last executing test programs: 2.690422682s ago: executing program 3 (id=1068): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000000900)='nfsd \\27.0.0.1 2000000000 te', 0x1c) 2.690193427s ago: executing program 3 (id=1069): io_uring_setup(0x4823, &(0x7f0000000100)={0x0, 0x3ffe, 0x40, 0x2, 0x16d}) pause() socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040f3f01f7d04a37f60a74b51f629a0332b0854d78ec1123e57c7ff57f1c8b1141977fb5ac0d93db53353a9f1776ef87199e5752827c1ddf2708ce41dd41fd679ecf82470cb8063f90e041b6c1"], 0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x6, 0x4, 0x6, 0x8, 0x0, 0xffffffffffffffff, 0x83}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xc, 0xd, &(0x7f0000000180)=@framed={{}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}, @call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f0000000340)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0857f9f582f03000000f0000000", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.859012189s ago: executing program 0 (id=1076): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp6\x00') preadv(r0, &(0x7f0000000300), 0x0, 0x6ae, 0x2000ff3f) 1.858001294s ago: executing program 0 (id=1078): r0 = syz_open_dev$mtd(&(0x7f0000000000), 0x1, 0x2401) r1 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='127.0.0.1:6789:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000300)='mon_addr\x00', &(0x7f0000000400)='127.0.0.1:6789\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async) ioctl$MEMSETBADBLOCK(r0, 0x40084d0c, &(0x7f0000000040)) ioctl$ECCGETLAYOUT(r0, 0x81484d11, &(0x7f0000000080)) 1.689843719s ago: executing program 3 (id=1079): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) connect$unix(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r1) sendmsg$IEEE802154_LIST_PHY(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r2, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x95}, 0x40000) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x3, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0xc0686611, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="080008004d0b00ec006800000c2190780a01010064010101070f51e0000001640101017f000001070f73ac1414aa64010101ac1e010100004e204e210401907822016cf008dbf4bda73cc620f9708bb3bc0df9c3836ff3524555fba603de1c8cf7be5116d42b16e9110f92030b826f7000116dbd11835e393fd1ff027343a5fb08c4d2f0c6d6b295b1af85a12f89245e31eecc26dd6f7549b51f0904499133a8d35d59d27bea2a7c2f261bd5f04c2c6cc66ca10b2491b1ee7e909c15d7030069670be1f8e7ad3cffc5140f5ae8b81b796c9ec344ccd1a89e70037d1ad507191e4180"], 0xf0) writev(r4, &(0x7f0000000840), 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r6, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r7 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r7, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10) listen(r7, 0x2) accept4(r7, 0x0, 0x0, 0x80800) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r5, 0xc0045006, &(0x7f0000000180)=0x6f) write$dsp(r5, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) ioctl$SNDCTL_SEQ_RESET(0xffffffffffffffff, 0x5100) 929.783979ms ago: executing program 0 (id=1089): bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x4, 0xe, &(0x7f0000000b80)=ANY=[@ANYBLOB="b70200001a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8e0400000000000000c61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b36db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece010000000100000010223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff814f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffff854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e92604e1026e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c36981edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ce852364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24}, 0x94) socket(0x400000000010, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000111000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) write$tun(r0, 0x0, 0xfce) 870.242436ms ago: executing program 0 (id=1090): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x1, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}]}) mlock(&(0x7f0000400000/0xc00000)=nil, 0xc00000) syz_open_dev$sndctrl(&(0x7f0000000040), 0x8d, 0x0) (async) r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x8d, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r0, 0xc1105511, &(0x7f0000000340)={{0xa, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil) (async) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil) flock(0xffffffffffffffff, 0x3) (async) flock(0xffffffffffffffff, 0x3) munlockall() r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020200600000000000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) madvise(&(0x7f00004f6000/0x4000)=nil, 0x4000, 0x14) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) recvmmsg(r2, &(0x7f0000003900)=[{{&(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000300)=[{&(0x7f00000001c0)}, {&(0x7f0000000200)=""/254, 0xfe}], 0x2, &(0x7f00000008c0)=""/4096, 0x1000}, 0x1000}, {{&(0x7f00000018c0)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f00000019c0)=[{&(0x7f0000001940)=""/67, 0x43}], 0x1, &(0x7f0000001a00)=""/115, 0x73}, 0xffff0000}, {{0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000001a80)=""/185, 0xb9}, {&(0x7f0000001b40)=""/7, 0x7}, {&(0x7f0000001b80)=""/211, 0xd3}, {&(0x7f0000001c80)=""/161, 0xa1}], 0x4}, 0x3}, {{&(0x7f0000001d80)=@phonet, 0x80, &(0x7f0000002140)=[{&(0x7f0000001e00)=""/110, 0x6e}, {&(0x7f0000001e80)=""/180, 0xb4}, {&(0x7f0000001f40)=""/154, 0x9a}, {&(0x7f0000002000)=""/229, 0xe5}, {&(0x7f0000002100)=""/47, 0x2f}], 0x5, &(0x7f0000002180)=""/201, 0xc9}, 0x8}, {{0x0, 0x0, &(0x7f0000003300)=[{&(0x7f0000002280)=""/4096, 0x1000}, {&(0x7f0000003280)=""/93, 0x5d}], 0x2, &(0x7f0000003340)}, 0x7}, {{&(0x7f0000003380)=@isdn, 0x80, &(0x7f0000003600)=[{&(0x7f0000003400)=""/156, 0x9c}, {&(0x7f00000034c0)=""/190, 0xbe}, {&(0x7f0000003580)=""/88, 0x58}], 0x3, &(0x7f0000003640)=""/60, 0x3c}, 0x7}, {{&(0x7f0000003680)=@x25={0x9, @remote}, 0x80, &(0x7f00000037c0)=[{&(0x7f0000003700)=""/147, 0x93}], 0x1, &(0x7f0000003800)=""/213, 0xd5}, 0x9}], 0x7, 0x40000061, 0x0) (async) recvmmsg(r2, &(0x7f0000003900)=[{{&(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000300)=[{&(0x7f00000001c0)}, {&(0x7f0000000200)=""/254, 0xfe}], 0x2, &(0x7f00000008c0)=""/4096, 0x1000}, 0x1000}, {{&(0x7f00000018c0)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f00000019c0)=[{&(0x7f0000001940)=""/67, 0x43}], 0x1, &(0x7f0000001a00)=""/115, 0x73}, 0xffff0000}, {{0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000001a80)=""/185, 0xb9}, {&(0x7f0000001b40)=""/7, 0x7}, {&(0x7f0000001b80)=""/211, 0xd3}, {&(0x7f0000001c80)=""/161, 0xa1}], 0x4}, 0x3}, {{&(0x7f0000001d80)=@phonet, 0x80, &(0x7f0000002140)=[{&(0x7f0000001e00)=""/110, 0x6e}, {&(0x7f0000001e80)=""/180, 0xb4}, {&(0x7f0000001f40)=""/154, 0x9a}, {&(0x7f0000002000)=""/229, 0xe5}, {&(0x7f0000002100)=""/47, 0x2f}], 0x5, &(0x7f0000002180)=""/201, 0xc9}, 0x8}, {{0x0, 0x0, &(0x7f0000003300)=[{&(0x7f0000002280)=""/4096, 0x1000}, {&(0x7f0000003280)=""/93, 0x5d}], 0x2, &(0x7f0000003340)}, 0x7}, {{&(0x7f0000003380)=@isdn, 0x80, &(0x7f0000003600)=[{&(0x7f0000003400)=""/156, 0x9c}, {&(0x7f00000034c0)=""/190, 0xbe}, {&(0x7f0000003580)=""/88, 0x58}], 0x3, &(0x7f0000003640)=""/60, 0x3c}, 0x7}, {{&(0x7f0000003680)=@x25={0x9, @remote}, 0x80, &(0x7f00000037c0)=[{&(0x7f0000003700)=""/147, 0x93}], 0x1, &(0x7f0000003800)=""/213, 0xd5}, 0x9}], 0x7, 0x40000061, 0x0) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000180)='./file0\x00') (async) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000180)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file2\x00', 0x1000, 0x0) r3 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200000, 0x95) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r3, 0x1, &(0x7f0000000340)={0x2000, r4}, 0x0) landlock_restrict_self(r3, 0x0) (async) landlock_restrict_self(r3, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) r5 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x2710}, 0x10, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'nr0\x00'}) 780.127149ms ago: executing program 3 (id=1091): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000100)={0x18, 0x56, 0x601, 0x0, 0x0, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1, 0x0, 0x0, 0xea}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) 779.515522ms ago: executing program 3 (id=1092): bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020000000000000", @ANYBLOB="00562653ef2b152c7200"/19, @ANYRES32=0x0, @ANYRES32], 0x48) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f000000"], 0x0, 0x35}, 0x28) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x1a, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180005000000ffff000077b9080000009500000000d3a07e"], &(0x7f0000000080)='GPL\x00', 0x7, 0x4fa, &(0x7f0000000cc0)=""/4096, 0x40f00, 0x5, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x0, 0x2, 0x4, 0x9}, 0x1, 0x0, 0x0, 0xff3e, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 767.921477ms ago: executing program 3 (id=1093): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e1d, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000880)={0x1c, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x4}, @CTA_EXPECT_NAT={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40010}, 0x24000050) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006200000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b"], 0x4c}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, 0x0, 0x4000000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000007c0000007c00000003000000010000000500008b9b3e9f7767757c06040000000f00000003000000080000005600000002000000060000000900000006000000"], 0x0, 0x97, 0x0, 0x1, 0x3}, 0x28) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000000c0)={&(0x7f000000b000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000008000/0x2000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f000000c000/0xf000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff2000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f000000b000/0x2000)=nil, &(0x7f0000ff3000/0x1000)=nil, 0x0}, 0x68) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) close(0x3) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000041436120410e5150e8d5000000010902f98a5c01000000"], 0x0) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/card3/oss_mixer\x00', 0x100, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) sync_file_range(r2, 0x2, 0xb9, 0x7) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x6f) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001300), 0x40, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xe) keyctl$KEYCTL_MOVE(0x1e, 0x0, 0x0, 0xfffffffffffffffb, 0x1) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c0000000906010200fff500000000000502ffff240007801800018014000240fe8000000000000000000000000000aa08000a40000000020900020073797a31000000000500010007000000"], 0x4c}}, 0x4000080) 679.486803ms ago: executing program 0 (id=1094): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x2, 0x2, &(0x7f0000000080)=@raw=[@call={0x85, 0x0, 0x0, 0x16}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2a}, 0x94) 679.127943ms ago: executing program 1 (id=1095): r0 = socket(0xa, 0x2, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000003c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX, @ANYRES8=0x0, @ANYBLOB="daea61aee467b0892e440ba80552d2b067133e25d42a32efeb7de9da2690dc72348704fa2cacf931796ea70d825d2ce481cd77355bb9e5eca16051e218d242abdf774dafa058b0893670b3", @ANYRESHEX=r0], &(0x7f0000000000)='GPL\x00', 0xfffffffe, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = syz_io_uring_setup(0x4175, &(0x7f0000000180)={0x0, 0x136f, 0x10000, 0x2, 0x2d0}, &(0x7f0000000040), &(0x7f0000000400), &(0x7f0000000000)) io_uring_enter(r2, 0x7b20, 0xf784, 0x4, 0x0, 0x0) io_uring_enter(r2, 0x1e61, 0x9296, 0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r5 = openat$hpet(0xffffff9c, &(0x7f0000000040), 0x200000, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r4, 0x84009422, &(0x7f0000000d00)={0x0, 0x0, {0x0, @struct}, {0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0x0, 0xf000}) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7}) syz_clone3(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x180) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB]) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8880, 0x85) getdents64(r6, 0x0, 0x4f) 610.305701ms ago: executing program 0 (id=1096): r0 = fsopen(&(0x7f0000000000)='gfs2\x00', 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000280)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000080)=0x5) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000001040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r3, 0x0, 0x8, 0x0) splice(r2, 0x0, r5, 0x0, 0x84, 0xd) ppoll(&(0x7f0000000440)=[{r5, 0x4410}], 0x1, 0x0, 0x0, 0x0) write$binfmt_misc(r3, &(0x7f0000000100)='F', 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='source', &(0x7f0000000400)='//\xf2/\x06\b\xa30\\\x00\x00\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas\x9d\x14\xe3\v\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7Gl\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\n\x8c0x0}) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340), r6) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r2, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0x14, r8, 0x800, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0xc0}, 0x1821f01b2cde32c8) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@bridge_delneigh={0x3c, 0x1c, 0xc07, 0x70bd23, 0x8000, {0x1c, 0x0, 0x0, r7, 0x40, 0x1f4}, [@NDA_DST_IPV6={0x14, 0x1, @mcast1}, @NDA_LLADDR={0xa, 0x2, @remote}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2c0008a1}, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r4, &(0x7f0000000c40)=ANY=[], 0x13) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r9, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000140)=[0x5], 0x0, 0x0, 0x1, 0x1}}, 0x40) r10 = creat(&(0x7f0000000440)='./file0\x00', 0x0) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x12, r3, 0x0) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r11, 0xffffffffffffffff, 0x0) ioctl$SNDCTL_SEQ_NRMIDIS(r2, 0x8004510b, &(0x7f0000000000)) setsockopt$IP_VS_SO_SET_DEL(r10, 0x0, 0x484, &(0x7f00000001c0)={0x20000000000084, @private=0xa010102, 0x0, 0x0, 'rr\x00'}, 0x2c) setrlimit(0x1, &(0x7f0000000000)={0x2, 0x3}) 203.935145ms ago: executing program 1 (id=1099): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x4c00, &(0x7f00000000c0)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x401, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x503, 0x2c638}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MAX_AGE={0x8, 0x3, 0x40a}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008086}, 0x0) 203.155474ms ago: executing program 2 (id=1100): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x9, 0x1, &(0x7f0000000040)=ANY=[], &(0x7f0000000600)='syzkaller\x00', 0x3, 0xaf, &(0x7f0000000140)=""/169, 0x41100, 0x70, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x101}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r0 = getpid() bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async, rerun: 32) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) (rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) read$FUSE(0xffffffffffffffff, &(0x7f0000001240)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ptrace$cont(0x9, r3, 0x4, 0xcf8) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) timerfd_create(0x9, 0x800) (async, rerun: 32) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) (async, rerun: 32) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) (async) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) (async) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, &(0x7f0000000000)) (async) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x8c, 0x0) (async) r4 = socket$netlink(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000300)=ANY=[@ANYBLOB="380000000314a7db00000000000000090900020073797a3200000000080041107369770014003300766c616e3100"/56], 0x38}, 0x1, 0x1000000, 0x0, 0x800}, 0x20000000) (async) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) (async) openat$autofs(0xffffff9c, &(0x7f0000000100), 0x200000, 0x0) (async, rerun: 64) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb010018000000000000000000000000000000020000000000"], 0x0, 0x1a, 0x0, 0x1, 0x8000}, 0x28) (async, rerun: 64) stat(&(0x7f00000005c0)='./file0\x00', &(0x7f00000006c0)) r5 = openat$vimc0(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r5, 0x4020565a, 0x0) (async) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x53c, 0x2e4, 0x0, 0x140, 0x140, 0x0, 0x474, 0x474, 0x474, 0x474, 0x474, 0x6, 0x0, {[{{@ipv6={@local, @private1, [], [], 'pimreg0\x00', 'macvtap0\x00', {}, {}, 0x21, 0x0, 0x1}, 0x0, 0x11c, 0x140, 0x0, {0x7a00000010000000}, [@common=@unspec=@cluster={{0x30}, {0x4, 0xb, 0x5}}, @common=@unspec=@ipvs={{0x48}, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0xffffff00, 0x0, 0xffffffff, 0xff000000], 0x4e20, 0x2f, 0x6, 0x4e22, 0x0, 0x20}}]}, @unspec=@CHECKSUM={0x24}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0xff}, [], [], 'veth1_macvtap\x00', 'veth1_vlan\x00', {}, {}, 0x2b}, 0x0, 0xa4, 0xd8}, @common=@inet=@SET3={0x34, 'SET\x00', 0x3, {{}, {}, {0x2}, 0x800001}}}, {{@uncond, 0x0, 0xa4, 0xcc, 0x48000000}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x8fd, 0x5}}}, {{@uncond, 0x0, 0xa4, 0xc8}, @unspec=@CHECKSUM={0x24}}, {{@uncond, 0x0, 0xa4, 0xc8}, @HL={0x24}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x598) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040050}, 0x24000080) 203.041715ms ago: executing program 1 (id=1101): bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020000000000000", @ANYBLOB="00562653ef2b152c7200"/19, @ANYRES32=0x0, @ANYRES32], 0x48) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f000000"], 0x0, 0x35}, 0x28) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x1a, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180005000000ffff000077b9080000009500000000d3a07e"], &(0x7f0000000080)='GPL\x00', 0x7, 0x4fa, &(0x7f0000000cc0)=""/4096, 0x40f00, 0x5, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x0, 0x2, 0x4, 0x9}, 0x1, 0x0, 0x0, 0xff3e, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 158.861973ms ago: executing program 1 (id=1102): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000100)={0x18, 0x56, 0x601, 0x0, 0x0, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1, 0x0, 0x0, 0xea}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) 152.148281ms ago: executing program 1 (id=1103): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f0000000440)={0x7, "7973f975ca5ecc1d777a549fafbb3da4831e965cf75899b0cd90cf03718bfe6f6db40416cf1fddd007467801e8a50e168c03aeb6caf9df7127d6058129a1ffb4ec06d0c02c9d634dd7366c734f0c7e3879f045654179107f4964337161fa4b9684fcd97c11776e1f449cf6fa9f76759321b35358b04b2eeb8119377031316967654225e86434ad647c93b695454b4bf8397dbe599ba9436e19c8aadfde4d0efe6b495ef51384ca23f348460e212c03344a6cba95494979176ed8069cff9f378dfe67d6f4850bb410b0b7fb0086945236ac49c82306a29d02c050456ec67093c9926b057518369c219c6db1e635d964a11a2697e31e7d7d0ac76fac9359dbca5466f3a9a72e9427ecf17db990477f47c2abeb2a3bfa44255bc6c8d1cc1593b22f8ebd1483ff3484d1c20a21d99dca1c5f70a08d47302ff98b0683ea45cb6d7f895e15fafb9d59284b2c620986e3da897b9de103c804a0b701f0a51000102e6be7bded286ac1f5aca8860976550b639fa41c6a85fb730cb09118c1f796ff40a6b32e1aadf2cca68d114f0f48b211fe9fcdda464229c19a178ce5bcde90095b59b58adcceb0b82f32d87a5b1cac8ad4ceb270e7059eea5c71ceb818cb3ea32947951c254b6b91b7bbea07013f88c144b9d4e30402d58db9eb230757070780d5bfdae5e2f6cf91775f997cf91022a14651f520a2ac287870cb408bdc768aa97a8eb2"}) ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f0000000080)=""/176) r1 = openat$ttynull(0xffffff9c, &(0x7f0000000000), 0x20000, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x1a8) r4 = fanotify_init(0xf00, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="12000000010000000400000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000200000b7082008000000007b8af8ff00000000a6a200000000000007020000e8ffff16b803000008000000b70400000000001b850000000300000095c4dc8a4b04ad5e0de0dfa86b3915b2951876934b528344c204b57a70166216ad1912c5c840640461d0b44c73188e36338327c509560720b1c021409fc7c25c568b73cd2429b2da6ac618e4b86c6225aef0f7658aa3f535aa74c90f88323b858c986d543f06b091d434ccca62f1de772bb8cf7a369da14ab42021099e95beec359239bee77a7a882535b0a4264a93a90a"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) setsockopt$packet_int(r6, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newchain={0x24, 0x64, 0x1, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfff1, 0x7}, {0xffe0, 0xc}, {0xfff2, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x20044801}, 0x20040000) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000000)=0x1) ioctl$TCSETS(r8, 0x89f0, &(0x7f0000000480)={0x2, 0x400ef, 0x6, 0xfffffff9, 0x6, "3e0a7a08100af7717fc5bc71f6092c9e7b27ab"}) fanotify_mark(r4, 0x44d, 0x8000000, r3, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000140)) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000040)={0x8, 0x1, 0x10001, 0x7, 0x19, "40c867e41fecedb718226b62b6e9f84baf9f1f"}) 54.508854ms ago: executing program 2 (id=1104): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x1f00, {0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x3}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x23}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8}]}}}]}], {0x14, 0x10}}, 0xa4}}, 0x4) 54.3279ms ago: executing program 2 (id=1105): r0 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101401, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000140)={'aio_iiro_16\x00', [0x7, 0x8, 0x3, 0x4, 0x2f, 0x2006, 0xf1, 0x27b1, 0x80ffa, 0xfffe, 0x0, 0x5, 0x40, 0x1000004, 0x1, 0x10000, 0x6, 0x1002f, 0x1ef, 0x1, 0x20000010, 0xfffffe00, 0x9, 0x4008, 0x746f, 0x8, 0x6, 0x4, 0xee, 0x4, 0x7ffd]}) 189.626µs ago: executing program 2 (id=1106): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="4800fc000d0a010800000000000000000a0000010900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100e47c00000800034000000001"], 0x48}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 0s ago: executing program 2 (id=1107): r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) recvmmsg(r1, &(0x7f0000001680)=[{{0x0, 0x0, 0x0}, 0xd0}], 0x1, 0x12023, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x2, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r2, 0xc03864bc, &(0x7f0000000380)={0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, 0x0) kernel console output (not intermixed with test programs): UM) 10*1024kB (UME) 4*2048kB (M) 25*4096kB (UM) = 153276kB [ 86.202403][ T6150] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 86.205672][ T6150] Node 0 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 86.208607][ T6150] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 86.211509][ T6150] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 86.214952][ T6150] 55247 total pagecache pages [ 86.216442][ T6150] 262 pages in swap cache [ 86.217822][ T6150] Free swap = 120660kB [ 86.219124][ T6150] Total swap = 124996kB [ 86.220437][ T6150] 524155 pages RAM [ 86.221606][ T6150] 0 pages HighMem/MovableOnly [ 86.223059][ T6150] 211524 pages reserved [ 86.224615][ T6150] 0 pages cma reserved [ 86.599017][ T6162] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 86.731467][ T846] usb 44-1: device descriptor read/8, error -110 [ 87.082381][ T61] usb 40-1: device descriptor read/8, error -110 [ 87.401567][ T846] usb usb44-port1: attempt power cycle [ 87.414101][ T6150] netlink: 8 bytes leftover after parsing attributes in process `syz.3.57'. [ 87.474659][ T6151] mmap: syz.3.57 (6151) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 87.474818][ T61] usb usb40-port1: attempt power cycle [ 88.703649][ T6181] netlink: 4 bytes leftover after parsing attributes in process `syz.1.66'. [ 88.786696][ T6179] netlink: 'syz.3.65': attribute type 2 has an invalid length. [ 88.789062][ T6179] netlink: 4 bytes leftover after parsing attributes in process `syz.3.65'. [ 88.848223][ T6183] process 'syz.3.65' launched './file2' with NULL argv: empty string added [ 88.928543][ T6185] sctp: [Deprecated]: syz.2.75 (pid 6185) Use of int in max_burst socket option. [ 88.928543][ T6185] Use struct sctp_assoc_value instead [ 89.077628][ T61] usb usb40-port1: unable to enumerate USB device [ 89.079958][ T846] usb usb44-port1: unable to enumerate USB device [ 89.511893][ T6200] random: crng reseeded on system resumption [ 89.933008][ T6208] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 90.554338][ T6214] netlink: 36 bytes leftover after parsing attributes in process `syz.1.76'. [ 90.618596][ T846] IPVS: starting estimator thread 0... [ 90.735714][ T6217] IPVS: using max 44 ests per chain, 105600 per kthread [ 90.782517][ T6222] capability: warning: `syz.0.79' uses 32-bit capabilities (legacy support in use) [ 90.932443][ T6223] netlink: 'syz.3.80': attribute type 2 has an invalid length. [ 90.934874][ T6223] netlink: 4 bytes leftover after parsing attributes in process `syz.3.80'. [ 91.792142][ T42] audit: type=1326 audit(1785139461.018:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6232 comm="syz.2.82" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf703efec code=0x0 [ 91.873616][ T6236] hfs: can't find a HFS filesystem on dev sr0 [ 93.203936][ T5854] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.363832][ T5854] usb 5-1: Using ep0 maxpacket: 16 [ 93.370986][ T5854] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 93.378741][ T5854] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 93.384096][ T5854] usb 5-1: Product: syz [ 93.385451][ T5854] usb 5-1: Manufacturer: syz [ 93.391049][ T5854] usb 5-1: SerialNumber: syz [ 93.396289][ T5854] usb 5-1: config 0 descriptor?? [ 93.527065][ T6280] tipc: Started in network mode [ 93.529197][ T6280] tipc: Node identity ac14140f, cluster identity 4711 [ 93.538584][ T6280] tipc: New replicast peer: 172.30.0.4 [ 93.546402][ T6280] tipc: Enabled bearer , priority 10 [ 93.634650][ T61] usb 5-1: USB disconnect, device number 2 [ 94.657650][ T9] tipc: Node number set to 2886997007 [ 94.694268][ T34] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 94.714706][ T42] audit: type=1326 audit(1785139463.948:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6306 comm="syz.2.103" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf703efec code=0x0 [ 94.875143][ T34] usb 8-1: config index 0 descriptor too short (expected 39, got 27) [ 94.880769][ T34] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 94.886648][ T34] usb 8-1: config 0 interface 0 has no altsetting 0 [ 94.890460][ T34] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 94.893367][ T34] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 94.896612][ T34] usb 8-1: Product: syz [ 94.898433][ T34] usb 8-1: Manufacturer: syz [ 94.900248][ T34] usb 8-1: SerialNumber: syz [ 94.905740][ T34] usb 8-1: config 0 descriptor?? [ 94.909133][ T34] hub 8-1:0.0: bad descriptor, ignoring hub [ 94.911422][ T34] hub 8-1:0.0: probe with driver hub failed with error -5 [ 94.917641][ T34] usb 8-1: selecting invalid altsetting 0 [ 95.179056][ T6324] tipc: Started in network mode [ 95.180679][ T6324] tipc: Node identity ac14140f, cluster identity 4711 [ 95.183532][ T6324] tipc: New replicast peer: 172.30.0.2 [ 95.186944][ T6324] tipc: Enabled bearer , priority 10 [ 95.534958][ T6301] usb 8-1: reset high-speed USB device number 2 using dummy_hcd [ 95.683942][ T6301] usb 8-1: device descriptor read/64, error -71 [ 95.926569][ T6301] usb 8-1: reset high-speed USB device number 2 using dummy_hcd [ 96.074199][ T6301] usb 8-1: device descriptor read/64, error -71 [ 96.194129][ T9] tipc: Node number set to 2886997007 [ 96.333911][ T6301] usb 8-1: reset high-speed USB device number 2 using dummy_hcd [ 96.354496][ T6301] usb 8-1: device descriptor read/8, error -71 [ 96.403824][ T1355] usb 6-1: new low-speed USB device number 2 using dummy_hcd [ 96.534840][ T1355] usb 6-1: device descriptor read/64, error -71 [ 96.593884][ T6301] usb 8-1: reset high-speed USB device number 2 using dummy_hcd [ 96.614837][ T6301] usb 8-1: device descriptor read/8, error -71 [ 96.674030][ T6373] netlink: 12 bytes leftover after parsing attributes in process `syz.0.121'. [ 96.678141][ T6373] bridge_slave_0: default FDB implementation only supports local addresses [ 96.686220][ T6373] netlink: 12 bytes leftover after parsing attributes in process `syz.0.121'. [ 96.689972][ T6373] bridge_slave_0: default FDB implementation only supports local addresses [ 96.736381][ T34] usb 8-1: USB disconnect, device number 2 [ 96.783818][ T1355] usb 6-1: new low-speed USB device number 3 using dummy_hcd [ 96.793221][ T6376] tipc: Started in network mode [ 96.795866][ T6376] tipc: Node identity ac14140f, cluster identity 4711 [ 96.804865][ T6376] tipc: New replicast peer: 172.30.0.1 [ 96.813264][ T6376] tipc: Enabled bearer , priority 10 [ 96.893804][ T34] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 96.913780][ T1355] usb 6-1: device descriptor read/64, error -71 [ 97.024303][ T34] usb 8-1: device descriptor read/64, error -71 [ 97.027097][ T1355] usb usb6-port1: attempt power cycle [ 97.263879][ T34] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 97.373813][ T1355] usb 6-1: new low-speed USB device number 4 using dummy_hcd [ 97.394500][ T1355] usb 6-1: device descriptor read/8, error -71 [ 97.413956][ T34] usb 8-1: device descriptor read/64, error -71 [ 97.534351][ T34] usb usb8-port1: attempt power cycle [ 97.563379][ T6390] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 97.633870][ T1355] usb 6-1: new low-speed USB device number 5 using dummy_hcd [ 97.666260][ T1355] usb 6-1: device descriptor read/8, error -71 [ 97.741657][ T6407] netlink: 4 bytes leftover after parsing attributes in process `syz.3.135'. [ 97.745531][ T6407] netlink: 4 bytes leftover after parsing attributes in process `syz.3.135'. [ 97.751040][ T6407] netlink: 4 bytes leftover after parsing attributes in process `syz.3.135'. [ 97.784931][ T1355] usb usb6-port1: unable to enumerate USB device [ 97.801503][ T6413] openvswitch: netlink: Actions may not be safe on all matching packets [ 97.934248][ T9] tipc: Node number set to 2886997007 [ 97.938771][ T6420] netlink: 'syz.3.138': attribute type 3 has an invalid length. [ 97.943458][ T6420] netlink: 'syz.3.138': attribute type 3 has an invalid length. [ 97.950508][ T6420] netlink: 'syz.3.138': attribute type 3 has an invalid length. [ 97.953096][ T6420] netlink: 'syz.3.138': attribute type 3 has an invalid length. [ 97.958147][ T6420] netlink: 'syz.3.138': attribute type 3 has an invalid length. [ 97.961040][ T6420] netlink: 'syz.3.138': attribute type 3 has an invalid length. [ 97.963529][ T6420] netlink: 'syz.3.138': attribute type 3 has an invalid length. [ 97.966957][ T6420] netlink: 'syz.3.138': attribute type 3 has an invalid length. [ 97.969496][ T6420] netlink: 'syz.3.138': attribute type 3 has an invalid length. [ 97.971985][ T6420] netlink: 'syz.3.138': attribute type 3 has an invalid length. [ 97.983107][ T6420] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.138'. [ 97.986270][ T6420] openvswitch: netlink: Message has 512 unknown bytes. [ 98.743489][ T6430] netlink: 464 bytes leftover after parsing attributes in process `syz.3.142'. [ 98.747632][ T6430] netlink: 464 bytes leftover after parsing attributes in process `syz.3.142'. [ 98.998713][ T6458] netlink: 8 bytes leftover after parsing attributes in process `syz.2.150'. [ 99.008018][ T6458] : entered promiscuous mode [ 99.048571][ T6462] netlink: 24 bytes leftover after parsing attributes in process `syz.2.151'. [ 99.171699][ T6470] FAULT_INJECTION: forcing a failure. [ 99.171699][ T6470] name failslab, interval 1, probability 0, space 0, times 1 [ 99.175948][ T6470] CPU: 3 UID: 0 PID: 6470 Comm: syz.0.154 Not tainted syzkaller #0 PREEMPT(full) [ 99.175963][ T6470] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 99.175969][ T6470] Call Trace: [ 99.175973][ T6470] [ 99.175977][ T6470] dump_stack_lvl+0x100/0x190 [ 99.175994][ T6470] should_fail_ex.cold+0x5/0xa [ 99.176006][ T6470] should_failslab+0xc2/0x120 [ 99.176021][ T6470] kmem_cache_alloc_noprof+0x91/0x6a0 [ 99.176044][ T6470] ? __alloc_skb+0x4e9/0x710 [ 99.176057][ T6470] ? __alloc_skb+0x5b7/0x710 [ 99.176070][ T6470] ? sctp_chunkify+0x51/0x2f0 [ 99.176085][ T6470] sctp_chunkify+0x51/0x2f0 [ 99.176098][ T6470] _sctp_make_chunk+0x148/0x270 [ 99.176112][ T6470] sctp_make_control+0x2f/0x2d0 [ 99.176125][ T6470] sctp_make_strreset_resp+0x94/0x160 [ 99.176144][ T6470] ? __pfx_sctp_make_strreset_resp+0x10/0x10 [ 99.176164][ T6470] ? skb_set_owner_w+0x37d/0x780 [ 99.176178][ T6470] sctp_process_strreset_addstrm_in+0x33f/0x7f0 [ 99.176194][ T6470] ? __pfx_sctp_process_strreset_addstrm_in+0x10/0x10 [ 99.176211][ T6470] ? sctp_verify_reconf+0x23b/0x4b0 [ 99.176229][ T6470] sctp_sf_do_reconf+0x8bf/0xb20 [ 99.176246][ T6470] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 99.176262][ T6470] ? __pfx_sctp_sf_do_reconf+0x10/0x10 [ 99.176279][ T6470] ? __pfx_sctp_sm_lookup_event+0x10/0x10 [ 99.176295][ T6470] ? __pfx_sctp_cname+0x10/0x10 [ 99.176308][ T6470] sctp_do_sm+0x17a/0x5be0 [ 99.176320][ T6470] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 99.176334][ T6470] ? sctp_send_add_streams+0x27e/0x540 [ 99.176348][ T6470] ? __pfx_sctp_outq_flush+0x10/0x10 [ 99.176360][ T6470] ? __pfx_sctp_do_sm+0x10/0x10 [ 99.176372][ T6470] ? sctp_outq_tail+0x68c/0xa90 [ 99.176397][ T6470] ? ktime_get+0x22c/0x320 [ 99.176412][ T6470] ? lockdep_hardirqs_on+0x78/0x100 [ 99.176427][ T6470] sctp_assoc_bh_rcv+0x392/0x6f0 [ 99.176447][ T6470] sctp_inq_push+0x1db/0x280 [ 99.176458][ T6470] sctp_backlog_rcv+0x169/0x590 [ 99.176471][ T6470] ? __pfx_sctp_backlog_rcv+0x10/0x10 [ 99.176483][ T6470] __release_sock+0x3a2/0x440 [ 99.176501][ T6470] release_sock+0x1e5/0x280 [ 99.176515][ T6470] sctp_setsockopt+0x956/0xb370 [ 99.176527][ T6470] ? __pfx_aa_sk_perm+0x10/0x10 [ 99.176543][ T6470] ? __pfx_sctp_setsockopt+0x10/0x10 [ 99.176555][ T6470] ? aa_sock_opt_perm+0xfe/0x1b0 [ 99.176565][ T6470] ? sock_common_setsockopt+0x2e/0xf0 [ 99.176581][ T6470] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 99.176600][ T6470] do_sock_setsockopt+0xf3/0x1d0 [ 99.176617][ T6470] __sys_setsockopt+0x119/0x190 [ 99.176634][ T6470] __ia32_sys_setsockopt+0xbc/0x160 [ 99.176647][ T6470] ? __do_fast_syscall_32+0x98/0x970 [ 99.176661][ T6470] ? lockdep_hardirqs_on+0x78/0x100 [ 99.176673][ T6470] __do_fast_syscall_32+0xe7/0x970 [ 99.176686][ T6470] ? lockdep_hardirqs_on+0x78/0x100 [ 99.176699][ T6470] do_fast_syscall_32+0x32/0x70 [ 99.176712][ T6470] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 99.176726][ T6470] RIP: 0023:0xf6fdefec [ 99.176738][ T6470] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 99.176743][ T6470] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 99.176753][ T6470] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000084 [ 99.176759][ T6470] RDX: 0000000000000079 RSI: 0000000080000180 RDI: 0000000000000008 [ 99.176765][ T6470] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 99.176771][ T6470] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 99.176776][ T6470] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 99.176789][ T6470] [ 99.773798][ T34] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 99.844746][ T9] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 99.946995][ T34] usb 5-1: config 150 has an invalid interface number: 204 but max is 2 [ 99.949755][ T34] usb 5-1: config 150 has 2 interfaces, different from the descriptor's value: 3 [ 99.952722][ T34] usb 5-1: config 150 has no interface number 0 [ 99.955435][ T34] usb 5-1: config 150 interface 204 has no altsetting 0 [ 99.957680][ T34] usb 5-1: config 150 interface 1 has no altsetting 0 [ 99.961775][ T34] usb 5-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 99.966164][ T34] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.968764][ T34] usb 5-1: Product: syz [ 99.970156][ T34] usb 5-1: Manufacturer: syz [ 99.971620][ T34] usb 5-1: SerialNumber: syz [ 99.972096][ T6501] syzkaller0: entered promiscuous mode [ 99.975289][ T6501] syzkaller0: entered allmulticast mode [ 99.993793][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 100.187234][ T34] xr_serial 5-1:150.204: skipping garbage [ 100.189221][ T34] xr_serial 5-1:150.204: xr_serial converter detected [ 100.505106][ T5838] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 100.613618][ T9] usb 6-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 100.677240][ T5838] usb 7-1: config index 0 descriptor too short (expected 45, got 36) [ 100.679857][ T5838] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 100.683539][ T5838] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 100.687647][ T5838] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 100.691880][ T5838] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 100.695197][ T5838] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.702124][ T5838] usb 7-1: config 0 descriptor?? qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xa8000) [ 100.764541][ T1131] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 100.766782][ T1131] ata1: failed to read log page 10h (errno=-5) [ 100.768898][ T1131] ata1.00: exception Emask 0x1 SAct 0xc000 SErr 0x0 action 0x0 [ 100.771634][ T1131] ata1.00: irq_stat 0x41000000 [ 100.773650][ T1131] ata1.00: failed command: READ FPDMA QUEUED [ 100.775824][ T1131] ata1.00: cmd 60/40:70:ee:32:01/05:00:00:00:00/40 tag 14 ncq dma 688128 in [ 100.775824][ T1131] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 100.781448][ T1131] ata1.00: status: { DRDY } [ 100.783230][ T1131] ata1.00: error: { ABRT } [ 100.784896][ T1131] ata1.00: failed command: READ FPDMA QUEUED [ 100.787066][ T1131] ata1.00: cmd 60/40:78:2e:38:01/03:00:00:00:00/40 tag 15 ncq dma 425984 in [ 100.787066][ T1131] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 100.792765][ T1131] ata1.00: status: { DRDY } [ 100.794731][ T1131] ata1.00: error: { ABRT } [ 100.797353][ T1131] ata1.00: configured for UDMA/100 [ 100.799586][ T1131] sd 0:0:0:0: [sda] tag#14 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [ 100.802940][ T1131] sd 0:0:0:0: [sda] tag#14 Sense Key : Aborted Command [current] [ 100.805808][ T1131] sd 0:0:0:0: [sda] tag#14 Add. Sense: No additional sense information [ 100.808651][ T1131] sd 0:0:0:0: [sda] tag#14 CDB: Read(10) 28 00 00 01 32 ee 00 05 40 00 [ 100.811268][ T1131] blk_print_req_error: 7 callbacks suppressed [ 100.811279][ T1131] I/O error, dev sda, sector 78574 op 0x0:(READ) flags 0x84700 phys_seg 168 prio class 2 [ 100.817120][ T1131] sd 0:0:0:0: [sda] tag#15 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [ 100.820393][ T1131] sd 0:0:0:0: [sda] tag#15 Sense Key : Aborted Command [current] [ 100.822943][ T1131] sd 0:0:0:0: [sda] tag#15 Add. Sense: No additional sense information [ 100.825817][ T1131] sd 0:0:0:0: [sda] tag#15 CDB: Read(10) 28 00 00 01 38 2e 00 03 40 00 [ 100.828827][ T1131] I/O error, dev sda, sector 79918 op 0x0:(READ) flags 0x80700 phys_seg 104 prio class 2 [ 100.832183][ T1131] ata1: EH complete [ 100.938821][ T6504] ALSA: mixer_oss: invalid OSS volume 'PHl6qӆONEOUT' [ 100.941857][ T6504] ALSA: mixer_oss: invalid index 137438 [ 100.946772][ T5838] usbhid 7-1:0.0: can't add hid device: -71 [ 100.948735][ T5838] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 100.955253][ T5838] usb 7-1: USB disconnect, device number 3 [ 101.211001][ T9] usb 6-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 101.367186][ T9] usb 6-1: Product: syz [ 101.374196][ T9] usb 6-1: Manufacturer: syz [ 101.375608][ T9] usb 6-1: SerialNumber: syz [ 101.381940][ T9] usb 6-1: config 0 descriptor?? [ 101.589629][ T1355] usb 6-1: USB disconnect, device number 6 [ 101.745738][ T6511] FAULT_INJECTION: forcing a failure. [ 101.745738][ T6511] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 101.749557][ T6511] CPU: 3 UID: 0 PID: 6511 Comm: syz.2.168 Not tainted syzkaller #0 PREEMPT(full) [ 101.749570][ T6511] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.749577][ T6511] Call Trace: [ 101.749581][ T6511] [ 101.749585][ T6511] dump_stack_lvl+0x100/0x190 [ 101.749600][ T6511] should_fail_ex.cold+0x5/0xa [ 101.749613][ T6511] _copy_to_user+0x32/0xd0 [ 101.749630][ T6511] put_old_timespec32+0xb4/0x120 [ 101.749646][ T6511] ? __pfx_put_old_timespec32+0x10/0x10 [ 101.749676][ T6511] __ia32_sys_sched_rr_get_interval_time32+0xf0/0x170 [ 101.749695][ T6511] ? __pfx___ia32_sys_sched_rr_get_interval_time32+0x10/0x10 [ 101.749712][ T6511] ? __secure_computing+0x1e4/0x2c0 [ 101.749725][ T6511] __do_fast_syscall_32+0xe7/0x970 [ 101.749739][ T6511] ? lockdep_hardirqs_on+0x78/0x100 [ 101.749753][ T6511] do_fast_syscall_32+0x32/0x70 [ 101.749767][ T6511] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 101.749780][ T6511] RIP: 0023:0xf703efec [ 101.749792][ T6511] Code: Unable to access opcode bytes at 0xf703efc2. [ 101.749797][ T6511] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 00000000000000a1 [ 101.749807][ T6511] RAX: ffffffffffffffda RBX: 00000000000000a3 RCX: 0000000080000640 [ 101.749813][ T6511] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 101.749819][ T6511] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 101.749825][ T6511] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 101.749830][ T6511] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 101.749843][ T6511] [ 102.273890][ T9] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 102.383791][ T5746] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 102.422896][ T34] xr_serial ttyUSB0: Failed to set reg 0x0e: -71 [ 102.439813][ T9] usb 7-1: config index 0 descriptor too short (expected 39, got 27) [ 102.446959][ T9] usb 7-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 102.454454][ T9] usb 7-1: config 0 interface 0 has no altsetting 0 [ 102.459702][ T9] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 102.464398][ T9] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 102.473824][ T9] usb 7-1: Product: syz [ 102.475134][ T9] usb 7-1: Manufacturer: syz [ 102.476607][ T9] usb 7-1: SerialNumber: syz [ 102.480338][ T9] usb 7-1: config 0 descriptor?? [ 102.486447][ T9] hub 7-1:0.0: bad descriptor, ignoring hub [ 102.488536][ T9] hub 7-1:0.0: probe with driver hub failed with error -5 [ 102.551934][ T9] usb 7-1: selecting invalid altsetting 0 [ 102.555287][ T5746] usb 6-1: not running at top speed; connect to a high speed hub [ 102.560486][ T5746] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 102.566541][ T5746] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 102.574330][ T5746] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.587055][ T5746] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 102.601059][ T5746] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB1 [ 102.677710][ T6529] raw_sendmsg: syz.0.176 forgot to set AF_INET. Fix it! [ 102.682419][ T6529] sctp: [Deprecated]: syz.0.176 (pid 6529) Use of int in max_burst socket option deprecated. [ 102.682419][ T6529] Use struct sctp_assoc_value instead [ 102.700853][ T34] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 102.847698][ T34] usb 5-1: USB disconnect, device number 3 [ 102.851008][ T34] xr_serial 5-1:150.204: device disconnected [ 102.853510][ T846] usb 7-1: USB disconnect, device number 4 [ 102.870260][ T5530] usb 6-1: USB disconnect, device number 7 [ 102.898111][ T5530] garmin_gps ttyUSB1: Garmin GPS usb/tty converter now disconnected from ttyUSB1 [ 102.905078][ T5530] garmin_gps 6-1:1.0: device disconnected [ 103.126109][ T6539] VFS: file-max limit 0 reached [ 103.225317][ T6549] FAULT_INJECTION: forcing a failure. [ 103.225317][ T6549] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 103.229179][ T6549] CPU: 0 UID: 0 PID: 6549 Comm: syz.3.182 Not tainted syzkaller #0 PREEMPT(full) [ 103.229193][ T6549] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.229202][ T6549] Call Trace: [ 103.229206][ T6549] [ 103.229210][ T6549] dump_stack_lvl+0x100/0x190 [ 103.229225][ T6549] should_fail_ex.cold+0x5/0xa [ 103.229238][ T6549] _copy_to_iter+0x5a4/0x1720 [ 103.229257][ T6549] ? __pfx__copy_to_iter+0x10/0x10 [ 103.229274][ T6549] ? rcu_is_watching+0x12/0xc0 [ 103.229286][ T6549] ? __up_read+0x333/0x980 [ 103.229300][ T6549] copy_page_to_iter+0x285/0x370 [ 103.229317][ T6549] process_vm_rw_core.constprop.0+0x5a3/0x950 [ 103.229337][ T6549] ? __pfx_process_vm_rw_core.constprop.0+0x10/0x10 [ 103.229350][ T6549] ? rcu_is_watching+0x12/0xc0 [ 103.229362][ T6549] ? trace_kmalloc+0xeb/0x110 [ 103.229383][ T6549] ? iovec_from_user+0xda/0x140 [ 103.229400][ T6549] process_vm_rw+0x226/0x2d0 [ 103.229414][ T6549] ? __pfx_process_vm_rw+0x10/0x10 [ 103.229426][ T6549] ? find_held_lock+0x2b/0x80 [ 103.229442][ T6549] ? rcu_read_lock_any_held+0x6a/0xa0 [ 103.229467][ T6549] ? fput+0x79/0x100 [ 103.229480][ T6549] ? ksys_write+0x1ac/0x250 [ 103.229490][ T6549] __ia32_sys_process_vm_readv+0xdf/0x1b0 [ 103.229504][ T6549] ? __do_fast_syscall_32+0x98/0x970 [ 103.229518][ T6549] ? lockdep_hardirqs_on+0x78/0x100 [ 103.229530][ T6549] __do_fast_syscall_32+0xe7/0x970 [ 103.229543][ T6549] ? lockdep_hardirqs_on+0x78/0x100 [ 103.229556][ T6549] do_fast_syscall_32+0x32/0x70 [ 103.229570][ T6549] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 103.229583][ T6549] RIP: 0023:0xf7f07fec [ 103.229596][ T6549] Code: Unable to access opcode bytes at 0xf7f07fc2. [ 103.229600][ T6549] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 000000000000015b [ 103.229610][ T6549] RAX: ffffffffffffffda RBX: 000000000000008c RCX: 0000000080008400 [ 103.229617][ T6549] RDX: 0000000000000002 RSI: 0000000080008640 RDI: 0000000000000286 [ 103.229623][ T6549] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 103.229628][ T6549] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 103.229634][ T6549] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 103.229647][ T6549] [ 103.416000][ T846] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 103.597407][ T846] usb 7-1: Using ep0 maxpacket: 8 [ 103.621372][ T846] usb 7-1: unable to get BOS descriptor or descriptor too short [ 103.631877][ T846] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 103.640549][ T846] usb 7-1: can't read configurations, error -71 [ 104.666993][ T6561] bridge_slave_0: left allmulticast mode [ 104.668913][ T6561] bridge_slave_0: left promiscuous mode [ 104.671438][ T6561] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.682895][ T6561] bridge_slave_1: left allmulticast mode [ 104.685275][ T6561] bridge_slave_1: left promiscuous mode [ 104.686974][ T6561] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.694893][ T6561] bond0: (slave bond_slave_0): Releasing backup interface [ 104.697094][ T6567] ICMPv6: NA: fd:f9:a6:84:a5:1b advertised our address fe80::aa on syz_tun! [ 104.704762][ T6561] bond0: (slave bond_slave_1): Releasing backup interface [ 104.716002][ T6561] team0: Port device team_slave_0 removed [ 104.720935][ T6561] team0: Port device team_slave_1 removed [ 104.723075][ T6561] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 104.726745][ T6561] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 104.732276][ T6561] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 104.735311][ T6561] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 104.738640][ T6561] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 104.758308][ T6575] syzkaller0: entered promiscuous mode [ 104.760741][ T6575] syzkaller0: entered allmulticast mode [ 104.810457][ T5854] libceph: connect (1)[c::]:6789 error -101 [ 104.814376][ T5854] libceph: mon0 (1)[c::]:6789 connect error [ 104.850032][ T6577] ceph: No mds server is up or the cluster is laggy [ 104.948801][ T6583] validate_nla: 45 callbacks suppressed [ 104.948812][ T6583] netlink: 'syz.1.194': attribute type 1 has an invalid length. [ 104.966042][ T6583] 8021q: adding VLAN 0 to HW filter on device bond1 [ 104.999806][ T6583] __nla_validate_parse: 3 callbacks suppressed [ 104.999817][ T6583] netlink: 28 bytes leftover after parsing attributes in process `syz.1.194'. [ 105.007034][ T6583] bond1: entered promiscuous mode [ 105.008625][ T6583] bond1: entered allmulticast mode [ 105.027211][ T6583] bond1: (slave dummy0): making interface the new active one [ 105.029531][ T6583] dummy0: entered promiscuous mode [ 105.031289][ T6583] dummy0: entered allmulticast mode [ 105.033476][ T6583] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 105.114708][ T6596] netlink: 24 bytes leftover after parsing attributes in process `syz.1.199'. [ 105.120300][ T6596] netlink: 8 bytes leftover after parsing attributes in process `syz.1.199'. [ 105.124901][ T6596] netlink: 8 bytes leftover after parsing attributes in process `syz.1.199'. [ 105.431423][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.434750][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.536789][ T6613] syzkaller0: entered promiscuous mode [ 105.538534][ T6613] syzkaller0: entered allmulticast mode [ 105.691954][ T6616] netlink: 72 bytes leftover after parsing attributes in process `syz.3.205'. [ 105.757142][ T5530] libceph: connect (1)[c::]:6789 error -101 [ 105.759362][ T5530] libceph: mon0 (1)[c::]:6789 connect error [ 105.803810][ T6622] ceph: No mds server is up or the cluster is laggy [ 105.883946][ T9] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 106.084686][ T6631] netlink: 'syz.3.209': attribute type 1 has an invalid length. [ 106.103673][ T6631] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.127584][ T6631] netlink: 28 bytes leftover after parsing attributes in process `syz.3.209'. [ 106.136114][ T6618] dvmrp0: entered allmulticast mode [ 106.147081][ T6631] bond0: entered promiscuous mode [ 106.148608][ T6631] bond0: entered allmulticast mode [ 106.159477][ T6631] bond0: (slave dummy0): making interface the new active one [ 106.161755][ T6631] dummy0: entered promiscuous mode [ 106.163410][ T6631] dummy0: entered allmulticast mode [ 106.165950][ T6631] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 106.173238][ T6618] netlink: 'syz.0.213': attribute type 10 has an invalid length. [ 106.361349][ T6640] VFS: file-max limit 0 reached [ 106.470323][ T42] audit: type=1326 audit(1785139475.698:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6655 comm="syz.3.220" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f07fec code=0x0 [ 107.048874][ T6670] Invalid logical block size (1056964608) [ 107.384031][ T61] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 107.491414][ T6680] netlink: 'syz.2.228': attribute type 2 has an invalid length. [ 107.493907][ T6680] netlink: 4 bytes leftover after parsing attributes in process `syz.2.228'. [ 107.565253][ T61] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 107.568004][ T61] usb 6-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 107.571124][ T61] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 107.573979][ T61] usb 6-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 107.574624][ T5831] usb 8-1: new full-speed USB device number 6 using dummy_hcd [ 107.577398][ T61] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 107.583614][ T61] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 107.591066][ T61] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 107.594620][ T61] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 107.597359][ T61] usb 6-1: Product: syz [ 107.598764][ T61] usb 6-1: Manufacturer: syz [ 107.601876][ T6674] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 107.605247][ T61] cdc_wdm 6-1:1.0: skipping garbage [ 107.607132][ T61] cdc_wdm 6-1:1.0: skipping garbage [ 107.613173][ T61] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 107.615312][ T61] cdc_wdm 6-1:1.0: Unknown control protocol [ 107.745095][ T5831] usb 8-1: not running at top speed; connect to a high speed hub [ 107.757168][ T5831] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 107.763993][ T5831] usb 8-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 107.767994][ T5831] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.799817][ T5831] garmin_gps 8-1:1.0: Garmin GPS usb/tty converter detected [ 107.810498][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 107.812672][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 107.815667][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 107.817644][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 107.819972][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 107.821937][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 107.824534][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 107.826443][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 107.828437][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 107.830360][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 107.832754][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 107.834742][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 107.834826][ T61] usb 6-1: USB disconnect, device number 8 [ 107.836548][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 107.849916][ T5831] usb 8-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 108.349915][ T5530] usb 8-1: USB disconnect, device number 6 [ 108.360215][ T5530] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 108.363608][ T5530] garmin_gps 8-1:1.0: device disconnected [ 108.710934][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 108.719028][ T9] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 108.721466][ T9] usb 5-1: can't read configurations, error -71 [ 108.785554][ T6692] 9p: Bad value for 'rfdno' [ 109.654489][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.656923][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.425601][ T6738] ======================================================= [ 110.425601][ T6738] WARNING: The mand mount option has been deprecated and [ 110.425601][ T6738] and is ignored by this kernel. Remove the mand [ 110.425601][ T6738] option from the mount to silence this warning. [ 110.425601][ T6738] ======================================================= [ 110.641263][ T6744] syzkaller0: entered promiscuous mode [ 110.643206][ T6744] syzkaller0: entered allmulticast mode [ 112.906606][ T5754] Bluetooth: hci3: command 0x0405 tx timeout [ 113.249928][ T6790] netlink: 64 bytes leftover after parsing attributes in process `syz.0.272'. [ 113.283988][ T6790] syzkaller1: entered promiscuous mode [ 113.286935][ T6790] syzkaller1: entered allmulticast mode [ 113.322347][ T61] usb 8-1: new full-speed USB device number 7 using dummy_hcd [ 113.485721][ T61] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 113.491453][ T61] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 113.497499][ T61] usb 8-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 113.505216][ T61] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 113.517658][ T61] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 113.520759][ T61] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.528919][ T61] usb 8-1: Product: syz [ 113.530287][ T61] usb 8-1: Manufacturer: syz [ 113.535745][ T61] usb 8-1: SerialNumber: syz [ 113.547976][ T6786] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 113.762868][ T6786] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 114.173356][ T6808] netlink: 8 bytes leftover after parsing attributes in process `syz.0.277'. [ 114.881398][ T6806] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.889624][ T6806] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.788491][ T6836] netlink: 4 bytes leftover after parsing attributes in process `syz.0.287'. [ 116.219262][ T6849] netlink: 'syz.1.292': attribute type 2 has an invalid length. [ 116.221821][ T6849] netlink: 4 bytes leftover after parsing attributes in process `syz.1.292'. [ 116.227185][ T61] cdc_ncm 8-1:1.0: bind() failure [ 116.240795][ T61] cdc_ncm 8-1:1.1: CDC Union missing and no IAD found [ 116.247203][ T61] cdc_ncm 8-1:1.1: bind() failure [ 116.266904][ T61] usb 8-1: USB disconnect, device number 7 [ 116.905703][ T6889] netlink: 'syz.3.307': attribute type 2 has an invalid length. [ 116.908348][ T6889] netlink: 4 bytes leftover after parsing attributes in process `syz.3.307'. [ 116.924576][ T1355] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 117.105214][ T1355] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 117.108715][ T1355] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 117.112071][ T1355] usb 5-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 117.116372][ T1355] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 117.121498][ T1355] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 117.124555][ T1355] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.127133][ T1355] usb 5-1: Product: syz [ 117.128562][ T1355] usb 5-1: Manufacturer: syz [ 117.130094][ T1355] usb 5-1: SerialNumber: syz [ 117.134220][ T6880] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 117.351953][ T6880] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 117.376779][ T6906] netlink: 'syz.1.313': attribute type 10 has an invalid length. [ 117.390239][ T6906] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.396813][ T6906] team0: Port device bond0 added [ 117.455957][ T6906] bond1: left promiscuous mode [ 117.457533][ T6906] dummy0: left promiscuous mode [ 117.460080][ T6906] 8021q: adding VLAN 0 to HW filter on device bond1 [ 117.734391][ T6918] netlink: 64 bytes leftover after parsing attributes in process `syz.3.317'. [ 117.743563][ T6918] syzkaller1: entered promiscuous mode [ 117.748120][ T6918] syzkaller1: entered allmulticast mode [ 118.034856][ T6929] netlink: 8 bytes leftover after parsing attributes in process `syz.3.322'. [ 118.171265][ T6934] netlink: 20 bytes leftover after parsing attributes in process `syz.2.323'. [ 118.622312][ T6916] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 118.844424][ T6916] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.115612][ T6049] udevd[6049]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 119.120457][ T6049] udevd[6049]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 119.352701][ T5746] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 119.512936][ T6959] netlink: 16 bytes leftover after parsing attributes in process `syz.2.330'. [ 119.520261][ T5746] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 119.524225][ T5746] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 119.529902][ T5746] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 119.538298][ T5746] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 119.550301][ T5746] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 119.553235][ T5746] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 119.558534][ T5746] usb 6-1: Manufacturer: syz [ 119.597513][ T5746] usb 6-1: config 0 descriptor?? [ 120.077772][ T5746] appleir 0003:05AC:8243.0004: unknown main item tag 0x0 [ 120.134349][ T5746] appleir 0003:05AC:8243.0004: hiddev0,hidraw1: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 120.236062][ T1355] cdc_ncm 5-1:1.0: bind() failure [ 120.245174][ T1355] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 120.253477][ T1355] cdc_ncm 5-1:1.1: bind() failure [ 120.267123][ T1355] usb 5-1: USB disconnect, device number 6 [ 120.370443][ T6967] mmap: syz.1.326 (6967): VmData 37531648 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 120.413576][ T5746] usb 6-1: USB disconnect, device number 9 [ 121.300836][ T7004] nfsd: Unknown parameter 'uH-1sC0dಪ U( [ 121.300836][ T7004] (o ~ݤ F}H' [ 121.799033][ T7016] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 122.402617][ T34] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 123.001220][ T34] usb 5-1: Using ep0 maxpacket: 8 [ 123.317509][ T34] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 123.644180][ T34] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 123.823118][ T34] usb 5-1: config 0 interface 0 has no altsetting 0 [ 123.825246][ T34] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 123.827958][ T34] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.834322][ T34] usb 5-1: config 0 descriptor?? [ 124.010212][ T7040] fuse: Unknown parameter '%bk`<ȶ| YusG' [ 124.256411][ T34] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 124.258637][ T34] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 124.260764][ T34] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 124.262889][ T34] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 124.273527][ T34] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 124.276118][ T34] mcp2221 0003:04D8:00DD.0005: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 124.544892][ T7020] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 124.554395][ T7020] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.706804][ T34] usb 5-1: USB disconnect, device number 7 [ 126.738974][ T7095] syz.3.373 uses obsolete (PF_INET,SOCK_PACKET) [ 126.773447][ T7098] syzkaller0: entered promiscuous mode [ 126.775230][ T7098] syzkaller0: entered allmulticast mode [ 126.775300][ T7091] netlink: 'syz.2.375': attribute type 2 has an invalid length. [ 126.779271][ T7091] netlink: 4 bytes leftover after parsing attributes in process `syz.2.375'. [ 127.029124][ T7105] netlink: 40 bytes leftover after parsing attributes in process `syz.0.381'. [ 127.031445][ T7107] 9p: Bad value for 'rfdno' [ 127.066136][ T7107] bridge1: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 127.105771][ T7112] netlink: 16 bytes leftover after parsing attributes in process `syz.2.383'. [ 127.192517][ T42] audit: type=1326 audit(1785139496.418:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7111 comm="syz.2.383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 127.209461][ T42] audit: type=1326 audit(1785139496.428:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7111 comm="syz.2.383" exe="/syz-executor" sig=0 arch=40000003 syscall=77 compat=1 ip=0xf703efec code=0x7ffc0000 [ 127.226276][ T42] audit: type=1326 audit(1785139496.428:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7111 comm="syz.2.383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 127.239490][ T42] audit: type=1326 audit(1785139496.428:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7111 comm="syz.2.383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 127.248880][ T42] audit: type=1326 audit(1785139496.428:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7111 comm="syz.2.383" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 127.257210][ T42] audit: type=1326 audit(1785139496.428:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7111 comm="syz.2.383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 127.265604][ T42] audit: type=1326 audit(1785139496.428:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7111 comm="syz.2.383" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 127.283340][ T42] audit: type=1326 audit(1785139496.428:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7111 comm="syz.2.383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 127.292709][ T42] audit: type=1326 audit(1785139496.438:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7111 comm="syz.2.383" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 127.302649][ T7121] syzkaller0: entered promiscuous mode [ 127.308649][ T7121] syzkaller0: entered allmulticast mode [ 127.383434][ T7124] tipc: Started in network mode [ 127.388691][ T7124] tipc: Node identity aaaaaaaaaa3a, cluster identity 4711 [ 127.393962][ T7124] tipc: Enabled bearer , priority 27 [ 127.578661][ T7124] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.581816][ T7124] bridge0: port 1(bridge_slave_0) entered disabled state [ 127.684795][ T7124] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 127.698483][ T7124] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 127.804276][ T7124] tipc: Resetting bearer [ 127.925564][ T5794] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.942041][ T5794] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.953466][ T5794] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.963452][ T5794] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.030744][ T7132] netlink: 40 bytes leftover after parsing attributes in process `syz.2.390'. [ 128.335075][ T7137] netlink: 'syz.0.391': attribute type 2 has an invalid length. [ 128.337555][ T7137] netlink: 4 bytes leftover after parsing attributes in process `syz.0.391'. [ 128.504285][ T5530] tipc: Node number set to 9480874 [ 128.595394][ T7154] usbip-vudc usbip-vudc.0: gadget not bound [ 128.971646][ T7166] netlink: 40 bytes leftover after parsing attributes in process `syz.3.401'. [ 128.976049][ T7162] netlink: 'syz.2.398': attribute type 2 has an invalid length. [ 128.979361][ T7162] netlink: 4 bytes leftover after parsing attributes in process `syz.2.398'. [ 128.987327][ T7160] netlink: 'syz.0.399': attribute type 2 has an invalid length. [ 128.989746][ T7160] netlink: 4 bytes leftover after parsing attributes in process `syz.0.399'. [ 129.388221][ T42] audit: type=1326 audit(1785139498.618:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7183 comm="syz.0.409" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x7ffc0000 [ 130.725469][ T5754] Bluetooth: Wrong link type (-71) [ 130.792712][ T7229] netlink: 8 bytes leftover after parsing attributes in process `syz.2.423'. [ 130.820783][ T7231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.422'. [ 130.911661][ T7235] netlink: 'syz.3.426': attribute type 1 has an invalid length. [ 130.942631][ T7235] netlink: 'syz.3.426': attribute type 16 has an invalid length. [ 130.945111][ T7235] netlink: 'syz.3.426': attribute type 3 has an invalid length. [ 130.971081][ T7235] veth3: entered allmulticast mode [ 130.975995][ T7235] bond1: (slave veth3): Enslaving as an active interface with a down link [ 131.005874][ T7235] bond1 (unregistering): (slave veth3): Releasing active interface [ 131.010810][ T7235] bond1 (unregistering): Released all slaves [ 131.054950][ T5746] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 131.203797][ T5746] usb 7-1: Using ep0 maxpacket: 8 [ 131.206614][ T5746] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 131.209795][ T5746] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.225142][ T5746] pvrusb2: Hardware description: Terratec Grabster AV400 [ 131.228585][ T5746] pvrusb2: ********** [ 131.230916][ T5746] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 131.235195][ T5746] pvrusb2: Important functionality might not be entirely working. [ 131.238816][ T5746] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 131.243505][ T5746] pvrusb2: ********** [ 131.294586][ T7242] gadgetfs: bound to dummy_udc driver [ 131.307522][ T7242] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 131.311564][ T7242] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 131.427253][ T2514] pvrusb2: Invalid write control endpoint [ 131.479982][ T2514] pvrusb2: Invalid write control endpoint [ 131.482158][ T2514] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 131.485658][ T2514] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 131.488542][ T2514] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 131.491518][ T2514] pvrusb2: Device being rendered inoperable [ 131.498141][ T2514] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 131.500939][ T2514] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 131.507321][ T2514] pvrusb2: Attached sub-driver cx25840 [ 131.510012][ T2514] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 131.515239][ T2514] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 131.566083][ T7261] openvswitch: netlink: Flow actions attr not present in new flow. [ 132.275343][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.214251][ T7312] netlink: 'syz.3.448': attribute type 2 has an invalid length. [ 133.216590][ T7312] __nla_validate_parse: 9 callbacks suppressed [ 133.216599][ T7312] netlink: 4 bytes leftover after parsing attributes in process `syz.3.448'. [ 133.222507][ T7315] lo speed is unknown, defaulting to 1000 [ 133.225492][ T7315] lo speed is unknown, defaulting to 1000 [ 133.242253][ T7315] lo speed is unknown, defaulting to 1000 [ 133.247635][ T7315] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 133.253024][ T7315] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 133.258082][ T7315] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 133.286015][ T7315] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 133.305827][ T7315] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 133.357099][ T7320] netlink: 13 bytes leftover after parsing attributes in process `syz.1.450'. [ 133.397154][ T5746] lo speed is unknown, defaulting to 1000 [ 133.409575][ T7315] lo speed is unknown, defaulting to 1000 [ 133.419800][ T7315] lo speed is unknown, defaulting to 1000 [ 133.521251][ T7315] lo speed is unknown, defaulting to 1000 [ 133.525366][ T7315] lo speed is unknown, defaulting to 1000 [ 133.689420][ T7324] netlink: 'syz.1.452': attribute type 21 has an invalid length. [ 133.692010][ T7324] netlink: 132 bytes leftover after parsing attributes in process `syz.1.452'. [ 133.746885][ T7326] netlink: 28 bytes leftover after parsing attributes in process `syz.1.453'. [ 133.752529][ T7326] binder: 7325:7326 ioctl c0306201 80004a40 returned -22 [ 133.793349][ T7275] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 134.391519][ T9] usb 7-1: USB disconnect, device number 7 [ 134.905321][ T7351] fuse: Unknown parameter '00000000000000000000' [ 135.134402][ T5854] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 135.273819][ T5854] usb 5-1: device descriptor read/64, error -71 [ 135.324725][ T42] kauditd_printk_skb: 6 callbacks suppressed [ 135.324798][ T42] audit: type=1326 audit(1785139504.548:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7343 comm="syz.2.462" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 135.548050][ T5854] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 135.683888][ T5854] usb 5-1: device descriptor read/64, error -71 [ 135.714447][ T7356] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 135.759879][ T7358] netlink: 40 bytes leftover after parsing attributes in process `syz.3.467'. [ 135.794598][ T5854] usb usb5-port1: attempt power cycle [ 135.833664][ T7362] comedi comedi2: multiq3: I/O base address not correctly aligned [ 135.838749][ T7362] comedi comedi2: multiq3: I/O base address not correctly aligned [ 135.871911][ T7369] fuse: Unknown parameter '00000000000000000000' [ 135.938777][ T7371] netlink: 16 bytes leftover after parsing attributes in process `syz.3.472'. [ 135.941610][ T7372] netlink: 16 bytes leftover after parsing attributes in process `syz.3.472'. [ 136.094036][ T34] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 136.163943][ T5854] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 136.274276][ T34] usb 6-1: Using ep0 maxpacket: 32 [ 136.282752][ T34] usb 6-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 136.286319][ T34] usb 6-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 136.290026][ T34] usb 6-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 136.293895][ T34] usb 6-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 136.326048][ T34] usb 6-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 136.329441][ T34] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.332103][ T34] usb 6-1: Product: syz [ 136.333885][ T34] usb 6-1: Manufacturer: syz [ 136.335568][ T34] usb 6-1: SerialNumber: syz [ 136.405733][ C3] imon 6-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 136.428330][ T34] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:155.0/input/input13 [ 136.613923][ T34] imon 6-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 136.616934][ T34] (id 0x00) [ 136.663778][ T34] rc_core: IR keymap rc-imon-pad not found [ 136.665740][ T34] Registered IR keymap rc-empty [ 136.667945][ T34] imon 6-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 136.671233][ T34] imon 6-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 136.797611][ T5854] usb 5-1: device descriptor read/8, error -71 [ 136.832815][ T34] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:155.0/rc/rc0 [ 136.853778][ T34] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:155.0/rc/rc0/input14 [ 136.897761][ T34] imon 6-1:155.0: iMON device (15c2:ffdc, intf0) on usb<6:10> initialized [ 137.068161][ T7382] netlink: 504 bytes leftover after parsing attributes in process `syz.3.475'. [ 137.263811][ T5854] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 137.284805][ T5854] usb 5-1: device descriptor read/8, error -71 [ 137.394038][ T5854] usb usb5-port1: unable to enumerate USB device [ 137.511190][ T7390] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.514951][ T7390] bridge0: port 1(bridge_slave_0) entered disabled state [ 137.738311][ T7395] x_tables: duplicate underflow at hook 1 [ 139.588476][ T5831] usb 6-1: USB disconnect, device number 10 [ 139.665577][ T7413] netlink: 4 bytes leftover after parsing attributes in process `syz.2.484'. [ 140.367624][ T7437] netlink: 8 bytes leftover after parsing attributes in process `syz.1.492'. [ 141.402957][ T7457] netlink: 'syz.2.496': attribute type 1 has an invalid length. [ 141.433632][ T7457] netlink: 'syz.2.496': attribute type 16 has an invalid length. [ 141.437389][ T7457] netlink: 'syz.2.496': attribute type 3 has an invalid length. [ 141.440667][ T7457] netlink: 132 bytes leftover after parsing attributes in process `syz.2.496'. [ 141.449480][ T7457] netlink: 12 bytes leftover after parsing attributes in process `syz.2.496'. [ 141.459093][ T7457] netlink: 8 bytes leftover after parsing attributes in process `syz.2.496'. [ 141.530776][ T7457] veth3: entered allmulticast mode [ 141.543157][ T7457] bond1: (slave veth3): Enslaving as an active interface with a down link [ 141.670126][ T7464] bond1 (unregistering): (slave veth3): Releasing active interface [ 141.675260][ T7464] bond1 (unregistering): Released all slaves [ 141.973214][ T7483] netlink: 8 bytes leftover after parsing attributes in process `syz.0.502'. [ 142.598313][ T7492] netlink: 8 bytes leftover after parsing attributes in process `syz.2.513'. [ 143.805337][ T7506] netlink: 'syz.2.510': attribute type 2 has an invalid length. [ 143.807828][ T7506] netlink: 4 bytes leftover after parsing attributes in process `syz.2.510'. [ 143.942819][ T7509] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 143.955668][ T7509] netlink: 'syz.2.511': attribute type 29 has an invalid length. [ 144.072795][ T7514] netlink: 8 bytes leftover after parsing attributes in process `syz.0.512'. [ 144.084494][ T7516] netlink: 'syz.2.515': attribute type 7 has an invalid length. [ 144.086929][ T7516] netlink: 4 bytes leftover after parsing attributes in process `syz.2.515'. [ 145.178105][ T7530] netlink: 'syz.3.520': attribute type 2 has an invalid length. [ 145.191207][ T7530] __nla_validate_parse: 1 callbacks suppressed [ 145.191416][ T7530] netlink: 4 bytes leftover after parsing attributes in process `syz.3.520'. [ 145.647621][ T7541] xt_bpf: check failed: parse error [ 145.722786][ T7549] netlink: 8 bytes leftover after parsing attributes in process `syz.0.525'. [ 146.371028][ T7578] ntfs3(nullb0): Primary boot signature is not NTFS. [ 146.374690][ T7578] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 146.381051][ T7578] netlink: 'syz.2.539': attribute type 1 has an invalid length. [ 146.384155][ T7578] netlink: 756 bytes leftover after parsing attributes in process `syz.2.539'. [ 146.804845][ T7582] netlink: 4 bytes leftover after parsing attributes in process `syz.2.541'. [ 147.005097][ T7597] netlink: 8 bytes leftover after parsing attributes in process `syz.2.545'. [ 147.854632][ T1164] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 147.857135][ T1164] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 149.221204][ T7634] netlink: 4 bytes leftover after parsing attributes in process `syz.1.556'. [ 149.243017][ T7632] netlink: 4 bytes leftover after parsing attributes in process `syz.2.554'. [ 149.608633][ T7647] netlink: 20 bytes leftover after parsing attributes in process `syz.0.562'. [ 150.657198][ T7666] overlayfs: failed lookup in lower (newroot/126, name='bus', err=-40): overlapping layers [ 150.707940][ T7674] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 152.526184][ T7696] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 152.534857][ T7696] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 152.542801][ T7679] ptrace attach of ""[7698] was attempted by "/syz-executor exec"[7679] [ 152.613984][ T42] audit: type=1800 audit(1785139521.838:24): pid=7686 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.573" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 153.499533][ T7713] tipc: Enabling of bearer rejected, already enabled [ 154.256095][ T7737] netlink: 24 bytes leftover after parsing attributes in process `syz.2.591'. [ 154.310185][ T7745] netlink: 8 bytes leftover after parsing attributes in process `syz.2.595'. [ 154.431846][ T7747] netlink: 'syz.2.596': attribute type 2 has an invalid length. [ 154.434410][ T7747] netlink: 4 bytes leftover after parsing attributes in process `syz.2.596'. [ 154.540692][ T42] audit: type=1326 audit(1785139523.768:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7732 comm="syz.0.589" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fdefec code=0x0 [ 154.615377][ T7752] netlink: 32 bytes leftover after parsing attributes in process `syz.2.597'. [ 155.245576][ T7762] sctp: [Deprecated]: syz.3.600 (pid 7762) Use of int in max_burst socket option deprecated. [ 155.245576][ T7762] Use struct sctp_assoc_value instead [ 155.589899][ T7772] netlink: 'syz.3.605': attribute type 2 has an invalid length. [ 155.592241][ T7772] netlink: 4 bytes leftover after parsing attributes in process `syz.3.605'. [ 155.676306][ T7779] syzkaller0: entered promiscuous mode [ 155.678595][ T7779] syzkaller0: entered allmulticast mode [ 155.784621][ T6386] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 155.933797][ T6386] usb 7-1: Using ep0 maxpacket: 8 [ 155.936700][ T6386] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 155.939376][ T6386] usb 7-1: config 0 has no interface number 0 [ 155.942382][ T6386] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 155.945738][ T6386] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 155.949140][ T6386] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 155.952392][ T6386] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 155.960562][ T6386] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 155.964079][ T6386] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.969718][ T6386] usb 7-1: config 0 descriptor?? [ 155.986985][ T6386] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 156.352893][ T5846] usb 7-1: USB disconnect, device number 8 [ 156.362567][ T5846] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 156.744177][ T7798] netlink: 4 bytes leftover after parsing attributes in process `syz.3.611'. [ 156.856809][ T7800] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 157.151093][ T7822] netlink: 'syz.3.615': attribute type 2 has an invalid length. [ 157.153683][ T7822] netlink: 4 bytes leftover after parsing attributes in process `syz.3.615'. [ 157.325936][ T7832] netlink: 9 bytes leftover after parsing attributes in process `syz.2.619'. [ 157.463944][ T5831] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 157.615095][ T5831] usb 8-1: config index 0 descriptor too short (expected 45, got 36) [ 157.618605][ T5831] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 157.623137][ T5831] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 157.627505][ T5831] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 157.632704][ T5831] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 157.636841][ T5831] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.643267][ T5831] usb 8-1: config 0 descriptor?? [ 158.096816][ T5831] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 158.099829][ T5831] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 158.102192][ T5831] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 158.107291][ T5831] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 158.109621][ T5831] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 158.111882][ T5831] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 158.114704][ T5831] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 158.119313][ T5831] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 158.121901][ T5831] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 158.124959][ T5831] plantronics 0003:047F:FFFF.0006: unknown main item tag 0x0 [ 158.133102][ T5831] plantronics 0003:047F:FFFF.0006: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 158.148227][ T7855] No source specified [ 158.185227][ T7852] netlink: 'syz.2.625': attribute type 2 has an invalid length. [ 158.187722][ T7852] netlink: 4 bytes leftover after parsing attributes in process `syz.2.625'. [ 158.358554][ T7877] comedi comedi1: fl512: I/O base address not correctly aligned [ 158.369600][ T5831] usb 8-1: USB disconnect, device number 8 [ 158.402188][ T7879] netlink: 68 bytes leftover after parsing attributes in process `syz.2.636'. [ 158.409438][ T42] audit: type=1326 audit(1785139527.638:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7878 comm="syz.2.636" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf703efec code=0x0 [ 158.737105][ T7892] netlink: 'syz.1.641': attribute type 2 has an invalid length. [ 158.822871][ T7895] overlayfs: statfs failed on './file0' [ 159.550173][ T7918] VFS: file-max limit 0 reached [ 159.858361][ T7933] __nla_validate_parse: 2 callbacks suppressed [ 159.858372][ T7933] netlink: 8 bytes leftover after parsing attributes in process `syz.1.657'. [ 159.969416][ T7808] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 159.971887][ T7808] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 160.169341][ T7942] netlink: 4 bytes leftover after parsing attributes in process `syz.1.661'. [ 160.310830][ T7949] netlink: 8 bytes leftover after parsing attributes in process `syz.0.664'. [ 160.346029][ T7951] netlink: 52 bytes leftover after parsing attributes in process `syz.1.665'. [ 160.349505][ T7951] netlink: 52 bytes leftover after parsing attributes in process `syz.1.665'. [ 160.352615][ T7951] netlink: 52 bytes leftover after parsing attributes in process `syz.1.665'. [ 160.379014][ T7953] overlayfs: missing 'lowerdir' [ 160.662124][ T7969] netlink: 4 bytes leftover after parsing attributes in process `syz.2.671'. [ 160.831958][ T7975] netlink: 'syz.2.672': attribute type 1 has an invalid length. [ 160.877969][ T7975] 8021q: adding VLAN 0 to HW filter on device bond1 [ 160.890350][ T7982] netlink: 8 bytes leftover after parsing attributes in process `syz.3.675'. [ 160.969049][ T5754] Bluetooth: hci3: unexpected event for opcode 0x2062 [ 161.636496][ T8006] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 161.646955][ T8006] block device autoloading is deprecated and will be removed. [ 161.698420][ T8010] netlink: 12 bytes leftover after parsing attributes in process `syz.3.687'. [ 161.757962][ T8014] netlink: 36 bytes leftover after parsing attributes in process `syz.2.690'. [ 161.849705][ T8024] lo speed is unknown, defaulting to 1000 [ 162.235512][ T1355] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 162.374162][ T1355] usb 5-1: device descriptor read/64, error -71 [ 162.400897][ T8048] netlink: 'syz.3.700': attribute type 1 has an invalid length. [ 162.405356][ T8048] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 162.456455][ T8054] Mass Storage Function, version: 2009/09/11 [ 162.462004][ T8054] LUN: removable file: (no medium) [ 162.656139][ T1355] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 163.303847][ T1355] usb 5-1: device descriptor read/64, error -71 [ 163.523991][ T1355] usb usb5-port1: attempt power cycle [ 163.864288][ T1355] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 163.896142][ T1355] usb 5-1: device descriptor read/8, error -71 [ 164.173825][ T1355] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 164.209832][ T1355] usb 5-1: device descriptor read/8, error -71 [ 164.339235][ T1355] usb usb5-port1: unable to enumerate USB device [ 164.570234][ T42] audit: type=1326 audit(1785139533.798:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8102 comm="syz.3.719" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f07fec code=0x0 [ 164.694732][ T8107] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 164.754015][ T8112] binder: 8110:8112 ioctl c00c6211 0 returned -14 [ 164.995456][ T5754] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 164.998944][ T5754] Bluetooth: hci3: Injecting HCI hardware error event [ 165.012074][ T5748] Bluetooth: hci3: hardware error 0x00 [ 165.500551][ T8121] ehci-pci 0000:00:1d.7: remove, state 1 [ 165.503351][ T8121] usb usb1: USB disconnect, device number 1 [ 165.505451][ T8121] usb 1-1: USB disconnect, device number 2 [ 165.602865][ T8125] netlink: 'syz.0.724': attribute type 3 has an invalid length. [ 165.681975][ T8121] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 165.973828][ T5846] usb 2-1: new full-speed USB device number 3 using uhci_hcd [ 166.063016][ T8130] bond2 (unregistering): Released all slaves [ 166.084944][ T42] audit: type=1326 audit(1785139535.318:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8126 comm="syz.2.725" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 166.140024][ T5846] usb 2-1: not running at top speed; connect to a high speed hub [ 166.160450][ T5846] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 166.163356][ T5846] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 166.166328][ T5846] usb 2-1: Product: QEMU USB Tablet [ 166.168315][ T5846] usb 2-1: Manufacturer: QEMU [ 166.170089][ T5846] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 166.192077][ T5846] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.0007/input/input15 [ 166.264956][ T5846] hid-generic 0003:0627:0001.0007: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 166.290405][ T8122] usb 2-1: USB disconnect, device number 3 [ 166.340023][ T8137] fido_id[8137]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/2-1/report_descriptor': No such file or directory [ 166.470067][ T8122] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 166.474359][ T8122] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 166.479172][ T8122] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 166.506575][ T8122] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 166.511286][ T8122] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 166.514841][ T8122] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 166.517429][ T8122] usb usb1: Product: EHCI Host Controller [ 166.519176][ T8122] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 166.521195][ T8122] usb usb1: SerialNumber: 0000:00:1d.7 [ 166.528285][ T8122] hub 1-0:1.0: USB hub found [ 166.529958][ T8122] hub 1-0:1.0: 6 ports detected [ 166.577894][ T8122] hub 2-0:1.0: USB hub found [ 166.579618][ T8122] hub 2-0:1.0: 2 ports detected [ 166.615052][ T8122] hub 3-0:1.0: USB hub found [ 166.620717][ T8122] hub 3-0:1.0: 2 ports detected [ 166.643868][ T9] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 166.658438][ T8122] hub 4-0:1.0: USB hub found [ 166.660650][ T8122] hub 4-0:1.0: 2 ports detected [ 166.778284][ T8142] tipc: Enabled bearer , priority 0 [ 166.781412][ T8142] syzkaller0: entered promiscuous mode [ 166.783156][ T8142] syzkaller0: entered allmulticast mode [ 166.788424][ T8142] tipc: Resetting bearer [ 166.815635][ T9] usb 6-1: config index 0 descriptor too short (expected 45, got 36) [ 166.818641][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.822799][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 166.826495][ T10] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 166.829175][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 166.833937][ T9] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 166.837668][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.849986][ T9] usb 6-1: config 0 descriptor?? [ 167.015578][ T8151] siw: device registration error -23 [ 167.048245][ T10] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 167.051015][ T10] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 167.053589][ T10] usb 1-1: Product: QEMU USB Tablet [ 167.055825][ T10] usb 1-1: Manufacturer: QEMU [ 167.057322][ T10] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 167.081761][ T10] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.0008/input/input16 [ 167.143988][ T5748] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 167.154853][ T10] hid-generic 0003:0627:0001.0008: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 167.262519][ T9] hid_parser_main: 5 callbacks suppressed [ 167.262532][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 167.269833][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 167.272366][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 167.275041][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 167.277363][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 167.279671][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 167.281911][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 167.284414][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 167.286834][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 167.289035][ T9] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 167.308071][ T9] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 167.324919][ T8153] syz.2.733: page allocation failure: order:0, mode:0x10cc0(GFP_KERNEL|__GFP_NORETRY), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 167.329273][ T8153] CPU: 1 UID: 0 PID: 8153 Comm: syz.2.733 Tainted: G L syzkaller #0 PREEMPT(full) [ 167.329291][ T8153] Tainted: [L]=SOFTLOCKUP [ 167.329295][ T8153] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 167.329301][ T8153] Call Trace: [ 167.329306][ T8153] [ 167.329310][ T8153] dump_stack_lvl+0x100/0x190 [ 167.329325][ T8153] warn_alloc.cold+0x94/0xa8 [ 167.329337][ T8153] ? __pfx_warn_alloc+0x10/0x10 [ 167.329349][ T8153] ? find_held_lock+0x2b/0x80 [ 167.329363][ T8153] ? psi_memstall_leave+0x19c/0x360 [ 167.329380][ T8153] ? psi_memstall_leave+0x1e6/0x360 [ 167.329395][ T8153] ? psi_memstall_leave+0x1eb/0x360 [ 167.329409][ T8153] ? lockdep_hardirqs_on+0x78/0x100 [ 167.329426][ T8153] __alloc_frozen_pages_noprof+0x159f/0x2dc0 [ 167.329440][ T8153] ? finish_task_switch.isra.0+0x220/0x10c0 [ 167.329452][ T8153] ? lockdep_hardirqs_on+0x78/0x100 [ 167.329468][ T8153] ? trace_sched_exit_tp+0x120/0x160 [ 167.329482][ T8153] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 167.329497][ T8153] ? __schedule+0x126e/0x6730 [ 167.329514][ T8153] ? preempt_schedule_irq+0x7b/0x90 [ 167.329527][ T8153] ? irqentry_exit+0x24d/0xa00 [ 167.329538][ T8153] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 167.329555][ T8153] ? policy_nodemask+0xed/0x4f0 [ 167.329572][ T8153] alloc_pages_mpol+0x1fb/0x540 [ 167.329588][ T8153] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 167.329603][ T8153] ? alloc_pages_noprof+0x78/0x160 [ 167.329620][ T8153] alloc_pages_noprof+0x1a/0x160 [ 167.329631][ T8153] kimage_alloc_pages+0x72/0x380 [ 167.329648][ T8153] kimage_alloc_control_pages+0x157/0xa20 [ 167.329666][ T8153] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 167.329677][ T8153] ? __pfx_kimage_alloc_control_pages+0x10/0x10 [ 167.329697][ T8153] do_kexec_load+0x275/0x810 [ 167.329714][ T8153] ? __pfx_do_kexec_load+0x10/0x10 [ 167.329734][ T8153] __ia32_compat_sys_kexec_load+0x37f/0x400 [ 167.329753][ T8153] ? __pfx___ia32_compat_sys_kexec_load+0x10/0x10 [ 167.329774][ T8153] __do_fast_syscall_32+0xe7/0x970 [ 167.329790][ T8153] do_fast_syscall_32+0x32/0x70 [ 167.329804][ T8153] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 167.329818][ T8153] RIP: 0023:0xf703efec [ 167.329831][ T8153] Code: Unable to access opcode bytes at 0xf703efc2. [ 167.329836][ T8153] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 000000000000011b [ 167.329846][ T8153] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000003 [ 167.329853][ T8153] RDX: 0000000080001080 RSI: 00000000003e0000 RDI: 0000000000000000 [ 167.329859][ T8153] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 167.329865][ T8153] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 167.329871][ T8153] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 167.329884][ T8153] [ 167.329888][ T8153] Mem-Info: [ 167.417733][ T8153] active_anon:9520 inactive_anon:132 isolated_anon:0 [ 167.417733][ T8153] active_file:6329 inactive_file:29840 isolated_file:0 [ 167.417733][ T8153] unevictable:768 dirty:362 writeback:0 [ 167.417733][ T8153] slab_reclaimable:8101 slab_unreclaimable:54995 [ 167.417733][ T8153] mapped:27258 shmem:4133 pagetables:1651 [ 167.417733][ T8153] sec_pagetables:295 bounce:0 [ 167.417733][ T8153] kernel_misc_reclaimable:0 [ 167.417733][ T8153] free:28134 free_pcp:702 free_cma:0 [ 167.431584][ T8153] Node 0 active_anon:24kB inactive_anon:12kB active_file:52kB inactive_file:48kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:0kB writeback:0kB shmem:1540kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:9760kB pagetables:1704kB sec_pagetables:1104kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 167.441873][ T8153] Node 1 active_anon:38056kB inactive_anon:516kB active_file:25264kB inactive_file:119312kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:109004kB dirty:1448kB writeback:0kB shmem:14992kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:5288kB pagetables:4900kB sec_pagetables:76kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 167.452709][ T8153] Node 0 DMA free:1840kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:8kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:0kB free_cma:0kB [ 167.461768][ T8153] lowmem_reserve[]: 0 280 280 280 280 [ 167.463627][ T8153] Node 0 DMA32 free:14464kB boost:2048kB min:14820kB low:18012kB high:21204kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24kB inactive_anon:56kB active_file:52kB inactive_file:48kB unevictable:1536kB writepending:0kB zspages:20kB present:1032196kB managed:286952kB mlocked:0kB bounce:0kB free_pcp:832kB local_pcp:0kB free_cma:0kB [ 167.473488][ T8153] lowmem_reserve[]: 0 0 0 0 0 [ 167.475201][ T8153] Node 1 DMA32 free:96232kB boost:20480kB min:67620kB low:79404kB high:91188kB reserved_highatomic:0KB free_highatomic:0KB active_anon:38056kB inactive_anon:516kB active_file:25264kB inactive_file:119312kB unevictable:1536kB writepending:1448kB zspages:2100kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:2240kB local_pcp:0kB free_cma:0kB [ 167.486173][ T8153] lowmem_reserve[]: 0 0 0 0 0 [ 167.487702][ T8153] Node 0 DMA: 0*4kB 3*8kB (UM) 2*16kB (UM) 4*32kB (UM) 10*64kB (UM) 2*128kB (M) 1*256kB (M) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 1848kB [ 167.492025][ T8153] Node 0 DMA32: 8*4kB (ME) 35*8kB (ME) 9*16kB (UE) 97*32kB (UME) 41*64kB (UME) 16*128kB (ME) 6*256kB (UME) 5*512kB (UM) 0*1024kB 1*2048kB (U) 0*4096kB = 14376kB [ 167.497000][ T8153] Node 1 DMA32: 321*4kB (ME) 491*8kB (UME) 300*16kB (UME) 127*32kB (UME) 130*64kB (UME) 89*128kB (UME) 56*256kB (UME) 20*512kB (UME) 11*1024kB (UM) 3*2048kB (M) 5*4096kB (M) = 96252kB [ 167.502607][ T8153] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 167.505585][ T8153] Node 0 hugepages_total=1 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 167.508458][ T8153] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 167.511482][ T8153] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 167.514403][ T8153] 38787 total pagecache pages [ 167.515938][ T8153] 317 pages in swap cache [ 167.517385][ T8153] Free swap = 120348kB [ 167.518741][ T8153] Total swap = 124996kB [ 167.520134][ T8153] 524155 pages RAM [ 167.521361][ T8153] 0 pages HighMem/MovableOnly [ 167.523111][ T8153] 211524 pages reserved [ 167.524644][ T8153] 0 pages cma reserved [ 167.531915][ T5854] usb 6-1: USB disconnect, device number 11 [ 167.590774][ T8140] tipc: Resetting bearer [ 167.602202][ T8140] tipc: Disabling bearer [ 167.715676][ T8153] kexec: Could not allocate control_code_buffer [ 167.755448][ T8160] __nla_validate_parse: 6 callbacks suppressed [ 167.755462][ T8160] netlink: 3 bytes leftover after parsing attributes in process `syz.3.735'. [ 167.836838][ T8167] ALSA: mixer_oss: invalid OSS volume 'PHl6qӆONEOUT' [ 167.839860][ T8167] ALSA: mixer_oss: invalid index 137438 [ 168.621143][ T8183] lo speed is unknown, defaulting to 1000 [ 168.621586][ T8180] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 168.973967][ T10] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 169.213292][ T10] usb 6-1: config index 0 descriptor too short (expected 60928, got 36) [ 169.216516][ T10] usb 6-1: config 47 has too many interfaces: 109, using maximum allowed: 32 [ 169.223821][ T10] usb 6-1: config 47 has an invalid descriptor of length 0, skipping remainder of the config [ 169.228365][ T10] usb 6-1: config 47 has 0 interfaces, different from the descriptor's value: 109 [ 169.235488][ T10] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 169.238290][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.700294][ T10] usb 6-1: string descriptor 0 read error: -71 [ 169.710369][ T10] usb 6-1: USB disconnect, device number 12 [ 169.785898][ T8201] netlink: 'syz.0.749': attribute type 2 has an invalid length. [ 169.788313][ T8201] netlink: 4 bytes leftover after parsing attributes in process `syz.0.749'. [ 170.044715][ T8211] siw: device registration error -23 [ 170.117992][ T8219] netlink: 40 bytes leftover after parsing attributes in process `syz.2.755'. [ 170.542385][ T8242] lo speed is unknown, defaulting to 1000 [ 170.561308][ T8245] tmpfs: Cannot change global quota limit on remount [ 170.624655][ T8246] fuse: blksize only supported for fuseblk [ 171.643787][ T5846] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 171.814608][ T5846] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 171.818242][ T5846] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 171.821822][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 171.826089][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 171.830001][ T5846] usb 6-1: config 0 interface 0 has no altsetting 0 [ 171.833802][ T5846] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 171.837361][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 171.841772][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 171.845632][ T5846] usb 6-1: config 0 interface 0 has no altsetting 0 [ 171.850268][ T5846] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 171.853867][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 171.857818][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 171.861589][ T5846] usb 6-1: config 0 interface 0 has no altsetting 0 [ 171.865572][ T5846] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 171.869138][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 171.873326][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 171.877345][ T5846] usb 6-1: config 0 interface 0 has no altsetting 0 [ 171.880975][ T5846] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 171.884617][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 171.888504][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 171.892291][ T5846] usb 6-1: config 0 interface 0 has no altsetting 0 [ 171.895897][ T5846] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 171.899660][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 171.903980][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 171.907343][ T5846] usb 6-1: config 0 interface 0 has no altsetting 0 [ 171.910953][ T5846] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 171.914663][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 171.918692][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 171.922423][ T5846] usb 6-1: config 0 interface 0 has no altsetting 0 [ 171.926004][ T5846] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 171.929223][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 171.932544][ T5846] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 171.935446][ T5846] usb 6-1: config 0 interface 0 has no altsetting 0 [ 171.938991][ T5846] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 171.941747][ T5846] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 171.944461][ T5846] usb 6-1: Product: syz [ 171.945730][ T5846] usb 6-1: Manufacturer: syz [ 171.947137][ T5846] usb 6-1: SerialNumber: syz [ 171.950895][ T5846] usb 6-1: config 0 descriptor?? [ 171.955700][ T5846] yurex 6-1:0.0: Could not submitting URB [ 171.957620][ T5846] yurex 6-1:0.0: probe with driver yurex failed with error -5 [ 172.296853][ T8272] netlink: 'syz.3.774': attribute type 2 has an invalid length. [ 172.299197][ T8272] netlink: 4 bytes leftover after parsing attributes in process `syz.3.774'. [ 172.548206][ T8293] binder: 8291:8293 ioctl c00c6211 0 returned -14 [ 172.727566][ T5846] usb 6-1: USB disconnect, device number 13 [ 173.131352][ T8302] Bluetooth: MGMT ver 1.23 [ 173.572734][ T8313] FAULT_INJECTION: forcing a failure. [ 173.572734][ T8313] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 173.578571][ T8313] CPU: 3 UID: 0 PID: 8313 Comm: syz.2.786 Tainted: G L syzkaller #0 PREEMPT(full) [ 173.578599][ T8313] Tainted: [L]=SOFTLOCKUP [ 173.578619][ T8313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 173.578629][ T8313] Call Trace: [ 173.578635][ T8313] [ 173.578643][ T8313] dump_stack_lvl+0x100/0x190 [ 173.578667][ T8313] should_fail_ex.cold+0x5/0xa [ 173.578687][ T8313] _copy_from_user+0x2e/0xd0 [ 173.578720][ T8313] get_compat_msghdr+0xb3/0x480 [ 173.578747][ T8313] ? __pfx_get_compat_msghdr+0x10/0x10 [ 173.578776][ T8313] ? _kstrtoull+0x13c/0x1f0 [ 173.578794][ T8313] ? __pfx__kstrtoull+0x10/0x10 [ 173.578816][ T8313] ___sys_sendmsg+0x1b6/0x1e0 [ 173.578838][ T8313] ? __pfx____sys_sendmsg+0x10/0x10 [ 173.578854][ T8313] ? __lock_acquire+0x49f/0x1a40 [ 173.578911][ T8313] __sys_sendmmsg+0x309/0x440 [ 173.578938][ T8313] ? __pfx___sys_sendmmsg+0x10/0x10 [ 173.578961][ T8313] ? find_held_lock+0x2b/0x80 [ 173.578990][ T8313] ? __mutex_unlock_slowpath+0x35d/0x930 [ 173.579026][ T8313] ? fput+0x79/0x100 [ 173.579046][ T8313] ? ksys_write+0x1ac/0x250 [ 173.579066][ T8313] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 173.579094][ T8313] ? lockdep_hardirqs_on+0x78/0x100 [ 173.579115][ T8313] __do_fast_syscall_32+0xe7/0x970 [ 173.579137][ T8313] ? lockdep_hardirqs_on+0x78/0x100 [ 173.579159][ T8313] do_fast_syscall_32+0x32/0x70 [ 173.579182][ T8313] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 173.579205][ T8313] RIP: 0023:0xf703efec [ 173.579225][ T8313] Code: Unable to access opcode bytes at 0xf703efc2. [ 173.579233][ T8313] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 173.579251][ T8313] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000600 [ 173.579262][ T8313] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 173.579272][ T8313] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 173.579282][ T8313] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 173.579292][ T8313] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 173.579331][ T8313] [ 173.674296][ T8309] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 173.732565][ T8314] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 174.198845][ T8322] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 174.267615][ T8321] netlink: 'syz.1.788': attribute type 2 has an invalid length. [ 174.270016][ T8321] netlink: 4 bytes leftover after parsing attributes in process `syz.1.788'. [ 175.056204][ T8332] ehci-pci 0000:00:1d.7: remove, state 1 [ 175.058215][ T8332] usb usb1: USB disconnect, device number 1 [ 175.060155][ T8332] usb 1-1: USB disconnect, device number 2 [ 175.155719][ T8332] ehci-pci 0000:00:1d.7: USB bus 1 deregistered [ 175.223454][ T8332] netlink: 'syz.1.792': attribute type 3 has an invalid length. [ 175.250684][ T8337] lo speed is unknown, defaulting to 1000 [ 175.371608][ T8349] vivid-006: disconnect [ 175.378188][ T8348] vivid-006: reconnect [ 175.414015][ T8351] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 175.424871][ T846] usb 2-1: new full-speed USB device number 4 using uhci_hcd [ 175.430332][ T8354] random: crng reseeded on system resumption [ 175.440725][ T8354] fuse: Bad value for 'fd' [ 175.600128][ T846] usb 2-1: not running at top speed; connect to a high speed hub [ 175.620757][ T846] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 175.953836][ T5846] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 175.962054][ T846] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 175.964886][ T846] usb 2-1: Product: QEMU USB Tablet [ 175.966808][ T846] usb 2-1: Manufacturer: QEMU [ 175.968318][ T846] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 175.988694][ T846] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/0003:0627:0001.000A/input/input17 [ 176.069423][ T846] hid-generic 0003:0627:0001.000A: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 176.079833][ T8333] usb 2-1: USB disconnect, device number 4 [ 176.155760][ T5846] usb 5-1: config index 0 descriptor too short (expected 60928, got 36) [ 176.160411][ T5846] usb 5-1: config 47 has too many interfaces: 109, using maximum allowed: 32 [ 176.166442][ T5846] usb 5-1: config 47 has an invalid descriptor of length 0, skipping remainder of the config [ 176.170634][ T5846] usb 5-1: config 47 has 0 interfaces, different from the descriptor's value: 109 [ 176.174166][ T5846] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 176.177729][ T5846] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.209564][ T8360] fido_id[8360]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb2/report_descriptor': No such file or directory [ 176.231613][ T8362] lo speed is unknown, defaulting to 1000 [ 176.287105][ T8333] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 176.293065][ T8333] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 1 [ 176.299349][ T8333] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 176.313882][ T8333] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 176.318294][ T8333] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 176.321034][ T8333] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 176.323452][ T8333] usb usb1: Product: EHCI Host Controller [ 176.325324][ T8333] usb usb1: Manufacturer: Linux syzkaller ehci_hcd [ 176.327200][ T8333] usb usb1: SerialNumber: 0000:00:1d.7 [ 176.338971][ T8333] hub 1-0:1.0: USB hub found [ 176.340786][ T8333] hub 1-0:1.0: 6 ports detected [ 176.388364][ T8333] hub 2-0:1.0: USB hub found [ 176.392935][ T8333] hub 2-0:1.0: 2 ports detected [ 176.456878][ T5846] usb 5-1: string descriptor 0 read error: -71 [ 176.462262][ T5846] usb 5-1: USB disconnect, device number 16 [ 176.470627][ T8333] hub 3-0:1.0: USB hub found [ 176.474731][ T8333] hub 3-0:1.0: 2 ports detected [ 176.643895][ T61] usb 1-1: new high-speed USB device number 2 using ehci-pci [ 176.667956][ T8333] hub 4-0:1.0: USB hub found [ 176.669876][ T8333] hub 4-0:1.0: 2 ports detected [ 176.866268][ T61] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 176.870961][ T61] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 176.874175][ T61] usb 1-1: Product: QEMU USB Tablet [ 176.875711][ T61] usb 1-1: Manufacturer: QEMU [ 176.879050][ T61] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x8f000) [ 176.921156][ T61] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb1/1-1/1-1:1.0/0003:0627:0001.000B/input/input18 [ 176.986501][ T61] hid-generic 0003:0627:0001.000B: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 177.126795][ T1131] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 177.140933][ T1131] ata1: failed to read log page 10h (errno=-5) [ 177.148432][ T1131] ata1.00: NCQ disabled due to excessive errors [ 177.151438][ T1131] ata1.00: exception Emask 0x1 SAct 0x4000 SErr 0x0 action 0x0 [ 177.154565][ T1131] ata1.00: irq_stat 0x41000008 [ 177.156737][ T1131] ata1.00: failed command: WRITE FPDMA QUEUED [ 177.159860][ T1131] ata1.00: cmd 61/78:70:be:2c:0e/04:00:00:00:00/40 tag 14 ncq dma 585728 out [ 177.159860][ T1131] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 177.174405][ T1131] ata1.00: status: { DRDY } [ 177.176102][ T1131] ata1.00: error: { ABRT } [ 177.179036][ T1131] ata1.00: configured for UDMA/100 [ 177.181300][ T1131] ata1: EH complete [ 177.315665][ T8386] bond0: entered promiscuous mode [ 177.317402][ T8386] bond_slave_0: entered promiscuous mode [ 177.319630][ T8386] bond_slave_1: entered promiscuous mode [ 177.324613][ T8386] batadv0: entered promiscuous mode [ 177.328726][ T8386] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 177.334249][ T8386] bond0: left promiscuous mode [ 177.335853][ T8386] bond_slave_0: left promiscuous mode [ 177.337774][ T8386] bond_slave_1: left promiscuous mode [ 177.340428][ T8386] batadv0: left promiscuous mode [ 177.971728][ T8400] netlink: 4 bytes leftover after parsing attributes in process `syz.2.817'. [ 178.071173][ T8404] [ 178.091428][ T5831] libceph: connect (1)[c::]:6789 error -101 [ 178.094740][ T5831] libceph: mon0 (1)[c::]:6789 connect error [ 178.138749][ T8404] ceph: No mds server is up or the cluster is laggy [ 178.354872][ T5831] libceph: connect (1)[c::]:6789 error -101 [ 178.357748][ T5831] libceph: mon0 (1)[c::]:6789 connect error [ 178.413393][ T8390] isofs_fill_super: bread failed, dev=sr0, iso_blknum=32, block=32 [ 178.991416][ T8424] ALSA: mixer_oss: invalid OSS volume '' [ 179.133835][ T8431] netlink: 8 bytes leftover after parsing attributes in process `syz.3.828'. [ 179.147483][ T8436] netlink: 'syz.2.824': attribute type 4 has an invalid length. [ 179.396522][ T8448] lo speed is unknown, defaulting to 1000 [ 180.294074][ T8465] netlink: 'syz.0.842': attribute type 1 has an invalid length. [ 180.315319][ T8470] overlayfs: maximum fs stacking depth exceeded [ 180.317553][ T8465] netlink: 'syz.0.842': attribute type 16 has an invalid length. [ 180.321221][ T8465] netlink: 'syz.0.842': attribute type 3 has an invalid length. [ 180.323556][ T8465] netlink: 132 bytes leftover after parsing attributes in process `syz.0.842'. [ 180.328106][ T8465] netlink: 12 bytes leftover after parsing attributes in process `syz.0.842'. [ 180.333275][ T8465] netlink: 8 bytes leftover after parsing attributes in process `syz.0.842'. [ 180.358834][ T8465] veth3: entered allmulticast mode [ 180.364679][ T8465] bond1: (slave veth3): Enslaving as an active interface with a down link [ 180.376119][ T8465] bond1 (unregistering): (slave veth3): Releasing active interface [ 180.383003][ T8465] bond1 (unregistering): Released all slaves [ 180.431591][ T8462] isofs_fill_super: bread failed, dev=sr0, iso_blknum=32, block=32 [ 180.543794][ T5846] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 180.711871][ T5846] usb 6-1: Using ep0 maxpacket: 16 [ 180.742365][ T5846] usb 6-1: config index 0 descriptor too short (expected 65, got 36) [ 180.757550][ T5846] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 180.770153][ T5846] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 180.793235][ T5846] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 180.822243][ T5846] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 180.854242][ T5846] usb 6-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 180.876616][ T5846] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.004812][ T5846] usb 6-1: config 0 descriptor?? [ 181.031224][ T8466] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 181.286810][ T5846] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.0/input/input20 [ 181.441945][ T8466] 9p: Bad value for 'wfdno' [ 181.686771][ T8492] lo speed is unknown, defaulting to 1000 [ 181.692325][ T5831] usb 6-1: USB disconnect, device number 14 [ 183.435223][ T8545] overlayfs: overlapping lowerdir path [ 183.782135][ T8562] loop8: detected capacity change from 0 to 8 [ 183.793000][ T8562] loop8: [CUMANA/ADFS] p1 [ADFS] p1 [ 183.796457][ T8562] loop8: partition table partially beyond EOD, truncated [ 183.802750][ T8562] loop8: p1 size 2645487272 extends beyond EOD, truncated [ 183.833981][ T5901] udevd[5901]: inotify_add_watch(7, /dev/loop8p1, 10) failed: No such file or directory [ 183.858219][ T8567] syz.3.875 (8567): /proc/8567/oom_adj is deprecated, please use /proc/8567/oom_score_adj instead. [ 184.404495][ T8581] xt_nat: multiple ranges no longer supported [ 184.475079][ T8622] netlink: 4 bytes leftover after parsing attributes in process `syz.1.882'. [ 184.858498][ T8633] netlink: 'syz.3.886': attribute type 2 has an invalid length. [ 184.861181][ T8633] netlink: 4 bytes leftover after parsing attributes in process `syz.3.886'. [ 184.906218][ T8638] FAULT_INJECTION: forcing a failure. [ 184.906218][ T8638] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 184.910238][ T8638] CPU: 1 UID: 0 PID: 8638 Comm: syz.2.887 Tainted: G L syzkaller #0 PREEMPT(full) [ 184.910255][ T8638] Tainted: [L]=SOFTLOCKUP [ 184.910259][ T8638] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 184.910265][ T8638] Call Trace: [ 184.910269][ T8638] [ 184.910274][ T8638] dump_stack_lvl+0x100/0x190 [ 184.910289][ T8638] should_fail_ex.cold+0x5/0xa [ 184.910302][ T8638] _copy_from_user+0x2e/0xd0 [ 184.910319][ T8638] get_compat_msghdr+0xb3/0x480 [ 184.910335][ T8638] ? __pfx_get_compat_msghdr+0x10/0x10 [ 184.910353][ T8638] ? rcu_is_watching+0x12/0xc0 [ 184.910365][ T8638] ? ___sys_recvmsg+0x177/0x1a0 [ 184.910376][ T8638] ? kfree+0x1e5/0x6c0 [ 184.910385][ T8638] ? __lock_acquire+0x49f/0x1a40 [ 184.910403][ T8638] ___sys_recvmsg+0x193/0x1a0 [ 184.910415][ T8638] ? __pfx____sys_recvmsg+0x10/0x10 [ 184.910434][ T8638] ? __pfx___might_resched+0x10/0x10 [ 184.910453][ T8638] do_recvmmsg+0x54d/0x740 [ 184.910467][ T8638] ? __pfx_do_recvmmsg+0x10/0x10 [ 184.910479][ T8638] ? find_held_lock+0x2b/0x80 [ 184.910492][ T8638] ? ksys_write+0x190/0x250 [ 184.910501][ T8638] ? ksys_write+0x190/0x250 [ 184.910516][ T8638] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 184.910532][ T8638] __sys_recvmmsg+0x21f/0x270 [ 184.910548][ T8638] ? __pfx___sys_recvmmsg+0x10/0x10 [ 184.910565][ T8638] ? ksys_write+0x1ac/0x250 [ 184.910576][ T8638] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 184.910593][ T8638] ? __do_fast_syscall_32+0x98/0x970 [ 184.910608][ T8638] ? lockdep_hardirqs_on+0x78/0x100 [ 184.910620][ T8638] __do_fast_syscall_32+0xe7/0x970 [ 184.910633][ T8638] ? lockdep_hardirqs_on+0x78/0x100 [ 184.910647][ T8638] do_fast_syscall_32+0x32/0x70 [ 184.910661][ T8638] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 184.910675][ T8638] RIP: 0023:0xf703efec [ 184.910687][ T8638] Code: Unable to access opcode bytes at 0xf703efc2. [ 184.910692][ T8638] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 184.910702][ T8638] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000500 [ 184.910709][ T8638] RDX: 000000000000073d RSI: 0000000000000000 RDI: 0000000000000000 [ 184.910715][ T8638] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 184.910721][ T8638] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 184.910727][ T8638] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 184.910743][ T8638] [ 185.129016][ T8651] Invalid logical block size (16128) [ 185.344905][ T8658] syzkaller0: entered promiscuous mode [ 185.346771][ T8658] syzkaller0: entered allmulticast mode [ 186.481071][ T8690] program syz.0.906 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 187.350552][ T8713] futex_wake_op: syz.1.912 tries to shift op by -1; fix this program [ 187.543034][ T8722] lo speed is unknown, defaulting to 1000 [ 187.623926][ T5530] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 187.794107][ T5530] usb 5-1: Using ep0 maxpacket: 8 [ 187.800746][ T5530] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 187.822474][ T5530] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 187.826940][ T5530] usb 5-1: config 0 interface 0 has no altsetting 0 [ 187.832371][ T5530] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 187.839401][ T5530] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.849764][ T5530] usb 5-1: config 0 descriptor?? [ 188.312765][ T5530] hid_parser_main: 5 callbacks suppressed [ 188.312778][ T5530] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x0 [ 188.316978][ T5530] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x0 [ 188.319037][ T5530] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x0 [ 188.321168][ T5530] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x0 [ 188.323173][ T5530] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x0 [ 188.328243][ T5530] mcp2221 0003:04D8:00DD.000C: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 188.351474][ T8732] random: crng reseeded on system resumption [ 188.496923][ T8740] syzkaller0: entered promiscuous mode [ 188.505644][ T8740] syzkaller0: entered allmulticast mode [ 188.521049][ T9] usb 5-1: USB disconnect, device number 17 [ 188.686890][ T8743] overlay: Unknown parameter 'smackfsroot' [ 188.853809][ T5854] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 188.994080][ T5854] usb 8-1: device descriptor read/64, error -71 [ 189.138047][ T8750] netlink: 8 bytes leftover after parsing attributes in process `syz.0.924'. [ 189.231604][ T8726] Set syz1 is full, maxelem 65536 reached [ 189.253851][ T5854] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 189.383871][ T5854] usb 8-1: device descriptor read/64, error -71 [ 189.494113][ T5854] usb usb8-port1: attempt power cycle [ 189.506407][ T8752] netlink: 'syz.2.925': attribute type 2 has an invalid length. [ 189.508827][ T8752] netlink: 4 bytes leftover after parsing attributes in process `syz.2.925'. [ 189.843897][ T5854] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 189.885321][ T5854] usb 8-1: device descriptor read/8, error -71 [ 190.123858][ T5854] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 190.123883][ T5846] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 190.154473][ T5854] usb 8-1: device descriptor read/8, error -71 [ 190.274146][ T5854] usb usb8-port1: unable to enumerate USB device [ 190.283930][ T5846] usb 6-1: Using ep0 maxpacket: 8 [ 190.287538][ T5846] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 190.291612][ T5846] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 190.295829][ T5846] usb 6-1: config 0 interface 0 has no altsetting 0 [ 190.298442][ T5846] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 190.301065][ T5846] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.306865][ T5846] usb 6-1: config 0 descriptor?? [ 190.483930][ T846] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 190.670197][ T846] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 190.674824][ T846] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 190.675090][ T5753] Bluetooth: hci2: command 0x0406 tx timeout [ 190.675130][ T5760] Bluetooth: hci1: command 0x0406 tx timeout [ 190.675153][ T5760] Bluetooth: hci0: command 0x0406 tx timeout [ 190.680726][ T846] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 190.712350][ T846] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 190.761954][ T846] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 190.768683][ T846] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 190.771417][ T846] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 190.774337][ T846] usb 5-1: Product: syz [ 190.775658][ T846] usb 5-1: Manufacturer: syz [ 190.786928][ T846] cdc_wdm 5-1:1.0: skipping garbage [ 190.787092][ T8763] IPv6: NLM_F_CREATE should be specified when creating new route [ 190.788571][ T846] cdc_wdm 5-1:1.0: skipping garbage [ 190.803413][ T846] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 190.805683][ T846] cdc_wdm 5-1:1.0: Unknown control protocol [ 190.894278][ T5846] usbhid 6-1:0.0: can't add hid device: -71 [ 190.897907][ T5846] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 190.910387][ T5846] usb 6-1: USB disconnect, device number 15 [ 191.073333][ C2] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 191.073648][ T34] usb 5-1: USB disconnect, device number 18 [ 191.075323][ C2] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 191.075335][ C2] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 192.302324][ T8786] Illegal XDP return value 3210056014 on prog (id 121) dev N/A, expect packet loss! [ 192.516320][ T42] audit: type=1804 audit(1785139561.748:29): pid=8800 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.944" name="/newroot/241/bus/bus" dev="overlay" ino=1323 res=1 errno=0 [ 192.675954][ T8806] fuse: Unknown parameter '' [ 192.680395][ T8806] overlayfs: missing 'workdir' [ 193.121148][ T8825] netlink: 4 bytes leftover after parsing attributes in process `syz.0.953'. [ 193.592161][ T8842] syzkaller0: entered promiscuous mode [ 193.595200][ T8842] syzkaller0: entered allmulticast mode [ 193.600038][ T5794] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 193.604562][ T5794] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 193.608867][ T8842] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 193.612197][ T8842] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 193.616005][ T8842] tipc: Enabled bearer , priority 0 [ 193.619842][ T8841] tipc: Resetting bearer [ 193.636147][ T8841] tipc: Disabling bearer [ 193.688834][ C0] vcan0: j1939_tp_rxtimer: 0xffff888014173400: rx timeout, send abort [ 193.706063][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.012312][ T8852] netlink: 'syz.3.962': attribute type 2 has an invalid length. [ 194.014806][ T8852] netlink: 4 bytes leftover after parsing attributes in process `syz.3.962'. [ 194.189608][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802ae6f400: rx timeout, send abort [ 194.194520][ C0] vcan0: j1939_tp_rxtimer: 0xffff888014173400: abort rx timeout. Force session deactivation [ 194.233820][ T9] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 194.342609][ T8869] netlink: 'syz.0.968': attribute type 11 has an invalid length. [ 194.404326][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 194.408140][ T9] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 194.411460][ T9] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 194.415599][ T9] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 194.419360][ T9] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 194.423353][ T9] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 194.428960][ T9] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 194.431802][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.481463][ T8870] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 194.490807][ T5794] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 194.593915][ T5758] Bluetooth: hci2: command 0x0406 tx timeout [ 194.642991][ T9] usb 6-1: GET_CAPABILITIES returned 0 [ 194.644833][ T9] usbtmc 6-1:16.0: can't read capabilities [ 194.692918][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802ae6f400: abort rx timeout. Force session deactivation [ 194.850481][ T5746] usb 6-1: USB disconnect, device number 16 [ 194.877107][ T8885] overlayfs: failed to clone upperpath [ 194.881250][ T8885] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 194.914647][ T8885] netlink: 48 bytes leftover after parsing attributes in process `syz.0.973'. [ 195.198521][ T42] audit: type=1800 audit(1785139564.428:30): pid=8894 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=set_data cause=unavailable-hash-algorithm comm="syz.3.977" name="/newroot/248/file0" dev="tmpfs" ino=1362 res=0 errno=0 [ 195.245123][ T8898] FAULT_INJECTION: forcing a failure. [ 195.245123][ T8898] name failslab, interval 1, probability 0, space 0, times 0 [ 195.250179][ T8898] CPU: 1 UID: 0 PID: 8898 Comm: syz.3.978 Tainted: G L syzkaller #0 PREEMPT(full) [ 195.250196][ T8898] Tainted: [L]=SOFTLOCKUP [ 195.250200][ T8898] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 195.250206][ T8898] Call Trace: [ 195.250211][ T8898] [ 195.250215][ T8898] dump_stack_lvl+0x100/0x190 [ 195.250231][ T8898] should_fail_ex.cold+0x5/0xa [ 195.250242][ T8898] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 195.250254][ T8898] should_failslab+0xc2/0x120 [ 195.250270][ T8898] kmem_cache_alloc_noprof+0x91/0x6a0 [ 195.250284][ T8898] ? skb_clone+0x190/0x400 [ 195.250302][ T8898] skb_clone+0x190/0x400 [ 195.250317][ T8898] netlink_deliver_tap+0xaed/0xcc0 [ 195.250332][ T8898] netlink_unicast+0x6a5/0x850 [ 195.250345][ T8898] ? __pfx_netlink_unicast+0x10/0x10 [ 195.250356][ T8898] ? genl_rcv_msg+0x4be/0x800 [ 195.250372][ T8898] netlink_ack+0x655/0xb80 [ 195.250387][ T8898] netlink_rcv_skb+0x333/0x420 [ 195.250399][ T8898] ? __pfx_genl_rcv_msg+0x10/0x10 [ 195.250412][ T8898] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 195.250429][ T8898] ? netlink_deliver_tap+0x1ae/0xcc0 [ 195.250442][ T8898] genl_rcv+0x28/0x40 [ 195.250453][ T8898] netlink_unicast+0x585/0x850 [ 195.250466][ T8898] ? __pfx_netlink_unicast+0x10/0x10 [ 195.250482][ T8898] netlink_sendmsg+0x8b0/0xda0 [ 195.250495][ T8898] ? __pfx_netlink_sendmsg+0x10/0x10 [ 195.250509][ T8898] ? apparmor_socket_sendmsg+0x15b/0x270 [ 195.250523][ T8898] ____sys_sendmsg+0xa4d/0xbe0 [ 195.250534][ T8898] ? __pfx_netlink_sendmsg+0x10/0x10 [ 195.250546][ T8898] ? __pfx_____sys_sendmsg+0x10/0x10 [ 195.250563][ T8898] ___sys_sendmsg+0x190/0x1e0 [ 195.250576][ T8898] ? __pfx____sys_sendmsg+0x10/0x10 [ 195.250593][ T8898] ? find_held_lock+0x2b/0x80 [ 195.250615][ T8898] __sys_sendmsg+0x160/0x210 [ 195.250631][ T8898] ? __pfx___sys_sendmsg+0x10/0x10 [ 195.250650][ T8898] ? syscall_user_dispatch+0x76/0x130 [ 195.250664][ T8898] __do_fast_syscall_32+0xe7/0x970 [ 195.250678][ T8898] ? lockdep_hardirqs_on+0x78/0x100 [ 195.250697][ T8898] do_fast_syscall_32+0x32/0x70 [ 195.250711][ T8898] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 195.250725][ T8898] RIP: 0023:0xf7f07fec [ 195.250738][ T8898] Code: Unable to access opcode bytes at 0xf7f07fc2. [ 195.250743][ T8898] RSP: 002b:00000000f53c650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 195.250753][ T8898] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000180 [ 195.250760][ T8898] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 195.250766][ T8898] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 195.250772][ T8898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 195.250777][ T8898] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 195.250791][ T8898] [ 195.381559][ T8900] syz.1.979 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 195.572024][ T8908] EXT4-fs: Conflicting test_dummy_encryption options [ 195.719260][ T8913] netlink: 'syz.3.984': attribute type 1 has an invalid length. [ 195.731538][ T8913] 8021q: adding VLAN 0 to HW filter on device bond1 [ 195.747589][ T8913] 8021q: adding VLAN 0 to HW filter on device bond1 [ 195.749871][ T8913] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 195.753523][ T8913] bond1: (slave wireguard0): Error -95 calling set_mac_address [ 195.793059][ T8916] mac80211_hwsim hwsim6 wlan1: entered promiscuous mode [ 196.196148][ T8927] overlay: Bad value for 'workdir' [ 196.299254][ T8932] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 196.570041][ T8951] fuse: Bad value for 'fd' [ 196.572233][ T8951] BTRFS info: 'norecovery' is for compatibility only, recommended to use 'rescue=nologreplay' [ 196.739822][ T8966] loop5: detected capacity change from 0 to 4095 [ 196.816562][ T8966] buffer_io_error: 7 callbacks suppressed [ 196.816573][ T8966] Buffer I/O error on dev loop5, logical block 511, async page read [ 196.888235][ T5901] Buffer I/O error on dev loop5, logical block 511, async page read [ 197.373906][ T5746] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 197.553998][ T5746] usb 8-1: Using ep0 maxpacket: 16 [ 197.557710][ T5746] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 197.560994][ T5746] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 197.565801][ T5746] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 197.568704][ T5746] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 197.571183][ T5746] usb 8-1: Manufacturer: syz [ 197.574553][ T5746] usb 8-1: config 0 descriptor?? [ 197.585906][ T8981] FAULT_INJECTION: forcing a failure. [ 197.585906][ T8981] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 197.590188][ T8981] CPU: 2 UID: 0 PID: 8981 Comm: syz.1.1009 Tainted: G L syzkaller #0 PREEMPT(full) [ 197.590205][ T8981] Tainted: [L]=SOFTLOCKUP [ 197.590209][ T8981] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 197.590216][ T8981] Call Trace: [ 197.590220][ T8981] [ 197.590225][ T8981] dump_stack_lvl+0x100/0x190 [ 197.590240][ T8981] should_fail_ex.cold+0x5/0xa [ 197.590253][ T8981] save_fsave_header+0x14c/0x2f0 [ 197.590264][ T8981] ? __pfx_save_fsave_header+0x10/0x10 [ 197.590280][ T8981] ? copy_fpstate_to_sigframe+0x2b8/0xae0 [ 197.590291][ T8981] ? __local_bh_enable_ip+0x9e/0x120 [ 197.590305][ T8981] copy_fpstate_to_sigframe+0x755/0xae0 [ 197.590316][ T8981] ? do_raw_spin_lock+0x128/0x260 [ 197.590329][ T8981] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 197.590343][ T8981] ? posixtimer_deliver_signal+0x19d/0x6e0 [ 197.590356][ T8981] ? x86_task_fpu+0x5f/0x90 [ 197.590373][ T8981] get_sigframe+0x3fb/0x940 [ 197.590392][ T8981] ? __pfx_get_sigframe+0x10/0x10 [ 197.590408][ T8981] ? rcu_is_watching+0x12/0xc0 [ 197.590421][ T8981] ? siginfo_layout+0x156/0x290 [ 197.590434][ T8981] ia32_setup_rt_frame+0xe7/0xaf0 [ 197.590451][ T8981] ? __pfx_ia32_setup_rt_frame+0x10/0x10 [ 197.590468][ T8981] arch_do_signal_or_restart+0x459/0x7a0 [ 197.590486][ T8981] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 197.590516][ T8981] ? fput+0x79/0x100 [ 197.590541][ T8981] exit_to_user_mode_loop+0x139/0x6f0 [ 197.590559][ T8981] ? rcu_is_watching+0x12/0xc0 [ 197.590580][ T8981] do_int80_emulation+0x513/0x720 [ 197.590596][ T8981] asm_int80_emulation+0x1a/0x20 [ 197.590607][ T8981] RIP: 0023:0xf71c72eb [ 197.590616][ T8981] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 197.590627][ T8981] RSP: 002b:00000000f54864bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 197.590638][ T8981] RAX: 0000000000000001 RBX: 0000000000000007 RCX: 00000000f54865c0 [ 197.590644][ T8981] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 197.590650][ T8981] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 197.590656][ T8981] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 197.590662][ T8981] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 197.590674][ T8981] [ 197.785856][ T8984] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1010'. [ 198.174949][ T8990] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1005'. [ 198.620247][ T9006] netlink: 'syz.2.1018': attribute type 2 has an invalid length. [ 198.629751][ T9006] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1018'. [ 198.722889][ T9016] random: crng reseeded on system resumption [ 198.728835][ T5754] Bluetooth: hci0: unexpected event for opcode 0x042c [ 198.741110][ T9008] netlink: 'syz.1.1019': attribute type 2 has an invalid length. [ 198.743558][ T9008] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1019'. [ 198.765997][ T9018] netlink: 'syz.0.1022': attribute type 1 has an invalid length. [ 199.096258][ T9032] vfio-pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 199.132552][ T9033] IPVS: set_ctl: invalid protocol: 0 172.20.20.187:20003 [ 199.260547][ T9032] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 199.274976][ T9032] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 199.278055][ T9032] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 199.281125][ T9032] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 199.284911][ T9032] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 199.298317][ T9032] pci 0000:00:01.0: Adding to iommu group 1 [ 199.305070][ T9032] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 199.307289][ T9032] pci 0000:00:01.0: vgaarb: bridge control possible [ 199.309343][ T9032] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 199.319049][ T9032] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 199.325469][ T9032] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 199.331900][ T9032] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 199.345176][ T9032] [drm] Found bochs VGA, ID 0xb0c5. [ 199.347947][ T9032] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 199.367246][ T9032] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 199.380153][ T9032] bochs-drm 0000:00:01.0: [drm] *ERROR* fbdev: Failed to setup emulation (ret=-23) [ 199.393073][ T9035] netlink: 'syz.2.1028': attribute type 2 has an invalid length. [ 199.396793][ T9035] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1028'. [ 199.766011][ T9051] netlink: 'syz.0.1032': attribute type 64 has an invalid length. [ 199.768603][ T9051] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1032'. [ 199.771842][ T9051] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 200.130121][ T5746] usb 8-1: USB disconnect, device number 13 [ 200.585917][ T9066] netlink: 'syz.3.1037': attribute type 2 has an invalid length. [ 200.588472][ T9066] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1037'. [ 200.824953][ T9077] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1041'. [ 200.962640][ T9084] netlink: 'syz.3.1043': attribute type 16 has an invalid length. [ 200.966096][ T9084] netlink: 'syz.3.1043': attribute type 17 has an invalid length. [ 200.983864][ T9084] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.986928][ T9084] bridge0: port 2(bridge_slave_1) entered listening state [ 200.990044][ T9084] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.993052][ T9084] bridge0: port 1(bridge_slave_0) entered listening state [ 201.038533][ T9084] mac80211_hwsim hwsim6 wlan1: left promiscuous mode [ 201.049655][ T9084] bond0: left promiscuous mode [ 201.051795][ T9084] dummy0: left promiscuous mode [ 201.056803][ T9084] bond0: left allmulticast mode [ 201.058419][ T9084] dummy0: left allmulticast mode [ 201.060672][ T9084] 8021q: adding VLAN 0 to HW filter on device bond0 [ 201.066287][ T9084] veth3: left allmulticast mode [ 201.070186][ T9084] 8021q: adding VLAN 0 to HW filter on device bond1 [ 201.087068][ T9092] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1046'. [ 201.090460][ T9092] openvswitch: netlink: Missing key (keys=40, expected=100) [ 201.184339][ T9097] lo speed is unknown, defaulting to 1000 [ 201.415920][ T9105] netlink: 'syz.3.1051': attribute type 2 has an invalid length. [ 201.418328][ T9105] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1051'. [ 201.527018][ T9115] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1055'. [ 201.745643][ T9117] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1056'. [ 202.378159][ T9125] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 202.525961][ T9129] netlink: 'syz.0.1062': attribute type 2 has an invalid length. [ 202.528894][ T9129] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1062'. [ 202.588691][ T9132] usb usb8: usbfs: interface 0 claimed by hub while 'syz.3.1060' resets device [ 202.604640][ T9132] lo speed is unknown, defaulting to 1000 [ 203.628116][ T9170] netlink: 'syz.1.1074': attribute type 1 has an invalid length. [ 203.630579][ T9170] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1074'. [ 203.747033][ T9167] netlink: 'syz.0.1073': attribute type 2 has an invalid length. [ 203.749396][ T9167] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1073'. [ 203.908163][ T9188] team0: Port device bond0 removed [ 203.915417][ T5854] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 203.951612][ T9188] bond1: (slave dummy0): Releasing active interface [ 203.965212][ T9188] dummy0: left allmulticast mode [ 204.010079][ T9188] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 204.017184][ T9189] team0: Mode changed to "activebackup" [ 204.077069][ T5754] Bluetooth: hci1: unexpected event for opcode 0x1408 [ 204.176515][ T5854] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 204.475844][ T9205] netlink: 'syz.1.1084': attribute type 2 has an invalid length. [ 204.478288][ T9205] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1084'. [ 204.560230][ T9214] pimreg: tun_chr_ioctl cmd 1074025678 [ 204.561981][ T9214] pimreg: group set to 768 [ 204.624696][ T9216] veth7: entered promiscuous mode [ 204.626383][ T9216] veth7: entered allmulticast mode [ 204.679317][ T9183] ceph: No mds server is up or the cluster is laggy [ 204.708820][ T5854] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 204.809304][ T9223] overlayfs: failed to resolve './cgroup': -2 [ 205.203824][ T846] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 205.243365][ T9234] kAFS: No cell specified [ 205.363819][ T846] usb 8-1: Using ep0 maxpacket: 32 [ 205.369463][ T846] usb 8-1: config index 0 descriptor too short (expected 35577, got 27) [ 205.374436][ T846] usb 8-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 205.379511][ T846] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 205.384957][ T846] usb 8-1: config 1 has 0 interfaces, different from the descriptor's value: 92 [ 205.389106][ T42] audit: type=1804 audit(1785139573.618:31): pid=9247 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.1098" name="/newroot/265/file0" dev="tmpfs" ino=1448 res=1 errno=0 [ 205.390373][ T846] usb 8-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 205.400652][ T9247] uprobe: syz.1.1098:9247 failed to unregister, leaking uprobe [ 205.402635][ T846] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.409419][ T9245] netlink: 'syz.2.1097': attribute type 2 has an invalid length. [ 205.614161][ T846] usb 8-1: USB disconnect, device number 14 [ 205.654845][ T9266] comedi comedi0: aio_iiro_16: I/O base address or length out of range [ 205.713022][ T9271] ------------[ cut here ]------------ [ 205.716162][ T9271] !set->fb [ 205.716172][ T9271] WARNING: drivers/gpu/drm/drm_atomic.c:1951 at __drm_atomic_helper_set_config+0xa45/0xee0, CPU#0: syz.2.1107/9271 [ 205.720971][ T9271] Modules linked in: [ 205.723448][ T9271] CPU: 0 UID: 0 PID: 9271 Comm: syz.2.1107 Tainted: G L syzkaller #0 PREEMPT(full) [ 205.726976][ T9271] Tainted: [L]=SOFTLOCKUP [ 205.728653][ T9271] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 205.731749][ T9271] RIP: 0010:__drm_atomic_helper_set_config+0xa45/0xee0 [ 205.734716][ T9271] Code: 84 c0 74 09 3c 03 7f 05 e8 c8 b6 bd fc 45 89 75 38 e9 0e fb ff ff e8 fa 28 4e fc 90 0f 0b 90 e9 9f f7 ff ff e8 ec 28 4e fc 90 <0f> 0b 90 e9 47 f7 ff ff 8b 6c 24 28 e8 da 28 4e fc 49 8d 7c 24 08 [ 205.740619][ T9271] RSP: 0018:ffffc9000efb7950 EFLAGS: 00010293 [ 205.742497][ T9271] RAX: 0000000000000000 RBX: ffff888029878500 RCX: ffffffff85bb7a4b [ 205.745498][ T9271] RDX: ffff88802a308000 RSI: ffffffff85bb8374 RDI: ffff88802a308000 [ 205.747916][ T9271] RBP: ffff88802a874b00 R08: 0000000000000007 R09: fffffffffffff000 [ 205.750333][ T9271] R10: ffff888028f94c00 R11: 0000000000000000 R12: ffff888077d2d300 [ 205.752790][ T9271] R13: ffff888028f94c00 R14: ffff8880141c1400 R15: ffff88806c029368 [ 205.755567][ T9271] FS: 0000000000000000(0000) GS:ffff888096be3000(0063) knlGS:00000000571f8480 [ 205.758478][ T9271] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 205.760522][ T9271] CR2: 0000000000000000 CR3: 0000000027e6e000 CR4: 0000000000352ef0 [ 205.763167][ T9271] Call Trace: [ 205.764414][ T9271] [ 205.765343][ T9271] ? __pfx___drm_atomic_helper_set_config+0x10/0x10 [ 205.767371][ T9271] ? drm_client_rotation+0x451/0x6a0 [ 205.769004][ T9271] drm_client_modeset_commit_atomic+0x53d/0x7e0 [ 205.770926][ T9271] ? drm_client_modeset_commit_locked+0x4c/0x580 [ 205.772916][ T9271] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 205.775162][ T9271] ? drm_master_internal_acquire+0x21/0x80 [ 205.776981][ T9271] drm_client_modeset_commit_locked+0x14d/0x580 [ 205.778954][ T9271] drm_client_modeset_commit+0x4f/0x80 [ 205.780645][ T9271] __drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x137/0x160 [ 205.783058][ T9271] drm_fb_helper_restore_fbdev_mode_unlocked+0x93/0xc0 [ 205.786041][ T9271] drm_fbdev_client_restore+0x1b/0x30 [ 205.787708][ T9271] ? __pfx_drm_fbdev_client_restore+0x10/0x10 [ 205.789569][ T9271] drm_client_dev_restore+0x205/0x2a0 [ 205.791244][ T9271] drm_release+0x2c6/0x360 [ 205.792676][ T9271] ? __pfx_drm_release+0x10/0x10 [ 205.794382][ T9271] __fput+0x3ff/0xb50 [ 205.795646][ T9271] task_work_run+0x150/0x240 [ 205.797089][ T9271] ? __pfx_task_work_run+0x10/0x10 [ 205.798688][ T9271] exit_to_user_mode_loop+0x1d8/0x6f0 [ 205.800356][ T9271] ? rcu_is_watching+0x12/0xc0 [ 205.801846][ T9271] __do_fast_syscall_32+0x701/0x970 [ 205.803526][ T9271] do_fast_syscall_32+0x32/0x70 [ 205.805176][ T9271] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 205.807141][ T9271] RIP: 0023:0xf703efec [ 205.808426][ T9271] Code: Unable to access opcode bytes at 0xf703efc2. [ 205.810465][ T9271] RSP: 002b:00000000ffb3591c EFLAGS: 00000202 ORIG_RAX: 00000000000001b4 [ 205.813091][ T9271] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e [ 205.815581][ T9271] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 205.818005][ T9271] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 205.820443][ T9271] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 205.822874][ T9271] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 205.825392][ T9271] [ 205.826369][ T9271] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 205.828618][ T9271] CPU: 0 UID: 0 PID: 9271 Comm: syz.2.1107 Tainted: G L syzkaller #0 PREEMPT(full) [ 205.831883][ T9271] Tainted: [L]=SOFTLOCKUP [ 205.833246][ T9271] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 205.836331][ T9271] Call Trace: [ 205.837389][ T9271] [ 205.838313][ T9271] dump_stack_lvl+0x100/0x190 [ 205.839769][ T9271] vpanic+0x552/0x970 [ 205.841010][ T9271] ? __pfx_vpanic+0x10/0x10 [ 205.842431][ T9271] panic+0xd1/0xe0 [ 205.843659][ T9271] ? __pfx_panic+0x10/0x10 [ 205.845079][ T9271] ? check_panic_on_warn+0x1f/0x90 [ 205.846702][ T9271] check_panic_on_warn.cold+0x19/0x34 [ 205.848394][ T9271] ? __drm_atomic_helper_set_config+0xa45/0xee0 [ 205.850310][ T9271] __warn.cold+0x191/0x318 [ 205.851705][ T9271] __report_bug+0x30f/0x440 [ 205.853122][ T9271] ? __drm_atomic_helper_set_config+0xa45/0xee0 [ 205.855040][ T9271] ? __pfx___report_bug+0x10/0x10 [ 205.856614][ T9271] ? __drm_dev_dbg+0x149/0x1a0 [ 205.858108][ T9271] ? __drm_atomic_helper_set_config+0xa45/0xee0 [ 205.860034][ T9271] report_bug+0xb2/0x220 [ 205.861387][ T9271] ? __drm_atomic_helper_set_config+0xa45/0xee0 [ 205.863569][ T9271] handle_bug+0x16a/0x2a0 [ 205.865162][ T9271] exc_invalid_op+0x17/0x50 [ 205.866579][ T9271] asm_exc_invalid_op+0x1a/0x20 [ 205.868108][ T9271] RIP: 0010:__drm_atomic_helper_set_config+0xa45/0xee0 [ 205.870193][ T9271] Code: 84 c0 74 09 3c 03 7f 05 e8 c8 b6 bd fc 45 89 75 38 e9 0e fb ff ff e8 fa 28 4e fc 90 0f 0b 90 e9 9f f7 ff ff e8 ec 28 4e fc 90 <0f> 0b 90 e9 47 f7 ff ff 8b 6c 24 28 e8 da 28 4e fc 49 8d 7c 24 08 [ 205.876080][ T9271] RSP: 0018:ffffc9000efb7950 EFLAGS: 00010293 [ 205.877958][ T9271] RAX: 0000000000000000 RBX: ffff888029878500 RCX: ffffffff85bb7a4b [ 205.880386][ T9271] RDX: ffff88802a308000 RSI: ffffffff85bb8374 RDI: ffff88802a308000 [ 205.882823][ T9271] RBP: ffff88802a874b00 R08: 0000000000000007 R09: fffffffffffff000 [ 205.885262][ T9271] R10: ffff888028f94c00 R11: 0000000000000000 R12: ffff888077d2d300 [ 205.887689][ T9271] R13: ffff888028f94c00 R14: ffff8880141c1400 R15: ffff88806c029368 [ 205.890125][ T9271] ? __drm_atomic_helper_set_config+0x11b/0xee0 [ 205.892065][ T9271] ? __drm_atomic_helper_set_config+0xa44/0xee0 [ 205.894024][ T9271] ? __pfx___drm_atomic_helper_set_config+0x10/0x10 [ 205.896056][ T9271] ? drm_client_rotation+0x451/0x6a0 [ 205.897705][ T9271] drm_client_modeset_commit_atomic+0x53d/0x7e0 [ 205.899642][ T9271] ? drm_client_modeset_commit_locked+0x4c/0x580 [ 205.901610][ T9271] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 205.903716][ T9271] ? drm_master_internal_acquire+0x21/0x80 [ 205.905543][ T9271] drm_client_modeset_commit_locked+0x14d/0x580 [ 205.907488][ T9271] drm_client_modeset_commit+0x4f/0x80 [ 205.909183][ T9271] __drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x137/0x160 [ 205.911584][ T9271] drm_fb_helper_restore_fbdev_mode_unlocked+0x93/0xc0 [ 205.913720][ T9271] drm_fbdev_client_restore+0x1b/0x30 [ 205.915402][ T9271] ? __pfx_drm_fbdev_client_restore+0x10/0x10 [ 205.917306][ T9271] drm_client_dev_restore+0x205/0x2a0 [ 205.918977][ T9271] drm_release+0x2c6/0x360 [ 205.920378][ T9271] ? __pfx_drm_release+0x10/0x10 [ 205.921920][ T9271] __fput+0x3ff/0xb50 [ 205.923192][ T9271] task_work_run+0x150/0x240 [ 205.924635][ T9271] ? __pfx_task_work_run+0x10/0x10 [ 205.926229][ T9271] exit_to_user_mode_loop+0x1d8/0x6f0 [ 205.927881][ T9271] ? rcu_is_watching+0x12/0xc0 [ 205.929366][ T9271] __do_fast_syscall_32+0x701/0x970 [ 205.930982][ T9271] do_fast_syscall_32+0x32/0x70 [ 205.932508][ T9271] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 205.934490][ T9271] RIP: 0023:0xf703efec [ 205.935768][ T9271] Code: Unable to access opcode bytes at 0xf703efc2. [ 205.937811][ T9271] RSP: 002b:00000000ffb3591c EFLAGS: 00000202 ORIG_RAX: 00000000000001b4 [ 205.940358][ T9271] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 000000000000001e [ 205.942798][ T9271] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 205.945214][ T9271] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 205.947638][ T9271] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 205.950056][ T9271] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 205.952488][ T9271] [ 205.954571][ T9271] Kernel Offset: disabled [ 205.955915][ T9271] Rebooting in 86400 seconds..