T13306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 410.982281][T13306] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 411.003980][T13307] team0: Device xfrm0 is of different type [ 411.016989][T13315] tipc: Enabled bearer , priority 0 [ 411.847234][T13327] netlink: 'syz.0.1840': attribute type 12 has an invalid length. [ 412.099507][T10384] tipc: Node number set to 1284139331 [ 413.071845][T13359] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 413.075820][T13359] ALSA: mixer_oss: invalid index 137438 [ 413.261118][T13369] netlink: 'syz.4.1846': attribute type 12 has an invalid length. [ 413.266750][T13369] FAULT_INJECTION: forcing a failure. [ 413.266750][T13369] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 413.273617][T13369] CPU: 2 UID: 0 PID: 13369 Comm: syz.4.1846 Tainted: G L syzkaller #0 PREEMPT(full) [ 413.273636][T13369] Tainted: [L]=SOFTLOCKUP [ 413.273640][T13369] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 413.273647][T13369] Call Trace: [ 413.273651][T13369] [ 413.273655][T13369] dump_stack_lvl+0x100/0x190 [ 413.273673][T13369] should_fail_ex.cold+0x5/0xa [ 413.273684][T13369] ? prepare_alloc_pages+0x16d/0x5f0 [ 413.273703][T13369] should_fail_alloc_page+0xeb/0x140 [ 413.273720][T13369] prepare_alloc_pages+0x1f0/0x5f0 [ 413.273739][T13369] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 413.273755][T13369] ? __css_rstat_updated+0x1ce/0x5a0 [ 413.273776][T13369] ? __lock_acquire+0x49f/0x1a40 [ 413.273795][T13369] ? __lock_acquire+0x49f/0x1a40 [ 413.273813][T13369] ? trace_pelt_se_tp+0x143/0x1a0 [ 413.273829][T13369] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 413.273845][T13369] ? lock_acquire+0x1b9/0x370 [ 413.273863][T13369] ? find_held_lock+0x2b/0x80 [ 413.273879][T13369] ? mark_held_locks+0x40/0x70 [ 413.273898][T13369] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 413.273913][T13369] ? rcu_is_watching+0x12/0xc0 [ 413.273928][T13369] ? trace_sched_exit_tp+0x120/0x160 [ 413.273942][T13369] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 413.273960][T13369] ? policy_nodemask+0xed/0x4f0 [ 413.273979][T13369] alloc_pages_mpol+0x1fb/0x540 [ 413.273996][T13369] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 413.274014][T13369] ? tick_nohz_tick_stopped+0x6c/0xa0 [ 413.274041][T13369] ? __pfx_mac80211_hwsim_link_info_changed+0x10/0x10 [ 413.274057][T13369] ___kmalloc_large_node+0xe5/0x120 [ 413.274074][T13369] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 413.274090][T13369] __kmalloc_large_node_noprof+0x1c/0x70 [ 413.274108][T13369] ? __pfx_ieee80211_emulate_remove_chanctx+0x10/0x10 [ 413.274123][T13369] __kmalloc_noprof+0x5a1/0x820 [ 413.274136][T13369] ? irq_work_queue+0xce/0x100 [ 413.274147][T13369] ? wiphy_new_nm+0x701/0x21a0 [ 413.274165][T13369] ? __pfx_ieee80211_emulate_remove_chanctx+0x10/0x10 [ 413.274180][T13369] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 413.274195][T13369] ? __pfx_mac80211_hwsim_link_info_changed+0x10/0x10 [ 413.274209][T13369] wiphy_new_nm+0x701/0x21a0 [ 413.274225][T13369] ? __pfx_ieee80211_emulate_remove_chanctx+0x10/0x10 [ 413.274240][T13369] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 413.274254][T13369] ? __pfx_mac80211_hwsim_link_info_changed+0x10/0x10 [ 413.274268][T13369] ieee80211_alloc_hw_nm+0x1afc/0x22e0 [ 413.274281][T13369] ? __local_bh_enable_ip+0x9e/0x120 [ 413.274296][T13369] mac80211_hwsim_new_radio+0x1de/0x64c0 [ 413.274311][T13369] ? __pfx__printk+0x10/0x10 [ 413.274324][T13369] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 413.274340][T13369] ? __nla_validate_parse+0x4f9/0x28b0 [ 413.274352][T13369] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 413.274369][T13369] ? __nla_validate_parse+0x1e7/0x28b0 [ 413.274381][T13369] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 413.274401][T13369] hwsim_new_radio_nl+0xc6b/0x13f0 [ 413.274417][T13369] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 413.274436][T13369] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 413.274451][T13369] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 413.274468][T13369] genl_family_rcv_msg_doit+0x214/0x300 [ 413.274483][T13369] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 413.274496][T13369] ? genl_get_cmd+0x3e7/0x760 [ 413.274533][T13369] ? bpf_lsm_capable+0x9/0x10 [ 413.274546][T13369] ? security_capable+0x80/0x260 [ 413.274558][T13369] ? ns_capable+0xd2/0xf0 [ 413.274570][T13369] genl_rcv_msg+0x560/0x800 [ 413.274585][T13369] ? __pfx_genl_rcv_msg+0x10/0x10 [ 413.274599][T13369] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 413.274618][T13369] netlink_rcv_skb+0x159/0x420 [ 413.274630][T13369] ? __pfx_genl_rcv_msg+0x10/0x10 [ 413.274644][T13369] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 413.274661][T13369] ? netlink_deliver_tap+0x1ae/0xcc0 [ 413.274681][T13369] genl_rcv+0x28/0x40 [ 413.274693][T13369] netlink_unicast+0x585/0x850 [ 413.274706][T13369] ? __pfx_netlink_unicast+0x10/0x10 [ 413.274722][T13369] netlink_sendmsg+0x8b0/0xda0 [ 413.274738][T13369] ? __pfx_netlink_sendmsg+0x10/0x10 [ 413.274751][T13369] ? apparmor_socket_sendmsg+0x15b/0x270 [ 413.274766][T13369] ____sys_sendmsg+0xa4d/0xbe0 [ 413.274776][T13369] ? __pfx_netlink_sendmsg+0x10/0x10 [ 413.274788][T13369] ? __pfx_____sys_sendmsg+0x10/0x10 [ 413.274805][T13369] ___sys_sendmsg+0x190/0x1e0 [ 413.274818][T13369] ? __pfx____sys_sendmsg+0x10/0x10 [ 413.274836][T13369] ? find_held_lock+0x2b/0x80 [ 413.274858][T13369] __sys_sendmsg+0x160/0x210 [ 413.274873][T13369] ? __pfx___sys_sendmsg+0x10/0x10 [ 413.274892][T13369] ? __pfx_ksys_write+0x10/0x10 [ 413.274908][T13369] __do_fast_syscall_32+0xe7/0x970 [ 413.274925][T13369] ? lockdep_hardirqs_on+0x78/0x100 [ 413.274944][T13369] do_fast_syscall_32+0x32/0x70 [ 413.274966][T13369] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 413.274985][T13369] RIP: 0023:0xf70aefec [ 413.275005][T13369] Code: Unable to access opcode bytes at 0xf70aefc2. [ 413.275011][T13369] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 413.275033][T13369] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 413.275043][T13369] RDX: 0000000000080000 RSI: 0000000000000000 RDI: 0000000000000000 [ 413.275051][T13369] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 413.275060][T13369] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 413.275071][T13369] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 413.275094][T13369] [ 413.449642][T13373] block device autoloading is deprecated and will be removed. [ 413.555106][ T24] libceph: connect (1)[c::]:6789 error -101 [ 413.558353][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 413.572057][T13375] ceph: No mds server is up or the cluster is laggy [ 413.598110][T13376] fuse: Unknown parameter '000000000000000000000070x000000000000000b' [ 414.818518][T13428] FAULT_INJECTION: forcing a failure. [ 414.818518][T13428] name failslab, interval 1, probability 0, space 0, times 0 [ 414.826014][T13428] CPU: 2 UID: 0 PID: 13428 Comm: syz.1.1862 Tainted: G L syzkaller #0 PREEMPT(full) [ 414.826035][T13428] Tainted: [L]=SOFTLOCKUP [ 414.826039][T13428] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 414.826052][T13428] Call Trace: [ 414.826056][T13428] [ 414.826061][T13428] dump_stack_lvl+0x100/0x190 [ 414.826078][T13428] should_fail_ex.cold+0x5/0xa [ 414.826092][T13428] should_failslab+0xc2/0x120 [ 414.826110][T13428] kmem_cache_alloc_noprof+0x91/0x6a0 [ 414.826124][T13428] ? __pfx_map_id_range_down+0x10/0x10 [ 414.826141][T13428] ? security_inode_alloc+0x3b/0x2c0 [ 414.826158][T13428] security_inode_alloc+0x3b/0x2c0 [ 414.826172][T13428] inode_init_always_gfp+0xc77/0xfb0 [ 414.826186][T13428] alloc_inode+0x8e/0x250 [ 414.826202][T13428] new_inode+0x22/0x1c0 [ 414.826218][T13428] debugfs_create_dir+0xc4/0x440 [ 414.826237][T13428] ieee80211_debugfs_key_add+0x187/0x6f0 [ 414.826268][T13428] ? __pfx_ieee80211_debugfs_key_add+0x10/0x10 [ 414.826291][T13428] ? ieee80211_key_replace+0x668/0x3490 [ 414.826314][T13428] ieee80211_key_link+0x613/0x1550 [ 414.826337][T13428] ? __pfx_ieee80211_key_link+0x10/0x10 [ 414.826357][T13428] ? find_held_lock+0x2b/0x80 [ 414.826371][T13428] ? sta_info_get_bss+0x266/0x440 [ 414.826389][T13428] ieee80211_add_key+0x50a/0xd20 [ 414.826403][T13428] ? nl80211_remain_on_channel+0xb62/0xb80 [ 414.826422][T13428] rdev_add_key+0xf9/0x330 [ 414.826437][T13428] nl80211_new_key+0x3eb/0x7d0 [ 414.826456][T13428] ? __pfx_nl80211_new_key+0x10/0x10 [ 414.826479][T13428] ? nl80211_pre_doit+0x19a/0xae0 [ 414.826495][T13428] genl_family_rcv_msg_doit+0x214/0x300 [ 414.826512][T13428] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 414.826526][T13428] ? genl_get_cmd+0x3e7/0x760 [ 414.826543][T13428] ? bpf_lsm_capable+0x9/0x10 [ 414.826558][T13428] ? security_capable+0x80/0x260 [ 414.826571][T13428] ? ns_capable+0xd2/0xf0 [ 414.826584][T13428] genl_rcv_msg+0x560/0x800 [ 414.826600][T13428] ? __pfx_genl_rcv_msg+0x10/0x10 [ 414.826614][T13428] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 414.826627][T13428] ? __pfx_nl80211_new_key+0x10/0x10 [ 414.826643][T13428] ? __pfx_nl80211_post_doit+0x10/0x10 [ 414.826663][T13428] netlink_rcv_skb+0x159/0x420 [ 414.826675][T13428] ? __pfx_genl_rcv_msg+0x10/0x10 [ 414.826689][T13428] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 414.826708][T13428] ? netlink_deliver_tap+0x1ae/0xcc0 [ 414.826730][T13428] genl_rcv+0x28/0x40 [ 414.826742][T13428] netlink_unicast+0x585/0x850 [ 414.826757][T13428] ? __pfx_netlink_unicast+0x10/0x10 [ 414.826773][T13428] netlink_sendmsg+0x8b0/0xda0 [ 414.826788][T13428] ? __pfx_netlink_sendmsg+0x10/0x10 [ 414.826802][T13428] ? apparmor_socket_sendmsg+0x15b/0x270 [ 414.826819][T13428] ____sys_sendmsg+0xa4d/0xbe0 [ 414.826829][T13428] ? __pfx_netlink_sendmsg+0x10/0x10 [ 414.826842][T13428] ? __pfx_____sys_sendmsg+0x10/0x10 [ 414.826861][T13428] ___sys_sendmsg+0x190/0x1e0 [ 414.826873][T13428] ? __pfx____sys_sendmsg+0x10/0x10 [ 414.826892][T13428] ? find_held_lock+0x2b/0x80 [ 414.826916][T13428] __sys_sendmsg+0x160/0x210 [ 414.826933][T13428] ? __pfx___sys_sendmsg+0x10/0x10 [ 414.826952][T13428] ? __pfx_ksys_write+0x10/0x10 [ 414.826966][T13428] __do_fast_syscall_32+0xe7/0x970 [ 414.826981][T13428] ? lockdep_hardirqs_on+0x78/0x100 [ 414.826995][T13428] do_fast_syscall_32+0x32/0x70 [ 414.827010][T13428] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 414.827025][T13428] RIP: 0023:0xf70aefec [ 414.827039][T13428] Code: Unable to access opcode bytes at 0xf70aefc2. [ 414.827044][T13428] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 414.827061][T13428] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800006c0 [ 414.827068][T13428] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 414.827075][T13428] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 414.827081][T13428] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 414.827088][T13428] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 414.827102][T13428] [ 414.953271][T13428] debugfs: out of free dentries, can not create directory '0' [ 414.986464][T13430] binder: 13429:13430 unknown command 0 [ 414.988423][T13430] binder: 13429:13430 ioctl c0306201 800002c0 returned -22 [ 415.209174][T13437] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1860'. [ 415.215872][T13437] dummy0: left allmulticast mode [ 415.228222][T13437] dummy0: left promiscuous mode [ 415.234561][T13437] bridge0: port 3(dummy0) entered disabled state [ 415.260172][T13437] bridge_slave_1: left allmulticast mode [ 415.267118][T13437] bridge_slave_1: left promiscuous mode [ 415.327749][T13437] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.379692][T13437] bridge_slave_0: left allmulticast mode [ 415.399139][T13437] bridge_slave_0: left promiscuous mode [ 415.424419][T13437] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.726640][ T5747] Bluetooth: hci4: unexpected event for opcode 0x1408 [ 416.295063][T13456] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1866'. [ 416.300411][T13456] siw: device registration error -23 [ 416.416091][T13458] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1867'. [ 416.420105][T13458] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1867'. [ 416.424010][T13458] netlink: 'syz.0.1867': attribute type 18 has an invalid length. [ 416.527028][T13463] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1867'. [ 416.530297][T13463] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1867'. [ 416.533459][T13463] netlink: 'syz.0.1867': attribute type 18 has an invalid length. [ 417.725540][T13504] netlink: 'syz.3.1876': attribute type 1 has an invalid length. [ 417.749110][T13504] lo speed is unknown, defaulting to 1000 [ 418.148437][T13537] binder: 13535:13537 ioctl 40044591 80000280 returned -22 [ 418.629771][T13547] tipc: Enabling of bearer rejected, failed to enable media [ 418.803627][T13555] binder: BINDER_SET_CONTEXT_MGR already set [ 418.810051][T13555] binder: 13554:13555 ioctl 4018620d 80000040 returned -16 [ 421.342405][T13622] input: syz0 as /devices/virtual/input/input53 [ 421.696018][T13639] x_tables: duplicate underflow at hook 1 [ 421.708073][ T24] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 423.119520][T13667] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1910'. [ 423.200379][T13668] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1909'. [ 424.625679][T13712] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1920'. [ 425.229083][T13712] 8021q: adding VLAN 0 to HW filter on device bond1 [ 425.237426][T13713] bond1: entered allmulticast mode [ 425.355602][T13758] lo speed is unknown, defaulting to 1000 [ 425.862221][T13804] Option 'D' to dns_resolver key: bad/missing value [ 425.968396][T13808] 9pnet_virtio: no channels available for device syz [ 425.968406][T13807] 9pnet_virtio: no channels available for device syz [ 426.132411][ T5747] Bluetooth: hci4: adv larger than maximum supported [ 426.214064][T13814] overlay: Unknown parameter 'fsuuid' [ 426.785436][T13824] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1936'. [ 427.706555][T13831] overlayfs: failed to resolve './bus': -2 [ 428.653286][T13846] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1940'. [ 428.685771][T13850] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1940'. [ 428.790229][T13860] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1944'. [ 429.208988][T13872] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1946'. [ 429.226294][T13872] 8021q: adding VLAN 0 to HW filter on device bond2 [ 429.986616][T13924] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1953'. [ 430.023092][T13926] tipc: Enabling of bearer rejected, failed to enable media [ 430.951574][T13947] tipc: Enabled bearer , priority 0 [ 430.959192][T13947] syzkaller0: entered promiscuous mode [ 430.960959][T13947] syzkaller0: entered allmulticast mode [ 430.974829][T13947] syzkaller0: MTU too low for tipc bearer [ 430.977191][T13947] tipc: Disabling bearer [ 431.113887][T13955] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1959'. [ 431.358745][T13966] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1962'. [ 431.398831][T13969] fuse: fd is not a fuse device [ 431.640202][T13987] binder: 13986:13987 unknown command 0 [ 431.644771][T13987] binder: 13986:13987 ioctl c0306201 800002c0 returned -22 [ 431.746108][T13991] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1968'. [ 432.449527][T14013] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1971'. [ 432.465646][T14013] siw: device registration error -23 [ 432.600187][T14011] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1972'. [ 433.570615][T14046] 9pnet_virtio: no channels available for device syz [ 433.642924][T12589] Bluetooth: hci3: Frame reassembly failed (-84) [ 433.656660][T14046] overlayfs: failed to resolve './file1': -2 [ 434.640131][T14063] __nla_validate_parse: 2 callbacks suppressed [ 434.640143][T14063] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1986'. [ 434.752443][T14066] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1987'. [ 434.757274][T14066] siw: device registration error -23 [ 435.140279][T14086] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 435.147432][T14086] kvm: pic: level sensitive irq not supported [ 435.148819][T14086] kvm: pic: non byte read [ 435.154539][T14086] kvm: pic: level sensitive irq not supported [ 435.154794][T14086] kvm: pic: non byte read [ 435.160826][T14086] kvm: pic: level sensitive irq not supported [ 435.161106][T14086] kvm: pic: non byte read [ 435.167639][T14086] kvm: pic: level sensitive irq not supported [ 435.168761][T14086] kvm: pic: non byte read [ 435.173422][T14086] kvm: pic: level sensitive irq not supported [ 435.173701][T14086] kvm: pic: non byte read [ 435.178836][T14086] kvm: pic: level sensitive irq not supported [ 435.179173][T14086] kvm: pic: non byte read [ 435.184184][T14086] kvm: pic: level sensitive irq not supported [ 435.184455][T14086] kvm: pic: non byte read [ 435.188989][T14086] kvm: pic: level sensitive irq not supported [ 435.189264][T14086] kvm: pic: non byte read [ 435.194039][T14086] kvm: pic: level sensitive irq not supported [ 435.194352][T14086] kvm: pic: non byte read [ 435.199230][T14086] kvm: pic: level sensitive irq not supported [ 435.199554][T14086] kvm: pic: non byte read [ 435.678406][ T5743] Bluetooth: hci3: command 0x1003 tx timeout [ 435.683297][ T5747] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 436.720428][T14127] syz.1.2000 (14127) used obsolete PPPIOCDETACH ioctl [ 436.978303][T14113] syzkaller0: entered promiscuous mode [ 436.980134][T14113] syzkaller0: entered allmulticast mode [ 437.216042][T14116] syzkaller0: entered promiscuous mode [ 437.217694][T14116] syzkaller0: entered allmulticast mode [ 437.512128][T14151] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 437.929068][T14177] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2013'. [ 437.938841][T14177] siw: device registration error -23 [ 437.996356][T14184] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.2012'. [ 438.008766][T14184] openvswitch: netlink: Message has 512 unknown bytes. [ 438.161505][T14184] lo speed is unknown, defaulting to 1000 [ 438.702679][T14188] syzkaller0: entered promiscuous mode [ 438.705052][T14188] syzkaller0: entered allmulticast mode [ 438.729035][T14221] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2016'. [ 438.817473][ T7187] libceph: connect (1)[c::]:6789 error -101 [ 438.820572][ T7187] libceph: mon0 (1)[c::]:6789 connect error [ 438.823167][ T7187] libceph: connect (1)[c::]:6789 error -101 [ 438.827528][ T7187] libceph: mon0 (1)[c::]:6789 connect error [ 439.044564][T14208] ceph: No mds server is up or the cluster is laggy [ 439.091558][ T7187] libceph: connect (1)[c::]:6789 error -101 [ 439.094194][ T7187] libceph: mon0 (1)[c::]:6789 connect error [ 439.293663][T14249] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 439.296219][T14249] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 439.330777][T14249] vhci_hcd vhci_hcd.0: Device attached [ 439.457941][ T0] NOHZ tick-stop error: local softirq work is pending, handler #212!!! [ 439.504016][T14259] FAULT_INJECTION: forcing a failure. [ 439.504016][T14259] name failslab, interval 1, probability 0, space 0, times 0 [ 439.508394][T14259] CPU: 2 UID: 0 PID: 14259 Comm: syz.1.2020 Tainted: G L syzkaller #0 PREEMPT(full) [ 439.508426][T14259] Tainted: [L]=SOFTLOCKUP [ 439.508430][T14259] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 439.508437][T14259] Call Trace: [ 439.508442][T14259] [ 439.508447][T14259] dump_stack_lvl+0x100/0x190 [ 439.508463][T14259] should_fail_ex.cold+0x5/0xa [ 439.508480][T14259] should_failslab+0xc2/0x120 [ 439.508503][T14259] kmem_cache_alloc_noprof+0x91/0x6a0 [ 439.508523][T14259] ? preempt_schedule_thunk+0x16/0x40 [ 439.508550][T14259] ? dqget+0x6b4/0xe30 [ 439.508579][T14259] dqget+0x6b4/0xe30 [ 439.508606][T14259] ? __pfx_dqget+0x10/0x10 [ 439.508638][T14259] dquot_transfer+0x3a2/0x6b0 [ 439.508665][T14259] ? __pfx_dquot_transfer+0x10/0x10 [ 439.508689][T14259] ? capable_wrt_inode_uidgid+0xde/0x170 [ 439.508711][T14259] ? __pfx_make_vfsuid+0x10/0x10 [ 439.508735][T14259] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 439.508761][T14259] shmem_setattr+0x5a2/0x1140 [ 439.508780][T14259] ? __pfx_shmem_setattr+0x10/0x10 [ 439.508792][T14259] notify_change+0xb25/0x1330 [ 439.508813][T14259] chown_common+0x51e/0x6e0 [ 439.508829][T14259] ? __pfx_chown_common+0x10/0x10 [ 439.508843][T14259] ? mnt_get_write_access+0x52/0x2f0 [ 439.508862][T14259] ? mnt_get_write_access+0x1e9/0x2f0 [ 439.508879][T14259] do_fchownat+0x18e/0x1f0 [ 439.508893][T14259] ? __pfx_do_fchownat+0x10/0x10 [ 439.508908][T14259] ? exit_to_user_mode_loop+0x166/0x6f0 [ 439.508921][T14259] __ia32_sys_lchown16+0xe6/0x120 [ 439.508940][T14259] __do_fast_syscall_32+0xe7/0x970 [ 439.508954][T14259] ? lockdep_hardirqs_on+0x78/0x100 [ 439.508968][T14259] do_fast_syscall_32+0x32/0x70 [ 439.508982][T14259] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 439.508996][T14259] RIP: 0023:0xf70aefec [ 439.509010][T14259] Code: Unable to access opcode bytes at 0xf70aefc2. [ 439.509014][T14259] RSP: 002b:00000000f547c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000010 [ 439.509025][T14259] RAX: ffffffffffffffda RBX: 0000000080000080 RCX: 000000000000ee01 [ 439.509032][T14259] RDX: 00000000ffffffff RSI: 0000000000000000 RDI: 0000000000000000 [ 439.509038][T14259] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 439.509044][T14259] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 439.509050][T14259] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 439.509064][T14259] [ 439.642055][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.644717][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.647987][ T1482] usb 39-1: new high-speed USB device number 2 using vhci_hcd [ 439.764803][T14267] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2022'. [ 440.124932][T14250] vhci_hcd: connection reset by peer [ 440.127609][ T13] vhci_hcd vhci_hcd.1: stop threads [ 440.131076][ T13] vhci_hcd vhci_hcd.1: release socket [ 440.133651][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 440.754565][ T57] libceph: connect (1)[c::]:6789 error -101 [ 440.760130][ T57] libceph: mon0 (1)[c::]:6789 connect error [ 440.903330][T14288] ceph: No mds server is up or the cluster is laggy [ 440.978559][T14303] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2028'. [ 440.982291][T14303] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2028'. [ 441.022969][T14305] ptrace attach of "/syz-executor exec"[5740] was attempted by " [ 441.167903][T14316] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 441.410203][T14329] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2035'. [ 441.413868][T14329] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2035'. [ 441.635916][T14334] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2035'. [ 441.777491][ T5747] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 441.784970][ T5747] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 441.788714][ T5747] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 441.791821][ T5747] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 441.794890][ T5747] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 441.995325][T14341] lo speed is unknown, defaulting to 1000 [ 442.217614][T14341] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.219941][T14341] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.222711][T14341] bridge_slave_0: entered allmulticast mode [ 442.225355][T14341] bridge_slave_0: entered promiscuous mode [ 442.234043][T14341] bridge0: port 2(bridge_slave_1) entered blocking state [ 442.238906][T14341] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.241934][T14341] bridge_slave_1: entered allmulticast mode [ 442.245369][T14341] bridge_slave_1: entered promiscuous mode [ 442.284986][T14341] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 442.293744][T14341] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 442.312276][T14341] team0: Port device team_slave_0 added [ 442.315330][T14341] team0: Port device team_slave_1 added [ 442.387675][T14341] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 442.390524][T14341] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 442.399072][T14341] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 442.409825][T14341] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 442.412396][T14341] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 442.421110][T14341] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 442.457171][T14341] hsr_slave_0: entered promiscuous mode [ 442.459593][T14341] hsr_slave_1: entered promiscuous mode [ 442.462104][T14341] debugfs: 'hsr0' already exists in 'hsr' [ 442.463907][T14341] Cannot create hsr debugfs directory [ 442.649442][T14341] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 442.653575][T14341] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 45771 - 0 [ 442.656690][T14341] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 442.830248][T14341] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 442.834342][T14341] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 45771 - 0 [ 442.838513][T14341] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 442.903109][T14341] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 442.906271][T14341] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 45771 - 0 [ 442.909454][T14341] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 442.967120][T14520] syzkaller0: entered promiscuous mode [ 442.968933][T14520] syzkaller0: entered allmulticast mode [ 443.175333][T14341] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 443.179661][T14341] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 45771 - 0 [ 443.186487][T14341] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 443.406241][T14608] syzkaller0: entered promiscuous mode [ 443.408518][T14608] syzkaller0: entered allmulticast mode [ 443.530097][T14341] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 443.535728][T14341] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 443.538757][T14341] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 443.543883][T14341] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 443.546583][T14341] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 443.554441][T14341] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 443.570691][T14341] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 443.576795][T14341] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 443.620544][T14341] 8021q: adding VLAN 0 to HW filter on device bond0 [ 443.631916][T14341] 8021q: adding VLAN 0 to HW filter on device team0 [ 443.637051][T12595] bridge0: port 1(bridge_slave_0) entered blocking state [ 443.639450][T12595] bridge0: port 1(bridge_slave_0) entered forwarding state [ 443.644928][T12595] bridge0: port 2(bridge_slave_1) entered blocking state [ 443.647262][T12595] bridge0: port 2(bridge_slave_1) entered forwarding state [ 443.670630][T14341] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 443.812722][T14678] bridge_slave_0: left allmulticast mode [ 443.814781][T14678] bridge_slave_0: left promiscuous mode [ 443.816619][T14678] bridge0: port 1(bridge_slave_0) entered disabled state [ 443.823564][T14678] bridge_slave_1: left allmulticast mode [ 443.825411][T14678] bridge_slave_1: left promiscuous mode [ 443.828806][T14678] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.836871][T14676] FAULT_INJECTION: forcing a failure. [ 443.836871][T14676] name failslab, interval 1, probability 0, space 0, times 0 [ 443.847520][T14676] CPU: 3 UID: 0 PID: 14676 Comm: syz.1.2045 Tainted: G L syzkaller #0 PREEMPT(full) [ 443.847550][T14676] Tainted: [L]=SOFTLOCKUP [ 443.847563][T14676] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 443.847572][T14676] Call Trace: [ 443.847578][T14676] [ 443.847585][T14676] dump_stack_lvl+0x100/0x190 [ 443.847609][T14676] should_fail_ex.cold+0x5/0xa [ 443.847629][T14676] should_failslab+0xc2/0x120 [ 443.847653][T14676] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 443.847676][T14676] ? __alloc_skb+0x140/0x710 [ 443.847702][T14676] __alloc_skb+0x140/0x710 [ 443.847721][T14676] ? __alloc_skb+0x5b7/0x710 [ 443.847741][T14676] ? __pfx___alloc_skb+0x10/0x10 [ 443.847761][T14676] ? __pfx__copy_to_iter+0x10/0x10 [ 443.847810][T14676] netlink_dump+0x194/0xd00 [ 443.847831][T14676] ? __pfx_netlink_dump+0x10/0x10 [ 443.847858][T14676] ? skb_copy_datagram_iter+0xa1/0x250 [ 443.847880][T14676] netlink_recvmsg+0x7dc/0xa90 [ 443.847898][T14676] ? __pfx_netlink_recvmsg+0x10/0x10 [ 443.847915][T14676] ? is_bpf_text_address+0x8a/0x1a0 [ 443.847944][T14676] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 443.847965][T14676] ? __pfx_netlink_recvmsg+0x10/0x10 [ 443.847983][T14676] sock_recvmsg+0x1d5/0x220 [ 443.848001][T14676] ____sys_recvmsg+0x21e/0x670 [ 443.848022][T14676] ? __pfx_____sys_recvmsg+0x10/0x10 [ 443.848050][T14676] ? __lock_acquire+0x49f/0x1a40 [ 443.848081][T14676] ___sys_recvmsg+0x16a/0x1a0 [ 443.848099][T14676] ? __pfx____sys_recvmsg+0x10/0x10 [ 443.848139][T14676] do_recvmmsg+0x54d/0x740 [ 443.848161][T14676] ? __pfx_do_recvmmsg+0x10/0x10 [ 443.848181][T14676] ? find_held_lock+0x2b/0x80 [ 443.848202][T14676] ? ksys_write+0x190/0x250 [ 443.848217][T14676] ? ksys_write+0x190/0x250 [ 443.848243][T14676] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 443.848268][T14676] __sys_recvmmsg+0x21f/0x270 [ 443.848291][T14676] ? __pfx___sys_recvmmsg+0x10/0x10 [ 443.848317][T14676] ? ksys_write+0x1ac/0x250 [ 443.848334][T14676] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 443.848361][T14676] ? __do_fast_syscall_32+0x98/0x970 [ 443.848382][T14676] ? lockdep_hardirqs_on+0x78/0x100 [ 443.848403][T14676] __do_fast_syscall_32+0xe7/0x970 [ 443.848422][T14676] ? lockdep_hardirqs_on+0x78/0x100 [ 443.848443][T14676] do_fast_syscall_32+0x32/0x70 [ 443.848463][T14676] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 443.848485][T14676] RIP: 0023:0xf70aefec [ 443.848504][T14676] Code: Unable to access opcode bytes at 0xf70aefc2. [ 443.848511][T14676] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 443.848527][T14676] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000ec0 [ 443.848538][T14676] RDX: 0000000000000001 RSI: 0000000000012022 RDI: 0000000000000000 [ 443.848548][T14676] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 443.848563][T14676] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 443.848573][T14676] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 443.848597][T14676] [ 443.850422][ T5743] Bluetooth: hci3: command tx timeout [ 443.852588][T14678] bond0: (slave bond_slave_0): Releasing backup interface [ 443.971189][T14678] bond0: (slave c@0Ù): Releasing backup interface [ 443.980075][T14678] team0: Port device team_slave_0 removed [ 443.984328][T14678] team0: Port device team_slave_1 removed [ 443.988587][T14678] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 443.991239][T14678] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 443.994584][T14678] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 444.007918][T14678] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 444.011958][T14678] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 444.128323][T14341] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 444.199108][T14711] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 444.367947][ T5894] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 444.382849][T14341] veth0_vlan: entered promiscuous mode [ 444.449762][T14341] veth1_vlan: entered promiscuous mode [ 444.519952][T14341] veth0_macvtap: entered promiscuous mode [ 444.529717][T14341] veth1_macvtap: entered promiscuous mode [ 444.538878][T14341] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 444.539445][ T5894] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 444.549809][T14341] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 444.552262][ T5894] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 444.557513][ T5552] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.562130][ T5894] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 444.562500][ T5552] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.572945][ T5818] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.574360][ T5894] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 444.576688][ T5818] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.587925][ T5894] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.659083][ T5894] usb 9-1: config 0 descriptor?? [ 444.690882][T12599] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 444.695206][T12599] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 444.712175][T12595] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 444.714656][T12595] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 444.798026][ T1482] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 445.108958][ T5894] plantronics 0003:047F:FFFF.0006: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 445.590129][T14764] netlink: 'syz.3.2054': attribute type 2 has an invalid length. [ 445.847244][T14774] binder: 14772:14774 ioctl 4018620d 0 returned -22 [ 445.852533][T14774] binder: 14772:14774 unknown command 0 [ 445.854338][T14774] binder: 14772:14774 ioctl c0306201 800002c0 returned -22 [ 446.008321][ T5743] Bluetooth: hci3: command tx timeout [ 447.181661][T14804] netlink: 'syz.4.2064': attribute type 11 has an invalid length. [ 447.199432][ T1482] usb 9-1: USB disconnect, device number 14 [ 447.752033][T14838] input: syz1 as /devices/virtual/input/input54 [ 448.077901][ T5743] Bluetooth: hci3: command tx timeout [ 448.080608][T14853] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2071'. [ 448.091114][T14853] siw: device registration error -23 [ 448.148462][T14854] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2072'. [ 448.151397][T14854] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2072'. [ 448.154176][T14854] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2072'. [ 448.159593][T14854] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2072'. [ 448.485071][T14866] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2075'. [ 448.609642][T14870] FAULT_INJECTION: forcing a failure. [ 448.609642][T14870] name failslab, interval 1, probability 0, space 0, times 0 [ 448.616434][T14870] CPU: 2 UID: 0 PID: 14870 Comm: syz.3.2077 Tainted: G L syzkaller #0 PREEMPT(full) [ 448.616463][T14870] Tainted: [L]=SOFTLOCKUP [ 448.616469][T14870] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 448.616480][T14870] Call Trace: [ 448.616486][T14870] [ 448.616494][T14870] dump_stack_lvl+0x100/0x190 [ 448.616522][T14870] should_fail_ex.cold+0x5/0xa [ 448.616543][T14870] should_failslab+0xc2/0x120 [ 448.616575][T14870] kmem_cache_alloc_noprof+0x91/0x6a0 [ 448.616598][T14870] ? inet_bind2_bucket_create+0x36/0x5f0 [ 448.616630][T14870] inet_bind2_bucket_create+0x36/0x5f0 [ 448.616658][T14870] __inet_hash_connect+0x1527/0x2000 [ 448.616691][T14870] ? __pfx___inet_check_established+0x10/0x10 [ 448.616718][T14870] ? __pfx___inet_hash_connect+0x10/0x10 [ 448.616747][T14870] ? inet_init_ehash_secret+0xd/0x60 [ 448.616770][T14870] ? inet_hash_connect+0x9f/0x340 [ 448.616800][T14870] tcp_v4_connect+0xeb3/0x1b40 [ 448.616850][T14870] ? __pfx_tcp_v4_connect+0x10/0x10 [ 448.616881][T14870] __inet_stream_connect+0x208/0xfa0 [ 448.616911][T14870] ? __pfx___inet_stream_connect+0x10/0x10 [ 448.616932][T14870] ? kasan_save_track+0x14/0x30 [ 448.616954][T14870] ? __kasan_kmalloc+0xaa/0xb0 [ 448.616976][T14870] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 448.616995][T14870] ? tcp_sendmsg_fastopen+0x24d/0x750 [ 448.617025][T14870] tcp_sendmsg_fastopen+0x3ed/0x750 [ 448.617052][T14870] ? look_up_lock_class+0x64/0x120 [ 448.617089][T14870] tcp_sendmsg_locked+0x276d/0x44d0 [ 448.617118][T14870] ? __lock_acquire+0x49f/0x1a40 [ 448.617147][T14870] ? smc_switch_to_fallback+0x5c8/0xa10 [ 448.617174][T14870] ? smc_switch_to_fallback+0x5c8/0xa10 [ 448.617203][T14870] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 448.617229][T14870] ? do_raw_spin_lock+0x128/0x260 [ 448.617247][T14870] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 448.617272][T14870] ? __local_bh_enable_ip+0x9e/0x120 [ 448.617296][T14870] tcp_sendmsg+0x2e/0x50 [ 448.617318][T14870] ? __pfx_tcp_sendmsg+0x10/0x10 [ 448.617342][T14870] inet_sendmsg+0xb9/0x140 [ 448.617366][T14870] smc_sendmsg+0x230/0x540 [ 448.617395][T14870] __sys_sendto+0x48b/0x4e0 [ 448.617417][T14870] ? __pfx_smc_sendmsg+0x10/0x10 [ 448.617445][T14870] ? __pfx___sys_sendto+0x10/0x10 [ 448.617486][T14870] ? fput+0x79/0x100 [ 448.617507][T14870] ? ksys_write+0x1ac/0x250 [ 448.617526][T14870] __ia32_sys_sendto+0xdd/0x1b0 [ 448.617547][T14870] ? __do_fast_syscall_32+0x98/0x970 [ 448.617574][T14870] ? lockdep_hardirqs_on+0x78/0x100 [ 448.617593][T14870] __do_fast_syscall_32+0xe7/0x970 [ 448.617612][T14870] ? lockdep_hardirqs_on+0x78/0x100 [ 448.617630][T14870] do_fast_syscall_32+0x32/0x70 [ 448.617651][T14870] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 448.617674][T14870] RIP: 0023:0xf704efec [ 448.617695][T14870] Code: Unable to access opcode bytes at 0xf704efc2. [ 448.617703][T14870] RSP: 002b:00000000f543d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 448.617721][T14870] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 448.617732][T14870] RDX: 0000000000000000 RSI: 00000000200007fd RDI: 0000000080e68000 [ 448.617742][T14870] RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 [ 448.617752][T14870] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 448.617761][T14870] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 448.617785][T14870] [ 448.860744][T14875] batadv_slave_1: entered promiscuous mode [ 448.864959][T14875] netlink: 'syz.4.2078': attribute type 1 has an invalid length. [ 448.867560][T14875] netlink: 'syz.4.2078': attribute type 2 has an invalid length. [ 448.882486][T14880] FAULT_INJECTION: forcing a failure. [ 448.882486][T14880] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 448.884688][T14875] netlink: 'syz.4.2078': attribute type 1 has an invalid length. [ 448.887597][T14880] CPU: 1 UID: 0 PID: 14880 Comm: syz.1.2079 Tainted: G L syzkaller #0 PREEMPT(full) [ 448.887615][T14880] Tainted: [L]=SOFTLOCKUP [ 448.887632][T14880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 448.887639][T14880] Call Trace: [ 448.887643][T14880] [ 448.887648][T14880] dump_stack_lvl+0x100/0x190 [ 448.887664][T14880] should_fail_ex.cold+0x5/0xa [ 448.887675][T14880] ? prepare_alloc_pages+0x16d/0x5f0 [ 448.887693][T14880] should_fail_alloc_page+0xeb/0x140 [ 448.887711][T14880] prepare_alloc_pages+0x1f0/0x5f0 [ 448.887729][T14880] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 448.887742][T14880] ? register_lock_class+0x40/0x560 [ 448.887761][T14880] ? ima_match_policy+0x8c4/0x2350 [ 448.887777][T14880] ? ima_match_policy+0x8c4/0x2350 [ 448.887794][T14880] ? __lock_acquire+0x49f/0x1a40 [ 448.887814][T14880] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 448.887833][T14880] ? __lock_acquire+0x49f/0x1a40 [ 448.887850][T14880] ? __lock_acquire+0x49f/0x1a40 [ 448.887870][T14880] ? lock_acquire+0x1b9/0x370 [ 448.887887][T14880] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 448.887905][T14880] ? policy_nodemask+0xed/0x4f0 [ 448.887923][T14880] alloc_pages_mpol+0x1fb/0x540 [ 448.887939][T14880] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 448.887960][T14880] folio_alloc_mpol_noprof+0x36/0x260 [ 448.887984][T14880] vma_alloc_folio_noprof+0xed/0x1d0 [ 448.888002][T14880] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 448.888025][T14880] do_anonymous_page+0xb2b/0x2080 [ 448.888036][T14880] ? rcu_read_unlock+0x2d/0xb0 [ 448.888051][T14880] __handle_mm_fault+0x1d2c/0x2a00 [ 448.888065][T14880] ? mt_find+0x45e/0x8e0 [ 448.888080][T14880] ? __pfx___handle_mm_fault+0x10/0x10 [ 448.888091][T14880] ? __pfx_mt_find+0x10/0x10 [ 448.888113][T14880] ? find_vma+0xbf/0x140 [ 448.888127][T14880] ? __pfx_find_vma+0x10/0x10 [ 448.888142][T14880] handle_mm_fault+0x37b/0xa30 [ 448.888156][T14880] do_user_addr_fault+0x74c/0x12f0 [ 448.888176][T14880] exc_page_fault+0x6f/0xd0 [ 448.888189][T14880] asm_exc_page_fault+0x26/0x30 [ 448.888202][T14880] RIP: 0010:rep_stos_alternative+0x40/0x80 [ 448.888218][T14880] Code: c9 75 f6 e9 c2 aa 04 00 48 89 07 48 83 c7 08 83 e9 08 74 ef 83 f9 08 73 ef eb de 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 <48> 89 07 48 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 48 89 47 [ 448.888229][T14880] RSP: 0018:ffffc90006f2fca8 EFLAGS: 00050246 [ 448.888239][T14880] RAX: 0000000000000000 RBX: 000000007fff8000 RCX: 0000000000000040 [ 448.888247][T14880] RDX: ffff88802aa24a80 RSI: ffffffff825c0d51 RDI: 0000000080008000 [ 448.888254][T14880] RBP: 0000000000001000 R08: 0000000000000001 R09: 00000000000001d2 [ 448.888260][T14880] R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000008000 [ 448.888267][T14880] R13: ffff88802aa24a80 R14: dffffc0000000000 R15: 0000000080007040 [ 448.888278][T14880] ? __might_fault+0x111/0x140 [ 448.888292][T14880] read_zero+0xed/0x1f0 [ 448.888310][T14880] ? __pfx_read_zero+0x10/0x10 [ 448.888327][T14880] vfs_read+0x1e4/0xb40 [ 448.888347][T14880] ? __pfx_vfs_read+0x10/0x10 [ 448.888363][T14880] ? find_held_lock+0x2b/0x80 [ 448.888377][T14880] ? __fget_files+0x215/0x3d0 [ 448.888387][T14880] ? __fget_files+0x215/0x3d0 [ 448.888400][T14880] ? __fget_files+0x21f/0x3d0 [ 448.888413][T14880] ksys_read+0x12a/0x250 [ 448.888423][T14880] ? __pfx_ksys_read+0x10/0x10 [ 448.888433][T14880] ? ksys_write+0x1ac/0x250 [ 448.888443][T14880] ? __pfx_ksys_write+0x10/0x10 [ 448.888456][T14880] __do_fast_syscall_32+0xe7/0x970 [ 448.888470][T14880] ? lockdep_hardirqs_on+0x78/0x100 [ 448.888484][T14880] do_fast_syscall_32+0x32/0x70 [ 448.888498][T14880] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 448.888512][T14880] RIP: 0023:0xf70aefec [ 448.888522][T14880] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 448.888532][T14880] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 448.888542][T14880] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 448.888549][T14880] RDX: 00000000ffffff96 RSI: 0000000000000000 RDI: 0000000000000000 [ 448.888556][T14880] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 448.888562][T14880] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 448.888568][T14880] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 448.888582][T14880] [ 448.918689][T14883] netlink: 'syz.1.2081': attribute type 2 has an invalid length. [ 448.919702][T14875] netlink: 'syz.4.2078': attribute type 2 has an invalid length. [ 448.929800][T14883] netlink: 'syz.1.2081': attribute type 1 has an invalid length. [ 449.070783][T14873] batadv_slave_1: left promiscuous mode [ 449.181756][T14893] bridge0: port 1(bridge_slave_0) entered forwarding state [ 449.268407][T14907] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2086'. [ 449.282064][T14908] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2087'. [ 449.288515][T14907] siw: device registration error -23 [ 449.542992][T14912] xt_CT: You must specify a L4 protocol and not use inversions on it [ 450.159395][ T5743] Bluetooth: hci3: command tx timeout [ 450.977510][T14956] lo speed is unknown, defaulting to 1000 [ 451.178211][T14990] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2097'. [ 451.190717][T14990] siw: device registration error -23 [ 451.754180][T14999] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 451.762726][T14999] qnx6: wrong signature (magic) in superblock #1. [ 451.767118][T14999] qnx6: unable to read the first superblock [ 451.959104][T15010] lo speed is unknown, defaulting to 1000 [ 453.527668][T15061] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2109'. [ 454.838452][T15081] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2111'. [ 454.874296][T15081] siw: device registration error -23 [ 456.379252][T15120] syzkaller0: entered promiscuous mode [ 456.381587][T15120] syzkaller0: entered allmulticast mode [ 456.760083][T15140] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2123'. [ 456.961319][T15153] i2c i2c-1: Frontend requested software zigzag, but didn't set the frequency step size [ 456.968624][T15152] lo speed is unknown, defaulting to 1000 [ 457.700128][T15192] bridge4: entered promiscuous mode [ 457.702259][T15192] bridge4: entered allmulticast mode [ 459.161988][T15222] syzkaller0: entered promiscuous mode [ 459.163789][T15222] syzkaller0: entered allmulticast mode [ 459.903322][T15246] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2138'. [ 460.349945][T15261] ip6gretap0: entered promiscuous mode [ 460.356228][T15261] vlan2: entered promiscuous mode [ 460.668288][T10384] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 460.832472][T10384] usb 6-1: Using ep0 maxpacket: 8 [ 460.881843][T10384] usb 6-1: unable to get BOS descriptor or descriptor too short [ 460.894018][T10384] usb 6-1: too many configurations: 115, using maximum allowed: 8 [ 460.913202][T10384] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 460.924704][T10384] usb 6-1: can't read configurations, error -71 [ 461.362573][T15288] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2145'. [ 461.385921][T15288] siw: device registration error -23 [ 462.564298][T15317] lo speed is unknown, defaulting to 1000 [ 463.174036][T15357] netlink: 'syz.1.2151': attribute type 1 has an invalid length. [ 463.272899][T15364] ip6gretap0: entered promiscuous mode [ 463.274851][T15364] vlan2: entered promiscuous mode [ 463.789548][T15380] tmpfs: Unknown parameter 'uid, priority 0 [ 467.158148][T15469] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2168'. [ 467.212234][T15481] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2170'. [ 468.238217][ T41] tipc: Node number set to 2052369357 [ 469.027915][ T1482] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 469.187867][ T1482] usb 6-1: Using ep0 maxpacket: 8 [ 469.190869][ T1482] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 469.194005][ T1482] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 469.197042][ T1482] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 469.200764][ T1482] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 469.204937][ T1482] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 469.207735][ T1482] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 469.484299][ T1482] usb 6-1: GET_CAPABILITIES returned 0 [ 469.486112][ T1482] usbtmc 6-1:16.0: can't read capabilities [ 469.500821][T15531] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 471.241533][ T1482] usb 6-1: USB disconnect, device number 45 [ 472.438347][T15590] binder: 15587:15590 unknown command 0 [ 472.448120][T15590] binder: 15587:15590 ioctl c0306201 800002c0 returned -22 [ 472.552417][T15595] syzkaller0: entered promiscuous mode [ 472.554252][T15595] syzkaller0: entered allmulticast mode [ 474.163748][ T5747] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 474.170227][ T5747] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 474.174681][ T5747] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 474.177723][ T5747] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 474.182301][ T5747] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 474.458940][T15652] lo speed is unknown, defaulting to 1000 [ 474.579238][T15683] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 475.008671][T15652] bridge0: port 1(bridge_slave_0) entered blocking state [ 475.019456][T15652] bridge0: port 1(bridge_slave_0) entered disabled state [ 475.033239][T15652] bridge_slave_0: entered allmulticast mode [ 475.043844][T15652] bridge_slave_0: entered promiscuous mode [ 475.068699][T15652] bridge0: port 2(bridge_slave_1) entered blocking state [ 475.081826][T15652] bridge0: port 2(bridge_slave_1) entered disabled state [ 475.112299][T15652] bridge_slave_1: entered allmulticast mode [ 475.121271][T15652] bridge_slave_1: entered promiscuous mode [ 475.218901][T15652] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 475.237652][T15652] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 475.354779][T15652] team0: Port device team_slave_0 added [ 475.380657][T15652] team0: Port device team_slave_1 added [ 475.413913][T15840] FAULT_INJECTION: forcing a failure. [ 475.413913][T15840] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 475.422683][T15652] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 475.424884][T15652] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 475.446095][T15840] CPU: 2 UID: 0 PID: 15840 Comm: syz.1.2201 Tainted: G L syzkaller #0 PREEMPT(full) [ 475.446115][T15840] Tainted: [L]=SOFTLOCKUP [ 475.446119][T15840] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 475.446137][T15840] Call Trace: [ 475.446143][T15840] [ 475.446148][T15840] dump_stack_lvl+0x100/0x190 [ 475.446177][T15840] should_fail_ex.cold+0x5/0xa [ 475.446190][T15840] _copy_to_user+0x32/0xd0 [ 475.446214][T15840] simple_read_from_buffer+0xcb/0x170 [ 475.446233][T15840] proc_fail_nth_read+0x1af/0x230 [ 475.446249][T15840] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 475.446265][T15840] ? rw_verify_area+0xce/0x6d0 [ 475.446282][T15840] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 475.446297][T15840] vfs_read+0x1e4/0xb40 [ 475.446316][T15840] ? __pfx_vfs_read+0x10/0x10 [ 475.446333][T15840] ? find_held_lock+0x2b/0x80 [ 475.446348][T15840] ? __fget_files+0x215/0x3d0 [ 475.446361][T15840] ? __fget_files+0x21f/0x3d0 [ 475.446374][T15840] ksys_read+0x12a/0x250 [ 475.446384][T15840] ? __pfx_ksys_read+0x10/0x10 [ 475.446398][T15840] do_int80_emulation+0x14b/0x720 [ 475.446419][T15840] asm_int80_emulation+0x1a/0x20 [ 475.446431][T15840] RIP: 0023:0xf71e72eb [ 475.446442][T15840] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 475.446453][T15840] RSP: 002b:00000000f549d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 475.446464][T15840] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f549d5d0 [ 475.446471][T15840] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 475.446478][T15840] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 475.446484][T15840] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 475.446490][T15840] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 475.446504][T15840] [ 475.519458][T15652] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 475.526029][T15652] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 475.528865][T15652] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 475.538750][T15652] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 475.570565][T15652] hsr_slave_0: entered promiscuous mode [ 475.573477][T15652] hsr_slave_1: entered promiscuous mode [ 475.575716][T15652] debugfs: 'hsr0' already exists in 'hsr' [ 475.588251][T15652] Cannot create hsr debugfs directory [ 475.856427][T15958] FAULT_INJECTION: forcing a failure. [ 475.856427][T15958] name failslab, interval 1, probability 0, space 0, times 0 [ 475.878126][T15958] CPU: 2 UID: 0 PID: 15958 Comm: syz.4.2205 Tainted: G L syzkaller #0 PREEMPT(full) [ 475.878147][T15958] Tainted: [L]=SOFTLOCKUP [ 475.878151][T15958] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 475.878158][T15958] Call Trace: [ 475.878162][T15958] [ 475.878178][T15958] dump_stack_lvl+0x100/0x190 [ 475.878197][T15958] should_fail_ex.cold+0x5/0xa [ 475.878210][T15958] should_failslab+0xc2/0x120 [ 475.878226][T15958] __kmalloc_noprof+0xfc/0x820 [ 475.878239][T15958] ? rcu_is_watching+0x12/0xc0 [ 475.878252][T15958] ? tomoyo_realpath_from_path+0xb6/0x690 [ 475.878273][T15958] tomoyo_realpath_from_path+0xb6/0x690 [ 475.878293][T15958] tomoyo_path_number_perm+0x23c/0x580 [ 475.878308][T15958] ? tomoyo_path_number_perm+0x22e/0x580 [ 475.878323][T15958] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 475.878337][T15958] ? get_pid_task+0x106/0x250 [ 475.878368][T15958] ? find_held_lock+0x2b/0x80 [ 475.878382][T15958] ? __fget_files+0x215/0x3d0 [ 475.878391][T15958] ? hook_file_ioctl_common+0x140/0x440 [ 475.878406][T15958] ? __fget_files+0x215/0x3d0 [ 475.878418][T15958] ? __fget_files+0x21f/0x3d0 [ 475.878430][T15958] security_file_ioctl_compat+0xd3/0x230 [ 475.878445][T15958] __ia32_compat_sys_ioctl+0xc2/0x360 [ 475.878464][T15958] __do_fast_syscall_32+0xe7/0x970 [ 475.878478][T15958] ? lockdep_hardirqs_on+0x78/0x100 [ 475.878492][T15958] do_fast_syscall_32+0x32/0x70 [ 475.878506][T15958] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 475.878521][T15958] RIP: 0023:0xf70aefec [ 475.878534][T15958] Code: Unable to access opcode bytes at 0xf70aefc2. [ 475.878539][T15958] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 475.878551][T15958] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0386105 [ 475.878558][T15958] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 475.878565][T15958] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 475.878571][T15958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 475.878577][T15958] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 475.878604][T15958] [ 475.879403][T15958] ERROR: Out of memory at tomoyo_realpath_from_path. [ 475.908250][T15652] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 475.970904][T15652] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 475.979379][T15652] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 476.002181][T15652] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 476.006128][T15652] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 476.039328][T15652] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 476.043710][T15652] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 476.054285][T15652] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 476.089887][T15985] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2206'. [ 476.095154][T15985] siw: device registration error -23 [ 476.210122][T15652] 8021q: adding VLAN 0 to HW filter on device bond0 [ 476.244408][ T5747] Bluetooth: hci1: command tx timeout [ 476.265873][T15652] 8021q: adding VLAN 0 to HW filter on device team0 [ 476.299157][T12592] bridge0: port 1(bridge_slave_0) entered blocking state [ 476.301352][T12592] bridge0: port 1(bridge_slave_0) entered forwarding state [ 476.324400][T12592] bridge0: port 2(bridge_slave_1) entered blocking state [ 476.326613][T12592] bridge0: port 2(bridge_slave_1) entered forwarding state [ 476.797080][T16020] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 477.250128][T15652] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 477.271843][T16044] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2214'. [ 477.289095][T16044] siw: device registration error -23 [ 477.819200][T15652] veth0_vlan: entered promiscuous mode [ 477.826723][T15652] veth1_vlan: entered promiscuous mode [ 477.862613][T15652] veth0_macvtap: entered promiscuous mode [ 477.868926][T15652] veth1_macvtap: entered promiscuous mode [ 477.882222][T15652] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 477.923118][T15652] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 477.953513][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.965444][ T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.985397][ T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.998427][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.104549][T16061] lo speed is unknown, defaulting to 1000 [ 478.191921][T12595] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 478.200915][T12595] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 478.318008][ T5747] Bluetooth: hci1: command tx timeout [ 478.352692][T12595] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 478.356009][T16104] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2219'. [ 478.363940][T12595] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 478.421616][T16117] siw: device registration error -23 [ 479.538088][ T42] audit: type=1326 audit(1785044797.830:94): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16151 comm="syz.5.2226" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf701efec code=0x0 [ 479.668891][T16152] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(7) [ 479.671087][T16152] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 479.691716][T16152] vhci_hcd vhci_hcd.0: Device attached [ 480.117873][ T41] usb 47-1: new high-speed USB device number 2 using vhci_hcd [ 480.397970][ T5747] Bluetooth: hci1: command tx timeout [ 480.420614][T16173] vhci_hcd: connection closed [ 480.428013][ T5552] vhci_hcd vhci_hcd.5: stop threads [ 480.432045][ T5552] vhci_hcd vhci_hcd.5: release socket [ 480.434103][ T5552] vhci_hcd vhci_hcd.5: disconnect device [ 480.441087][T16183] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2230'. [ 480.445383][T16183] siw: device registration error -23 [ 480.643469][ T41] usb 47-1: enqueue for inactive port 0 [ 480.707986][ T41] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 480.726719][T16196] ip6gretap0: entered promiscuous mode [ 480.729238][T16196] vlan2: entered promiscuous mode [ 480.857904][ T1482] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 480.926779][T16204] FAULT_INJECTION: forcing a failure. [ 480.926779][T16204] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 480.931932][T16204] CPU: 0 UID: 0 PID: 16204 Comm: syz.5.2234 Tainted: G L syzkaller #0 PREEMPT(full) [ 480.931952][T16204] Tainted: [L]=SOFTLOCKUP [ 480.931956][T16204] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 480.931963][T16204] Call Trace: [ 480.931967][T16204] [ 480.931971][T16204] dump_stack_lvl+0x100/0x190 [ 480.931987][T16204] should_fail_ex.cold+0x5/0xa [ 480.932001][T16204] _copy_from_user+0x2e/0xd0 [ 480.932019][T16204] get_compat_msghdr+0xb3/0x480 [ 480.932036][T16204] ? __pfx_get_compat_msghdr+0x10/0x10 [ 480.932058][T16204] ___sys_sendmsg+0x1b6/0x1e0 [ 480.932071][T16204] ? __pfx____sys_sendmsg+0x10/0x10 [ 480.932089][T16204] ? find_held_lock+0x2b/0x80 [ 480.932112][T16204] __sys_sendmsg+0x160/0x210 [ 480.932127][T16204] ? __pfx___sys_sendmsg+0x10/0x10 [ 480.932146][T16204] ? __pfx_ksys_write+0x10/0x10 [ 480.932160][T16204] __do_fast_syscall_32+0xe7/0x970 [ 480.932174][T16204] ? lockdep_hardirqs_on+0x78/0x100 [ 480.932188][T16204] do_fast_syscall_32+0x32/0x70 [ 480.932202][T16204] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 480.932217][T16204] RIP: 0023:0xf701efec [ 480.932230][T16204] Code: Unable to access opcode bytes at 0xf701efc2. [ 480.932235][T16204] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 480.932246][T16204] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000140 [ 480.932253][T16204] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 480.932260][T16204] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 480.932266][T16204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 480.932273][T16204] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 480.932286][T16204] [ 481.035401][ T1482] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 481.040884][ T1482] usb 6-1: config 0 has no interfaces? [ 481.042696][ T1482] usb 6-1: New USB device found, idVendor=056a, idProduct=030c, bcdDevice= 0.00 [ 481.045573][ T1482] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.049845][ T1482] usb 6-1: config 0 descriptor?? [ 481.266440][ T1482] usb 6-1: string descriptor 0 read error: -71 [ 481.269431][ T1482] usb 6-1: USB disconnect, device number 46 [ 482.195057][T16241] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2240'. [ 482.296481][T16244] FAULT_INJECTION: forcing a failure. [ 482.296481][T16244] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 482.312163][T16244] CPU: 0 UID: 0 PID: 16244 Comm: syz.5.2241 Tainted: G L syzkaller #0 PREEMPT(full) [ 482.312185][T16244] Tainted: [L]=SOFTLOCKUP [ 482.312194][T16244] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 482.312201][T16244] Call Trace: [ 482.312205][T16244] [ 482.312210][T16244] dump_stack_lvl+0x100/0x190 [ 482.312226][T16244] should_fail_ex.cold+0x5/0xa [ 482.312239][T16244] _copy_to_user+0x32/0xd0 [ 482.312258][T16244] simple_read_from_buffer+0xcb/0x170 [ 482.312278][T16244] proc_fail_nth_read+0x1af/0x230 [ 482.312304][T16244] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 482.312323][T16244] ? rw_verify_area+0xce/0x6d0 [ 482.312339][T16244] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 482.312354][T16244] vfs_read+0x1e4/0xb40 [ 482.312374][T16244] ? __pfx_vfs_read+0x10/0x10 [ 482.312391][T16244] ? find_held_lock+0x2b/0x80 [ 482.312405][T16244] ? __fget_files+0x215/0x3d0 [ 482.312418][T16244] ? __fget_files+0x21f/0x3d0 [ 482.312432][T16244] ksys_read+0x12a/0x250 [ 482.312442][T16244] ? __pfx_ksys_read+0x10/0x10 [ 482.312456][T16244] do_int80_emulation+0x14b/0x720 [ 482.312472][T16244] asm_int80_emulation+0x1a/0x20 [ 482.312484][T16244] RIP: 0023:0xf71572eb [ 482.312493][T16244] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 482.312504][T16244] RSP: 002b:00000000f53ec4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 482.312516][T16244] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f53ec5d0 [ 482.312523][T16244] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 482.312529][T16244] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 482.312536][T16244] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 482.312542][T16244] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 482.312556][T16244] [ 482.481403][ T5747] Bluetooth: hci1: command tx timeout [ 482.915287][T16252] syzkaller0: entered promiscuous mode [ 482.917105][T16252] syzkaller0: entered allmulticast mode [ 484.230965][T16281] netlink: 'syz.1.2247': attribute type 10 has an invalid length. [ 484.289803][T16281] bond0 (unregistering): Released all slaves [ 484.848797][ T845] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 485.237398][T16368] syzkaller0: entered promiscuous mode [ 485.266549][T16368] FAULT_INJECTION: forcing a failure. [ 485.266549][T16368] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 485.293945][T16368] CPU: 0 UID: 0 PID: 16368 Comm: syz.4.2257 Tainted: G L syzkaller #0 PREEMPT(full) [ 485.293965][T16368] Tainted: [L]=SOFTLOCKUP [ 485.293969][T16368] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 485.293976][T16368] Call Trace: [ 485.293981][T16368] [ 485.293985][T16368] dump_stack_lvl+0x100/0x190 [ 485.294002][T16368] should_fail_ex.cold+0x5/0xa [ 485.294015][T16368] _copy_from_user+0x2e/0xd0 [ 485.294034][T16368] get_compat_msghdr+0xb3/0x480 [ 485.294052][T16368] ? __pfx_get_compat_msghdr+0x10/0x10 [ 485.294074][T16368] ___sys_sendmsg+0x1b6/0x1e0 [ 485.294087][T16368] ? __pfx____sys_sendmsg+0x10/0x10 [ 485.294104][T16368] ? find_held_lock+0x2b/0x80 [ 485.294127][T16368] __sys_sendmsg+0x160/0x210 [ 485.294142][T16368] ? __pfx___sys_sendmsg+0x10/0x10 [ 485.294161][T16368] ? __pfx_ksys_write+0x10/0x10 [ 485.294186][T16368] __do_fast_syscall_32+0xe7/0x970 [ 485.294207][T16368] ? lockdep_hardirqs_on+0x78/0x100 [ 485.294222][T16368] do_fast_syscall_32+0x32/0x70 [ 485.294236][T16368] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 485.294251][T16368] RIP: 0023:0xf70aefec [ 485.294265][T16368] Code: Unable to access opcode bytes at 0xf70aefc2. [ 485.294270][T16368] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 485.294281][T16368] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 0000000080009b40 [ 485.294288][T16368] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 485.294294][T16368] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 485.294301][T16368] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 485.294307][T16368] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 485.294321][T16368] [ 485.417829][ T845] usb 6-1: Using ep0 maxpacket: 8 [ 485.884082][ T845] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 485.888080][ T845] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 485.891222][ T845] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 485.894245][ T845] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 485.897367][ T845] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 485.917261][ T845] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 485.927626][ T845] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.121615][T16400] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 486.156569][ T845] usb 6-1: usb_control_msg returned -32 [ 486.164467][ T845] usbtmc 6-1:16.0: can't read capabilities [ 486.404205][T16378] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2258'. [ 486.544811][T16421] usbtmc 6-1:16.0: INITIATE_CLEAR returned 0 [ 486.753834][ T845] usb 6-1: USB disconnect, device number 47 [ 487.073100][T16463] tipc: Enabling of bearer rejected, failed to enable media [ 487.578065][ T845] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 487.584068][T16480] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 487.586139][T16480] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 487.590818][T16480] vhci_hcd vhci_hcd.0: Device attached [ 487.596024][T16481] vhci_hcd: cannot find the pending unlink 8 [ 487.648981][T16480] lo speed is unknown, defaulting to 1000 [ 487.732428][ T845] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 487.749408][ T845] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 487.765899][ T845] usb 6-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 487.774745][ T845] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 487.781019][ T845] usb 6-1: Product: syz [ 487.784614][ T845] usb 6-1: Manufacturer: syz [ 487.821853][T16475] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 487.830924][T16475] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 487.834939][T16481] vhci_hcd: connection closed [ 487.835186][ T5818] vhci_hcd vhci_hcd.5: stop threads [ 487.840600][ T7187] usb 47-1: new high-speed USB device number 3 using vhci_hcd [ 487.847293][ T845] usb_debug 6-1:1.0: debug converter detected [ 487.851704][ T5818] vhci_hcd vhci_hcd.5: release socket [ 487.856172][ T5818] vhci_hcd vhci_hcd.5: disconnect device [ 487.868602][ T845] usb 6-1: debug converter now attached to ttyUSB0 [ 488.050983][ C2] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 488.054843][ T845] usb 6-1: USB disconnect, device number 48 [ 488.063080][ T845] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 488.072017][ T845] usb_debug 6-1:1.0: device disconnected [ 488.379472][ T5889] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 488.446651][T16556] FAULT_INJECTION: forcing a failure. [ 488.446651][T16556] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 488.452516][T16556] CPU: 0 UID: 0 PID: 16556 Comm: syz.5.2282 Tainted: G L syzkaller #0 PREEMPT(full) [ 488.452535][T16556] Tainted: [L]=SOFTLOCKUP [ 488.452540][T16556] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 488.452546][T16556] Call Trace: [ 488.452551][T16556] [ 488.452555][T16556] dump_stack_lvl+0x100/0x190 [ 488.452572][T16556] should_fail_ex.cold+0x5/0xa [ 488.452585][T16556] _copy_from_user+0x2e/0xd0 [ 488.452603][T16556] __sys_bpf+0x2f5/0x4e80 [ 488.452619][T16556] ? __pfx___sys_bpf+0x10/0x10 [ 488.452631][T16556] ? find_held_lock+0x2b/0x80 [ 488.452645][T16556] ? get_pid_task+0xfc/0x250 [ 488.452659][T16556] ? get_pid_task+0xfc/0x250 [ 488.452676][T16556] ? proc_fail_nth_write+0x9f/0x220 [ 488.452692][T16556] ? find_held_lock+0x2b/0x80 [ 488.452709][T16556] ? rcu_read_lock_any_held+0x6a/0xa0 [ 488.452724][T16556] ? find_held_lock+0x2b/0x80 [ 488.452736][T16556] ? ksys_write+0x190/0x250 [ 488.452747][T16556] ? ksys_write+0x190/0x250 [ 488.452767][T16556] ? fput+0x79/0x100 [ 488.452780][T16556] ? __ia32_sys_bpf+0xcc/0x170 [ 488.452792][T16556] __ia32_sys_bpf+0xcc/0x170 [ 488.452804][T16556] ? __do_fast_syscall_32+0x98/0x970 [ 488.452820][T16556] __do_fast_syscall_32+0xe7/0x970 [ 488.452833][T16556] ? lockdep_hardirqs_on+0x78/0x100 [ 488.452852][T16556] do_fast_syscall_32+0x32/0x70 [ 488.452867][T16556] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 488.452882][T16556] RIP: 0023:0xf701efec [ 488.452895][T16556] Code: Unable to access opcode bytes at 0xf701efc2. [ 488.452900][T16556] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 488.452911][T16556] RAX: ffffffffffffffda RBX: 000000000000001d RCX: 0000000080000140 [ 488.452918][T16556] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000000 [ 488.452925][T16556] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 488.452931][T16556] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 488.452938][T16556] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 488.452951][T16556] [ 488.541138][ T5889] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 488.547734][ T5889] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 488.552212][ T5889] usb 9-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 488.555521][ T5889] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 488.558626][ T5889] usb 9-1: Product: syz [ 488.559941][ T5889] usb 9-1: Manufacturer: syz [ 488.565750][T16543] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 488.569928][T16543] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 488.573408][ T5889] usb_debug 9-1:1.0: debug converter detected [ 488.581845][ T5889] usb 9-1: debug converter now attached to ttyUSB0 [ 488.910458][T16574] syzkaller0: entered promiscuous mode [ 488.912236][T16574] syzkaller0: entered allmulticast mode [ 489.011984][ T1482] usb 9-1: USB disconnect, device number 15 [ 489.022340][ T1482] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 489.026672][ T1482] usb_debug 9-1:1.0: device disconnected [ 490.222058][T16609] FAULT_INJECTION: forcing a failure. [ 490.222058][T16609] name failslab, interval 1, probability 0, space 0, times 0 [ 490.669622][T16609] CPU: 0 UID: 0 PID: 16609 Comm: syz.4.2289 Tainted: G L syzkaller #0 PREEMPT(full) [ 490.669643][T16609] Tainted: [L]=SOFTLOCKUP [ 490.669647][T16609] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 490.669654][T16609] Call Trace: [ 490.669658][T16609] [ 490.669663][T16609] dump_stack_lvl+0x100/0x190 [ 490.669679][T16609] should_fail_ex.cold+0x5/0xa [ 490.669692][T16609] should_failslab+0xc2/0x120 [ 490.669708][T16609] __kmalloc_cache_noprof+0x91/0x6c0 [ 490.669719][T16609] ? binder_get_thread+0x1c7/0x850 [ 490.669735][T16609] ? binder_get_thread+0x1c7/0x850 [ 490.669749][T16609] ? binder_get_thread+0x201/0x850 [ 490.669766][T16609] binder_get_thread+0x201/0x850 [ 490.669783][T16609] binder_poll+0x3f/0x430 [ 490.669797][T16609] ? __pfx_binder_poll+0x10/0x10 [ 490.669812][T16609] do_select+0xd54/0x1850 [ 490.669839][T16609] ? __pfx_do_select+0x10/0x10 [ 490.669856][T16609] ? __lock_acquire+0x49f/0x1a40 [ 490.669874][T16609] ? __pfx___pollwait+0x10/0x10 [ 490.669892][T16609] ? __pfx_pollwake+0x10/0x10 [ 490.669910][T16609] ? __pfx_pollwake+0x10/0x10 [ 490.669928][T16609] ? __pfx_pollwake+0x10/0x10 [ 490.669945][T16609] ? __pfx_pollwake+0x10/0x10 [ 490.669963][T16609] ? __pfx_pollwake+0x10/0x10 [ 490.669981][T16609] ? __pfx_pollwake+0x10/0x10 [ 490.670004][T16609] ? _kstrtoull+0x13c/0x1f0 [ 490.670020][T16609] ? find_held_lock+0x2b/0x80 [ 490.670034][T16609] ? compat_core_sys_select+0x1e6/0x8b0 [ 490.670051][T16609] ? compat_core_sys_select+0x1e6/0x8b0 [ 490.670070][T16609] ? compat_core_sys_select+0x68a/0x8b0 [ 490.670088][T16609] compat_core_sys_select+0x68a/0x8b0 [ 490.670109][T16609] ? __pfx_compat_core_sys_select+0x10/0x10 [ 490.670129][T16609] ? get_pid_task+0xfc/0x250 [ 490.670154][T16609] ? __pfx_set_compat_user_sigmask+0x10/0x10 [ 490.670169][T16609] do_compat_pselect+0x27a/0x2b0 [ 490.670188][T16609] ? __pfx_do_compat_pselect+0x10/0x10 [ 490.670208][T16609] ? fput+0x79/0x100 [ 490.670222][T16609] __ia32_compat_sys_pselect6_time32+0x152/0x1c0 [ 490.670237][T16609] __do_fast_syscall_32+0xe7/0x970 [ 490.670256][T16609] ? lockdep_hardirqs_on+0x78/0x100 [ 490.670270][T16609] do_fast_syscall_32+0x32/0x70 [ 490.670284][T16609] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 490.670299][T16609] RIP: 0023:0xf70aefec [ 490.670312][T16609] Code: Unable to access opcode bytes at 0xf70aefc2. [ 490.670317][T16609] RSP: 002b:00000000f547c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000134 [ 490.670328][T16609] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 0000000080000240 [ 490.670335][T16609] RDX: 0000000000000000 RSI: 00000000800002c0 RDI: 0000000000000000 [ 490.670341][T16609] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 490.670348][T16609] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 490.670355][T16609] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 490.670368][T16609] [ 490.968971][T16631] FAULT_INJECTION: forcing a failure. [ 490.968971][T16631] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 490.972888][T16631] CPU: 0 UID: 0 PID: 16631 Comm: syz.1.2295 Tainted: G L syzkaller #0 PREEMPT(full) [ 490.972906][T16631] Tainted: [L]=SOFTLOCKUP [ 490.972910][T16631] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 490.972917][T16631] Call Trace: [ 490.972921][T16631] [ 490.972925][T16631] dump_stack_lvl+0x100/0x190 [ 490.972941][T16631] should_fail_ex.cold+0x5/0xa [ 490.972954][T16631] _copy_from_user+0x2e/0xd0 [ 490.972972][T16631] move_addr_to_kernel+0x65/0x170 [ 490.972985][T16631] __sys_sendto+0x1b8/0x4e0 [ 490.972999][T16631] ? __pfx___sys_sendto+0x10/0x10 [ 490.973023][T16631] ? fput+0x79/0x100 [ 490.973036][T16631] ? ksys_write+0x1ac/0x250 [ 490.973048][T16631] __ia32_sys_sendto+0xdd/0x1b0 [ 490.973062][T16631] ? __do_fast_syscall_32+0x98/0x970 [ 490.973077][T16631] ? lockdep_hardirqs_on+0x78/0x100 [ 490.973089][T16631] __do_fast_syscall_32+0xe7/0x970 [ 490.973103][T16631] ? lockdep_hardirqs_on+0x78/0x100 [ 490.973117][T16631] do_fast_syscall_32+0x32/0x70 [ 490.973131][T16631] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 490.973145][T16631] RIP: 0023:0xf70aefec [ 490.973158][T16631] Code: Unable to access opcode bytes at 0xf70aefc2. [ 490.973163][T16631] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171 [ 490.973174][T16631] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 490.973180][T16631] RDX: 0000000000000000 RSI: 00000000200007bd RDI: 0000000080e68000 [ 490.973187][T16631] RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 [ 490.973193][T16631] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 490.973200][T16631] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 490.973213][T16631] [ 491.400336][T16649] syzkaller0: entered promiscuous mode [ 491.402099][T16649] syzkaller0: entered allmulticast mode [ 491.706763][T16657] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2298'. [ 492.558394][T16677] af_packet: tpacket_rcv: packet too big, clamped from 80 to 4294967272. macoff=96 [ 492.897880][ T24] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 492.960832][ T7187] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 493.061696][ T24] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 493.104230][ T24] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 493.143620][ T24] usb 10-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 493.167132][ T24] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 493.190177][ T24] usb 10-1: Product: syz [ 493.196297][ T24] usb 10-1: Manufacturer: syz [ 493.214066][T16685] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 493.225783][T16685] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 493.238673][ T24] usb_debug 10-1:1.0: debug converter detected [ 493.252539][ T24] usb 10-1: debug converter now attached to ttyUSB0 [ 493.259939][T16698] bridge0: port 2(bridge_slave_1) entered disabled state [ 493.262503][T16698] bridge0: port 1(bridge_slave_0) entered disabled state [ 493.355498][T16698] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 493.362187][T16698] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 493.434279][T11249] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.441751][T11249] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.448718][ C2] debug ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 493.452957][T11249] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.454091][ T24] usb 10-1: USB disconnect, device number 2 [ 493.456600][T11249] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.462645][ T24] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 493.470664][ T24] usb_debug 10-1:1.0: device disconnected [ 493.967874][ T9] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 494.117990][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 494.606190][T16745] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2310'. [ 495.029952][T16749] syz_tun: entered allmulticast mode [ 495.048753][T16748] syz_tun: left allmulticast mode [ 495.263445][T16757] binder_alloc: 16756: binder_alloc_buf, no vma [ 495.909337][T16783] FAULT_INJECTION: forcing a failure. [ 495.909337][T16783] name failslab, interval 1, probability 0, space 0, times 0 [ 495.917890][T16783] CPU: 2 UID: 0 PID: 16783 Comm: syz.4.2317 Tainted: G L syzkaller #0 PREEMPT(full) [ 495.917910][T16783] Tainted: [L]=SOFTLOCKUP [ 495.917914][T16783] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 495.917922][T16783] Call Trace: [ 495.917927][T16783] [ 495.917933][T16783] dump_stack_lvl+0x100/0x190 [ 495.917949][T16783] should_fail_ex.cold+0x5/0xa [ 495.917962][T16783] should_failslab+0xc2/0x120 [ 495.917978][T16783] __kmalloc_cache_noprof+0x91/0x6c0 [ 495.917989][T16783] ? binder_get_thread+0x1c7/0x850 [ 495.918004][T16783] ? binder_get_thread+0x1c7/0x850 [ 495.918018][T16783] ? binder_get_thread+0x201/0x850 [ 495.918035][T16783] binder_get_thread+0x201/0x850 [ 495.918052][T16783] binder_poll+0x3f/0x430 [ 495.918067][T16783] ? __pfx_binder_poll+0x10/0x10 [ 495.918081][T16783] do_select+0xd54/0x1850 [ 495.918114][T16783] ? __pfx_do_select+0x10/0x10 [ 495.918132][T16783] ? __lock_acquire+0x49f/0x1a40 [ 495.918149][T16783] ? __pfx___pollwait+0x10/0x10 [ 495.918167][T16783] ? __pfx_pollwake+0x10/0x10 [ 495.918185][T16783] ? __pfx_pollwake+0x10/0x10 [ 495.918203][T16783] ? __pfx_pollwake+0x10/0x10 [ 495.918221][T16783] ? __pfx_pollwake+0x10/0x10 [ 495.918238][T16783] ? __pfx_pollwake+0x10/0x10 [ 495.918264][T16783] ? _kstrtoull+0x13c/0x1f0 [ 495.918280][T16783] ? find_held_lock+0x2b/0x80 [ 495.918293][T16783] ? compat_core_sys_select+0x1e6/0x8b0 [ 495.918311][T16783] ? compat_core_sys_select+0x1e6/0x8b0 [ 495.918330][T16783] ? compat_core_sys_select+0x68a/0x8b0 [ 495.918347][T16783] compat_core_sys_select+0x68a/0x8b0 [ 495.918368][T16783] ? __pfx_compat_core_sys_select+0x10/0x10 [ 495.918388][T16783] ? get_pid_task+0xfc/0x250 [ 495.918414][T16783] ? __pfx_set_compat_user_sigmask+0x10/0x10 [ 495.918429][T16783] do_compat_pselect+0x27a/0x2b0 [ 495.918448][T16783] ? __pfx_do_compat_pselect+0x10/0x10 [ 495.918468][T16783] ? fput+0x79/0x100 [ 495.918482][T16783] __ia32_compat_sys_pselect6_time32+0x152/0x1c0 [ 495.918497][T16783] __do_fast_syscall_32+0xe7/0x970 [ 495.918511][T16783] ? lockdep_hardirqs_on+0x78/0x100 [ 495.918525][T16783] do_fast_syscall_32+0x32/0x70 [ 495.918540][T16783] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 495.918554][T16783] RIP: 0023:0xf70aefec [ 495.918569][T16783] Code: Unable to access opcode bytes at 0xf70aefc2. [ 495.918574][T16783] RSP: 002b:00000000f547c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000134 [ 495.918586][T16783] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 0000000080000180 [ 495.918592][T16783] RDX: 0000000000000000 RSI: 0000000080000440 RDI: 0000000000000000 [ 495.918599][T16783] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 495.918606][T16783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 495.918612][T16783] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 495.918625][T16783] [ 496.491973][T16795] FAULT_INJECTION: forcing a failure. [ 496.491973][T16795] name failslab, interval 1, probability 0, space 0, times 0 [ 496.504210][T16795] CPU: 2 UID: 0 PID: 16795 Comm: syz.5.2319 Tainted: G L syzkaller #0 PREEMPT(full) [ 496.504230][T16795] Tainted: [L]=SOFTLOCKUP [ 496.504235][T16795] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 496.504242][T16795] Call Trace: [ 496.504246][T16795] [ 496.504261][T16795] dump_stack_lvl+0x100/0x190 [ 496.504280][T16795] should_fail_ex.cold+0x5/0xa [ 496.504293][T16795] should_failslab+0xc2/0x120 [ 496.504309][T16795] __kmalloc_noprof+0xfc/0x820 [ 496.504323][T16795] ? rcu_is_watching+0x12/0xc0 [ 496.504336][T16795] ? tomoyo_realpath_from_path+0xb6/0x690 [ 496.504357][T16795] tomoyo_realpath_from_path+0xb6/0x690 [ 496.504377][T16795] tomoyo_path_number_perm+0x23c/0x580 [ 496.504392][T16795] ? tomoyo_path_number_perm+0x22e/0x580 [ 496.504407][T16795] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 496.504422][T16795] ? get_pid_task+0x106/0x250 [ 496.504449][T16795] ? find_held_lock+0x2b/0x80 [ 496.504463][T16795] ? __fget_files+0x215/0x3d0 [ 496.504473][T16795] ? hook_file_ioctl_common+0x140/0x440 [ 496.504487][T16795] ? __fget_files+0x215/0x3d0 [ 496.504500][T16795] ? __fget_files+0x21f/0x3d0 [ 496.504512][T16795] security_file_ioctl_compat+0xd3/0x230 [ 496.504528][T16795] __ia32_compat_sys_ioctl+0xc2/0x360 [ 496.504546][T16795] __do_fast_syscall_32+0xe7/0x970 [ 496.504561][T16795] ? lockdep_hardirqs_on+0x78/0x100 [ 496.504575][T16795] do_fast_syscall_32+0x32/0x70 [ 496.504590][T16795] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 496.504604][T16795] RIP: 0023:0xf701efec [ 496.504618][T16795] Code: Unable to access opcode bytes at 0xf701efc2. [ 496.504623][T16795] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 496.504635][T16795] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000040946400 [ 496.504642][T16795] RDX: 00000000800003c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 496.504649][T16795] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 496.504655][T16795] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 496.504662][T16795] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 496.504675][T16795] [ 496.505061][T16795] ERROR: Out of memory at tomoyo_realpath_from_path. [ 496.652198][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 496.654621][ T9] usb 6-1: no configurations [ 496.656109][ T9] usb 6-1: can't read configurations, error -22 [ 497.385347][T16833] xt_CT: You must specify a L4 protocol and not use inversions on it [ 497.480855][T16839] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2326'. [ 497.484401][T16839] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2326'. [ 497.489658][T16839] netlink: 'syz.1.2326': attribute type 1 has an invalid length. [ 497.627048][T16850] binder_alloc: 16849: binder_alloc_buf, no vma [ 497.630976][T16848] ip6gretap0: entered promiscuous mode [ 497.635524][T16848] vlan2: entered promiscuous mode [ 498.058709][T16875] syzkaller0: entered promiscuous mode [ 498.060550][T16875] syzkaller0: entered allmulticast mode [ 501.041000][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.101769][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.342526][T16943] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2346'. [ 501.363180][T16952] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2347'. [ 501.457098][T16961] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2349'. [ 501.462481][T16961] siw: device registration error -23 [ 501.555822][T16970] JFS: discard option not supported on device [ 501.559412][T16967] ================================================================== [ 501.561889][T16967] BUG: KASAN: global-out-of-bounds in usb_copy_descriptors+0x18d/0x320 [ 501.564413][T16967] Read of size 192 at addr ffffffff9ba3ca60 by task syz.1.2352/16967 [ 501.567648][T16967] [ 501.568891][T16967] CPU: 2 UID: 0 PID: 16967 Comm: syz.1.2352 Tainted: G L syzkaller #0 PREEMPT(full) [ 501.568909][T16967] Tainted: [L]=SOFTLOCKUP [ 501.568914][T16967] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 501.568922][T16967] Call Trace: [ 501.568927][T16967] [ 501.568932][T16967] dump_stack_lvl+0x100/0x190 [ 501.568946][T16967] print_report+0x13d/0x4b0 [ 501.568963][T16967] ? __virt_addr_valid+0x239/0x430 [ 501.568976][T16967] ? usb_copy_descriptors+0x18d/0x320 [ 501.568993][T16967] kasan_report+0xdf/0x1c0 [ 501.569009][T16967] ? usb_copy_descriptors+0x18d/0x320 [ 501.569026][T16967] kasan_check_range+0x10f/0x1e0 [ 501.569044][T16967] __asan_memcpy+0x23/0x60 [ 501.569056][T16967] usb_copy_descriptors+0x18d/0x320 [ 501.569072][T16967] usb_assign_descriptors+0xd2/0x470 [ 501.569088][T16967] f_audio_bind+0x243a/0x3950 [ 501.569109][T16967] ? __pfx_f_audio_bind+0x10/0x10 [ 501.569126][T16967] usb_add_function+0x219/0x890 [ 501.569143][T16967] configfs_composite_bind+0xd83/0x1960 [ 501.569159][T16967] ? kernfs_create_link+0x1bd/0x240 [ 501.569179][T16967] gadget_bind_driver+0x28c/0xbf0 [ 501.569191][T16967] ? __pfx_gadget_bind_driver+0x10/0x10 [ 501.569203][T16967] really_probe+0x241/0xa60 [ 501.569218][T16967] __driver_probe_device+0x20e/0x450 [ 501.569233][T16967] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 501.569250][T16967] driver_probe_device+0x4a/0x140 [ 501.569267][T16967] __driver_attach+0x21f/0x5b0 [ 501.569283][T16967] ? __pfx___driver_attach+0x10/0x10 [ 501.569298][T16967] bus_for_each_dev+0x13e/0x1d0 [ 501.569310][T16967] ? __pfx_bus_for_each_dev+0x10/0x10 [ 501.569321][T16967] ? bus_add_driver+0x2b5/0x5b0 [ 501.569335][T16967] bus_add_driver+0x305/0x5b0 [ 501.569348][T16967] driver_register+0x1e2/0x360 [ 501.569365][T16967] usb_gadget_register_driver_owner+0x132/0x210 [ 501.569377][T16967] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 501.569393][T16967] configfs_write_iter+0x302/0x4e0 [ 501.569404][T16967] vfs_write+0x6ac/0x1050 [ 501.569414][T16967] ? __pfx_configfs_write_iter+0x10/0x10 [ 501.569425][T16967] ? __pfx_vfs_write+0x10/0x10 [ 501.569434][T16967] ? find_held_lock+0x2b/0x80 [ 501.569450][T16967] ksys_write+0x12a/0x250 [ 501.569460][T16967] ? __pfx_ksys_write+0x10/0x10 [ 501.569471][T16967] __do_fast_syscall_32+0xe7/0x970 [ 501.569485][T16967] ? lockdep_hardirqs_on+0x78/0x100 [ 501.569498][T16967] do_fast_syscall_32+0x32/0x70 [ 501.569511][T16967] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 501.569525][T16967] RIP: 0023:0xf70aefec [ 501.569539][T16967] Code: Unable to access opcode bytes at 0xf70aefc2. [ 501.569544][T16967] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 501.569555][T16967] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080001f00 [ 501.569562][T16967] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 501.569568][T16967] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 501.569575][T16967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 501.569582][T16967] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 501.569593][T16967] [ 501.569597][T16967] [ 501.662044][T16967] The buggy address belongs to the variable: [ 501.663873][T16967] ac_header_desc+0x0/0x40 [ 501.665234][T16967] [ 501.665978][T16967] The buggy address belongs to the physical page: [ 501.667912][T16967] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ba3c [ 501.670526][T16967] flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) [ 501.672896][T16967] raw: 00fff00000002000 ffffea00006e8f08 ffffea00006e8f08 0000000000000000 [ 501.675465][T16967] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 501.678039][T16967] page dumped because: kasan: bad access detected [ 501.680001][T16967] page_owner info is not present (never set?) [ 501.681828][T16967] [ 501.682574][T16967] Memory state around the buggy address: [ 501.684263][T16967] ffffffff9ba3c900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 501.686698][T16967] ffffffff9ba3c980: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 [ 501.689096][T16967] >ffffffff9ba3ca00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 [ 501.691508][T16967] ^ [ 501.693738][T16967] ffffffff9ba3ca80: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 [ 501.696168][T16967] ffffffff9ba3cb00: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 [ 501.698581][T16967] ================================================================== [ 501.711657][T16970] Mount JFS Failure: -22 [ 501.712996][T16970] jfs_mount failed w/return code = -22 [ 501.731108][T16970] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2350'. [ 501.736420][T16967] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 501.738650][T16967] CPU: 2 UID: 0 PID: 16967 Comm: syz.1.2352 Tainted: G L syzkaller #0 PREEMPT(full) [ 501.741958][T16967] Tainted: [L]=SOFTLOCKUP [ 501.743293][T16967] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 501.746368][T16967] Call Trace: [ 501.747452][T16967] [ 501.748389][T16967] dump_stack_lvl+0x100/0x190 [ 501.749847][T16967] vpanic+0x552/0x970 [ 501.751123][T16967] ? __pfx_vpanic+0x10/0x10 [ 501.752528][T16967] ? mark_held_locks+0x40/0x70 [ 501.754009][T16967] ? usb_copy_descriptors+0x18d/0x320 [ 501.755706][T16967] panic+0xd1/0xe0 [ 501.756906][T16967] ? __pfx_panic+0x10/0x10 [ 501.758285][T16967] ? usb_copy_descriptors+0x18d/0x320 [ 501.760051][T16967] ? preempt_schedule_common+0x42/0xc0 [ 501.761749][T16967] check_panic_on_warn.cold+0x19/0x34 [ 501.763470][T16967] end_report.part.0+0x3a/0x90 [ 501.765022][T16967] kasan_report.cold+0xe/0x18 [ 501.766497][T16967] ? usb_copy_descriptors+0x18d/0x320 [ 501.768218][T16967] kasan_check_range+0x10f/0x1e0 [ 501.769792][T16967] __asan_memcpy+0x23/0x60 [ 501.771198][T16967] usb_copy_descriptors+0x18d/0x320 [ 501.772825][T16967] usb_assign_descriptors+0xd2/0x470 [ 501.774503][T16967] f_audio_bind+0x243a/0x3950 [ 501.775996][T16967] ? __pfx_f_audio_bind+0x10/0x10 [ 501.777605][T16967] usb_add_function+0x219/0x890 [ 501.779133][T16967] configfs_composite_bind+0xd83/0x1960 [ 501.780883][T16967] ? kernfs_create_link+0x1bd/0x240 [ 501.782500][T16967] gadget_bind_driver+0x28c/0xbf0 [ 501.784105][T16967] ? __pfx_gadget_bind_driver+0x10/0x10 [ 501.785806][T16967] really_probe+0x241/0xa60 [ 501.787276][T16967] __driver_probe_device+0x20e/0x450 [ 501.788906][T16967] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 501.790738][T16967] driver_probe_device+0x4a/0x140 [ 501.792329][T16967] __driver_attach+0x21f/0x5b0 [ 501.793817][T16967] ? __pfx___driver_attach+0x10/0x10 [ 501.795486][T16967] bus_for_each_dev+0x13e/0x1d0 [ 501.797039][T16967] ? __pfx_bus_for_each_dev+0x10/0x10 [ 501.798687][T16967] ? bus_add_driver+0x2b5/0x5b0 [ 501.800229][T16967] bus_add_driver+0x305/0x5b0 [ 501.801684][T16967] driver_register+0x1e2/0x360 [ 501.803186][T16967] usb_gadget_register_driver_owner+0x132/0x210 [ 501.805095][T16967] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 501.806836][T16967] configfs_write_iter+0x302/0x4e0 [ 501.808425][T16967] vfs_write+0x6ac/0x1050 [ 501.809787][T16967] ? __pfx_configfs_write_iter+0x10/0x10 [ 501.811559][T16967] ? __pfx_vfs_write+0x10/0x10 [ 501.813043][T16967] ? find_held_lock+0x2b/0x80 [ 501.814508][T16967] ksys_write+0x12a/0x250 [ 501.815883][T16967] ? __pfx_ksys_write+0x10/0x10 [ 501.817414][T16967] __do_fast_syscall_32+0xe7/0x970 [ 501.818995][T16967] ? lockdep_hardirqs_on+0x78/0x100 [ 501.820615][T16967] do_fast_syscall_32+0x32/0x70 [ 501.822137][T16967] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 501.824081][T16967] RIP: 0023:0xf70aefec [ 501.825364][T16967] Code: Unable to access opcode bytes at 0xf70aefc2. [ 501.827446][T16967] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 501.830025][T16967] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080001f00 [ 501.832445][T16967] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 501.834917][T16967] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 501.837394][T16967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 501.839842][T16967] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 501.842278][T16967] [ 501.843809][T16967] Kernel Offset: disabled [ 501.845153][T16967] Rebooting in 86400 seconds.. VM DIAGNOSIS: 05:47:01 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000000 RBX=ffff8880263dafd0 RCX=0000000000000000 RDX=0000000000000005 RSI=ffffffff81d7654d RDI=ffff8880263dafd0 RBP=ffffffff81d7654d RSP=ffffc9000739f8f8 R8 =0000000000000000 R9 =ffffed10056476c9 R10=ffff88802b23b64b R11=0000000000000000 R12=ffff88802b23b600 R13=ffff88802b23c4e0 R14=ffff8880263dafb8 R15=ffff8880263da540 RIP=ffffffff81e56070 RFL=00000097 [--S-APC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096be5000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080001000 CR3=0000000021322000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000000 RBX=0000000000000006 RCX=ffffffff81b51eaa RDX=ffff88801c742540 RSI=ffffffff81b51ece RDI=ffff88801c742540 RBP=0000000000000001 RSP=ffffc9000046fdf8 R8 =0000000000000001 R9 =0000000000000003 R10=0000000000000006 R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff9200008dfc4 R15=0000000000000000 RIP=ffffffff81b51ecf RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096ce5000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00000000f547bff4 CR3=000000000e994000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000a000000000 0000000200000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=000000000000005b RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85a11295 RDI=ffffffff9b9f11a0 RBP=ffffffff9b9f1160 RSP=ffffc9000c21f198 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=3966666666666552 R12=0000000000000000 R13=000000000000005b R14=ffffffff9b6f11e0 R15=ffffffff85a11230 RIP=ffffffff85a112bf RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096de5000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080001000 CR3=000000001e867000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000a000000000 0000000200000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000000 RBX=0000000000000006 RCX=ffffffff81b51eaa RDX=ffff88801c7fa540 RSI=ffffffff81b51ece RDI=ffff88801c7fa540 RBP=0000000000000003 RSP=ffffc9000048fdf8 R8 =0000000000000001 R9 =0000000000000003 R10=0000000000000006 R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff92000091fc4 R15=0000000000000000 RIP=ffffffff81b51ecf RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096ee5000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080008000 CR3=000000000e994000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 41a983f44e9f510c b63dbfb408a9c4ce ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 29d1a408a6021f2b af29ccfd55bc6419 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 83001e8b3aa6fbb7 d855d500d51ca7b3 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 e7c0a8620b0739e1 a2b6e8d715a254b0 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000000027c0 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000040 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 bb42000001000000 f69e008001000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000011af1f5 011af2d801000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 1cd40000011af1d9 00000000011af12e ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 011af2c18a4a0080 d6320080011af124 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a87ecc180f2361ba 411cb595ed8c8109 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 c3be62ce4be0060b 1fc51759a7d6c88b ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 a54ff53a3c6ef372 bb67ae856a09e667 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 5be0cd191f83d9ab 9b05688c510e527f ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000