last executing test programs: 1m26.28619631s ago: executing program 3 (id=1125): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYBLOB="010000000000000000000700000024000180060005004e230000060001000200051b080003"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) 1m26.206065893s ago: executing program 3 (id=1127): fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) mremap(&(0x7f0000041000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00004c3000/0x2000)=nil) r0 = socket$kcm(0x29, 0x2, 0x0) write$cgroup_pressure(r0, 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000240)=0x3) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x20040011) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x0, 0x0, 0x0, 0x8020000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$pppoe(0xffffffffffffffff, &(0x7f0000000140)={0x18, 0x0, {0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 'veth0_to_hsr\x00'}}, 0x1e) connect$pppoe(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x4000080) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10, 0x80e1}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r3 = openat$nvram(0xffffff9c, 0x0, 0x203, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000100)={'gretap0\x00', &(0x7f0000000000)=@ethtool_sset_info={0x37, 0xa43, 0xff}}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x43b1, 0x0, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x8c, 0x1, 0x1, 0x301, 0x0, 0x0, {0xf8c0bfc7e8223f5c, 0x0, 0xa}, [@CTA_TUPLE_REPLY={0x68, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010100}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x1}, @CTA_STATUS={0x8}]}, 0x8c}}, 0x40000) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @my=0x0}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) 1m26.095103163s ago: executing program 3 (id=1128): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f0000000040)='timerslack_ns\x00') write$binfmt_format(r2, &(0x7f0000000180)='0\x00', 0x2) 1m26.094225224s ago: executing program 3 (id=1130): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) mkdir(&(0x7f00000001c0)='./file0\x00', 0x8) mkdir(&(0x7f0000000300)='./bus\x00', 0x68) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000240)='./file0\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) readahead(r1, 0xe, 0xffffffffffffffff) ioctl$F2FS_IOC_GET_PIN_FILE(0xffffffffffffffff, 0x4606, 0x0) keyctl$read(0xb, r0, 0x0, 0x0) mkdir(&(0x7f0000000100)='mnt\x00', 0x1ff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000060a010400000000000000000a0000010900010073797a3100000004100004800c00018008000100636d70000900020073797a3200000000140000001100010000000000000000000100000a8c261081be0a274359fd2a8aa38ac8ccc5981a440435ed5bf2fa0c6c260a6e6ba70e28bd215de8531b93e07db8c000d2626089b688c5687d3ab7c25776df37eef887508b8476c3d7107bc676a9fdeddc088455bf8c408f2bc073caa45a7ce12852f660eecc05dcb3c54cb4f110aefdce91b890da6e44b4b22a0cfb6a45c0ed98a0d339b59ff5e50fecf9d77f274763aca563062d58e0fbdc27f6dd58a322bc182b7f1bb96c0f90b64e04a881babc971b21f86dae8af4300bbda45646dde9ca8947e47fb3d529"], 0x64}, 0x1, 0x0, 0x0, 0x4008840}, 0x20040040) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000400)={0x0, 0xd0}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB='+'], 0x12) mount(0x0, &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0cc5605, &(0x7f00000000c0)={0x1, @pix_mp={0x0, 0x0, 0x56555941, 0x0, 0x2000000}}) statx(0xffffffffffffffff, &(0x7f0000000240)='mnt/ttyUSB0\x00', 0x800, 0x4, &(0x7f0000000580)) r3 = syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040a00e58684000010203010902270001010080320904000003ff000000070581024000000705020240000007058303"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@cgroup=r4, 0x11, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000640)={@cgroup=r5, 0x24, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0a062e04"], 0xd) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000140)=ANY=[@ANYBLOB="001308000000f00d3e89bf565ec7a3b4773553c11fa870d01d6ca86c00caebf132973823409c9a17b89d0bd97812d32fdff73012cf661f08dcabde6b848e99138a753f5d02297b965d08773d0190dffb38ec36582f5af2b8d67286605857a520bd863f043d40d3f020cd6688442ce1e87b14f7190d177c00"/134], 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000400)='mnt/ttyUSB0\x00', 0x2, 0x0) r6 = socket(0x2c, 0x8000e, 0x1000000) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000006140)=ANY=[@ANYBLOB="640000001900010000000000000000001d01090050001180"], 0x64}}, 0x0) 1m24.270647065s ago: executing program 3 (id=1139): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f0000000040)='timerslack_ns\x00') write$binfmt_format(r2, &(0x7f0000000180)='0\x00', 0x2) 1m23.865784646s ago: executing program 3 (id=1141): syz_io_uring_setup(0x28b5, &(0x7f0000000480)={0x0, 0xf6dd, 0xc0000, 0x0, 0x12}, &(0x7f0000000040)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000340)=0x0) (async) brk(0x55555ede6000) brk(0x5ede5fff) (async, rerun: 64) syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_NOP128={0x3f, 0x48, 0x0, 0xffffffffffffffff, 0x2, 0x8001, 0x4, 0x0, 0x0, {0x86}}) (rerun: 64) getpid() (async, rerun: 64) openat$cdrom(0xffffffffffffff9c, &(0x7f0000000200), 0xc000, 0x0) (rerun: 64) syz_open_dev$loop(&(0x7f0000000000), 0x1e, 0x4000) (async) syz_open_dev$loop(&(0x7f0000000100), 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.stat\x00', 0x275a, 0x0) (async) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='cgroup\x00') preadv(r3, &(0x7f0000000000)=[{&(0x7f0000000100)=""/191, 0xbf}], 0x1, 0x25, 0x0) (async, rerun: 32) syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) (async, rerun: 32) io_submit(0x0, 0x0, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x124411, 0x0) (async, rerun: 32) r4 = socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 32) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x6a) close(r5) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) (async) r7 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) (async) recvmsg$unix(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x20) (async, rerun: 64) sendmmsg(r7, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (async, rerun: 64) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) (async) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r9, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r8, 0x0}]) r10 = socket$tipc(0x1e, 0x5, 0x0) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f00000002c0), 0x200480, &(0x7f00000005c0)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r10}}) (async, rerun: 32) getsockopt$inet6_udp_int(r4, 0x11, 0x66, 0x0, &(0x7f00000000c0)) (rerun: 32) 1m23.747458047s ago: executing program 32 (id=1141): syz_io_uring_setup(0x28b5, &(0x7f0000000480)={0x0, 0xf6dd, 0xc0000, 0x0, 0x12}, &(0x7f0000000040)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000340)=0x0) (async) brk(0x55555ede6000) brk(0x5ede5fff) (async, rerun: 64) syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_NOP128={0x3f, 0x48, 0x0, 0xffffffffffffffff, 0x2, 0x8001, 0x4, 0x0, 0x0, {0x86}}) (rerun: 64) getpid() (async, rerun: 64) openat$cdrom(0xffffffffffffff9c, &(0x7f0000000200), 0xc000, 0x0) (rerun: 64) syz_open_dev$loop(&(0x7f0000000000), 0x1e, 0x4000) (async) syz_open_dev$loop(&(0x7f0000000100), 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.stat\x00', 0x275a, 0x0) (async) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='cgroup\x00') preadv(r3, &(0x7f0000000000)=[{&(0x7f0000000100)=""/191, 0xbf}], 0x1, 0x25, 0x0) (async, rerun: 32) syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) (async, rerun: 32) io_submit(0x0, 0x0, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x124411, 0x0) (async, rerun: 32) r4 = socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 32) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x6a) close(r5) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) (async) r7 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) (async) recvmsg$unix(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x20) (async, rerun: 64) sendmmsg(r7, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (async, rerun: 64) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) (async) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r9, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r8, 0x0}]) r10 = socket$tipc(0x1e, 0x5, 0x0) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f00000002c0), 0x200480, &(0x7f00000005c0)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r10}}) (async, rerun: 32) getsockopt$inet6_udp_int(r4, 0x11, 0x66, 0x0, &(0x7f00000000c0)) (rerun: 32) 6.369853933s ago: executing program 2 (id=1676): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) fcntl$setstatus(r0, 0x4, 0x800) ioctl(r0, 0x8934, &(0x7f00000002c0)="657468310000000000000000000000cf06000000c40ff3075b04dc727a8b9bc395a2e0f662de91f6b95cfbf004c8bcf76d2bba4f29276179f5ebe0d3a4f3f508a34cc0015792690151925b083904b755ffaf8415d5ef35b2493f5f97b125c30dd2e8148024e60cb8646ccf3e8366fd7469577f7ca0419d1e0dc47d7a3ebebe4a082cb14e418d3362f11cf5a9abaeb32c5c7ec13b30f73137654dcbcd47d417c366a317c4a41a13a00483208bd603042496419eb89e36febeae1a31dc8d9a717905c1b4a09e86") ioctl(r0, 0x8914, &(0x7f00000000c0)="6c6170623000000000000000000000000100") socket$netlink(0x10, 0x3, 0x6) ioctl(r0, 0x890b, 0x0) bind$x25(r0, &(0x7f0000000080)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x2}}, 0x12) connect$x25(r0, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) close(r0) 5.968814352s ago: executing program 2 (id=1677): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r0, 0x4) sendmsg$inet(r2, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1800}, 0x20000000) 5.855696936s ago: executing program 2 (id=1678): r0 = open(&(0x7f0000000100)='./file0\x00', 0x466040, 0x1a0) fdatasync(r0) (async) mkdirat(r0, &(0x7f0000000000)='./tracing\x00', 0x82) (async) mount(0x0, &(0x7f0000000140)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x110800, 0x0) (async) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r1, &(0x7f0000000100)='e:my_read_msr1 -sr/', 0x13) r2 = openat$cdrom(0xffffff9c, &(0x7f0000000080), 0x120, 0x0) (async) write(0xffffffffffffffff, &(0x7f00000000c0)="1c0000001d005f0214fffffffffffff8070000003000000000005200", 0x1c) (async) arch_prctl$ARCH_SHSTK_LOCK(0x5003, 0x2) (async) arch_prctl$ARCH_SHSTK_LOCK(0x5003, 0x1) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, 0x0, 0x0) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FIBMAP(r4, 0x2201, 0x0) (async) ioctl$CDROMREADTOCENTRY(r2, 0x5306, &(0x7f0000001580)={0x1, 0x3, 0x0, 0x2, @msf={0x4, 0x80, 0xfc}, 0xfc}) 5.804853164s ago: executing program 2 (id=1679): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0x10, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0xa0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b80a000500000000", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000900)={0x1, &(0x7f00000008c0)=[{0x6, 0x0, 0x0, 0x6}]}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101001, 0x0) connect$bt_sco(0xffffffffffffffff, &(0x7f0000000100)={0x1f, @none}, 0x8) getsockname(0xffffffffffffffff, &(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, &(0x7f00000000c0)=0x80) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc)=0x10, 0x5, 0x801, 0x0, &(0x7f0000000280), 0x2) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) mlock2(&(0x7f0000495000/0x2000)=nil, 0x2000, 0x0) mincore(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0) openat$autofs(0xffffff9c, &(0x7f0000000040), 0x8000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000", @ANYRES32, @ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) r3 = socket$alg(0x26, 0x5, 0x0) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x41, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = accept4(r3, 0x0, 0x0, 0x800) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2b) sendto$packet(r4, 0x0, 0x0, 0x24008805, 0x0, 0x0) unshare(0xa000200) r5 = semget$private(0x0, 0x4000, 0x0) semctl$GETALL(r5, 0x0, 0xd, 0x0) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) 5.483041165s ago: executing program 1 (id=1681): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_SET_FRONTEND(r2, 0x40246f4c, &(0x7f0000000040)={0x80000003, 0x0, @qam={0x0, 0xa, 0x6}}) sendto$packet(r1, &(0x7f0000000600)="d8b8f5a2289fedded39f79c78869a3cda57dc252f75ff3c104a126ad48adce8f0e98a950a526353fa8d1f1f8066b53786aca597ae0c003fd21a6587ac5520045360d2e5aa562a401e592bcfc58c0d2a60ae395f3fb89d355a220515630c2922f0fd8023f8aaa67287f2c7ad1bb4c90422c53df26719815a4623a13e672d9fe7ac5a8fed25dfabe68f0f78c3d141da3a996339f5a3f51b92a34272c7a7a2a23fe2d52e14bf5f074853976a718f65c70b968ac357f218b4bd26fb290a0167a578389d4140855208e0b4b570b27d92192e6e3c9cfa977e0dbf5b216a68dd1d0d20aa79e76776959e18f22f39e43ccd0f8e3963dc37fced359a6f1aad5d4cdfb5f6d6ba814f0e130edab39f06686c3da8c4022400f496f3240281c4eea169046be517f6c4661ce5df3df908bf000b882710afe0591a897c07bb3c4493edee322d4aa6a28c85290d44229732499e6f96e0222780a16bf0a86ff22d6fd545b8ac4c7c593d5ea06ff15ef1c6f01efc649b9143e259329edaa9d48bf3d9417fe9c3f4e3a53b8ab0000e3d9a0e9938d731a6e54228476681c7e1022fb17f686c781496420a3476fb03132aac5282b92de57abb64e74f3c658fb42f5a338d2b0bc316abd41e96cc3708bf3f91da759d161f4b15195ccfdcb00e560ef7fb457d7435b16fe3da112a7411193007bc83b6685d8e1f5a9f7b3e7f73319212f0de514e2761ff0fb91de", 0x202, 0x800, 0x0, 0x0) recvmsg(r1, 0x0, 0x0) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x3, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000002c0)={[0xb59, 0x9, 0xfffffffffffffff9, 0x2, 0x0, 0x0, 0x4002004c4, 0x1004, 0x76, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x90], 0xeeee8000, 0x2018d3}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 5.295677333s ago: executing program 1 (id=1682): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0x10, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0xa0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b80a000500000000", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000900)={0x1, &(0x7f00000008c0)=[{0x6, 0x0, 0x0, 0x6}]}) r2 = socket(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101001, 0x0) connect$bt_sco(r2, &(0x7f0000000100)={0x1f, @none}, 0x8) getsockname(r2, &(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, &(0x7f00000000c0)=0x80) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc)=0x10, 0x5, 0x801, 0x0, &(0x7f0000000280), 0x2) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) mlock2(&(0x7f0000495000/0x2000)=nil, 0x2000, 0x0) mincore(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0) openat$autofs(0xffffff9c, &(0x7f0000000040), 0x8000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000", @ANYRES32, @ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r4 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2b) sendto$packet(r4, 0x0, 0x0, 0x24008805, 0x0, 0x0) unshare(0xa000200) r5 = semget$private(0x0, 0x4000, 0x0) semctl$GETALL(r5, 0x0, 0xd, 0x0) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) 4.334060884s ago: executing program 4 (id=1686): socket$inet_sctp(0x2, 0x5, 0x84) r0 = socket(0x2, 0x80805, 0x0) recvmsg$kcm(r0, &(0x7f0000002840)={&(0x7f0000000200)=@pppol2tp, 0x80, &(0x7f0000002700)=[{&(0x7f0000000280)=""/60, 0x3c}, {&(0x7f00000002c0)=""/115, 0x73}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/138, 0x8a}, {&(0x7f0000001500)=""/243, 0xf3}, {&(0x7f0000001600)=""/235, 0xeb}, {&(0x7f0000001700)=""/4096, 0x1000}], 0x7, &(0x7f0000002740)=""/243, 0xf3}, 0x3dfdbfbdd7a869e0) r1 = socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setsockopt$MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) statx(0xffffffffffffffff, 0x0, 0x1000, 0xf0cb2f4a0c2cfc5d, 0x0) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd4, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x175a978679bbbe1d, 0x80a0a1240160183d) r4 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x4) renameat(r3, &(0x7f0000000080)='./file0\x00', r4, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x10c062) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x1c1803, 0x196) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000000080)={r6, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x14, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_procs(r7, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r8, &(0x7f00000001c0), 0x12) mkdir(&(0x7f0000000240)='./file1\x00', 0x8) socket$nl_netfilter(0x10, 0x3, 0xc) 3.132145704s ago: executing program 2 (id=1688): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a\x9e@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e*\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000280), 0x4, 0x90743) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x8, &(0x7f0000000000), 0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0xf}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) epoll_create(0x5) writev(r1, &(0x7f0000000840)=[{&(0x7f0000000240)="962ce42fe6ef96b7492308dd9effcecefa35a8904568182394", 0x19}, {0x0}], 0x2) syz_open_dev$vim2m(0x0, 0x0, 0x2) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r2, 0xc008561c, &(0x7f0000000100)={0x980914, 0x3, @name="6c14f9104c575323652bb05c9764e27d0235e28510452c132c1eaa54d11e47a7"}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$sndseq(0xffffff9c, &(0x7f0000001240), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r4, 0xc0a45320, &(0x7f00000000c0)={{0x80, 0xff}, 'port0\x00', 0x3eb, 0x21e3f, 0x10, 0x0, 0x3, 0x5, 0x400, 0x0, 0xa}) openat$sequencer2(0xffffff9c, &(0x7f0000000280), 0x4011, 0x0) readv(r4, &(0x7f0000002340)=[{&(0x7f0000000000)=""/66, 0x42}], 0x1) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1, 0x92) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_RELOAD_REGDB(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x501, 0x70bd2c, 0x25dfdbf8}, 0x14}, 0x1, 0x0, 0x0, 0x20008001}, 0x40) 3.043837424s ago: executing program 4 (id=1689): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) flock(r0, 0xa) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r2 = openat$full(0xffffff9c, &(0x7f0000000000), 0x40000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x9, &(0x7f0000000240)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000002f000000b709000000000000850000000700000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fanotify_init(0x200, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r3, &(0x7f00000008c0)=[{{&(0x7f0000000000)={0xa, 0x4e1f, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1}, 0x1c, &(0x7f0000001780)=[{&(0x7f0000000040)="a4", 0x1}], 0x1}}, {{&(0x7f00000004c0)={0xa, 0x4e21, 0x0, @remote, 0x1}, 0x1c, 0x0}}], 0x2, 0x0) shutdown(r3, 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x7, 0x30, 0x5, 0x5}, &(0x7f00000000c0)=0x18) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) fsetxattr$system_posix_acl(r4, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000010"], 0xfe44, 0x0) r5 = syz_open_dev$media(0x0, 0x7fdffffe, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x4c, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r5, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) r8 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x0, r7, 0x0, 0x0}) ioctl$VIDIOC_G_INPUT(r8, 0x80045626, &(0x7f0000000180)) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff2000}]}) close_range(r9, 0xffffffffffffffff, 0x0) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000e40), 0x40080, 0x0) io_setup(0xffff, &(0x7f0000000140)) ioctl$TIOCPKT(r10, 0x5420, &(0x7f00000000c0)=0x6) ioctl$TCSETS(r10, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "fe94b89fc43c3328eae0cae1f5eba329e6f216"}) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) 2.831761972s ago: executing program 0 (id=1691): socket$inet_sctp(0x2, 0x5, 0x84) r0 = socket(0x2, 0x80805, 0x0) recvmsg$kcm(r0, &(0x7f0000002840)={&(0x7f0000000200)=@pppol2tp, 0x80, &(0x7f0000002700)=[{&(0x7f0000000280)=""/60, 0x3c}, {&(0x7f00000002c0)=""/115, 0x73}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/138, 0x8a}, {&(0x7f0000001500)=""/243, 0xf3}, {&(0x7f0000001600)=""/235, 0xeb}, {&(0x7f0000001700)=""/4096, 0x1000}], 0x7, &(0x7f0000002740)=""/243, 0xf3}, 0x3dfdbfbdd7a869e0) r1 = socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setsockopt$MRT6_ADD_MIF(r1, 0x29, 0xca, 0x0, 0x0) statx(0xffffffffffffffff, 0x0, 0x1000, 0xf0cb2f4a0c2cfc5d, 0x0) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd4, &(0x7f0000000080)=0xa, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x175a978679bbbe1d, 0x80a0a1240160183d) r4 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x4) renameat(r3, &(0x7f0000000080)='./file0\x00', r4, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x10c062) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x1c1803, 0x196) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000000080)={r6, 0x0, {0x0, 0x0, 0x0, 0x5a, 0x6010000000000ffd, 0x0, 0x0, 0x19, 0x14, "faf98317e5a1149989fc8dbe43ee6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60b534464c516bdd8a0f3500", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802c4daf4162e43ac61b7ad3300", [0xbffffffffffffce8, 0x100]}}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_procs(r7, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r8, &(0x7f00000001c0), 0x12) mkdir(&(0x7f0000000240)='./file1\x00', 0x8) socket$nl_netfilter(0x10, 0x3, 0xc) 2.725754771s ago: executing program 4 (id=1692): fanotify_init(0x1a, 0x800) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0xa8) syz_open_dev$video(&(0x7f00000001c0), 0x7, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0x80007, 0x7f, 0x20000006, 0xca, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x100001, 0x3, 0x0, 0x5, 0x6, 0x2000001, 0x7, 0x3c5b, 0x1, 0x24, 0x8006, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0xfffffffc, 0x6, 0x7, 0x17, 0xd, 0x3, 0x2, 0x3e, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x4f8f1592, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x169432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x312, 0xd, 0x8, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x7ffe, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x0, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0xa6d, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x45, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x2000000, 0x1ef, 0x7, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x1fe, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0x4000a9, 0x5, 0x9, 0xac8, 0x2000af, 0xfffffffe, 0x8, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x3, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x2, 0x5, 0x42c2, 0x6, 0x6, 0x0, 0xb9, 0x4e7, 0x5, 0x2, 0x57, 0x4, 0x8000003, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x1, 0x1, 0x2, 0x5, 0xe7, 0x8, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0x6, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x45, 0x8, 0x30b1d693, 0x5, 0x1f40, 0x7, 0x41, 0x6c1b, 0x2000, 0x804, 0xac1, 0xb1e, 0xd7, 0x9, 0xffff3441, 0xfff]}, 0x45c) syz_open_dev$vim2m(&(0x7f0000000040), 0x40005, 0x2) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1}) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xf}, {0xb, 0x1}, {0xffe8}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xff, 0xfc, 0x200, 0x80000a, 0x0, 0x1, 0x1}}, {0x4}}, {{0x1c, 0x1, {0x6, 0x4, 0x4, 0x9, 0x2, 0x8, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x2040806}, 0x0) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x300}], 0x20000000000000dc, 0x0, 0x0, 0x0) 2.3151012s ago: executing program 4 (id=1693): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0x10, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0xa0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b80a000500000000", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = socket(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101001, 0x0) connect$bt_sco(r2, &(0x7f0000000100)={0x1f, @none}, 0x8) getsockname(r2, &(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, &(0x7f00000000c0)=0x80) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc)=0x10, 0x5, 0x801, 0x0, &(0x7f0000000280), 0x2) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) mlock2(&(0x7f0000495000/0x2000)=nil, 0x2000, 0x0) mincore(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0) openat$autofs(0xffffff9c, &(0x7f0000000040), 0x8000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000", @ANYRES32, @ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x41, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r4, 0x0, 0x0, 0x800) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2b) sendto$packet(r5, 0x0, 0x0, 0x24008805, 0x0, 0x0) unshare(0xa000200) r6 = semget$private(0x0, 0x4000, 0x0) semctl$GETALL(r6, 0x0, 0xd, 0x0) r7 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) 2.194244662s ago: executing program 1 (id=1694): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b3", 0x40}], 0x2}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000740)=""/105, 0x69}], 0x1}, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x81, 0x8, &(0x7f0000000000)) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x2, &(0x7f0000000040)) openat$adsp1(0xffffff9c, &(0x7f00000000c0), 0x10000, 0x0) bind$x25(r2, &(0x7f0000000080)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) 2.193247487s ago: executing program 2 (id=1695): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0x10, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0xa0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b80a000500000000", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000900)={0x1, &(0x7f00000008c0)=[{0x6, 0x0, 0x0, 0x6}]}) r2 = socket(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101001, 0x0) connect$bt_sco(r2, &(0x7f0000000100)={0x1f, @none}, 0x8) getsockname(r2, &(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, &(0x7f00000000c0)=0x80) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc)=0x10, 0x5, 0x801, 0x0, &(0x7f0000000280), 0x2) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) mlock2(&(0x7f0000495000/0x2000)=nil, 0x2000, 0x0) mincore(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0) openat$autofs(0xffffff9c, &(0x7f0000000040), 0x8000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000", @ANYRES32, @ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r4 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2b) sendto$packet(r4, 0x0, 0x0, 0x24008805, 0x0, 0x0) unshare(0xa000200) r5 = semget$private(0x0, 0x4000, 0x0) semctl$GETALL(r5, 0x0, 0xd, 0x0) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) 2.094805924s ago: executing program 1 (id=1696): r0 = socket$inet6(0xa, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_emit_ethernet(0x126, &(0x7f0000005a00)={@local, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6410a6", 0xf0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1e}, @local, {[@dstopts={0x3a, 0x1c, '\x00', [@generic={0x5, 0xad, "e1aee0fda47947472011ad5f45d5370090592f44de9df82eba41881a0e62615dac01356c4e9025071c8e19b0d7bd228edb91b818b77b650abe89a964652e28b8ca6986e77235f5c898fa11b85e82094fc0066e7cdb34639712d5f053e41a3880c706d6a9932f194b19fc516d05fd5c129573a8cd0535dbbfd40ffdffff426e043d10fc1d2fe2f8de3e01b5eb7b9f65875b81a601e7aed11af5f5a7ff41e521d60b024ddc44e45d826967b69e33"}, @hao={0xc9, 0x10, @dev={0xfe, 0x80, '\x00', 0x18}}, @enc_lim={0x4, 0x1, 0x3}, @hao={0xc9, 0x10, @mcast2}, @jumbo={0xc2, 0x4, 0xfffffffc}, @calipso={0x7, 0x8, {0x2, 0x0, 0x8, 0x7}}]}]}}}}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0xffffffff, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x4, 0x3, 0xe}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1b, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40844}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x278, &(0x7f0000000340)={0x0, 0x0, 0x13580}, &(0x7f0000000100), 0x0, &(0x7f0000000000)) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) openat$dsp1(0xffffff9c, &(0x7f0000000180), 0x82002, 0x0) r4 = syz_open_dev$video4linux(&(0x7f0000000200), 0xffffffff, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r4, 0x4020565a, &(0x7f0000000280)={0x4, 0x777, 0x3}) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}}) 1.743803121s ago: executing program 0 (id=1697): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000090000000000000000000000850000"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)={0x24, 0x40, 0x107, 0x0, 0x25dfdbfc, {0x4, 0x7c}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x16, 0x0, 0x0, @ipv4=@multicast1}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x48800}, 0x0) syz_kvm_setup_cpu$x86(r2, r1, &(0x7f00003a1000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="9a01000000f800b8d58800000f23d00f21f8351000000d0f23f864640f79ea66baf80cb8c85f5480ef66bafc0cecc4c2adac17b9550200000f320f2860c7c4e11751df0f2e2d00000080b9800000c00f3235008000000f30", 0x58}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r3, 0x4048ae9b, &(0x7f0000000080)={0x130000, 0x0, {[0x0, 0x1f8, 0x0, 0xffffffffefffff15, 0x3, 0x8, 0x1, 0x4]}}) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="2a0000000600000000000000000020000000000000000000020002000000004bba8327358ba9f58b0abd1c0018e9852c371d77caf940ccf2"], 0x2a) ioctl$KVM_RUN(r3, 0xae80, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xffffffffffffff94, 0x0, &(0x7f0000000100), 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) set_mempolicy(0x1, 0x0, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r9 = dup(r8) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f0000000440)={[0x8002, 0xffff, 0xffffffffffffffff, 0x7a, 0xaf5, 0xfffffffffffffffd, 0x6, 0x1, 0xfffffffffffffffe, 0x7, 0xaa1, 0x213, 0x3, 0x6, 0x6, 0x80000001], 0x257000, 0x2}) mmap(&(0x7f00000ce000/0x4000)=nil, 0x4000, 0xb, 0x13, r9, 0x2000) ioctl$KVM_PRE_FAULT_MEMORY(r7, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000200)={r10}, 0x4) r11 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) ioctl$BTRFS_IOC_SET_FEATURES(r11, 0x40309439, &(0x7f0000000000)={0x2, 0x1, 0x1a}) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x3, 0x1c, &(0x7f00000000c0)=ANY=[@ANYBLOB="180800002d98afeb000000000000000018280000", @ANYRES32=r10, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000000000b7020000000000007b9af8ff00000000b5090000000000007baaf0ff00000000bf9700000000000007080000fffdffffbfa400000000000007040000f0ffffff740200000800000018220000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000007d98000000000000560800000000000085000000a4000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.194203066s ago: executing program 0 (id=1698): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x8607}, 0x10) r1 = openat$bsg(0xffffff9c, &(0x7f0000000340)='/dev/bsg/1:0:0:0\x00', 0x154002, 0x0) ioctl$BSG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000480)) sendmsg$nl_generic(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000001600010a"], 0x20}}, 0x8000) r2 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x78, '\x00', 0x0, @fallback=0x30, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000300)={@map=r2, 0x24, 0x0, 0x10000, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r5, 0x0, 0x25, 0x0, @void}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r5, 0x0, 0x25, 0x8, @void}, 0x10) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000180)={0x10000}, 0x8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000380)={r3, 0x0, 0x30, 0x0, @val=@netkit={@void, @value=r5, @void, @void, r4}}, 0x1c) 1.124873115s ago: executing program 0 (id=1699): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff) mount$nfs4(0x0, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000200), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='addr=:']) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000f900800000009c000061aa00000018110000ccade868", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000018000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000100000085000000a60000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x7d}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1.054497661s ago: executing program 0 (id=1700): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) mkdir(&(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff) mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) r6 = syz_open_dev$tty20(0xc, 0x4, 0x1) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r8 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r8, 0xc0184800, &(0x7f0000000100)={0x20004, r7, 0x2}) r10 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_GEM_FLINK(r10, 0xc008640a, &(0x7f0000000300)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r10, 0xc010640b, &(0x7f0000000140)={r11}) ioctl$PIO_UNIMAP(r6, 0x4b67, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x8000, 0xffff}]}) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x52, 0xd8, 0xfffc, {0x20, 0x1}, {0x46, 0x8002}, @ramp={0x3, 0xfb27, {0x5, 0x4, 0x1ff, 0xfff}}}) r12 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) write$char_usb(r12, &(0x7f0000000040)="e2", 0x12d8) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_sfeatures={0x3b, 0x2, [{0x178f705d, 0xb}, {0x6, 0x2007f}]}}) write(r4, &(0x7f00000005c0)='64=', 0x3) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00', @ANYRES16=r2, @ANYBLOB="0500"/11, @ANYRES32=r3, @ANYBLOB="0800050008000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r9, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000400)=ANY=[@ANYBLOB="5000030008021100000108021100000008021100000000000080000000009873e0534acfc4250491fc0000000400010001018206028000"], 0x2b) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) 931.739193ms ago: executing program 1 (id=1701): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000000c0)={0x9}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@gettaction={0x1c, 0x5a, 0xc6b747b6bf1c6b95, 0xfffffffe, 0xfffffffd, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE(0xffffffffffffffff, 0x5000940e, &(0x7f0000000100)={{}, "033c6ca95e11a3f08590190248c863dc4c8a619bf0ca00c2be6ffe4797f88ece837adb247f888677c4864625529a81959e8aabf234a4643ac5a9c748df44255aab3ac3579a6c528f8c6dfe88eb52241244b068009806e384226024cbebaca5261ab646401a1cff22f99ed719bc64df6e907748fe7aa765a1c93b4a06152997c1f66ad0869e32c5d17a1dfd98bf4082bdbcb2845fe763b8ed5eafdd678a463a41b39768de4ff7f9815d163a0f879945b30f185daf1cb3cbe9634e765e4f0bb452275d52f2394a854ce9006c33838c995906ffc4b31a99b10ee3bf94cb309b60e44a6ef23a5825b13d20e3228c2032ce8702c109b3aedd6984906a316461453df6a08b2c1706a77273e6578e1d23fc9708a3f2db9c22d19c9f89122a98939adb0797f7bc925a9e7b0bd7c3821fa0139a1c740120d2eefb0a01b24587c9f952bf5872d8703ed919adf544a0a905b160d04381d545ebba9a25f1dc090a3324fb8961b6380ff9c35e4588246b9d17743bf367d1eba2b0efd47be4a51e0f3ac00f7d0d2206b6d72fb860b938104f41537e0e4e7d700c05e442b025effd2043584601269c1b21f4b36ec0c814cfc2afa145e59ab7abecae95ac22d2ecfbc1e95a34d48432a22a6c0ce10ed4abceab2245f5185d5d6a4cc56bcf32859ec3d442ce255ece7354b021e812be17edaa75ce6005d92678cd519d3ad5815bc256af02499119f6aa3963675f7cd85362050a84660947c639981ad9d712e945f7f9dbe5b94a0986d6515263e7dcaa5a5aa176a9ed772bc50005fab5146faa70f0e4522feaae8914ef04f93b610a774b736e2f2ba184b79b32e715e791454a1aeb8f8f3d0bba2bd480ee7ea3fd5e8aaa812103f722b23510020a77e1ad102239754c3f6aec4361d542a51b97cef8ea7b94f22562ff592e8578d9ba8941c8a77236d23d92ed860b967d5945d6051bb9fb9606e329399aad5b476bff50fdec07cb94ce1b71c4147d4e3aa264fc7aa1a4137182d70ff6d4c14bdcb70ec72ef1eaf731a1aca39b5b948251e31b80f7b39784a1ff1dc7cb1100149b468cbee1aba0953357de72fd65379c8f45280e07e8801b2a663ca2d8635a901a5c6e248b8b53235c5ed346642d5f7253a40f859a046cfc98ea8d1aef6da7444d5b7633f34052dbc6adca5313717361b8368bd5f8b7a818ca8f07b6a5d29171df7b5826e08994aa04b831727aacb239a2c3cfc65b8aa0759afd13bdab8e9fecd78e6fcea8aa2e9e40cff9c679425248ab1f7e780280fe1d6176ff84f1b63cb495c60c050a8f56bc5a8fce2d83419728af469c20aa0720de107de5fede18411e174ec6500fe94fae3cebf3addbdc4679743980fed58d0047c56ab251d15c742bbae85f3828405a2b347fd433d52da85690aac3dfb4db83777f36a1ec6706456914ec897ab245fa35fd38aa8f404db70544d933e6c06b701478cb3973f56129ff110a4dfaa84fa977bad97150f72356e2fd961ba6fc85d122176436bbed7ebbb0d8378fbdceac1e74d44385917a285c2170200316bb057bafe0c53b601724f11ef10dc12a399ab8a6b4f140b960a7934aaf2a4e5f66fd4228992018bf727d1ff557b534547c16189c8f74c85ebe9d48b0bfde19a92c01d2bf0f82713de10994adea6db31d58c16b30cdff0aef9e174f4475c6554a10c5bb2a3d480d722ae1cb42a9a451ee1c32dff6ca2851e4c3a23945163900fc6111f3c690eafc15e6512886e3617de2d31833e7df93639ccd654f998dba428dbea01914b476477b00000000e97d31cf763134c84d84515ae8fdf928934d8637d6f9b0fa86fa25b25bd51cd37708eeb034fb0dd510f36ddd8766e4010e08df0f458507b73fe8ca5c4829c4038543b5f4aabbd1f0420f18ce408e7dd877a3488fd269f3aa32b5ee2626ae803b936d863ab24a4aa4bee7adb97c418a2dc0ca711bba53f727ca3f7d94ddbd0567911358aed2baa152ae342584bb0a67ad0f4623dc99c9718ecf82b51b39854b1304d34f8c0be4375e95083a1955ac999c638f3f448e373cc456ae889f64a3d080b7ef720783b3898af099d3aee7c4dedf005533f1dbf3c14fc572d27f830371320c8f7c53440c31713f926afb3348c8270ad518b99669b34bdce6a135a0f7ef866099bf4d1c145d73a383a3cbbc3d34ae2c869edcd79610444632833072291c10765a9e962025a8ede679a8008ea24e900cf707c33d0042d33fc2443e3afb919fea6d41074f9fb03c37141ba089f17f55ae4979a78aabc4e72243fc7fd485f892c4011efbd4cd9ef0e3dd452f73deb4c415c75347a6235ec270f75ba31ba5409c380ec41a6b63cbb1003c9074b734a003fdacb95433a3dcb9b6e5f0130377bb40e49e04f188b83d46d254142f4496a6bb3408e90a9286941723ce68513e47ca8baa24ba79df46ddf1b59767e9462ded80ab054fd905c6db23ab0958452b07ba369534aaaf07f48f50c48dd1911dccb431112639a85516cc40f4b0d04c04c8f5b294bef2707b0299814ae7d6404cef3b654cb5e3d012d73e9abcb1f5cdac8880de537e75ba0eb68dda6c971747d2ac6f334a7756ffa813ec39d7e38f8f52b62831f28adadadb70e82266a25f12a48a951f5a2cfbffb868b464b27f8fc1ac89d769d2df18efd9be74116c749ee47dcead8bdf4b38f4f584c825eb088fa0048fb12bcd03778842b4f86eb6ded5e30900a74fa5171d0a9f721b0b99cb98d89d7c37259cf05be2a19b8f7ec8ceb330a1814f32e32d2dd75a7c6370fbc17b3adec5d13a28bb439c55dc2b52ffd188e593c9758b551b4074ccd66da831322b45a74c947e9403b32193a6198a57d08e145092b4c97db810447979825fd379a90b1668e0b80460b3448d8c7461482fca25f89e655942d40380a8b8c6ef2fd3866fe31d70f254bfbd67839c622f349060dd928b678033876f51aecf05524d3e179b4a43df7bc3c6cb9a0cd9852bcc42dec3d71add33060a4370448fbcc50808d7ff0a9410f5b91a79171305dc58e8554a4cffe13804ef71bbef85e903ba44f0a4100e9ade24e57de1591a9d71af9f94091d425220be23d4c7b58985873831fa1c0fde9ba091bde61e6caa50af521fb56b21ca1dd1e66e1697e68d6583b1c2c44d88b69a131434022902a4f96d464d40f0ee19928ae7027c02e9bfb49f9c4a5b74a48bd466ad991a35abd898886ee4c1a7e37a474f922a4e57e6c46f5fd06f48e4918b0bd2996881a999fcb7bf54b4e7a9eea1bd2315c1ee6b45cb21a49730b180096dc3290f7efc4de3c785a97b8797bccd9cd09d1bf8a498c22e5fbf0d388cd58be44cc2fdb4dd3677453d20c9e01ecf3467fe74f0a1fc6f20b0d81a7adc9c8ee28bcdcd71f1f97bbf72dd1006acde4824ef45f95dab9dea8cef52a0990add23f7d57fbf8b83652ccaa613c36f525b3777bd7ecd299b3b7d896c07d749922e235bd46a841348fdafa32671a7edda900dc19a74bbfbbdb8e5c7d55eb561d1ae7718aba187a3c5870571a50177ef2660a9cb566425f35f6cf71e866d1e584fdde0f57ecbbd57ea7a04459db823557a1f3e7ea432240bc5b724d51ef3a321397d9a455fb16dec828630f88253ee289e23798512da3db6c7965803155f27ba152f2287b373f74cd0048ac122f674a469b99614d2e24e7e2abe711aba352edaaeb2dc6419314f311fabc52c6947ea17dec6a1261e99163fb5c521aff0c89df3438a29e69c48b779505440fcac253a63a9a6c18680f0271046f579237739cd40d9334e2b4160384d1c69056e285181d4296abab6833dfff212f3b6da9aab6511ad69f682ba9cf990f066d68963f232a38b70f1fb76b19e8b1d8c6df332e237b0f6b2901755ab69751537d0f9ccb1b79db71cfb76f9e3a6771581768b5aa8bcbbe0ca71b86535880b7041c511bcf81cbeed58fb23489e89e02bb22f8dca24f05450962f1c1a45c3e2f2e424ce25ce46c2d7a59f64633097dc031a6dbd5e0505b0ececac2f1f25ef72b9f098fdfd82a575fa061d3b193e5afac8d3ed4a75c192beffdd5d22e8398fe898606a4ab242a3129c569556ac69c37a7f77928a9cc9185a5fc2582c31f1337ec15e5e1e66af1c51dbec78cba3c05d7867bc990b1e51bc6b152aaf2e4aaaffa50d93d841a921b554d79600ebfcde7c30f1b52b34cde75fba61fff59f03453ab4d0496afc18ba7546307d9d5e802f8d9b8c5f8787627e6d0f3f19527dc943239084994ce0d043e9e38f3ed77f5d4e08151300c3c04b6d4ac17adb13d0f5b96f29dc414b1c9f1e170e1618412e36325e2347eecb32199341aeec10b3cf8eccb1d2dddb5556ff7212cbe45e58c990d540819bd8abf92dda3018714ebd4a05ead45d63088b12bfd5f52c1096b7029345184edeb00e1f6a1bdbf553dbfb9c06d6954574cc188a0398170cdd3d5b02540d4554a0bd36893d5663dd8f369bf50819564600af6f14dd8af1b67dd8486a076fa8fa141a62747d8e693280fd732c3f9b0c2d7cf27dbc0292f52624ac3e821199282a637fad9376d7fc6307b4fb1a1c4b109bdcb7e1957cb7fe3d81022513381984ef79f2f95ac4b5adb9d05a633aa637a9def0cd5c34ac9ce116b501a0d36df0546985febcc31a9e84c317dd6918df959c257e186eec12cd41742b3591960df5ab821d931be5c8042fc5770d9afccb30c24f8a1d772e254b36cd1ede0c2a812c58cf5f4bce88393622087d7576ae74fa4b55b86bd178abe477e7346dc4b72dac62e9ded994e6bb7b90d5f6814f1c371c518990a4c2cb1787d9c84d4efe433a90b7c1f7a35ae3aef3ec68a30c5a754817ef3739c48c5b5784193b822e9aff25a0f559616e6dce19e33bdea329086890f6e161eaac1860f7230364389e398d6b9a95d5006a3df27d9551f40382ce27bba082c18bcec960d519ea98ba9d0ba784e0c58f126f417e5e94115d00d92e56056b98464ed8105f0ae00789a5492506fa04b0109a8ad87a856907f741652fea7d6d9561fd5e4066e4cff25b5a18c965f75bc68edbaa4c3cd37188a37320d495dc47aa7ccb878f33a03e4b6043146c1a2c58cb4faf11a4daad925b75e6715cd56ea4bcdd68ab2c9fcb231ab14654f4d3fc7d105e56b41c1de5f6a5f2c3483eba709dd63f2a2af63305d289a7ed38b0864f963f99775bd7db5e5935c6d9011d8d10ec62949c4dfa5955c1bed1c6fcd6eb4b88998a0fe4beb936879c8a894079a0e9fafe5862ed802ca30e0f4c755b2c9baea945c011f9cb827cd218573f343a3f6400df09a219f4408b95a22e325f85223401f5227ec15707b639f779ce559214c0da26c63e82841f084f4a8f36484436c6ad65ac60b14c8dee74138886197665a207312c031846db0d7a8f2ca37fe84184a698f9e0abf1b63de033fa105532e5b107f7a345bd3fc9f4d2ae09a698340dae613723cdc0d455e94ef71bbaa64f1252d536bb1c0b4551768ea911768745cac6c20e42db256e463d50e6318fb06dd46999a38e76c5683eeb276ad02755de4bb01c1ff3d24610bf38349800b488357bb611e6cab6ef8afd27952653a5e52b9fb968bcc1e06bd5349078c93c463daa4be697de51f6e15c699ead6fd1f84df8a74c4ce3dd32f6d33ba733e406cdc47764b7ff33d565d4c4e309559b65a53e7775d01bc2d7adfcfca33477fd453b8cd5cd3a23382ee70b1dae8bcf7479a86854b8b5b6348834ab509d03432eeeb93eb0d52ca70f5059781143b1f2d84c26bfa7e1ff37dd329600"}) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x3}) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000b40)={{0x1}, 0x0, 0x0}, 0x1c) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl(r2, 0xc138fd03, &(0x7f0000001000)="0400000032000000") ioctl(r2, 0xc138fd01, &(0x7f0000002000)="04000000320000000e0000006c01") 435.063367ms ago: executing program 4 (id=1702): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xc, 0x7, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2ffff}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f0000000180)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x7, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$9p_tcp(&(0x7f0000000640), &(0x7f0000000680)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000000080)={'trans=tcp,', {'port', 0x3d, 0x4e22}}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x7f) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000140)={@dev, @local, 0x0}, &(0x7f00000001c0)=0xc) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'gretap0\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x20, 0x7800, 0xc, 0x3, {{0x8, 0x4, 0x3, 0x2c, 0x20, 0x66, 0x0, 0x6, 0x2f, 0x0, @broadcast, @remote, {[@end, @generic={0x88, 0x9, "c812c9fb54c28e"}]}}}}}) sendmsg$ETHTOOL_MSG_EEE_GET(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x78, r2, 0x4, 0x70bd29, 0x25dfdbfb, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x40}, 0x24048800) 364.535665ms ago: executing program 0 (id=1703): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000040)={0x0, 0x3, 0x2, 0xfff}) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000001c0)="ad", 0x1) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYRES8=r0], 0x14}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000040)={0x0, 0x2000, 0x0, {0x2, 0xa}, {0x1, 0x8}, @const={0x0, {0xfbff, 0x8, 0x4, 0x81}}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4808000010001fff3a4ee9bfd5c3a3696c40af0b", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e"], 0x3}}, 0x0) write$binfmt_misc(r3, &(0x7f0000000000), 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ffe6, 0x0) r5 = openat$ndctl0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(r5, 0xc0186445, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r5, 0xc008640a, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r6 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) dup(r6) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x40) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) r7 = socket$inet6(0x10, 0x3, 0x0) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="043e1d", @ANYRES32=r7], 0x22) 334.474851ms ago: executing program 4 (id=1704): socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080), 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000175b133a00"/28], 0x50) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040f3f01f7d04a37f60a74b51f629a0332b0854d78ec1123e57c7ff57f1c8b1141977fb5ac0d93db53353a9f1776ef87199e5752827c1ddf2708ce41dd41fd679ecf82470cb8063f90e041b6c1d68c036918033f210aba1baa733be085"], 0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0xa545) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000380)='./file0\x00', 0x67) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x2010042, &(0x7f0000000000)) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x180, 0x0) ioctl$SNDCTL_SYNTH_ID(r3, 0xc08c5114, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[], 0x290}, 0x1, 0x0, 0x0, 0x200400c0}, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x400448ca, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = socket$inet(0xa, 0x801, 0x84) listen(r6, 0x8) accept4(r6, 0x0, 0x0, 0x0) connect$can_bcm(r5, &(0x7f0000001ff0), 0x10) syz_open_dev$ndb(0x0, 0x0, 0x8180) openat$sequencer2(0xffffff9c, 0x0, 0x89980, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) 0s ago: executing program 1 (id=1705): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1c0) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/strings/0x409\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409/s1\x00', 0x1c0) rmdir(&(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/s1\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a566830000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a300000000078010000060a0104000000000000000001000000e4000480240001800b00010065787468647200001400028008000540000000000500020083000000100001800a00010072616e67"], 0x1ec}, 0x1, 0x0, 0x0, 0x2a008800}, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="f00000001000130700000000fcdbbcc87f2ea5f7242251dae3765ddf25ac1414aa00000000000000ff984f120000000000200100"/64, @ANYRES64=r0, @ANYRES32=0x0, @ANYBLOB="20010000000000000000000000000000000000fe320000000000000000000000000000000000000000000000000000000000000000000000fdffffffffffffff09000000000000000000000000000000090000000000000000000000000000004305"], 0xf0}, 0x1, 0x0, 0x0, 0x10810}, 0x400c0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = socket(0x10, 0x3, 0x0) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)="1c00000021006bcd210002006e04000081000010000000017aa60864", 0x1c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r3, 0xc0105500, &(0x7f00000001c0)={0x2, 0x8, 0x9, 0x1, 0x0, 0x5, 0x0}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(r1, 0x4068aea3, &(0x7f00000005c0)={0xc1, 0x0, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_emit_ethernet(0x92, &(0x7f0000000180)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @remote, @void, {@mpls_mc={0x8848, {[], @llc={@snap={0xab, 0x1, "b0d2", "b0999b", 0x8809, "ae46295c4eb65bb4a0dfac4c039dbf1c90b594f26ccc1379ca989da1ec4a51fda99d753abf6181c3294efbcb5550ba9c9dcdae63b13c44bc35c51337e2c3514ce0fb6d3e24b6665474996dae64268fb6ef504f484acb4f3bc6e21d5e19dab19124abe466e7aee6e34186ca33a90d0f0c3bcead915b386547b255a2"}}}}}}, &(0x7f00000004c0)={0x1, 0x3, [0x51d, 0x8c3, 0x98c, 0xed2]}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x1, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x40, 0x42, 0xfb, 0x0, 0xc, 0x0, 0xfb, 0x4, 0xfc, 0x34}}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x100000000005, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x80000004000080, 0x1c00000, 0x8, 0x0, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(r4, 0xae80, 0x0) kernel console output (not intermixed with test programs): /O error on dev loop7, logical block 0, async page read [ 288.243662][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 288.247246][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 288.478180][ T9239] jffs2: notice: (9239) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 288.489824][ T9239] netlink: 8 bytes leftover after parsing attributes in process `syz.1.843'. [ 288.493641][ T9239] netlink: 8 bytes leftover after parsing attributes in process `syz.1.843'. [ 288.503635][ T9234] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 288.726489][ T9247] binder: 9246:9247 ioctl c00c6211 0 returned -14 [ 289.119837][ T9258] bond1 (unregistering): Released all slaves [ 289.661527][ T9266] netlink: 'syz.1.848': attribute type 1 has an invalid length. [ 289.679503][ T9266] __nla_validate_parse: 1 callbacks suppressed [ 289.679521][ T9266] netlink: 756 bytes leftover after parsing attributes in process `syz.1.848'. [ 289.934755][ T9269] pim6reg: entered allmulticast mode [ 289.983397][ T9267] pim6reg: left allmulticast mode [ 290.094362][ T9269] loop7: detected capacity change from 0 to 7 [ 290.116514][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 290.123740][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.127293][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 290.132328][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.136202][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 290.139474][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 290.143290][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 290.151265][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 290.156901][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 290.346899][ T9274] jffs2: notice: (9274) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 290.414417][ T9274] netlink: 8 bytes leftover after parsing attributes in process `syz.2.852'. [ 290.425125][ T9274] netlink: 8 bytes leftover after parsing attributes in process `syz.2.852'. [ 290.669843][ T9296] sch_fq: defrate 2 ignored. [ 290.674851][ T9296] netlink: 4 bytes leftover after parsing attributes in process `syz.2.860'. [ 290.678029][ T9296] netlink: 5 bytes leftover after parsing attributes in process `syz.2.860'. [ 290.826797][ T9302] jffs2: notice: (9302) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 290.835467][ T9302] netlink: 8 bytes leftover after parsing attributes in process `syz.1.862'. [ 290.838288][ T9302] netlink: 8 bytes leftover after parsing attributes in process `syz.1.862'. [ 291.050154][ T9311] netlink: 'syz.1.863': attribute type 1 has an invalid length. [ 291.056541][ T9311] netlink: 756 bytes leftover after parsing attributes in process `syz.1.863'. [ 291.178015][ T9315] syzkaller0: entered promiscuous mode [ 291.180372][ T9315] syzkaller0: entered allmulticast mode [ 291.447199][ T9328] jffs2: notice: (9328) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 291.459622][ T9328] netlink: 8 bytes leftover after parsing attributes in process `syz.2.871'. [ 291.464451][ T9328] netlink: 8 bytes leftover after parsing attributes in process `syz.2.871'. [ 292.140933][ T5828] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 292.242060][ T9358] jffs2: notice: (9358) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 292.307313][ T5828] usb 6-1: config 0 has an invalid interface number: 205 but max is 0 [ 292.313746][ T5828] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 292.323482][ T5828] usb 6-1: config 0 has no interface number 0 [ 292.326469][ T5828] usb 6-1: config 0 interface 205 has no altsetting 0 [ 292.333432][ T5828] usb 6-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 292.337503][ T5828] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 292.341640][ T5828] usb 6-1: Product: syz [ 292.343561][ T5828] usb 6-1: Manufacturer: syz [ 292.345581][ T5828] usb 6-1: SerialNumber: syz [ 292.350918][ T5828] usb 6-1: config 0 descriptor?? [ 292.356676][ T5828] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 292.362678][ T5828] dvb-usb: bulk message failed: -22 (3/0) [ 292.405346][ T5828] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 292.414866][ T5828] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 292.420237][ T5828] usb 6-1: media controller created [ 292.427030][ T5828] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 292.446869][ T5828] dvb-usb: bulk message failed: -22 (6/0) [ 292.451660][ T5828] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 292.453586][ T9363] netlink: 'syz.3.883': attribute type 1 has an invalid length. [ 292.465409][ T5828] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb6/6-1/input/input117 [ 292.478130][ T5828] dvb-usb: schedule remote query interval to 150 msecs. [ 292.481523][ T5828] dvb-usb: bulk message failed: -22 (3/0) [ 292.500397][ T5828] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 293.179281][ T5828] dvb-usb: bulk message failed: -22 (1/0) [ 294.010919][ T5828] dvb-usb: error while querying for an remote control event. [ 294.047450][ T56] usb 6-1: USB disconnect, device number 17 [ 294.059159][ T9381] input: syz0 as /devices/virtual/input/input118 [ 294.132064][ T56] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 294.447985][ T9388] jffs2: notice: (9388) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 294.645643][ T9394] syzkaller0: entered promiscuous mode [ 294.648215][ T9394] syzkaller0: entered allmulticast mode [ 294.748969][ T9406] netlink: 'syz.2.897': attribute type 1 has an invalid length. [ 294.752228][ T9406] __nla_validate_parse: 9 callbacks suppressed [ 294.752243][ T9406] netlink: 756 bytes leftover after parsing attributes in process `syz.2.897'. [ 295.250741][ T9409] pim6reg: entered allmulticast mode [ 295.278530][ T9407] pim6reg: left allmulticast mode [ 295.350368][ T9409] loop7: detected capacity change from 0 to 7 [ 295.359077][ C1] blk_print_req_error: 2 callbacks suppressed [ 295.359093][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 295.366210][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.369542][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 295.373412][ T9411] netlink: 88 bytes leftover after parsing attributes in process `syz.0.899'. [ 295.374121][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.381483][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 295.385982][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.390190][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 295.394603][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.398280][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 295.402708][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 295.406821][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 295.684506][ T1037] Process accounting resumed [ 296.572453][ T9440] jffs2: notice: (9440) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 296.645553][ T9443] netlink: 'syz.1.909': attribute type 1 has an invalid length. [ 296.648261][ T9443] netlink: 756 bytes leftover after parsing attributes in process `syz.1.909'. [ 296.664766][ T9440] netlink: 8 bytes leftover after parsing attributes in process `syz.2.911'. [ 296.673410][ T9440] netlink: 8 bytes leftover after parsing attributes in process `syz.2.911'. [ 296.883825][ T9451] fuse: Unknown parameter 'rooÿmode' [ 297.329158][ T9463] netlink: 52 bytes leftover after parsing attributes in process `syz.0.917'. [ 298.669445][ T9475] ipt_REJECT: TCP_RESET invalid for non-tcp [ 298.744657][ T9477] netlink: 88 bytes leftover after parsing attributes in process `syz.1.920'. [ 299.113928][ T9482] overlayfs: missing 'lowerdir' [ 299.246929][ T9485] fuse: Unknown parameter 'rooÿmode' [ 299.403864][ T9495] netlink: 'syz.0.926': attribute type 1 has an invalid length. [ 299.407946][ T9495] netlink: 756 bytes leftover after parsing attributes in process `syz.0.926'. [ 299.994592][ T9507] netlink: 88 bytes leftover after parsing attributes in process `syz.1.929'. [ 300.199066][ T9516] CUSE: unknown device info "" [ 300.202518][ T9516] CUSE: unknown device info "Ö" [ 300.204653][ T9516] CUSE: unknown device info "" [ 300.208580][ T9516] CUSE: unknown device info "" [ 300.211582][ T9516] CUSE: unknown device info "" [ 300.216420][ T9516] CUSE: unknown device info "" [ 300.218379][ T9516] CUSE: unknown device info "ðÿÿÿ" [ 300.221720][ T9516] CUSE: unknown device info "" [ 300.223689][ T9516] CUSE: unknown device info "" [ 300.230520][ T9516] CUSE: unknown device info "" [ 300.232823][ T9516] CUSE: unknown device info "" [ 300.234820][ T9516] CUSE: unknown device info "r" [ 300.239204][ T9516] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 300.241655][ T9516] CUSE: unknown device info "ÿÿÿÿ" [ 300.245498][ T9516] CUSE: unknown device info "" [ 300.247113][ T9516] CUSE: unknown device info "€" [ 300.248683][ T9516] CUSE: DEVNAME unspecified [ 300.395487][ T9526] netlink: 'syz.3.931': attribute type 4 has an invalid length. [ 300.551494][ T9527] fuse: Unknown parameter 'rooÿmode' [ 300.949787][ T9538] smpboot: CPU 1 is now offline [ 301.114864][ T9538] smpboot: CPU 3 is now offline [ 301.119922][ T9544] netlink: 88 bytes leftover after parsing attributes in process `syz.1.939'. [ 301.195902][ T9548] netlink: 'syz.3.941': attribute type 12 has an invalid length. [ 301.198450][ T9548] netlink: 'syz.3.941': attribute type 29 has an invalid length. [ 301.203353][ T9548] netlink: 148 bytes leftover after parsing attributes in process `syz.3.941'. [ 301.213981][ T9548] netlink: 'syz.3.941': attribute type 3 has an invalid length. [ 301.228522][ T9548] netlink: 'syz.3.941': attribute type 2 has an invalid length. [ 301.237609][ T9548] netlink: 35 bytes leftover after parsing attributes in process `syz.3.941'. [ 301.308815][ T9553] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 301.312943][ T9553] block device autoloading is deprecated and will be removed. [ 301.317165][ T9549] md: md2 stopped. [ 301.445139][ T9555] netlink: 'syz.1.942': attribute type 1 has an invalid length. [ 301.451068][ T9555] netlink: 756 bytes leftover after parsing attributes in process `syz.1.942'. [ 301.779895][ T9558] fuse: Unknown parameter 'rooÿmode' [ 302.017786][ T9563] program syz.0.944 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 302.831260][ T9569] openvswitch: netlink: Key 6 has unexpected len 18 expected 2 [ 302.948434][ T9571] MTRR 2 not used [ 302.972285][ T9571] process 'syz.3.948' launched './file0' with NULL argv: empty string added [ 302.981607][ T9575] netlink: 88 bytes leftover after parsing attributes in process `syz.1.950'. [ 303.010077][ T42] audit: type=1326 audit(1786188972.929:22823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9572 comm="syz.2.949" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x0 [ 304.298841][ T9581] pim6reg: entered allmulticast mode [ 304.319000][ T9581] pim6reg: left allmulticast mode [ 304.536667][ T9581] loop7: detected capacity change from 0 to 7 [ 304.547408][ T9592] 9p: Bad value for 'wfdno' [ 304.547596][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 304.552088][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 304.555156][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 304.558002][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 304.561078][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 304.563991][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 304.567018][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 304.569839][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 304.572896][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 304.579437][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 304.582538][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 304.654008][ T9595] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 304.738385][ T9601] netlink: 88 bytes leftover after parsing attributes in process `syz.0.960'. [ 304.775156][ T9604] netlink: 28 bytes leftover after parsing attributes in process `syz.1.959'. [ 304.817124][ T9607] netlink: 24 bytes leftover after parsing attributes in process `syz.1.961'. [ 304.820117][ T9607] netlink: 24 bytes leftover after parsing attributes in process `syz.1.961'. [ 304.893091][ T9610] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 305.116060][ T42] audit: type=1326 audit(1786188975.039:22824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9615 comm="syz.0.964" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 305.428023][ T9622] program syz.2.965 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 306.226449][ T9636] netlink: 88 bytes leftover after parsing attributes in process `syz.2.970'. [ 306.402276][ T9631] syz.1.967 (9631) used greatest stack depth: 19104 bytes left [ 306.709343][ T9653] netlink: 16 bytes leftover after parsing attributes in process `syz.3.976'. [ 306.715492][ T9653] netlink: 16 bytes leftover after parsing attributes in process `syz.3.976'. [ 306.765844][ T9656] jffs2: notice: (9656) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 306.775695][ T9656] netlink: 8 bytes leftover after parsing attributes in process `syz.3.977'. [ 306.778535][ T9656] netlink: 8 bytes leftover after parsing attributes in process `syz.3.977'. [ 306.840629][ T1037] usb 7-1: new full-speed USB device number 6 using dummy_hcd [ 306.885677][ T9665] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 306.970966][ T1037] usb 7-1: device descriptor read/64, error -71 [ 306.984315][ T9644] device-mapper: ioctl: only supply one of name or uuid, cmd(9) [ 307.077140][ T9671] fuse: Unknown parameter 'rooÿmode' [ 307.221228][ T1037] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 307.232267][ T9680] jffs2: notice: (9680) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 307.243491][ T9680] netlink: 8 bytes leftover after parsing attributes in process `syz.0.986'. [ 307.246387][ T9680] netlink: 8 bytes leftover after parsing attributes in process `syz.0.986'. [ 307.298031][ T9682] netlink: 8 bytes leftover after parsing attributes in process `syz.1.987'. [ 307.301721][ T9682] netlink: 'syz.1.987': attribute type 5 has an invalid length. [ 307.304924][ T9682] netlink: 20 bytes leftover after parsing attributes in process `syz.1.987'. [ 307.324990][ T9682] geneve2: entered promiscuous mode [ 307.327381][ T9682] geneve2: entered allmulticast mode [ 307.350507][ T1037] usb 7-1: device descriptor read/64, error -71 [ 307.352644][ T12] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 307.352779][ T5735] ffs_data_put(): freeing [ 307.356755][ T12] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 307.360692][ T12] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 307.460747][ T1037] usb usb7-port1: attempt power cycle [ 307.810874][ T1037] usb 7-1: new full-speed USB device number 8 using dummy_hcd [ 307.823786][ T9715] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 307.827490][ T9716] netlink: 88 bytes leftover after parsing attributes in process `syz.0.996'. [ 307.841294][ T1037] usb 7-1: device descriptor read/8, error -71 [ 307.945436][ T9722] netlink: 'syz.1.993': attribute type 10 has an invalid length. [ 307.965830][ T9722] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 307.999012][ T9722] team0: Port device netdevsim1 added [ 308.080347][ T1037] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 308.111370][ T1037] usb 7-1: device descriptor read/8, error -71 [ 308.233100][ T1037] usb usb7-port1: unable to enumerate USB device [ 308.307268][ T9732] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 308.589377][ T42] audit: type=1800 audit(1786188978.509:22825): pid=9735 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1000" name="UDC" dev="configfs" ino=28439 res=0 errno=0 [ 308.830349][ T5828] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 308.982372][ T5828] usb 5-1: Dual-Role OTG device on HNP port [ 308.989980][ T5828] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 308.994971][ T5828] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 309.016788][ T5828] cdc_acm 5-1:1.0: ttyACM0: USB ACM device [ 309.468419][ T9761] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 310.147637][ T9785] jffs2: notice: (9785) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 310.553455][ T9802] netlink: 'syz.3.1026': attribute type 1 has an invalid length. [ 311.130448][ T12] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 311.136569][ T12] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 311.143542][ T12] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 311.155032][ T12] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 311.245623][ T9824] __nla_validate_parse: 11 callbacks suppressed [ 311.245641][ T9824] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1036'. [ 311.367076][ T9828] FAULT_INJECTION: forcing a failure. [ 311.367076][ T9828] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 311.375221][ T9828] CPU: 2 UID: 0 PID: 9828 Comm: syz.0.1038 Tainted: G L syzkaller #0 PREEMPT(full) [ 311.375249][ T9828] Tainted: [L]=SOFTLOCKUP [ 311.375255][ T9828] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 311.375265][ T9828] Call Trace: [ 311.375272][ T9828] [ 311.375279][ T9828] dump_stack_lvl+0x100/0x190 [ 311.375308][ T9828] should_fail_ex.cold+0x5/0xa [ 311.375330][ T9828] _copy_to_user+0x32/0xd0 [ 311.375360][ T9828] simple_read_from_buffer+0xcb/0x170 [ 311.375391][ T9828] proc_fail_nth_read+0x1af/0x230 [ 311.375418][ T9828] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 311.375449][ T9828] ? rw_verify_area+0xce/0x6d0 [ 311.375473][ T9828] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 311.375496][ T9828] vfs_read+0x1e4/0xb40 [ 311.375515][ T9828] ? __pfx_vfs_read+0x10/0x10 [ 311.375528][ T9828] ? find_held_lock+0x2b/0x80 [ 311.375550][ T9828] ? __fget_files+0x215/0x3d0 [ 311.375571][ T9828] ? __fget_files+0x21f/0x3d0 [ 311.375593][ T9828] ksys_read+0x12a/0x250 [ 311.375609][ T9828] ? __pfx_ksys_read+0x10/0x10 [ 311.375631][ T9828] do_int80_emulation+0x14b/0x720 [ 311.375659][ T9828] asm_int80_emulation+0x1a/0x20 [ 311.375676][ T9828] RIP: 0023:0xf71774eb [ 311.375691][ T9828] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 311.375706][ T9828] RSP: 002b:00000000f542d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 311.375724][ T9828] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f542d5d0 [ 311.375734][ T9828] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 311.375743][ T9828] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 311.375753][ T9828] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 311.375762][ T9828] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 311.375784][ T9828] [ 311.630492][ T9845] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1043'. [ 311.635852][ T9845] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1043'. [ 311.702308][ T9] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 311.862174][ T9] usb 7-1: config 0 has no interfaces? [ 311.864050][ T9] usb 7-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 311.866909][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.875801][ T9] usb 7-1: config 0 descriptor?? [ 312.086766][ T9] usb 7-1: USB disconnect, device number 10 [ 312.407688][ T9856] misc userio: Can't change port type on an already running userio instance [ 312.416832][ T9860] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1050'. [ 312.896436][ T9866] netlink: 'syz.3.1052': attribute type 1 has an invalid length. [ 312.902260][ T9866] netlink: 756 bytes leftover after parsing attributes in process `syz.3.1052'. [ 313.315468][ T9869] fuse: Unknown parameter 'rooÿmode' [ 313.349529][ T9872] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1054'. [ 313.352209][ T9872] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1054'. [ 313.406340][ T9874] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1055'. [ 313.765439][ T9880] loop0: detected capacity change from 0 to 640 [ 313.775010][ T9880] MTDSB: Device #1 doesn't appear to exist [ 313.775010][ T9880] [ 314.035123][ T9893] fuse: Unknown parameter 'rooÿmode' [ 314.161950][ T9895] netlink: 'syz.0.1061': attribute type 1 has an invalid length. [ 314.201734][ T9895] netlink: 756 bytes leftover after parsing attributes in process `syz.0.1061'. [ 314.254785][ T9898] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1063'. [ 315.269538][ T9920] jffs2: notice: (9920) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 315.380446][ T5842] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 315.530549][ T5842] usb 6-1: Using ep0 maxpacket: 32 [ 315.540082][ T5842] usb 6-1: unable to get BOS descriptor or descriptor too short [ 315.546336][ T5842] usb 6-1: string descriptor 0 read error: -22 [ 315.548491][ T5842] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 315.551503][ T5842] usb 6-1: New USB device strings: Mfr=1, Product=252, SerialNumber=3 [ 315.563433][ T5842] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 315.574838][ T5842] dw2102: su3000_power_ctrl: 1, initialized 0 [ 315.576953][ T5842] dvb-usb: bulk message failed: -22 (2/0) [ 315.587410][ T5842] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 315.591968][ T5842] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 315.602325][ T5842] usb 6-1: media controller created [ 315.604046][ T5842] dvb-usb: bulk message failed: -22 (6/0) [ 315.605842][ T5842] dw2102: i2c transfer failed. [ 315.607473][ T5842] dvb-usb: bulk message failed: -22 (6/0) [ 315.609296][ T5842] dw2102: i2c transfer failed. [ 315.611838][ T5842] dvb-usb: bulk message failed: -22 (6/0) [ 315.628511][ T5842] dw2102: i2c transfer failed. [ 315.640062][ T5842] dvb-usb: bulk message failed: -22 (6/0) [ 315.646017][ T5842] dw2102: i2c transfer failed. [ 315.647815][ T5842] dvb-usb: bulk message failed: -22 (6/0) [ 315.649678][ T5842] dw2102: i2c transfer failed. [ 315.652344][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 315.654512][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 315.657913][ T5842] dvb-usb: bulk message failed: -22 (6/0) [ 315.659779][ T5842] dw2102: i2c transfer failed. [ 315.662489][ T5842] dvb-usb: MAC address: 02:02:02:02:02:02 [ 315.669939][ T5842] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 315.685648][ T5842] dvb-usb: bulk message failed: -22 (3/0) [ 315.689193][ T5842] dw2102: command 0x0e transfer failed. [ 315.692249][ T5842] dvb-usb: bulk message failed: -22 (3/0) [ 315.694159][ T5842] dw2102: command 0x0e transfer failed. [ 315.819203][ T9934] capability: warning: `syz.0.1077' uses 32-bit capabilities (legacy support in use) [ 315.971447][ T9935] NILFS (nbd0): device size too small [ 316.006728][ T5842] dvb-usb: bulk message failed: -22 (3/0) [ 316.010375][ T5842] dw2102: command 0x0e transfer failed. [ 316.016876][ T5842] dvb-usb: bulk message failed: -22 (3/0) [ 316.019453][ T5842] dw2102: command 0x0e transfer failed. [ 316.022061][ T5842] dvb-usb: bulk message failed: -22 (1/0) [ 316.027546][ T5842] dw2102: command 0x51 transfer failed. [ 316.033056][ T9917] dvb-usb: bulk message failed: -22 (5/0) [ 316.043951][ T9917] dw2102: i2c transfer failed. [ 316.084945][ T5842] DVB: Unable to find symbol ds3000_attach() [ 316.090060][ T5842] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 316.190349][ T5842] rc_core: IR keymap rc-su3000 not found [ 316.192318][ T5842] Registered IR keymap rc-empty [ 316.195491][ T5842] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.1/usb6/6-1/rc/rc0 [ 316.209531][ T5842] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.1/usb6/6-1/rc/rc0/input120 [ 316.219534][ T5842] dvb-usb: schedule remote query interval to 150 msecs. [ 316.225627][ T5842] dw2102: su3000_power_ctrl: 0, initialized 1 [ 316.229437][ T5842] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 316.235657][ T9952] jffs2: notice: (9952) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 316.236774][ T5842] usb 6-1: USB disconnect, device number 18 [ 316.259280][ T6454] udevd[6454]: setting mode of /dev/input/event4 to 020660 failed: No such file or directory [ 316.260643][ T9952] __nla_validate_parse: 5 callbacks suppressed [ 316.260653][ T9952] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1080'. [ 316.269270][ T6454] udevd[6454]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 316.276967][ T9952] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1080'. [ 316.295177][ T5842] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 316.424911][ T9961] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 316.427210][ T9961] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 316.430511][ T9961] vhci_hcd vhci_hcd.0: Device attached [ 316.433024][ T9962] vhci_hcd: connection closed [ 316.437191][ T12] vhci_hcd vhci_hcd.2: stop threads [ 316.441057][ T12] vhci_hcd vhci_hcd.2: release socket [ 316.442746][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 316.841445][ T9977] jffs2: notice: (9977) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 316.881789][ T9977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1090'. [ 316.890301][ T9977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1090'. [ 316.915141][ T9979] pim6reg: entered allmulticast mode [ 316.943391][ T9975] pim6reg: left allmulticast mode [ 317.016157][ T9979] loop7: detected capacity change from 0 to 7 [ 317.038168][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 317.045441][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 317.048503][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 317.053657][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 317.056727][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 317.061826][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 317.064886][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 317.074616][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 317.077714][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 317.083161][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 317.086248][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 317.249291][ T9988] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1095'. [ 317.291636][ T9991] sctp: [Deprecated]: syz.1.1094 (pid 9991) Use of struct sctp_assoc_value in delayed_ack socket option. [ 317.291636][ T9991] Use struct sctp_sack_info instead [ 317.647602][T10001] jffs2: notice: (10001) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 317.655085][T10001] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1100'. [ 317.657996][T10001] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1100'. [ 317.788556][T10007] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 317.797090][T10007] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 318.008424][T10007] batadv_slave_0: entered promiscuous mode [ 318.016240][T10007] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1102'. [ 318.027626][T10007] batadv_slave_0 (unregistering): left promiscuous mode [ 318.035741][T10007] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 318.429809][T10019] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1104'. [ 318.440218][T10019] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1104'. [ 318.843488][T10029] program syz.2.1106 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 319.309591][T10029] infiniband syz0: set down [ 319.311278][T10029] infiniband syz0: added bond_slave_1 [ 319.684955][T10029] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 319.688408][T10029] infiniband syz0: Couldn't open port 1 [ 319.694031][T10029] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 319.698665][T10029] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 319.704020][T10029] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 319.721357][T10029] RDS/IB: syz0: added [ 319.722940][T10029] smc: adding ib device syz0 with port count 1 [ 319.724990][T10029] smc: ib device syz0 port 1 has no pnetid [ 320.688414][T10036] jffs2: notice: (10036) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 320.718132][T10037] pim6reg: entered allmulticast mode [ 320.767936][T10030] pim6reg: left allmulticast mode [ 320.803188][T10030] loop7: detected capacity change from 0 to 7 [ 321.164347][T10056] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 321.479520][T10078] jffs2: notice: (10078) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 321.492651][T10078] __nla_validate_parse: 4 callbacks suppressed [ 321.492669][T10078] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1120'. [ 321.498815][T10078] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1120'. [ 321.646051][T10082] pim6reg: entered allmulticast mode [ 321.649348][T10082] pim6reg: left allmulticast mode [ 321.714169][T10082] loop7: detected capacity change from 0 to 7 [ 321.722015][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 321.725517][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 321.728534][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 321.731721][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 321.734821][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 321.737854][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 321.741194][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 321.744647][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 321.747865][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 322.575383][T10105] jffs2: notice: (10105) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 322.582892][T10105] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1129'. [ 322.585778][T10105] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1129'. [ 322.620084][T10108] netlink: 'syz.2.1132': attribute type 1 has an invalid length. [ 322.636653][T10108] 8021q: adding VLAN 0 to HW filter on device bond1 [ 322.666558][T10108] bond1: (slave veth3): Enslaving as an active interface with a down link [ 322.678090][T10108] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 322.681601][T10108] bond1: (slave batadv1): making interface the new active one [ 322.684858][T10108] batadv1: entered promiscuous mode [ 322.686956][T10108] bond1: (slave batadv1): Enslaving as an active interface with an up link [ 322.760555][ T5828] usb 8-1: new full-speed USB device number 11 using dummy_hcd [ 322.780513][ T5909] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 322.903645][T10113] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1134'. [ 322.908895][T10113] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 322.924954][ T5828] usb 8-1: not running at top speed; connect to a high speed hub [ 322.929572][ T5828] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 322.931213][ T5909] usb 6-1: Using ep0 maxpacket: 32 [ 322.936146][ T5828] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 322.943454][ T5828] usb 8-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 322.944700][ T5909] usb 6-1: unable to get BOS descriptor or descriptor too short [ 322.947364][ T5828] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.953921][ T5828] usb 8-1: Product: syz [ 322.955457][ T5828] usb 8-1: Manufacturer: syz [ 322.957135][ T5828] usb 8-1: SerialNumber: syz [ 322.962958][ T5828] oti6858 8-1:1.0: oti6858 converter detected [ 322.969263][ T5828] usb 8-1: oti6858 converter now attached to ttyUSB0 [ 322.969473][ T5909] usb 6-1: string descriptor 0 read error: -22 [ 322.976699][ T5909] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 322.982448][ T5909] usb 6-1: New USB device strings: Mfr=1, Product=252, SerialNumber=3 [ 323.003743][ T5909] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 323.009315][ T5909] dw2102: su3000_power_ctrl: 1, initialized 0 [ 323.014397][ T5909] dvb-usb: bulk message failed: -22 (2/0) [ 323.021213][ T5909] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 323.029839][ T5909] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 323.032492][T10117] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 323.036471][ T5909] usb 6-1: media controller created [ 323.038137][ T5909] dvb-usb: bulk message failed: -22 (6/0) [ 323.039942][ T5909] dw2102: i2c transfer failed. [ 323.041533][ T5909] dvb-usb: bulk message failed: -22 (6/0) [ 323.043349][ T5909] dw2102: i2c transfer failed. [ 323.044855][ T5909] dvb-usb: bulk message failed: -22 (6/0) [ 323.046628][ T5909] dw2102: i2c transfer failed. [ 323.048174][ T5909] dvb-usb: bulk message failed: -22 (6/0) [ 323.049964][ T5909] dw2102: i2c transfer failed. [ 323.051532][ T5909] dvb-usb: bulk message failed: -22 (6/0) [ 323.053339][ T5909] dw2102: i2c transfer failed. [ 323.054860][ T5909] dvb-usb: bulk message failed: -22 (6/0) [ 323.056649][ T5909] dw2102: i2c transfer failed. [ 323.058165][ T5909] dvb-usb: MAC address: 02:02:02:02:02:02 [ 323.065405][ T5909] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 323.074968][ T5909] dvb-usb: bulk message failed: -22 (3/0) [ 323.076794][ T5909] dw2102: command 0x0e transfer failed. [ 323.078540][ T5909] dvb-usb: bulk message failed: -22 (3/0) [ 323.080914][ T5909] dw2102: command 0x0e transfer failed. [ 323.390424][ T5909] dvb-usb: bulk message failed: -22 (3/0) [ 323.392836][ T5909] dw2102: command 0x0e transfer failed. [ 323.395202][ T5909] dvb-usb: bulk message failed: -22 (3/0) [ 323.397445][ T5909] dw2102: command 0x0e transfer failed. [ 323.399139][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 323.401457][ T5909] dw2102: command 0x51 transfer failed. [ 323.426090][ T5909] DVB: Unable to find symbol ds3000_attach() [ 323.428576][ T5909] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 323.482261][ T5909] rc_core: IR keymap rc-su3000 not found [ 323.484132][ T5909] Registered IR keymap rc-empty [ 323.486228][ T5909] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.1/usb6/6-1/rc/rc0 [ 323.490526][ T5909] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.1/usb6/6-1/rc/rc0/input121 [ 323.497439][ T5909] dvb-usb: schedule remote query interval to 150 msecs. [ 323.499698][ T5909] dw2102: su3000_power_ctrl: 0, initialized 1 [ 323.501780][ T5909] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 323.526143][T10120] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 323.558238][T10121] dw2102: i2c wr: len=8192 is too big! [ 323.558238][T10121] [ 323.652738][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 323.751512][ T5842] usb 8-1: USB disconnect, device number 11 [ 323.778028][T10127] pim6reg: entered allmulticast mode [ 323.783379][ T5842] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 323.792408][ T5842] oti6858 8-1:1.0: device disconnected [ 323.803915][T10126] pim6reg: left allmulticast mode [ 323.860820][T10126] loop7: detected capacity change from 0 to 7 [ 323.867704][ C2] blk_print_req_error: 2 callbacks suppressed [ 323.867715][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 323.873471][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 323.876385][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 323.879249][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 323.882243][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 323.891757][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 323.894747][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 323.897736][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 323.900755][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 323.904010][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 323.907087][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 324.046714][ T5909] dw2102: i2c transfer failed. [ 324.298415][ T5744] overlayfs: failed lookup in lower (newroot/298, name='file0', err=-40): overlapping layers [ 324.302427][ T5744] overlayfs: failed lookup in lower (newroot/298, name='file0', err=-40): overlapping layers [ 324.674704][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 324.678483][ T9] dw2102: i2c transfer failed. [ 324.785476][T10129] jffs2: notice: (10129) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 324.837297][T10129] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1140'. [ 324.841348][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 324.842092][T10129] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1140'. [ 324.843796][ T9] dw2102: i2c transfer failed. [ 324.941243][T10133] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1143'. [ 324.972112][ T5746] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 324.976698][ T5746] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 324.985912][ T5746] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 325.006985][ T5746] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 325.011302][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 325.013475][ T5746] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 325.015762][ T5909] dw2102: i2c transfer failed. [ 325.039875][ T64] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 325.050151][ T64] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 325.054137][ T64] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 325.057434][ T64] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 325.060031][ T64] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 325.181472][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 325.185244][ T9] dw2102: i2c transfer failed. [ 325.350437][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 325.364366][ T9] dw2102: i2c transfer failed. [ 325.463616][ T5570] bridge_slave_1: left allmulticast mode [ 325.477545][ T5570] bridge_slave_1: left promiscuous mode [ 325.493924][ T5570] bridge0: port 2(bridge_slave_1) entered disabled state [ 325.506551][T10155] fuse: Unknown parameter '' [ 325.516092][ T5570] bridge_slave_0: left allmulticast mode [ 325.525448][ T5570] bridge_slave_0: left promiscuous mode [ 325.534045][ T5570] bridge0: port 1(bridge_slave_0) entered disabled state [ 325.540523][ T5906] dvb-usb: bulk message failed: -22 (1/0) [ 325.546490][ T5906] dw2102: i2c transfer failed. [ 325.619279][T10161] loop7: detected capacity change from 0 to 7 [ 325.711384][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 325.731629][ T5909] dw2102: i2c transfer failed. [ 325.754474][ T5909] usb 6-1: USB disconnect, device number 19 [ 326.022972][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 326.032395][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 326.035654][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 326.051601][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 326.054630][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 326.074905][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 326.078709][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 326.095856][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 326.099375][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 326.146586][T10172] jffs2: notice: (10172) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 326.168341][ T5909] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 326.214039][ T5570] erspan0 (unregistering): left promiscuous mode [ 326.214630][T10174] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1151'. [ 326.220024][T10174] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1151'. [ 326.228134][ T5570] gretap0 (unregistering): left promiscuous mode [ 326.247275][ T5570] batman_adv: batadv0: Removing interface: gretap2 [ 326.274807][ T5570] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 326.279026][ T5570] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 326.284226][ T5570] bond0 (unregistering): Released all slaves [ 326.298614][T10156] pim6reg: entered allmulticast mode [ 326.301346][T10151] pim6reg: left allmulticast mode [ 326.313899][ T5447] 8021q: adding VLAN 0 to HW filter on device eth2 [ 326.543947][T10185] netlink: 88 bytes leftover after parsing attributes in process `syz.1.1153'. [ 326.704299][ T5447] 8021q: adding VLAN 0 to HW filter on device eth3 [ 326.928528][T10205] jffs2: notice: (10205) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 327.055709][ T5447] 8021q: adding VLAN 0 to HW filter on device eth4 [ 327.090633][ T64] Bluetooth: hci3: command tx timeout [ 327.108719][ T42] audit: type=1326 audit(1786188997.029:22826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10208 comm="syz.1.1159" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x0 [ 327.193883][ T42] audit: type=1326 audit(1786188997.119:22827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10211 comm="syz.0.1160" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 327.332942][ T5447] 8021q: adding VLAN 0 to HW filter on device eth5 [ 327.360929][ T5570] hsr_slave_0: left promiscuous mode [ 327.365795][ T5570] hsr_slave_1: left promiscuous mode [ 327.369455][ T5570] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 327.379213][ T5570] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 327.741880][ T5570] team0 (unregistering): Port device team_slave_1 removed [ 327.763582][ T5570] team0 (unregistering): Port device team_slave_0 removed [ 328.348932][T10136] bridge0: port 1(bridge_slave_0) entered blocking state [ 328.351345][T10136] bridge0: port 1(bridge_slave_0) entered disabled state [ 328.353570][T10136] bridge_slave_0: entered allmulticast mode [ 328.356292][T10136] bridge_slave_0: entered promiscuous mode [ 328.359527][T10136] bridge0: port 2(bridge_slave_1) entered blocking state [ 328.361948][T10136] bridge0: port 2(bridge_slave_1) entered disabled state [ 328.364198][T10136] bridge_slave_1: entered allmulticast mode [ 328.367459][T10136] bridge_slave_1: entered promiscuous mode [ 328.391571][T10136] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 328.396276][T10136] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 328.409137][ T5570] IPVS: stop unused estimator thread 0... [ 328.412756][T10136] team0: Port device team_slave_0 added [ 328.416590][T10136] team0: Port device team_slave_1 added [ 328.433795][T10136] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 328.435918][T10136] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 328.444965][T10136] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 328.451693][T10136] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 328.454290][T10136] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 328.465711][T10136] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 328.503631][T10136] hsr_slave_0: entered promiscuous mode [ 328.506807][T10136] hsr_slave_1: entered promiscuous mode [ 328.511157][T10136] debugfs: 'hsr0' already exists in 'hsr' [ 328.512957][T10136] Cannot create hsr debugfs directory [ 328.706830][T10251] bond0: (slave bond_slave_1): Releasing backup interface [ 328.863389][T10136] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 328.874729][T10136] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 328.880901][T10136] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 328.897913][T10136] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 328.907987][T10136] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 328.919441][T10136] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 328.923507][T10253] syz.2.1165 (10253): drop_caches: 2 [ 328.931237][T10136] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 328.951319][T10136] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 329.055888][T10136] 8021q: adding VLAN 0 to HW filter on device bond0 [ 329.067494][T10263] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1166'. [ 329.084138][T10136] 8021q: adding VLAN 0 to HW filter on device team0 [ 329.097661][T10073] bridge0: port 1(bridge_slave_0) entered blocking state [ 329.099895][T10073] bridge0: port 1(bridge_slave_0) entered forwarding state [ 329.107573][T10264] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 329.115926][T10073] bridge0: port 2(bridge_slave_1) entered blocking state [ 329.118236][T10073] bridge0: port 2(bridge_slave_1) entered forwarding state [ 329.142844][T10264] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 329.286227][T10264] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 329.657589][T10289] netlink: 11870 bytes leftover after parsing attributes in process `syz.2.1174'. [ 329.669087][T10290] Bluetooth: ISO socket layer initialized [ 329.921032][ T9] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 329.942277][T10320] socket: no more sockets [ 330.134442][ T9] usb 7-1: config 220 has an invalid interface number: 76 but max is 2 [ 330.139270][ T9] usb 7-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 330.150825][ T9] usb 7-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 330.156586][ T9] usb 7-1: config 220 has no interface number 2 [ 330.164564][ T9] usb 7-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 330.175276][ T9] usb 7-1: config 220 interface 0 has no altsetting 0 [ 330.184452][ T9] usb 7-1: config 220 interface 76 has no altsetting 0 [ 330.193849][ T9] usb 7-1: config 220 interface 1 has no altsetting 0 [ 330.202376][T10323] openvswitch: netlink: IP tunnel TTL not specified. [ 330.205510][ T9] usb 7-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 330.214552][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.224066][ T9] usb 7-1: Product: syz [ 330.229098][ T9] usb 7-1: Manufacturer: syz [ 330.229714][T10136] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 330.231662][ T9] usb 7-1: SerialNumber: syz [ 330.425438][T10136] veth0_vlan: entered promiscuous mode [ 330.436288][T10136] veth1_vlan: entered promiscuous mode [ 330.484796][ T9] uvcvideo 7-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 330.488434][T10136] veth0_macvtap: entered promiscuous mode [ 330.490472][ T9] uvcvideo 7-1:220.0: No valid video chain found. [ 330.492545][ T9] usb 7-1: selecting invalid altsetting 0 [ 330.508443][T10136] veth1_macvtap: entered promiscuous mode [ 330.517687][ T9] usb 7-1: selecting invalid altsetting 0 [ 330.521592][ T9] usbtest 7-1:220.1: probe with driver usbtest failed with error -22 [ 330.533741][T10136] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 330.539306][ T9] usb 7-1: USB disconnect, device number 11 [ 330.549197][T10136] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 330.581261][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.745363][ T226] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 330.748874][ T226] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 330.770511][T10344] pim6reg: entered allmulticast mode [ 330.773548][T10344] pim6reg: left allmulticast mode [ 330.780490][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.783421][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.790597][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.802027][ T226] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 330.804866][ T226] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 330.852349][T10344] loop7: detected capacity change from 0 to 7 [ 330.863600][ C0] blk_print_req_error: 2 callbacks suppressed [ 330.863611][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 330.871584][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 330.874818][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 330.878355][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 330.881427][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 330.885393][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 330.888465][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 330.891590][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 330.894603][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 330.900566][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 330.903582][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 331.026300][ T42] audit: type=1326 audit(1786189000.949:22828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10353 comm="syz.1.1184" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x0 [ 331.049035][T10356] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1186'. [ 331.160589][ T64] Bluetooth: hci3: command 0x040f tx timeout [ 331.604179][T10380] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1193'. [ 331.829013][T10384] pim6reg: entered allmulticast mode [ 331.832248][T10384] pim6reg: left allmulticast mode [ 331.894821][T10384] loop7: detected capacity change from 0 to 7 [ 331.902860][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 331.906230][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 331.909279][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 331.913659][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 331.916719][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 331.919817][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 331.922954][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 331.928257][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 331.932156][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 332.059257][T10387] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1196'. [ 332.377899][T10395] socket: no more sockets [ 332.416561][ T42] audit: type=1326 audit(1786189002.339:22829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10397 comm="syz.2.1201" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 332.432589][ T42] audit: type=1326 audit(1786189002.339:22830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10397 comm="syz.2.1201" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 332.449678][ T42] audit: type=1326 audit(1786189002.349:22831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10397 comm="syz.2.1201" exe="/syz-executor" sig=0 arch=40000003 syscall=296 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 332.459823][ T42] audit: type=1326 audit(1786189002.349:22832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10397 comm="syz.2.1201" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 332.474822][ T42] audit: type=1326 audit(1786189002.349:22833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10397 comm="syz.2.1201" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 332.490333][ T42] audit: type=1326 audit(1786189002.349:22834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10397 comm="syz.2.1201" exe="/syz-executor" sig=0 arch=40000003 syscall=61 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 332.507120][ T42] audit: type=1326 audit(1786189002.349:22835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10397 comm="syz.2.1201" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 332.535880][ T42] audit: type=1326 audit(1786189002.349:22836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10397 comm="syz.2.1201" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 332.556149][ T42] audit: type=1326 audit(1786189002.349:22837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10397 comm="syz.2.1201" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 332.580128][ T42] audit: type=1326 audit(1786189002.349:22838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10397 comm="syz.2.1201" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 332.686881][T10409] pim6reg: entered allmulticast mode [ 332.694075][T10409] pim6reg: left allmulticast mode [ 332.751491][T10409] loop7: detected capacity change from 0 to 7 [ 332.907374][T10421] uprobe: syz.2.1209:10421 failed to unregister, leaking uprobe [ 333.240791][ T64] Bluetooth: hci3: command 0x040f tx timeout [ 333.567632][T10437] netlink: 'syz.4.1213': attribute type 1 has an invalid length. [ 333.570127][T10437] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1213'. [ 334.103398][ T12] batadv1: left promiscuous mode [ 334.630138][T10461] se_device not configured yet, cannot port link [ 334.727693][T10466] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 334.793816][T10461] ceph: No mds server is up or the cluster is laggy [ 335.184572][T10342] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 335.320754][ T64] Bluetooth: hci3: command 0x040f tx timeout [ 335.340558][T10342] usb 9-1: Using ep0 maxpacket: 16 [ 335.389998][T10342] usb 9-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 335.394111][T10342] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.397374][T10342] usb 9-1: Product: syz [ 335.399334][T10342] usb 9-1: Manufacturer: syz [ 335.401684][T10342] usb 9-1: SerialNumber: syz [ 335.642647][T10342] usb 9-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 335.657449][T10342] usb 9-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 335.665000][T10342] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 335.672489][T10342] usb 9-1: media controller created [ 335.680539][ T12] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 335.690493][ T12] netdevsim netdevsim10 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 335.699608][T10342] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 335.704383][T10486] jffs2: notice: (10486) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 335.712750][T10486] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1227'. [ 335.716257][T10486] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1227'. [ 335.855023][T10342] zl10353_read_register: readreg error (reg=127, ret==-71) [ 335.910645][T10342] dvb_usb_gl861 9-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 335.917189][T10342] usb 9-1: USB disconnect, device number 2 [ 336.479164][T10514] jffs2: notice: (10514) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 336.492301][T10514] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1236'. [ 336.496542][T10514] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1236'. [ 337.392136][T10544] jffs2: notice: (10544) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 337.403107][T10544] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1247'. [ 337.411095][ T64] Bluetooth: hci3: command 0x040f tx timeout [ 337.414890][T10544] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1247'. [ 337.487678][T10549] netlink: 'syz.0.1246': attribute type 1 has an invalid length. [ 337.515255][T10549] netlink: 756 bytes leftover after parsing attributes in process `syz.0.1246'. [ 337.934391][T10563] netlink: 'syz.4.1251': attribute type 1 has an invalid length. [ 337.943989][T10563] netlink: 756 bytes leftover after parsing attributes in process `syz.4.1251'. [ 338.387844][T10579] jffs2: notice: (10579) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 338.446590][T10579] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1256'. [ 338.460556][T10579] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1256'. [ 338.617332][ T42] kauditd_printk_skb: 27 callbacks suppressed [ 338.617350][ T42] audit: type=1326 audit(1786189008.539:22866): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10584 comm="syz.2.1258" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x0 [ 338.682988][T10594] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1260'. [ 338.816472][T10603] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1262'. [ 338.846507][T10605] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 339.087091][T10615] netlink: 164 bytes leftover after parsing attributes in process `syz.0.1265'. [ 339.127090][T10615] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1265'. [ 339.406463][T10628] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 339.492412][ T64] Bluetooth: hci3: command 0x040f tx timeout [ 339.510379][ T1037] usb 6-1: new low-speed USB device number 20 using dummy_hcd [ 339.666523][T10636] batadv_slave_1: entered promiscuous mode [ 339.670838][ T1037] usb 6-1: Invalid ep0 maxpacket: 16 [ 339.800855][ T1037] usb 6-1: new low-speed USB device number 21 using dummy_hcd [ 339.962921][ T1037] usb 6-1: Invalid ep0 maxpacket: 16 [ 339.965415][ T1037] usb usb6-port1: attempt power cycle [ 340.300465][ T1037] usb 6-1: new low-speed USB device number 22 using dummy_hcd [ 340.321321][ T1037] usb 6-1: Invalid ep0 maxpacket: 16 [ 340.450665][ T1037] usb 6-1: new low-speed USB device number 23 using dummy_hcd [ 340.471134][ T1037] usb 6-1: Invalid ep0 maxpacket: 16 [ 340.473838][ T1037] usb usb6-port1: unable to enumerate USB device [ 340.485500][T10635] batadv_slave_1: left promiscuous mode [ 340.938996][T10660] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 341.013570][T10662] syz.4.1274 (10662) used obsolete PPPIOCDETACH ioctl [ 341.422995][T10674] binder: 10673:10674 ioctl 40085874 80000100 returned -22 [ 341.617141][ T42] audit: type=1326 audit(1786189011.539:22867): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10678 comm="syz.4.1283" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fa5fec code=0x0 [ 341.816167][T10686] pim6reg: entered allmulticast mode [ 341.830539][T10686] pim6reg: left allmulticast mode [ 341.925121][T10686] loop7: detected capacity change from 0 to 7 [ 341.937402][ C0] blk_print_req_error: 2 callbacks suppressed [ 341.937414][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 342.034392][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.037533][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 342.100721][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.103848][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 342.107391][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.110496][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 342.117210][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.120240][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 342.123441][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 342.126543][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 342.473261][T10692] geneve2: left allmulticast mode [ 342.579821][T10704] netlink: 'syz.1.1291': attribute type 23 has an invalid length. [ 342.634350][T10707] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 342.738630][T10712] loop0: detected capacity change from 0 to 32768 [ 342.770919][T10717] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 342.793609][T10717] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 342.924485][T10712] device-mapper: thin: Data device (loop1) discard unsupported: Disabling discard passdown. [ 343.181850][T10727] kAFS: unable to lookup cell '/,c¾ûL' [ 343.206627][T10727] binder: 10724:10727 ioctl c0506107 80000180 returned -22 [ 344.507560][T10754] jffs2: notice: (10754) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 344.545164][T10754] __nla_validate_parse: 3 callbacks suppressed [ 344.545182][T10754] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1305'. [ 344.559512][T10754] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1305'. [ 345.607109][T10776] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1311'. [ 345.777766][T10784] FAULT_INJECTION: forcing a failure. [ 345.777766][T10784] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 345.805792][T10787] jffs2: notice: (10787) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 345.813452][T10784] CPU: 0 UID: 0 PID: 10784 Comm: syz.2.1311 Tainted: G L syzkaller #0 PREEMPT(full) [ 345.813471][T10784] Tainted: [L]=SOFTLOCKUP [ 345.813475][T10784] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 345.813482][T10784] Call Trace: [ 345.813486][T10784] [ 345.813492][T10784] dump_stack_lvl+0x100/0x190 [ 345.813515][T10784] should_fail_ex.cold+0x5/0xa [ 345.813532][T10784] _copy_to_user+0x32/0xd0 [ 345.813552][T10784] simple_read_from_buffer+0xcb/0x170 [ 345.813574][T10784] proc_fail_nth_read+0x1af/0x230 [ 345.813592][T10784] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 345.813610][T10784] ? rw_verify_area+0xce/0x6d0 [ 345.813627][T10784] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 345.813643][T10784] vfs_read+0x1e4/0xb40 [ 345.813656][T10784] ? __pfx_vfs_read+0x10/0x10 [ 345.813665][T10784] ? find_held_lock+0x2b/0x80 [ 345.813683][T10784] ? __fget_files+0x215/0x3d0 [ 345.813696][T10784] ? __fget_files+0x21f/0x3d0 [ 345.813710][T10784] ksys_read+0x12a/0x250 [ 345.813721][T10784] ? __pfx_ksys_read+0x10/0x10 [ 345.813735][T10784] do_int80_emulation+0x14b/0x720 [ 345.813757][T10784] asm_int80_emulation+0x1a/0x20 [ 345.813769][T10784] RIP: 0023:0xf71e74eb [ 345.813778][T10784] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 345.813789][T10784] RSP: 002b:00000000f545b4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 345.813804][T10784] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00000000f545b5d0 [ 345.813811][T10784] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 345.813817][T10784] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 345.813824][T10784] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 345.813830][T10784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 345.813844][T10784] [ 345.983904][T10787] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1314'. [ 346.020221][T10787] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1314'. [ 346.356412][T10833] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1320'. [ 346.506146][T10844] netlink: 'syz.0.1322': attribute type 1 has an invalid length. [ 346.542938][T10844] bond2: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 346.580841][T10847] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(8) [ 346.582951][T10847] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 346.605714][T10847] vhci_hcd vhci_hcd.0: Device attached [ 346.609081][T10852] batman_adv: batadv0: Adding interface: veth0 [ 346.615660][T10852] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.637436][T10852] batman_adv: batadv0: Interface activated: veth0 [ 346.672823][T10074] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 346.696331][T10074] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 346.761605][T10847] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 346.890508][T10342] usb 40-1: SetAddress Request (2) to port 0 [ 346.896828][T10342] usb 40-1: new SuperSpeed USB device number 2 using vhci_hcd [ 347.194448][T10848] vhci_hcd: connection reset by peer [ 347.196398][T10871] FAULT_INJECTION: forcing a failure. [ 347.196398][T10871] name failslab, interval 1, probability 0, space 0, times 0 [ 347.200708][ T12] vhci_hcd vhci_hcd.1: stop threads [ 347.200994][T10871] CPU: 2 UID: 0 PID: 10871 Comm: syz.0.1328 Tainted: G L syzkaller #0 PREEMPT(full) [ 347.201012][T10871] Tainted: [L]=SOFTLOCKUP [ 347.201016][T10871] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 347.201023][T10871] Call Trace: [ 347.201027][T10871] [ 347.201032][T10871] dump_stack_lvl+0x100/0x190 [ 347.201050][T10871] should_fail_ex.cold+0x5/0xa [ 347.201064][T10871] should_failslab+0xc2/0x120 [ 347.201082][T10871] kmem_cache_alloc_noprof+0x91/0x6a0 [ 347.201099][T10871] ? do_getname+0x35/0x390 [ 347.201116][T10871] do_getname+0x35/0x390 [ 347.201132][T10871] __ia32_sys_renameat2+0xd8/0x140 [ 347.201148][T10871] __do_fast_syscall_32+0xe7/0x970 [ 347.201165][T10871] ? lockdep_hardirqs_on+0x78/0x100 [ 347.201182][T10871] do_fast_syscall_32+0x32/0x70 [ 347.201199][T10871] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 347.201213][T10871] RIP: 0023:0xf703efec [ 347.201226][T10871] Code: Unable to access opcode bytes at 0xf703efc2. [ 347.201232][T10871] RSP: 002b:00000000f540c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000161 [ 347.201243][T10871] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000100 [ 347.201250][T10871] RDX: 00000000ffffff9c RSI: 0000000080000480 RDI: 0000000000000002 [ 347.201256][T10871] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 347.201263][T10871] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 347.201269][T10871] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 347.201282][T10871] [ 347.224487][T10870] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1327'. [ 347.226240][ T12] vhci_hcd vhci_hcd.1: release socket [ 347.295389][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 348.134510][T10878] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1330'. [ 348.322152][T10891] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1333'. [ 348.367852][T10894] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1334'. [ 348.553746][T10902] netlink: 'syz.0.1338': attribute type 2 has an invalid length. [ 348.880437][ T9] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 349.648764][ T5909] IPVS: starting estimator thread 0... [ 349.740389][T10914] IPVS: using max 30 ests per chain, 72000 per kthread [ 349.756944][ T9] usb 9-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 349.763475][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.773991][ T9] usb 9-1: Product: syz [ 349.775381][ T9] usb 9-1: Manufacturer: syz [ 349.780575][ T9] usb 9-1: SerialNumber: syz [ 349.790178][ T9] usb 9-1: config 0 descriptor?? [ 349.799539][ T9] i2c-tiny-usb 9-1:0.0: version 6d.cc found at bus 009 address 003 [ 349.807770][T10924] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 349.821510][T10924] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 349.913754][T10928] binder: 10927:10928 ioctl c0306201 0 returned -14 [ 349.954143][T10930] __nla_validate_parse: 2 callbacks suppressed [ 349.954156][T10930] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1343'. [ 350.028301][T10933] binder: 10927:10933 ioctl c0306201 0 returned -14 [ 350.175511][T10936] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1345'. [ 350.284261][T10941] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 350.341211][T10900] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 350.469418][T10946] random: crng reseeded on system resumption [ 350.848237][ T9] (null): failure reading functionality [ 350.855335][T10956] socket: no more sockets [ 350.859614][ T9] i2c i2c-2: failure reading functionality [ 350.870834][ T9] i2c i2c-2: connected i2c-tiny-usb device [ 350.883841][ T9] usb 9-1: USB disconnect, device number 3 [ 350.893769][T10956] socket: no more sockets [ 350.986448][T10956] socket: no more sockets [ 351.485273][T10979] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1360'. [ 351.488190][T10979] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1360'. [ 351.666511][T10983] ovs-system: entered promiscuous mode [ 351.934370][ T42] audit: type=1326 audit(1786189021.859:22868): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10987 comm="syz.2.1364" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x0 [ 351.973686][T10342] usb 40-1: device descriptor read/8, error -110 [ 352.014408][T10996] netlink: 'syz.0.1365': attribute type 2 has an invalid length. [ 352.023251][T10996] netlink: 164 bytes leftover after parsing attributes in process `syz.0.1365'. [ 352.247769][T11007] lpc_ich 0000:00:00.0: I/O space for ACPI uninitialized [ 352.258905][T11007] lpc_ich 0000:00:00.0: No MFD cells added [ 352.266246][T11007] lpc_ich 0000:00:1d.7: I/O space for ACPI uninitialized [ 352.275132][T11007] lpc_ich 0000:00:1d.7: No MFD cells added [ 352.381133][T10342] usb usb40-port1: attempt power cycle [ 352.961511][T10342] usb usb40-port1: unable to enumerate USB device [ 353.061324][T11034] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 353.065622][T11034] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 353.112667][T11036] 9p: Bad value for 'rfdno' [ 353.210876][T11036] lpc_ich 0000:00:00.0: I/O space for ACPI uninitialized [ 353.256667][T11036] lpc_ich 0000:00:00.0: No MFD cells added [ 353.264117][T11036] lpc_ich 0000:00:1d.7: I/O space for ACPI uninitialized [ 353.267981][T11036] lpc_ich 0000:00:1d.7: No MFD cells added [ 353.328306][T11043] Unsupported ieee802154 address type: 0 [ 353.471596][T11052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 353.475436][T11052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 353.941876][T11062] jffs2: notice: (11062) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 353.968821][T11062] input: syz0 as /devices/virtual/input/input123 [ 354.045999][ T42] audit: type=1326 audit(1786189023.969:22869): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11064 comm="syz.2.1387" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x0 [ 354.313708][T11076] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 354.635190][T11084] evm: overlay not supported [ 354.750662][T11086] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 354.811555][T11088] jffs2: notice: (11088) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 354.844220][T11088] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1394'. [ 354.848614][T11088] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1394'. [ 355.407875][T11100] netlink: 'syz.0.1396': attribute type 1 has an invalid length. [ 355.519073][T11100] 8021q: adding VLAN 0 to HW filter on device bond3 [ 355.760347][T10342] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 355.921851][T10342] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 355.925150][T10342] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 355.928316][T10342] usb 7-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 355.931302][T10342] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 355.938766][T10342] spcp8x5 7-1:1.0: SPCP8x5 converter detected [ 355.948694][T10342] usb 7-1: SPCP8x5 converter now attached to ttyUSB0 [ 356.310789][T11107] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 356.315222][T11107] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 356.319325][T11107] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 356.520091][T11106] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 356.535936][T10342] usb 7-1: USB disconnect, device number 12 [ 356.572501][T11124] pim6reg: entered allmulticast mode [ 356.578128][T11124] pim6reg: left allmulticast mode [ 356.605417][T10342] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 356.614323][T10342] spcp8x5 7-1:1.0: device disconnected [ 356.673231][T11124] loop7: detected capacity change from 0 to 7 [ 356.690845][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 356.696241][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 356.699422][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 356.703423][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 356.706575][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 356.711381][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 356.714455][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 356.717469][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 356.720529][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 356.724327][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 356.727686][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 356.981495][T11130] bond4 (unregistering): Released all slaves [ 357.182784][T11132] netlink: 'syz.4.1404': attribute type 1 has an invalid length. [ 357.191148][T11132] netlink: 756 bytes leftover after parsing attributes in process `syz.4.1404'. [ 357.324404][ T42] audit: type=1326 audit(1786189027.249:22870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11142 comm="syz.2.1407" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x0 [ 358.062082][T11146] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 358.074250][T11146] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 1th superblock [ 358.090377][T11146] F2FS-fs (nullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 358.104570][T11146] F2FS-fs (nullb0): Can't find valid F2FS filesystem in 2th superblock [ 358.202097][ T42] audit: type=1800 audit(1786189028.099:22871): pid=11149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1408" name="attr_allow_any_host" dev="configfs" ino=37426 res=0 errno=0 [ 358.266127][T11154] batman_adv: batadv0: Adding interface: veth0 [ 358.269931][T11154] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.279852][T11154] batman_adv: batadv0: Interface activated: veth0 [ 358.291724][T11154] batman_adv: batadv0: Interface deactivated: veth0 [ 358.297686][T11154] batman_adv: batadv0: Removing interface: veth0 [ 358.350999][T11156] pim6reg: entered allmulticast mode [ 358.354279][T11157] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 358.362610][T11157] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 358.380505][T11156] pim6reg: left allmulticast mode [ 358.400644][T10345] libceph: connect (1)[c::]:6789 error -101 [ 358.421912][T10345] libceph: mon0 (1)[c::]:6789 connect error [ 358.432591][T11156] loop7: detected capacity change from 0 to 7 [ 358.447548][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 358.450742][T11146] ceph: No mds server is up or the cluster is laggy [ 358.457001][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 358.460089][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 358.469125][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 358.472194][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 358.475320][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 358.478397][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 358.482186][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 358.484895][T10345] libceph: connect (1)[c::]:6789 error -101 [ 358.488477][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 358.497922][T10345] libceph: mon0 (1)[c::]:6789 connect error [ 358.615256][T11160] 9p: Bad value for 'rfdno' [ 358.629603][T11162] netdevsim netdevsim2 Éæ0: renamed from netdevsim0 (while UP) [ 358.664532][T11160] tipc: Started in network mode [ 358.667372][T11160] tipc: Node identity e0000001, cluster identity 4711 [ 358.670636][T11160] tipc: Enabling of bearer rejected, failed to enable media [ 358.743335][T11168] binder_alloc: 11167: binder_alloc_buf, no vma [ 358.746249][T11168] netlink: 108 bytes leftover after parsing attributes in process `syz.0.1416'. [ 358.795731][T11172] jffs2: notice: (11172) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 358.832007][T11175] tipc: Enabled bearer , priority 10 [ 358.892779][T10345] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 359.033813][T11181] pim6reg: entered allmulticast mode [ 359.038813][T11181] pim6reg: left allmulticast mode [ 359.091973][T11181] loop7: detected capacity change from 0 to 7 [ 359.121897][T10345] usb 7-1: Using ep0 maxpacket: 8 [ 359.127323][T10345] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 359.132372][T10345] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 359.140215][T10345] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 359.148970][T10345] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 359.158526][T10345] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 359.171805][T10345] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 359.180457][T10345] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.230752][ T5842] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 359.377059][T11184] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1422'. [ 359.383400][ T5842] usb 9-1: New USB device found, idVendor=8087, idProduct=0025, bcdDevice= 0.00 [ 359.383707][T11184] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 359.390340][ T5842] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.518259][T10345] usb 7-1: usb_control_msg returned -32 [ 359.523150][T10345] usbtmc 7-1:16.0: can't read capabilities [ 359.860642][T10345] tipc: Node number set to 2130706433 [ 359.875312][T11187] usbtmc 7-1:16.0: INDICATOR_PULSE returned 0 [ 359.883560][T11187] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1414'. [ 360.080411][ T9] usb 7-1: USB disconnect, device number 13 [ 360.258335][ T42] audit: type=1326 audit(1786189030.179:22872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11213 comm="syz.1.1430" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x0 [ 360.739135][T11218] jffs2: notice: (11218) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 361.099681][T11235] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 361.480376][ T5746] Bluetooth: hci4: command 0xfc05 tx timeout [ 361.484013][ T64] Bluetooth: hci4: Reading Intel version command failed (-110) [ 361.484067][ T5746] Bluetooth: hci4: Resetting usb device. [ 361.492056][ C0] Bluetooth: hci4: urb ffff888025eff900 failed to resubmit (2) [ 361.599897][T11240] netlink: 'syz.1.1437': attribute type 1 has an invalid length. [ 361.608173][T11240] netlink: 756 bytes leftover after parsing attributes in process `syz.1.1437'. [ 361.650605][ T1037] usb 9-1: reset high-speed USB device number 4 using dummy_hcd [ 361.714573][T11246] netlink: 'syz.0.1438': attribute type 1 has an invalid length. [ 361.722307][T11246] netlink: 756 bytes leftover after parsing attributes in process `syz.0.1438'. [ 361.730544][T11193] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 361.781020][ T1037] usb 9-1: device descriptor read/64, error -32 [ 361.952787][T11254] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1441'. [ 361.996483][T11254] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 362.014334][T11254] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1441'. [ 362.035823][T11254] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 362.164034][T11257] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1442'. [ 362.402813][T11262] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1444'. [ 362.789488][ T5842] usb 9-1: USB disconnect, device number 4 [ 363.261340][T11273] pim6reg: entered allmulticast mode [ 363.277237][T11270] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 363.404388][T11268] pim6reg: left allmulticast mode [ 363.472561][T11273] loop7: detected capacity change from 0 to 7 [ 363.520074][ C0] blk_print_req_error: 8 callbacks suppressed [ 363.520093][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 363.525401][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 363.528252][ C0] buffer_io_error: 5 callbacks suppressed [ 363.528261][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 363.533067][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 363.535881][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 363.538782][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 363.541638][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 363.544571][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 363.547383][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 363.550829][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 363.553663][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 363.930460][ T9] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 363.982338][ T42] audit: type=1326 audit(1786189033.909:22873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11281 comm="syz.4.1450" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fa5fec code=0x0 [ 364.095895][ T9] usb 6-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 364.102052][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.106939][ T9] usb 6-1: Product: syz [ 364.108294][ T9] usb 6-1: Manufacturer: syz [ 364.112099][ T9] usb 6-1: SerialNumber: syz [ 364.116247][ T9] usb 6-1: config 0 descriptor?? [ 364.131295][ T9] i2c-tiny-usb 6-1:0.0: version 6d.cc found at bus 006 address 024 [ 364.221571][ T42] audit: type=1326 audit(1786189034.139:22874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11288 comm="syz.0.1452" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 365.332120][T11300] batman_adv: batadv0: Adding interface: veth0 [ 365.336390][T11300] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 365.352797][T11300] batman_adv: batadv0: Interface activated: veth0 [ 365.369295][T11300] batman_adv: batadv0: Interface deactivated: veth0 [ 365.385773][T11300] batman_adv: batadv0: Removing interface: veth0 [ 365.421335][T11303] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 365.425774][T11303] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 365.437413][T11303] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 365.441836][T11303] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 365.771022][ T42] audit: type=1326 audit(1786189035.699:22875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11304 comm="syz.4.1455" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fa5fec code=0x0 [ 365.980366][ T5842] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 366.130730][ T5842] usb 7-1: Using ep0 maxpacket: 8 [ 366.142075][ T5842] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 366.151227][ T5842] usb 7-1: config 179 has no interface number 0 [ 366.159377][ T5842] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 366.172940][ T5842] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 366.187226][ T5842] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 366.202401][ T5842] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 366.219562][ T5842] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 366.234676][ T5842] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 366.246141][ T5842] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.258677][T11308] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 366.391664][ T9] (null): failure reading functionality [ 366.552702][T11316] syzkaller1: entered promiscuous mode [ 366.579699][T11316] syzkaller1: entered allmulticast mode [ 366.752959][ T9] i2c i2c-2: failure reading functionality [ 366.770798][ T9] i2c i2c-2: connected i2c-tiny-usb device [ 366.781982][ T9] usb 6-1: USB disconnect, device number 24 [ 366.837279][T10345] usb 7-1: USB disconnect, device number 14 [ 366.837303][ C2] xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 366.841653][ C2] xpad 7-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 366.857850][T11322] fuse: Bad value for 'rootmode' [ 367.144483][T11337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 367.270488][ T42] audit: type=1326 audit(1786189037.179:22876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11338 comm="syz.0.1465" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 367.828273][T11347] jffs2: notice: (11347) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 367.857209][T11347] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1466'. [ 367.871288][T11347] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1466'. [ 368.202616][T11359] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1471'. [ 368.345085][ T5842] IPVS: starting estimator thread 0... [ 368.452891][T11371] IPVS: using max 43 ests per chain, 103200 per kthread [ 368.487874][T11377] jffs2: notice: (11377) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 368.514363][T11377] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1477'. [ 368.523077][T11377] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1477'. [ 368.542752][T11378] sock: sock_timestamping_bind_phc: sock not bind to device [ 368.724241][T11381] netlink: 124 bytes leftover after parsing attributes in process `syz.4.1478'. [ 368.730750][T11381] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1478'. [ 368.741938][T11381] No source specified [ 368.866982][T11383] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1479'. [ 368.874613][T11383] netlink: 'syz.4.1479': attribute type 7 has an invalid length. [ 368.882173][T11383] netlink: 'syz.4.1479': attribute type 8 has an invalid length. [ 368.888633][T11383] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1479'. [ 369.052166][T11386] pim6reg: entered allmulticast mode [ 369.056810][T11386] pim6reg: left allmulticast mode [ 369.122827][T11389] loop7: detected capacity change from 0 to 7 [ 369.137369][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 369.144623][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.147728][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 369.148523][T11388] pim6reg: entered allmulticast mode [ 369.150986][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.154630][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 369.163725][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.166794][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 369.167909][T11388] pim6reg: left allmulticast mode [ 369.174271][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.177367][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 369.194673][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.197759][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 369.224587][T11390] 9pnet_virtio: no channels available for device syz [ 369.239051][T11390] loop7: detected capacity change from 0 to 7 [ 369.259872][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 369.266436][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.269479][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 369.272557][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.275601][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 369.279714][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 369.282765][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 369.286366][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 369.290539][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 369.471748][T11394] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 369.476138][T11398] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 369.483635][T11401] jffs2: notice: (11401) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 369.492487][T11401] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1486'. [ 370.218240][ T42] audit: type=1326 audit(1786189040.139:22877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11417 comm="syz.0.1492" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 370.520652][ T5750] Bluetooth: hci3: command 0x040f tx timeout [ 370.799930][ T9] libceph: connect (1)[c::]:6789 error -101 [ 370.809363][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 370.847065][T11435] jffs2: notice: (11435) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 370.870794][T11428] ceph: No mds server is up or the cluster is laggy [ 371.010885][T11438] FAULT_INJECTION: forcing a failure. [ 371.010885][T11438] name failslab, interval 1, probability 0, space 0, times 0 [ 371.028779][T11438] CPU: 0 UID: 0 PID: 11438 Comm: syz.4.1497 Tainted: G L syzkaller #0 PREEMPT(full) [ 371.028800][T11438] Tainted: [L]=SOFTLOCKUP [ 371.028804][T11438] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 371.028811][T11438] Call Trace: [ 371.028816][T11438] [ 371.028821][T11438] dump_stack_lvl+0x100/0x190 [ 371.028841][T11438] should_fail_ex.cold+0x5/0xa [ 371.028875][T11438] should_failslab+0xc2/0x120 [ 371.028896][T11438] __kmalloc_noprof+0xfc/0x820 [ 371.028911][T11438] ? __pfx_dynamic_dname+0x10/0x10 [ 371.028929][T11438] ? tomoyo_encode2+0xfb/0x3c0 [ 371.028961][T11438] tomoyo_encode2+0xfb/0x3c0 [ 371.028982][T11438] tomoyo_encode+0x29/0x50 [ 371.028998][T11438] tomoyo_realpath_from_path+0x18c/0x690 [ 371.029018][T11438] tomoyo_path_number_perm+0x23c/0x580 [ 371.029032][T11438] ? tomoyo_path_number_perm+0x22e/0x580 [ 371.029047][T11438] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 371.029062][T11438] ? get_pid_task+0x106/0x250 [ 371.029092][T11438] ? find_held_lock+0x2b/0x80 [ 371.029107][T11438] ? __fget_files+0x215/0x3d0 [ 371.029117][T11438] ? hook_file_ioctl_common+0x140/0x440 [ 371.029132][T11438] ? __fget_files+0x215/0x3d0 [ 371.029145][T11438] ? __fget_files+0x21f/0x3d0 [ 371.029157][T11438] security_file_ioctl_compat+0xd3/0x230 [ 371.029188][T11438] __ia32_compat_sys_ioctl+0xc2/0x360 [ 371.029208][T11438] __do_fast_syscall_32+0xe7/0x970 [ 371.029226][T11438] ? lockdep_hardirqs_on+0x78/0x100 [ 371.029243][T11438] do_fast_syscall_32+0x32/0x70 [ 371.029260][T11438] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 371.029274][T11438] RIP: 0023:0xf7fa5fec [ 371.029290][T11438] Code: Unable to access opcode bytes at 0xf7fa5fc2. [ 371.029295][T11438] RSP: 002b:00000000f546650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 371.029306][T11438] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000000089f6 [ 371.029313][T11438] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 371.029319][T11438] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 371.029325][T11438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 371.029332][T11438] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 371.029346][T11438] [ 371.029508][T11438] ERROR: Out of memory at tomoyo_realpath_from_path. [ 371.621158][T11444] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 371.759715][T11449] overlayfs: failed to resolve './bus': -2 [ 372.356758][ T42] audit: type=1800 audit(1786189042.279:22878): pid=11469 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1507" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 372.522215][T11476] ieee802154 phy0 wpan0: encryption failed: -22 [ 372.790505][ T9] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 373.682013][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 373.690350][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 373.693267][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 373.700366][ T9] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 373.705035][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.711913][ T9] usb 6-1: config 0 descriptor?? [ 373.860395][T11278] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 374.017437][T11278] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 374.022359][T11278] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 374.026888][T11278] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 374.033639][T11278] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 374.037881][T11278] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 374.046123][T11278] usb 7-1: config 0 descriptor?? [ 374.300765][ T9] plantronics 0003:047F:FFFF.0007: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 374.468172][T11278] plantronics 0003:047F:FFFF.0008: unknown global tag 0xe [ 374.476830][T11278] plantronics 0003:047F:FFFF.0008: item 0 4 1 14 parsing failed [ 374.482953][T11278] plantronics 0003:047F:FFFF.0008: parse failed [ 374.485052][T11278] plantronics 0003:047F:FFFF.0008: probe with driver plantronics failed with error -22 [ 374.822262][T11511] __nla_validate_parse: 5 callbacks suppressed [ 374.822321][T11511] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1521'. [ 374.827569][T11511] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1521'. [ 374.926530][T11518] 9p: Bad value for 'rfdno' [ 375.666880][ T1037] usb 7-1: USB disconnect, device number 15 [ 376.103221][T11530] 9pnet_fd: Insufficient options for proto=fd [ 376.106268][T11540] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 376.158910][T11541] FAULT_INJECTION: forcing a failure. [ 376.158910][T11541] name failslab, interval 1, probability 0, space 0, times 0 [ 376.163692][T11541] CPU: 0 UID: 0 PID: 11541 Comm: syz.1.1529 Tainted: G L syzkaller #0 PREEMPT(full) [ 376.163710][T11541] Tainted: [L]=SOFTLOCKUP [ 376.163715][T11541] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 376.163721][T11541] Call Trace: [ 376.163725][T11541] [ 376.163730][T11541] dump_stack_lvl+0x100/0x190 [ 376.163748][T11541] should_fail_ex.cold+0x5/0xa [ 376.163762][T11541] should_failslab+0xc2/0x120 [ 376.163780][T11541] kmem_cache_alloc_noprof+0x91/0x6a0 [ 376.163796][T11541] ? vm_area_alloc+0x1f/0x160 [ 376.163810][T11541] vm_area_alloc+0x1f/0x160 [ 376.163821][T11541] __mmap_region+0x1033/0x2db0 [ 376.163834][T11541] ? __pfx___might_resched+0x10/0x10 [ 376.163854][T11541] ? __pfx___mmap_region+0x10/0x10 [ 376.163865][T11541] ? find_held_lock+0x2b/0x80 [ 376.163888][T11541] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 376.163919][T11541] ? find_held_lock+0x2b/0x80 [ 376.163933][T11541] ? is_bpf_text_address+0x8a/0x1a0 [ 376.163951][T11541] ? is_bpf_text_address+0x8a/0x1a0 [ 376.163990][T11541] mmap_region+0x35d/0x620 [ 376.164004][T11541] ? __pfx_mmap_region+0x10/0x10 [ 376.164020][T11541] ? bpf_lsm_capable+0x9/0x10 [ 376.164034][T11541] ? security_capable+0x80/0x260 [ 376.164047][T11541] do_mmap+0xc63/0x12f0 [ 376.164071][T11541] ? __pfx_do_mmap+0x10/0x10 [ 376.164087][T11541] ? __pfx_down_write_killable+0x10/0x10 [ 376.164109][T11541] vm_mmap_pgoff+0x29e/0x470 [ 376.164129][T11541] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 376.164144][T11541] ? __fget_files+0x215/0x3d0 [ 376.164158][T11541] ? __fget_files+0x21f/0x3d0 [ 376.164171][T11541] ksys_mmap_pgoff+0x3cb/0x610 [ 376.164188][T11541] ? fput+0x79/0x100 [ 376.164201][T11541] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 376.164216][T11541] ? ksys_write+0x1ac/0x250 [ 376.164226][T11541] ? __pfx_ksys_write+0x10/0x10 [ 376.164240][T11541] __do_fast_syscall_32+0xe7/0x970 [ 376.164257][T11541] ? lockdep_hardirqs_on+0x78/0x100 [ 376.164278][T11541] do_fast_syscall_32+0x32/0x70 [ 376.164300][T11541] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 376.164320][T11541] RIP: 0023:0xf6fdefec [ 376.164340][T11541] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 376.164345][T11541] RSP: 002b:00000000f53ac50c EFLAGS: 00000292 ORIG_RAX: 00000000000000c0 [ 376.164357][T11541] RAX: ffffffffffffffda RBX: 0000000080b5f000 RCX: 0000000000004000 [ 376.164364][T11541] RDX: 000000000100000d RSI: 0000000000002012 RDI: 0000000000000004 [ 376.164370][T11541] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 376.164376][T11541] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 376.164382][T11541] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 376.164396][T11541] [ 376.424960][T11560] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 376.473540][T11560] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 376.537967][T11562] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1535'. [ 376.561927][T11278] usb 6-1: USB disconnect, device number 25 [ 376.563865][T11562] geneve1: entered promiscuous mode [ 376.565460][T11565] hsr0: entered promiscuous mode [ 376.579513][T11562] Line length is too long: Should be less than 4094 [ 376.596780][T11564] hsr0: left promiscuous mode [ 376.605744][T11566] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 376.815934][T11577] nbd: couldn't find device at index 524288 [ 376.824444][T11577] netlink: 'syz.4.1541': attribute type 12 has an invalid length. [ 377.150773][ T5570] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.162837][ T5570] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.174636][ T5570] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.195212][ T5570] netdevsim netdevsim3 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.258105][T11582] syzkaller0: entered promiscuous mode [ 377.260009][T11582] syzkaller0: entered allmulticast mode [ 377.271760][ T5570] netdevsim netdevsim3 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.383210][T11599] openvswitch: netlink: Message has 162 unknown bytes. [ 377.727299][T11609] FAULT_INJECTION: forcing a failure. [ 377.727299][T11609] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 377.731684][T11609] CPU: 0 UID: 0 PID: 11609 Comm: syz.4.1547 Tainted: G L syzkaller #0 PREEMPT(full) [ 377.731704][T11609] Tainted: [L]=SOFTLOCKUP [ 377.731708][T11609] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 377.731714][T11609] Call Trace: [ 377.731719][T11609] [ 377.731724][T11609] dump_stack_lvl+0x100/0x190 [ 377.731742][T11609] should_fail_ex.cold+0x5/0xa [ 377.731756][T11609] _copy_from_user+0x2e/0xd0 [ 377.731775][T11609] copy_from_buffer+0x7f/0xc0 [ 377.731790][T11609] copy_uabi_to_xstate+0x266/0x650 [ 377.731804][T11609] ? __pfx_copy_uabi_to_xstate+0x10/0x10 [ 377.731834][T11609] ? __fpu_restore_sig+0xc06/0x13b0 [ 377.731846][T11609] ? x86_task_fpu+0x5f/0x90 [ 377.731864][T11609] __fpu_restore_sig+0xfeb/0x13b0 [ 377.731878][T11609] ? __pfx___fpu_restore_sig+0x10/0x10 [ 377.731897][T11609] ? __might_fault+0xc5/0x140 [ 377.731913][T11609] fpu__restore_sig+0x151/0x190 [ 377.731925][T11609] ia32_restore_sigcontext+0x456/0x620 [ 377.731940][T11609] ? __pfx_ia32_restore_sigcontext+0x10/0x10 [ 377.731957][T11609] ? rcu_is_watching+0x12/0xc0 [ 377.731972][T11609] ? _raw_spin_unlock_irq+0x23/0x50 [ 377.731987][T11609] ? lockdep_hardirqs_on+0x78/0x100 [ 377.732005][T11609] __do_compat_sys_rt_sigreturn+0x18c/0x270 [ 377.732020][T11609] ? __pfx___ia32_compat_sys_rt_sigreturn+0x10/0x10 [ 377.732039][T11609] do_int80_emulation+0x14b/0x720 [ 377.732057][T11609] asm_int80_emulation+0x1a/0x20 [ 377.732068][T11609] RIP: 0023:0xf7fa5fea [ 377.732079][T11609] Code: 19 85 d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 80 5d 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 [ 377.732090][T11609] RSP: 002b:00000000f546650c EFLAGS: 00000292 [ 377.732099][T11609] RAX: 0000000000000036 RBX: 0000000000000003 RCX: 0000000000005101 [ 377.732106][T11609] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 377.732112][T11609] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 377.732118][T11609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 377.732125][T11609] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 377.732138][T11609] [ 378.361700][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.363874][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.330535][ T64] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 379.334993][ T5750] Bluetooth: hci4: command 0x1003 tx timeout [ 380.704590][T11644] cramfs: checking physical address 0x0000000043b60000 for linear cramfs image [ 380.721498][T11644] cramfs: wrong magic [ 380.726370][T11644] cramfs: wrong magic [ 380.762121][T11652] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1559'. [ 380.903381][T11661] jffs2: notice: (11661) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 380.992240][T11665] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1563'. [ 381.003472][T11665] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1563'. [ 382.584385][ T42] audit: type=1326 audit(1786189051.509:22879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11683 comm="syz.1.1569" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x0 [ 382.668834][T11689] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1570'. [ 382.697165][T11689] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1570'. [ 383.033293][T11705] ptrace attach of "/syz-executor exec"[10136] was attempted by " [ 383.512479][ T9] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 383.732056][ T9] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 383.735858][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 383.742915][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 383.749020][ T9] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 383.759519][ T9] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 383.771286][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.781786][ T9] usb 7-1: config 0 descriptor?? [ 384.203027][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 384.215753][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 384.223358][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 384.231362][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 384.238755][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 384.248762][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 384.256900][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 384.266390][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 384.273331][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 384.283102][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 384.301324][ T9] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 385.640708][ T9] usb 7-1: reset high-speed USB device number 16 using dummy_hcd [ 385.891990][T11743] ceph: No mds server is up or the cluster is laggy [ 386.046047][T11760] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1587'. [ 386.133694][T11763] jffs2: notice: (11763) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 386.139971][T11764] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 386.175472][T11763] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1588'. [ 386.183695][T11763] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1588'. [ 386.267670][T11769] /dev/sg0: Can't lookup blockdev [ 386.291973][T11769] usb usb8: usbfs: interface 0 claimed by hub while 'syz.0.1591' sets config #0 [ 387.005191][T10345] usb 7-1: USB disconnect, device number 16 [ 387.147531][T11772] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 387.408732][T11778] orangefs_mount: mount request failed with -4 [ 387.411031][T11786] netlink: 'syz.1.1597': attribute type 1 has an invalid length. [ 387.416729][ T42] audit: type=1326 audit(1786189056.339:22880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11780 comm="syz.4.1595" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fa5fec code=0x0 [ 387.420629][T11786] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1597'. [ 387.550336][ T42] audit: type=1326 audit(1786189056.469:22881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11790 comm="syz.2.1598" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x0 [ 388.440358][ T64] Bluetooth: hci3: command 0x040f tx timeout [ 389.141022][ T42] audit: type=1326 audit(1786189058.059:22882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11822 comm="syz.0.1603" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 389.417477][T11828] Process accounting resumed [ 390.741209][T11844] syz_tun: left allmulticast mode [ 390.743037][T11844] syz_tun: left promiscuous mode [ 390.744876][T11844] bridge0: port 3(syz_tun) entered disabled state [ 390.756498][T11844] bridge_slave_0: left allmulticast mode [ 390.759114][T11844] bridge_slave_0: left promiscuous mode [ 390.764011][T11844] bridge0: port 1(bridge_slave_0) entered disabled state [ 390.767939][T11844] bridge_slave_1: left promiscuous mode [ 390.769964][T11844] bridge0: port 2(bridge_slave_1) entered disabled state [ 390.776324][T11844] bond0: (slave bond_slave_0): Releasing backup interface [ 390.783091][T11844] team0: Port device team_slave_0 removed [ 390.786060][T11844] team0: Port device team_slave_1 removed [ 390.788153][T11844] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 390.830181][T11847] team0: Port device xfrm0 added [ 390.834039][T11846] syzkaller0: entered promiscuous mode [ 390.837344][T11846] syzkaller0: entered allmulticast mode [ 390.849716][T11844] tipc: Enabled bearer , priority 0 [ 391.514103][T11858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 391.592605][T11859] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 391.614863][T11859] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 392.416968][ T42] audit: type=1326 audit(1786189061.339:22883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11883 comm="syz.4.1621" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fa5fec code=0x0 [ 392.582620][T11889] netlink: 'syz.1.1620': attribute type 1 has an invalid length. [ 392.615595][T11889] netlink: 756 bytes leftover after parsing attributes in process `syz.1.1620'. [ 393.588123][T11898] kAFS: Invalid Command on /proc/fs/afs/cells file [ 393.761341][T11907] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 393.784986][T11910] netlink: 'syz.1.1629': attribute type 2 has an invalid length. [ 394.855052][T11928] netlink: 'syz.0.1634': attribute type 1 has an invalid length. [ 394.872322][T11928] netlink: 756 bytes leftover after parsing attributes in process `syz.0.1634'. [ 395.085014][T11933] 9pnet_fd: Insufficient options for proto=fd [ 396.985117][T11952] program syz.0.1640 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 397.084016][T11910] Process accounting resumed [ 397.246487][T11964] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1643'. [ 397.564527][ T9] libceph: connect (1)[c::]:6789 error -101 [ 397.567040][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 397.569479][T11972] ceph: No mds server is up or the cluster is laggy [ 397.641771][T11978] bond0: (slave sit0): refused to change device type [ 397.811483][T11995] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 397.948517][ T42] audit: type=1326 audit(1786189066.869:22884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12001 comm="syz.2.1655" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x0 [ 397.985810][T12004] block nbd1: not configured, cannot reconfigure [ 398.308059][T12022] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1661'. [ 398.339198][T12022] syzkaller0: entered promiscuous mode [ 398.341443][T12022] syzkaller0: entered allmulticast mode [ 398.398788][T12022] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1661'. [ 398.409808][T12024] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1662'. [ 398.949400][T12027] CIFS: Attempting to mount //127.0.0.1/share [ 398.990103][T12027] CIFS: VFS: Error connecting to socket. Aborting operation. [ 398.992971][T12027] CIFS: VFS: cifs_mount failed w/return code = -4 [ 399.734829][T12035] fuse: Unknown parameter 'E|Ù8m(¶N¦¦Mò·æðz2$æ»ÈÆÖgb{mÎS?ãŠè\q`\ Š©taÕO•ôpq¥¤yMôÐ0À™*(£_܈” duƒÜÅÙL¢Ìkï{”0ÿn[¡>À]éÝû¼CÓ¬~y3uËÞF–ª' [ 401.970733][ T42] audit: type=1326 audit(1786189070.889:22885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12061 comm="syz.4.1672" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fa5fec code=0x0 [ 402.016002][T12040] loop7: detected capacity change from 0 to 7 [ 402.028086][ C0] blk_print_req_error: 2 callbacks suppressed [ 402.028131][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 402.036636][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 402.039756][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 402.045637][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 402.048764][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 402.053927][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 402.057097][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 402.057236][ T5447] veth1_vlan: left promiscuous mode [ 402.062343][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 402.065493][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 402.071527][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 402.074588][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 402.203631][T12076] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1675'. [ 402.435131][T12082] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 402.437583][T12082] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 402.460457][T12082] vhci_hcd vhci_hcd.0: Device attached [ 402.740563][ T1037] usb 38-1: SetAddress Request (6) to port 0 [ 402.746988][ T1037] usb 38-1: new SuperSpeed USB device number 6 using vhci_hcd [ 402.845216][ T42] audit: type=1326 audit(1786189071.769:22886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12097 comm="syz.2.1679" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x0 [ 403.116087][T12083] vhci_hcd: connection reset by peer [ 403.120128][ T12] vhci_hcd vhci_hcd.0: stop threads [ 403.125741][ T12] vhci_hcd vhci_hcd.0: release socket [ 403.137256][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 403.360907][ T42] audit: type=1326 audit(1786189072.289:22887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12110 comm="syz.1.1682" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x0 [ 404.450954][T12121] loop7: detected capacity change from 0 to 7 [ 404.468435][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 404.473254][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.476378][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 404.484129][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.487387][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 404.495173][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.498342][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 404.505483][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 404.513712][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 405.084802][T12128] pim6reg: entered allmulticast mode [ 405.118358][T12127] 9pnet_virtio: no channels available for device syz [ 405.134764][T12127] loop7: detected capacity change from 0 to 7 [ 406.117275][T12144] loop7: detected capacity change from 0 to 7 [ 406.650352][ T42] audit: type=1326 audit(1786189075.559:22888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12153 comm="syz.2.1695" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x0 [ 407.049045][T12168] netlink: 'syz.0.1697': attribute type 1 has an invalid length. [ 407.560228][T12177] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 408.038608][ T1037] usb 38-1: device descriptor read/8, error -110 [ 408.152511][T12186] 9pnet_fd: p9_fd_create_tcp (12186): problem connecting socket to 127.0.0.1 [ 408.278678][ T64] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 408.321983][T12191] netlink: 2028 bytes leftover after parsing attributes in process `syz.0.1703'. [ 408.337713][T12191] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1703'. [ 408.635094][T12194] [ 408.635938][T12194] ====================================================== [ 408.638080][T12194] WARNING: possible circular locking dependency detected [ 408.640183][T12194] syzkaller #0 Tainted: G L [ 408.642119][T12194] ------------------------------------------------------ [ 408.644483][T12194] syz.1.1705/12194 is trying to acquire lock: [ 408.646457][T12194] ffffffff901cc5e8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x79a/0x950 [ 408.649573][T12194] [ 408.649573][T12194] but task is already holding lock: [ 408.651844][T12194] ffff8880130d0f80 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 408.654969][T12194] [ 408.654969][T12194] which lock already depends on the new lock. [ 408.654969][T12194] [ 408.658122][T12194] [ 408.658122][T12194] the existing dependency chain (in reverse order) is: [ 408.661070][T12194] [ 408.661070][T12194] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 408.664046][T12194] lock_acquire+0x1b9/0x370 [ 408.665757][T12194] down_write+0x8b/0x1f0 [ 408.667509][T12194] configfs_depend_item_unlocked+0xf3/0x6a0 [ 408.669926][T12194] usbg_make_tpg+0x261/0x620 [ 408.671745][T12194] target_fabric_make_tpg+0xab/0x8c0 [ 408.673969][T12194] configfs_mkdir+0x51e/0xb70 [ 408.675934][T12194] vfs_mkdir+0x361/0x850 [ 408.677675][T12194] filename_mkdirat+0x48b/0x5e0 [ 408.679722][T12194] __ia32_sys_mkdir+0x6a/0x90 [ 408.681588][T12194] __do_fast_syscall_32+0xe7/0x970 [ 408.683624][T12194] do_fast_syscall_32+0x32/0x70 [ 408.685378][T12194] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 408.687603][T12194] [ 408.687603][T12194] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 408.690044][T12194] lock_acquire+0x1b9/0x370 [ 408.691715][T12194] __mutex_lock+0x1a4/0x1bd0 [ 408.693527][T12194] tcm_set_name+0x29/0xb0 [ 408.695330][T12194] function_make+0x21c/0x3f0 [ 408.697175][T12194] configfs_mkdir+0x51e/0xb70 [ 408.698936][T12194] vfs_mkdir+0x361/0x850 [ 408.700440][T12194] filename_mkdirat+0x48b/0x5e0 [ 408.702145][T12194] __ia32_sys_mkdir+0x6a/0x90 [ 408.703818][T12194] __do_fast_syscall_32+0xe7/0x970 [ 408.705569][T12194] do_fast_syscall_32+0x32/0x70 [ 408.707290][T12194] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 408.709450][T12194] [ 408.709450][T12194] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 408.712021][T12194] check_prev_add+0xeb/0xe60 [ 408.713646][T12194] __lock_acquire+0x136c/0x1a40 [ 408.715334][T12194] lock_acquire+0x1b9/0x370 [ 408.717007][T12194] __mutex_lock+0x1a4/0x1bd0 [ 408.718855][T12194] configfs_rmdir+0x79a/0x950 [ 408.720677][T12194] vfs_rmdir+0x328/0x8a0 [ 408.722547][T12194] filename_rmdir+0x31a/0x5c0 [ 408.724479][T12194] __ia32_sys_rmdir+0x45/0x60 [ 408.726577][T12194] __do_fast_syscall_32+0xe7/0x970 [ 408.728447][T12194] do_fast_syscall_32+0x32/0x70 [ 408.730155][T12194] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 408.732202][T12194] [ 408.732202][T12194] other info that might help us debug this: [ 408.732202][T12194] [ 408.735305][T12194] Chain exists of: [ 408.735305][T12194] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#24 [ 408.735305][T12194] [ 408.739494][T12194] Possible unsafe locking scenario: [ 408.739494][T12194] [ 408.741602][T12194] CPU0 CPU1 [ 408.743266][T12194] ---- ---- [ 408.744909][T12194] lock(&sb->s_type->i_mutex_key#24); [ 408.746614][T12194] lock(&opts->dep_lock); [ 408.748787][T12194] lock(&sb->s_type->i_mutex_key#24); [ 408.751169][T12194] lock(gadget_subsys.su_mutex); [ 408.752765][T12194] [ 408.752765][T12194] *** DEADLOCK *** [ 408.752765][T12194] [ 408.755267][T12194] 3 locks held by syz.1.1705/12194: [ 408.756893][T12194] #0: ffff888021c10450 (sb_writers#13){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 408.759809][T12194] #1: ffff8880130d2740 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 408.763182][T12194] #2: ffff8880130d0f80 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 408.766347][T12194] [ 408.766347][T12194] stack backtrace: [ 408.768197][T12194] CPU: 0 UID: 0 PID: 12194 Comm: syz.1.1705 Tainted: G L syzkaller #0 PREEMPT(full) [ 408.768217][T12194] Tainted: [L]=SOFTLOCKUP [ 408.768221][T12194] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 408.768229][T12194] Call Trace: [ 408.768244][T12194] [ 408.768250][T12194] dump_stack_lvl+0x100/0x190 [ 408.768286][T12194] print_circular_bug.cold+0x178/0x1c7 [ 408.768307][T12194] check_noncircular+0x146/0x160 [ 408.768329][T12194] check_prev_add+0xeb/0xe60 [ 408.768348][T12194] ? __bfs+0x150/0x2a0 [ 408.768365][T12194] __lock_acquire+0x136c/0x1a40 [ 408.768388][T12194] lock_acquire+0x1b9/0x370 [ 408.768399][T12194] ? configfs_rmdir+0x79a/0x950 [ 408.768414][T12194] ? __pfx___might_resched+0x10/0x10 [ 408.768432][T12194] __mutex_lock+0x1a4/0x1bd0 [ 408.768448][T12194] ? configfs_rmdir+0x79a/0x950 [ 408.768461][T12194] ? configfs_rmdir+0x79a/0x950 [ 408.768475][T12194] ? __pfx___mutex_lock+0x10/0x10 [ 408.768490][T12194] ? do_raw_spin_lock+0x128/0x260 [ 408.768502][T12194] ? find_held_lock+0x2b/0x80 [ 408.768516][T12194] ? fast_dput+0x2fe/0x6d0 [ 408.768531][T12194] ? do_raw_spin_unlock+0x145/0x1e0 [ 408.768545][T12194] ? _raw_spin_unlock+0x28/0x50 [ 408.768560][T12194] ? fast_dput+0x168/0x6d0 [ 408.768575][T12194] ? configfs_rmdir+0x79a/0x950 [ 408.768587][T12194] configfs_rmdir+0x79a/0x950 [ 408.768602][T12194] ? __pfx_configfs_rmdir+0x10/0x10 [ 408.768615][T12194] ? __pfx_down_write+0x10/0x10 [ 408.768632][T12194] vfs_rmdir+0x328/0x8a0 [ 408.768646][T12194] filename_rmdir+0x31a/0x5c0 [ 408.768658][T12194] ? __pfx_filename_rmdir+0x10/0x10 [ 408.768672][T12194] ? do_getname+0x191/0x390 [ 408.768706][T12194] __ia32_sys_rmdir+0x45/0x60 [ 408.768720][T12194] __do_fast_syscall_32+0xe7/0x970 [ 408.768738][T12194] do_fast_syscall_32+0x32/0x70 [ 408.768756][T12194] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 408.768771][T12194] RIP: 0023:0xf6fdefec [ 408.768789][T12194] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 408.768803][T12194] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000028 [ 408.768814][T12194] RAX: ffffffffffffffda RBX: 0000000080000200 RCX: 0000000000000000 [ 408.768821][T12194] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 408.768828][T12194] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 408.768835][T12194] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 408.768842][T12194] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 408.768852][T12194] [ 408.820680][ T1037] usb usb38-port1: attempt power cycle [ 408.882340][T12194] usb usb9: check_ctrlrecip: process 12194 (syz.1.1705) requesting ep 01 but needs 81 [ 408.885467][T12194] usb usb9: usbfs: process 12194 (syz.1.1705) did not claim interface 0 before use [ 409.410687][ T1037] usb usb38-port1: unable to enumerate USB device