last executing test programs: 4m43.710706254s ago: executing program 4 (id=3014): r0 = socket$kcm(0x10, 0x100000000002, 0x4) sched_setscheduler(0x0, 0x2, 0x0) r1 = socket(0x1e, 0x4, 0x3) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x16, 0x13, &(0x7f0000000480)=ANY=[@ANYRES16=r2], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x0, 0x10, 0x10, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r4 = getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x0, 0x8000) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r4, 0x5, &(0x7f0000000000)=0x7) r7 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r8, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r7, r8, 0x5b) keyctl$revoke(0x3, r7) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r9, 0xffffffffffffffff, 0x3f00000000000000) r10 = syz_genetlink_get_family_id$gtp(&(0x7f0000000100), r1) sendmsg$GTP_CMD_ECHOREQ(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01002bbd7000fedbdf25030000000c0003000000000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x880}, 0x24004000) socketpair$unix(0x1, 0x2, 0x0, 0x0) r11 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r11, &(0x7f0000000840)={0x11, 0x10, 0xfa00, {0x0}}, 0x18) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) 4m41.901670225s ago: executing program 4 (id=3023): fcntl$lock(0xffffffffffffffff, 0x7, 0x0) keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f0000001580)=""/4100, 0x1004) bpf$PROG_LOAD(0x5, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440), 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[], 0xe) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x84, &(0x7f0000000000), 0x90) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, 0x0) setregid(0x0, r0) getegid() r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)=@newqdisc={0x40, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r2, {0x0, 0xc}, {0xffff, 0xffff}, {0x2, 0xd}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x3f, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0xffffffffffffffff}]}}]}, 0x40}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) msgget$private(0x0, 0x3bd) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r4, 0x0, &(0x7f00000010c0)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="00000100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000180)={0x14, &(0x7f00000000c0)={0x0, 0x1, 0x60, {0x60, 0xc, "b81d7e75f81a239abbde24c13277a669ca48aafa326f3f37df491ecaf32ce5be9fb3edf4074f16b21f90189b7c64c02358a7f040dc3f217a66d91f561837a615ae0dc63f1011f0ee73c9f1e5be0f1137f9db51ce2102798ff1fc8a248b48"}}, &(0x7f0000000140)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000003c0)={0x44, &(0x7f00000001c0)={0x40, 0xb, 0x36, "7be4265440dace13bba3708951312021fa121312af3b36f15ba260fa4e79511383b903d6a7d70c487f30e88c74148d0859008f161e57"}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000240)={0x0, 0x8, 0x1, 0x7d}, &(0x7f0000000280)={0x20, 0x80, 0x1c, {0x6, 0x147c, 0x400, 0x1, 0x4, 0x6, 0x5cc1, 0x0, 0x5, 0x3, 0x3, 0x5}}, &(0x7f00000002c0)={0x20, 0x85, 0x4, 0x400}, &(0x7f0000000300)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000340)={0x20, 0x87, 0x2, 0x80}, &(0x7f0000000380)={0x20, 0x89, 0x2}}) 4m38.651105631s ago: executing program 4 (id=3031): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1e, 0x0, 0x2, 0xff}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x4, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1fe) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x210800, &(0x7f0000000280)={[{}]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000003480)={&(0x7f0000003040)=ANY=[], 0x70}, 0x1, 0x40030000000000, 0x0, 0x24040001}, 0x4800) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_CQM(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x20, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_CQM={0x4}]}, 0x20}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="210025bd7200000000003900000008000300", @ANYRES32=r8, @ANYBLOB="0c005a690800008004000104"], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000480)={&(0x7f0000000700)={0x158, 0x0, 0x400, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x7}, @NL80211_ATTR_INACTIVITY_TIMEOUT={0x6, 0x96, 0x3}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_SMPS_MODE={0x5}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x2}, @acl_policy=[@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x34, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}]}, @NL80211_ATTR_MAC_ADDRS={0x28, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_MAC_ADDRS={0x70, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @device_b}, {0xa}, {0xa}, {0xa, 0x6, @device_b}, {0xa}, {0xa}, {0xa}]}, @NL80211_ATTR_MAC_ADDRS={0x28, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa}, {0xa}]}]]}, 0x158}, 0x1, 0x0, 0x0, 0x10048000}, 0x802) rseq(&(0x7f0000000300), 0x20, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close_range(r5, 0xffffffffffffffff, 0x2) dup3(r4, r10, 0x80000) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000100)={'ip_vti0\x00', 0x0, 0x700, 0x700, 0x3, 0x2, {{0x15, 0x4, 0x1, 0x16, 0x54, 0x67, 0x0, 0x9, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@lsrr={0x83, 0xf, 0x67, [@dev={0xac, 0x14, 0x14, 0x2f}, @loopback, @loopback]}, @lsrr={0x83, 0x13, 0xa9, [@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @remote, @dev={0xac, 0x14, 0x14, 0x13}]}, @rr={0x7, 0x3, 0xbe}, @rr={0x7, 0xb, 0x85, [@dev={0xac, 0x14, 0x14, 0x28}, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @lsrr={0x83, 0x7, 0xd0, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp={0x44, 0x8, 0x21, 0x0, 0x1, [0x4]}]}}}}}) sendmsg$MPTCP_PM_CMD_REMOVE(r2, &(0x7f00000002c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x7c, r3, 0x8, 0x70bd2b, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r11}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x4) 4m38.401237975s ago: executing program 4 (id=3032): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0xfffffffc, 0x5, 0x0, 'queue0\x00', 0x10000}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000380)) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000ac0)={0x0, 0x21c, 0x3}) 4m37.953142919s ago: executing program 4 (id=3034): socket$igmp(0x2, 0x3, 0x2) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x4, @remote, 0xb}, 0x1c) syz_emit_ethernet(0xfef3, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6011010000641100fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e200e22"], 0x0) 4m36.059955047s ago: executing program 4 (id=3038): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x40000000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000000c0), 0x4) r4 = openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) tee(r3, r4, 0x101, 0xb) openat$binfmt_format(0xffffff9c, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0x0, 0x0) pipe(0x0) r6 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[{0x18, 0x110, 0xc, "aa"}, {0x18, 0x110, 0x1, '\x00'}, {0x10, 0x115}], 0x40}, 0x0) fgetxattr(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="73656375726974791700"], 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000080)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x5}]}) 3m58.42186007s ago: executing program 0 (id=3125): openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x218cc2, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000540)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000013000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="008400000000040014001a80100004800c000180"], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r4, &(0x7f00000040c0)={0x2020}, 0x2020) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xfffffffffffffffd}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) fgetxattr(r6, 0x0, &(0x7f0000000280)=""/198, 0xc6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x25dfdbfd, {0x2, 0x14, 0x10, 0x0, 0x0, 0x4, 0x0, 0x1, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4090) sendmsg$nl_route(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@ipv6_newnexthop={0x24, 0x68, 0x309, 0x0, 0x1, {}, [@NHA_BLACKHOLE={0x4}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x24}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r4, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, r3, {0x10000, 0x590f}}, './file0\x00'}) sendmsg$nl_netfilter(r13, &(0x7f00000004c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000480)={&(0x7f0000000200)={0x26c, 0x0, 0x8, 0x301, 0x70bd29, 0x25dfdbfb, {0x3, 0x0, 0x3}, [@generic="89acf95e94d9a412fdebd91eaf1e38217d84cfe31e3eebaca1ea1d8f6036e94c03bf9110bcff47829b5aaa444c46f660133d7a5396a27d72530da73e2798b5798197d72cb9c2be27b4171282c0a442c3ef9e1daed5bf6984922c08ff3cca170b051940254da48b0a74d3bd8c2bf882253a06e9b7f54ed0ecab5d93117fff4296", @generic="b07b7555f3b9bb20ffde4ac109544409d268c3d05ead72bd4cc57911423b889d7095f14f5bc9352eda97723fb59b5e60e495989fb9556af022edc02724fd75f4c3b752804dbff977d4c59de9f91a5b4f224b746d0b30c4e96354ef26b51519832bd59ea93e7f7a8bd983f0c16ac01f36b9e413cc33143ef32f72b5571174c7fd7fd3d509de6111a1c7fa6b9d857ce7dcfa6921649c96833bc4dfea1aae35807ebbed236c23927d", @generic="12340db427109c9fb347c074662273e59b40c940aa3705eb4f09d5136140b45078642d668cfc45b3437ef9f7a10cb50d399f61004c5ccb565f1a7f10e559bd4b96a01f37", @typed={0x8, 0xe8, 0x0, 0x0, @fd=r13}, @typed={0x8, 0x42, 0x0, 0x0, @ipv4=@private=0xa010100}, @typed={0xd4, 0x10b, 0x0, 0x0, @binary="c96abaa07cc9d928d13f2fc62c5d6a9821dca703333cdfb64dd31b3c06ba3a5422bb1309455260547f1b4e5d010e4c5a8436b2193f756da04b12a4110f6b39a6310b4891e20bc9a29dadb98db31bda98d0e303b61cb1c23ad5189a25453a92f0a04300ae6e5516b90838124ff9d2e47bdda22c6c9ddf28182b35fd93d12dbacbdf711467e24c1ead2e1b1fa13b7c51b3941b31cc694f812c928df5cfc158c8091499785547885ad2bdaf7fd2a8ed874c656bb6a8214f90f9eed95feb901e57567be5d0c0bcd4455a1de5cf2f7a09410c"}, @typed={0x4, 0x13c}, @typed={0x4, 0x66}]}, 0x26c}, 0x1, 0x0, 0x0, 0x24000004}, 0x80d5) 3m57.261059617s ago: executing program 0 (id=3127): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f00000007c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x7, [@struct={0x5, 0x1, 0x0, 0xf, 0x0, 0x5, [{0x4, 0x1, 0x4}]}]}, {0x0, [0x61, 0x0, 0x0, 0x61, 0x61]}}, 0x0, 0x37}, 0x28) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, 0x0, 0xb, 0x5, 0x0, 0x1000000, {0x2}, [@NFTA_COMPAT_TYPE={0x8}, @NFTA_COMPAT_NAME={0x7, 0x1, '(,\x00'}, @NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x90) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000040)={0xffffffff, 0xc, 0x80, "e13b88727b2532f77fab1ca1f1e7482a35aff9729b0031f39f4ce43df154e3d4", 0x32315258}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x5c, 0x10, 0x401, 0x400000, 0x3, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0xc574450d1af3b5a4}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x10, 0x5, 0x0, 0x1, [@IFLA_BRPORT_MULTICAST_ROUTER={0x5, 0x19, 0x3}, @IFLA_BRPORT_FLUSH={0x4}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) syz_usb_connect(0x3, 0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000401107500500000102030109023c0001010080320904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d020002"], 0x0) r5 = dup3(r4, r3, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=@updpolicy={0xc4, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xc4}}, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newspdinfo={0x1c, 0x24, 0x21, 0x0, 0x0, 0x0, [@XFRMA_SPD_IPV6_HTHRESH={0x6}]}, 0x1c}}, 0x0) sendmsg$nl_xfrm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="b80000001900674c000000000000000000000000000000000000000000000000e000000200000000000000000000000000000000000000000a"], 0xb8}}, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=@updpolicy={0xb8, 0x14, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0xfffffffffffffe9b, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000c00)={0x44, 0x0, &(0x7f0000000a80)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000080)={0x0, 0xc2ba}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r5, 0x84, 0x5, &(0x7f0000000240)={r9, @in6={{0xa, 0x4e24, 0x7ff, @loopback, 0x5}}}, 0x84) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'ipvlan0\x00'}) 3m53.732562733s ago: executing program 0 (id=3141): fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32], 0x28}, 0x1, 0x0, 0x0, 0x24008821}, 0x802) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="040e07022d0c"], 0xa) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x7, 0x2, 0x8, 0x2, 0x2}) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000340)={0x0, 0x1, 0x8, 0x11, 0x200, &(0x7f0000000d80)="1ae19327aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a730900000000fdfd000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000005000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c536689a4a62f872f9ca3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d228186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f91ffffffffd51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6ece06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a2a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0600000000000000a1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe021c773a6664b66ae04aa62c564d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000004000000000f800"}) 3m50.00329372s ago: executing program 0 (id=3147): fcntl$lock(0xffffffffffffffff, 0x7, 0x0) keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f0000001580)=""/4100, 0x1004) bpf$PROG_LOAD(0x5, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440), 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="0403"], 0xe) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x84, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, 0x0) setregid(0x0, r0) getegid() r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)=@newqdisc={0x40, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r2, {0x0, 0xc}, {0xffff, 0xffff}, {0x2, 0xd}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x3f, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0xffffffffffffffff}]}}]}, 0x40}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) msgget$private(0x0, 0x3bd) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r4, 0x0, &(0x7f00000010c0)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="00000100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000180)={0x14, &(0x7f00000000c0)={0x0, 0x1, 0x60, {0x60, 0xc, "b81d7e75f81a239abbde24c13277a669ca48aafa326f3f37df491ecaf32ce5be9fb3edf4074f16b21f90189b7c64c02358a7f040dc3f217a66d91f561837a615ae0dc63f1011f0ee73c9f1e5be0f1137f9db51ce2102798ff1fc8a248b48"}}, &(0x7f0000000140)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000003c0)={0x44, &(0x7f00000001c0)={0x40, 0xb, 0x36, "7be4265440dace13bba3708951312021fa121312af3b36f15ba260fa4e79511383b903d6a7d70c487f30e88c74148d0859008f161e57"}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000240)={0x0, 0x8, 0x1, 0x7d}, &(0x7f0000000280)={0x20, 0x80, 0x1c, {0x6, 0x147c, 0x400, 0x1, 0x4, 0x6, 0x5cc1, 0x0, 0x5, 0x3, 0x3, 0x5}}, &(0x7f00000002c0)={0x20, 0x85, 0x4, 0x400}, &(0x7f0000000300)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000340)={0x20, 0x87, 0x2, 0x80}, &(0x7f0000000380)={0x20, 0x89, 0x2}}) 3m46.637283183s ago: executing program 0 (id=3152): setns(0xc9, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000006100), 0x49f, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELFLOWTABLE={0x100, 0x18, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_FLOWTABLE_HOOK={0xec, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0xa4, 0x3, 0x0, 0x1, [{0x14, 0x1, 'bridge_slave_0\x00'}, {0x14, 0x1, 'nr0\x00'}, {0x14, 0x1, 'dummy0\x00'}, {0x14, 0x1, 'vlan0\x00'}, {0x14, 0x1, 'ip6gre0\x00'}, {0x14, 0x1, 'ip6erspan0\x00'}, {0x14, 0x1, 'ipvlan1\x00'}, {0x14, 0x1, 'netdevsim0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'bridge_slave_1\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x4}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xffff}]}]}, @NFT_MSG_NEWTABLE={0x34, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x5}, [@NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELOBJ={0x1d8, 0x14, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}, @NFTA_OBJ_USERDATA={0x72, 0x8, "3e484c65f85524511df7286eeaab5a0f76c54b630ce553112fe3a8c2692523eb32f2cff4a781b65e299779ec8ba6c0b32974f6f51fdc085898b5d781795f35882b263ada4164597f8cc724ffa5c9f4bcee4f31a1237fdb0c7f14182ba21f4eec54f5564ad1870875191807ad1074"}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_OBJ_USERDATA={0xc1, 0x8, "112dfe69391cf77ea8ae0d8690961e245f062bd28f1956194c455dc1dadb6c5d4fc6a46c27f28742b979f5c9833767cf4308d1be626e04e4abf7230ae1acdef7e92062554f1eb5425e8f76755eee2bf67b6e243b067a24cbbf9b46f44fbc82bfa4baddfaf45eeed25d513dabdbac47c0e2b648c1ea5d9e78dab0b82c899d307f2dc65a9a2965cbee48dc7e02126f8c20b5d48316ff9c2e82cc324aca47ccc0616453d55726262ec3044bc4d7efa0900f47a9095d64ded449cee3224d0d"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_USERDATA={0x3e, 0x8, "f0e779c3b6da946bfdb58e02c4e545c6326839a9305943ee598e1db3f4bf7d6163007d1c4c4587f4168580c3b7c2538451192f807191fc673ace"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x334}, 0x1, 0x0, 0x0, 0x1}, 0x8080) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f00000001c0)={[], [{@smackfsdef={'smackfsdef', 0x3d, '%'}}]}) writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000080)='X', 0x1}], 0x1) 3m43.917314291s ago: executing program 0 (id=3157): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002140)=@newlink={0x44, 0x10, 0x403, 0x3, 0x4, {0x0, 0x0, 0x74, 0x0, 0x0, 0x20156}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x1}, @IFLA_BOND_AD_USER_PORT_KEY={0x6}]}}}]}, 0x44}}, 0x4044) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000002940)={0x0, 0x0, &(0x7f0000002900)={&(0x7f0000002880)={0x38, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x2}, @NFULA_CFG_MODE={0xa, 0x2, {0x6, 0x1}}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_QTHRESH={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r3, &(0x7f0000000200)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x3e, 0x8, 0x1a1, 0x40, 0x0, 0x0, 0xfffa, 0x38, 0x1, 0xfffe, 0x1, 0x4}, [{0x3, 0x85f, 0x8, 0xd, 0x0, 0xe5, 0x8, 0x3}], "", ['\x00']}, 0x178) mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x1, 0x0) write(r4, &(0x7f0000000080)="30062a", 0x3) close(r3) r5 = inotify_init1(0x0) inotify_add_watch(r5, &(0x7f0000000000)='.\x00', 0x50007a2) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) r6 = fsopen(&(0x7f0000000140)='hugetlbfs\x00', 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$inet_tcp_TCP_ULP(r8, 0x6, 0x1f, &(0x7f0000000300), 0x3) ppoll(&(0x7f0000000180)=[{r1, 0x80}, {r2, 0x8}, {r0, 0x702}, {r2, 0x80}, {r7, 0x1441}, {r1, 0x8000}, {r0, 0xd100}], 0x7, &(0x7f00000001c0)={0x0, 0x3938700}, &(0x7f0000000200)={[0xffffffffffff58dd]}, 0x8) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000240)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) write(r9, &(0x7f0000000100)='bRequestType=0 bRequest=6 wValue=12544 wIndex=0 wLength=0\x00', 0xfe3c) io_cancel(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, 0x0, r2, &(0x7f0000000000)="8281a257ea989466a4417700f5904fe150a4ac941940f90d8b83154be3af924bd6fcd053f4a1cc509d50093ed11a19426fd4f0ffb9e3634ab3197df0f99af1b7575f252487fa0a", 0x47, 0xfff, 0x0, 0x0, r9}, &(0x7f00000000c0)) 3m27.549083486s ago: executing program 32 (id=3157): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002140)=@newlink={0x44, 0x10, 0x403, 0x3, 0x4, {0x0, 0x0, 0x74, 0x0, 0x0, 0x20156}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x1}, @IFLA_BOND_AD_USER_PORT_KEY={0x6}]}}}]}, 0x44}}, 0x4044) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000002940)={0x0, 0x0, &(0x7f0000002900)={&(0x7f0000002880)={0x38, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x2}, @NFULA_CFG_MODE={0xa, 0x2, {0x6, 0x1}}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_QTHRESH={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r3, &(0x7f0000000200)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x3e, 0x8, 0x1a1, 0x40, 0x0, 0x0, 0xfffa, 0x38, 0x1, 0xfffe, 0x1, 0x4}, [{0x3, 0x85f, 0x8, 0xd, 0x0, 0xe5, 0x8, 0x3}], "", ['\x00']}, 0x178) mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x1, 0x0) write(r4, &(0x7f0000000080)="30062a", 0x3) close(r3) r5 = inotify_init1(0x0) inotify_add_watch(r5, &(0x7f0000000000)='.\x00', 0x50007a2) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) r6 = fsopen(&(0x7f0000000140)='hugetlbfs\x00', 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$inet_tcp_TCP_ULP(r8, 0x6, 0x1f, &(0x7f0000000300), 0x3) ppoll(&(0x7f0000000180)=[{r1, 0x80}, {r2, 0x8}, {r0, 0x702}, {r2, 0x80}, {r7, 0x1441}, {r1, 0x8000}, {r0, 0xd100}], 0x7, &(0x7f00000001c0)={0x0, 0x3938700}, &(0x7f0000000200)={[0xffffffffffff58dd]}, 0x8) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000240)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) write(r9, &(0x7f0000000100)='bRequestType=0 bRequest=6 wValue=12544 wIndex=0 wLength=0\x00', 0xfe3c) io_cancel(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, 0x0, r2, &(0x7f0000000000)="8281a257ea989466a4417700f5904fe150a4ac941940f90d8b83154be3af924bd6fcd053f4a1cc509d50093ed11a19426fd4f0ffb9e3634ab3197df0f99af1b7575f252487fa0a", 0x47, 0xfff, 0x0, 0x0, r9}, &(0x7f00000000c0)) 2m54.76599561s ago: executing program 3 (id=3233): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x32}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="38000000100005070000", @ANYRES32=r2, @ANYBLOB="00000016010000001800120008000100736974000c0002000800030036"], 0x38}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x439, 0x70bd2a, 0xffffffea, {0x0, 0x0, 0xe403, r2, 0x404a8}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x40}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008004}, 0x40c0) 2m52.603893078s ago: executing program 3 (id=3236): r0 = socket(0x2, 0x3, 0x6) bind$inet(r0, &(0x7f0000000080)={0x2, 0xfffa, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f00000000c0)=0x6, 0x4) sendto$inet(r0, 0x0, 0x0, 0x48800, &(0x7f0000000000)={0x2, 0x4e24, @broadcast}, 0x10) sendto$inet(r0, &(0x7f00000023c0)="8ce2ad4d4f95e087a7846d3f", 0xc, 0x0, &(0x7f0000002400)={0x2, 0x0, @multicast2}, 0x10) 2m50.120235235s ago: executing program 3 (id=3239): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0xff8d, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e3", 0xd}], 0x2}], 0x1, 0x40800) 2m47.873802946s ago: executing program 3 (id=3241): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f00000002c0)={0xc, r1}) r2 = socket$inet(0x2, 0x2, 0x1) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010101}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2f, &(0x7f0000000200)={0x1, {{0xa, 0x4e20, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0xa4fffffb, @mcast1}}}, 0x108) write(r5, &(0x7f0000000000)="5a000300010003", 0x7) listen(0xffffffffffffffff, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd600a843500140601fe8080000000000000000000000000bbfe0000000000000000aa00004e22000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5002000090780000"], 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x1, @empty, @local, {[], {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x4, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@generic={0x3, 0x2}]}}}}}}}}, 0x0) ioctl$IOMMU_VFIO_SET_IOMMU(r0, 0x3b66, 0x1) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, &(0x7f0000000440)=ANY=[@ANYBLOB="1800007f0000000000200000000000000001"]) 2m45.899770114s ago: executing program 3 (id=3244): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) fstat(0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0x40405514, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0x3, &(0x7f0000004240)=0x40000006, 0x4) recvmsg(r1, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/233, 0xe9}, 0x10000) socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x20040600) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000140)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(0x0) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000003c0)={0x0, 0x90, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0x1, 0xffffffffffffffff}, &(0x7f0000000400), &(0x7f0000000440)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x10, 0xa, &(0x7f0000000600)=@raw=[@map_val={0x18, 0x3, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0xffffff80}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x25af}, @jmp={0x5, 0x0, 0x4, 0x2, 0x0, 0x18, 0xfffffffffffffff0}], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f0000000000)=0x10000005, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f00000005c0)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffdfffd}, [@call={0x85, 0x0, 0x0, 0x28}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e09f547ed3f02dc1fd3d6487775b", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000200)={0xeb3b, 0x3, 0x1, 0xb, 0x400, 0xffffffff, 0xd172, 0x2f44, 0x0}, &(0x7f0000000240)=0x20) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_opts(r6, 0x0, 0x5, &(0x7f0000000040)=""/1, &(0x7f0000000200)=0x1) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000280)={r5, 0xfffffff4}, &(0x7f0000000340)=0x8) r7 = add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc1}, &(0x7f0000000100)={0x0, "1ee60cd4b389fb3f075a3f64bf265ef1338730ed3fdf7f0516378370f22839363daffa7a5175b02d78b6496a22ce9234400fd1bd7abbc91f95a3b9a3a4eb0ff4", 0x33}, 0x48, 0xfffffffffffffff9) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f0000000180)='trusted\x00', &(0x7f00000001c0)) ioctl$MON_IOCG_STATS(0xffffffffffffffff, 0x80089203, &(0x7f0000000580)) r8 = syz_open_dev$mtd(&(0x7f0000000900), 0x46, 0x1) ioctl$MEMREADOOB64(r8, 0x1269, &(0x7f00000000c0)={0x1, 0x0, 0x0, 0x0}) 2m41.542779278s ago: executing program 3 (id=3247): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) capset(0x0, &(0x7f0000000040)={0x0, 0x372e, 0xfffffffc, 0x7e, 0xfffffffe}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f00000016c0), 0x121040, 0x0) (async) ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x40086603, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r2, 0x0) (async) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) ioctl$KVM_SET_FPU(r2, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0xd, 0x96, 0x0, 0x100, 0x10000, 0x1, '\x00', 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) socket$igmp(0x2, 0x3, 0x2) (async) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='net/hci\x00') syz_emit_ethernet(0x52, &(0x7f0000002700)=ANY=[@ANYBLOB="5b37182347bcffffffffffff88a80000430500"], 0x0) (async) writev(r4, &(0x7f0000000640)=[{&(0x7f0000000500)='A', 0x1}], 0x1) (async) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000480)=[@in={0x2, 0x4e21, @private=0xa010101}]}, 0x0) (async) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$MRT6_ASSERT(r7, 0x29, 0xcf, &(0x7f0000000080), 0x4) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x83, &(0x7f00000004c0)=@assoc_value={0x0}, &(0x7f0000000440)=0x8) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="160000000000000004010067528e730b3073397b6fe77d82289764000000000000", @ANYRES32=r8, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x13, 0x8, &(0x7f0000000d40)=ANY=[@ANYBLOB="b4000000000000001e1000000000000018120000", @ANYRES32=r9, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500050000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f0000000040)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, r4}, 0x94) (async) getsockopt$inet_sctp6_SCTP_STATUS(r5, 0x84, 0xe, &(0x7f0000000100)={r8, 0x7, 0x1ff, 0x2, 0xc7, 0x4, 0x7, 0x8, {0x0, @in6={{0xa, 0x4e20, 0x5, @mcast1, 0x4}}, 0x9, 0xfffffffa, 0x9, 0x7, 0x6ef}}, &(0x7f00000001c0)=0xb0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000000)={r8, 0x8}, 0x8) 2m26.046271203s ago: executing program 33 (id=3247): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) capset(0x0, &(0x7f0000000040)={0x0, 0x372e, 0xfffffffc, 0x7e, 0xfffffffe}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f00000016c0), 0x121040, 0x0) (async) ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x40086603, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r2, 0x0) (async) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) ioctl$KVM_SET_FPU(r2, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0xd, 0x96, 0x0, 0x100, 0x10000, 0x1, '\x00', 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) socket$igmp(0x2, 0x3, 0x2) (async) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='net/hci\x00') syz_emit_ethernet(0x52, &(0x7f0000002700)=ANY=[@ANYBLOB="5b37182347bcffffffffffff88a80000430500"], 0x0) (async) writev(r4, &(0x7f0000000640)=[{&(0x7f0000000500)='A', 0x1}], 0x1) (async) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000480)=[@in={0x2, 0x4e21, @private=0xa010101}]}, 0x0) (async) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$MRT6_ASSERT(r7, 0x29, 0xcf, &(0x7f0000000080), 0x4) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x83, &(0x7f00000004c0)=@assoc_value={0x0}, &(0x7f0000000440)=0x8) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="160000000000000004010067528e730b3073397b6fe77d82289764000000000000", @ANYRES32=r8, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x13, 0x8, &(0x7f0000000d40)=ANY=[@ANYBLOB="b4000000000000001e1000000000000018120000", @ANYRES32=r9, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500050000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f0000000040)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, r4}, 0x94) (async) getsockopt$inet_sctp6_SCTP_STATUS(r5, 0x84, 0xe, &(0x7f0000000100)={r8, 0x7, 0x1ff, 0x2, 0xc7, 0x4, 0x7, 0x8, {0x0, @in6={{0xa, 0x4e20, 0x5, @mcast1, 0x4}}, 0x9, 0xfffffffa, 0x9, 0x7, 0x6ef}}, &(0x7f00000001c0)=0xb0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000000)={r8, 0x8}, 0x8) 1m35.603753694s ago: executing program 1 (id=3311): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x74, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {0x0, 0x8}, {0x7, 0x10}}, [@filter_kind_options=@f_fw={{0x7}, {0x40, 0x2, [@TCA_FW_ACT={0x3c, 0x4, [@m_vlan={0x38, 0x1, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x8}}]}, 0x74}, 0x1, 0x0, 0x0, 0x80}, 0x24000880) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) fdatasync(0xffffffffffffffff) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r1, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a803f0003"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) 1m31.498088407s ago: executing program 1 (id=3313): r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000340)={r0}) r1 = fsopen(&(0x7f0000000140)='vfat\x00', 0x1) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000a80)="2a73ed35", 0x4}], 0x1}}], 0x1, 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x2, &(0x7f0000000040)='utf8', &(0x7f0000000080)="a6", 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0) ioctl$KVM_GET_MSRS_sys(r2, 0xc008ae88, &(0x7f0000000000)={0x2, 0x0, [{0x176, 0x0, 0xe7}, {0x27e, 0x0, 0x7fffffff}]}) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000000)='utf8', &(0x7f00000000c0)='/%@#\x00', 0x0) 1m29.670829799s ago: executing program 1 (id=3314): bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0800000004000000040000000500010000000000", @ANYRES32, @ANYBLOB="8000ecffffff0500000000000000000200010000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00'], 0x50) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001400add427323b472545b4560a117fffffff81000e220e227f000001925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={0x164, r3, 0x1, 0x70bd2c, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e22}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x4}, @WGDEVICE_A_PEERS={0x6c, 0x8, 0x0, 0x1, [{0x68, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x0, @loopback}}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e22, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x9}}]}]}, @WGDEVICE_A_PEERS={0xc0, 0x8, 0x0, 0x1, [{0xbc, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "60b651a05ccf4718bb4d5e8688b848a21b6bca1bac48cac74084896ac890de6a"}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x2}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "621478bc24c250853e30d67a51a47f015630de5e9267171614af683d5c40e400"}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e22, 0x40, @remote, 0x1}}]}]}]}, 0x164}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBENT(r4, 0x4b47, &(0x7f0000000180)={0x2, 0x3, 0x40}) syz_emit_ethernet(0x96, &(0x7f00000003c0)={@random="e33191a352cd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x60, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1, [{0x4, 0x7, "9595f429ae08a565c9a41d413a70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c692056"}]}}}}}}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1000, 0x103) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r5 = landlock_create_ruleset(&(0x7f0000000080)={0x1fff, 0x0, 0x3, 0x6220, 0x9}, 0x30, 0x0) landlock_restrict_self(r5, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2) ioctl$BTRFS_IOC_SUBVOL_CREATE(r1, 0x5000940e, &(0x7f0000000ac0)={{r2}, "d69ce26caaa1fa371d54b90949aef4fd276b01e30f3af683ccb39d4026df5d89b34d5ba1e2d1d0e944510ffdcb4f1dba8efc18fff5009510248237d50594d3490b1d32442223bfc9bed3fe7ee0e48471a25fe54a6be099c4b00bdd11dd62d5eeb069e10716898da1ac5e19d7f46a7f2853feeea81c5585fe8284530110d2a9d88aa1e3c02633670985a364d4db30c580cafc8533b8c7ae147db58565247fcb35a977fb7fd23b8e0ad5918ec0c40716ce0757d6cb5627f1defe50a701304bf7e0b68d4f2f6c781538926e52c5f25196511e2f86afc27ba9cfa92d3460e7696d91ab492416c2ec917462f0c69d599e4d485a48c66222553c8c752142a1f89ea7404db1042f33ed8b17fec4f9f9452fbcecd97de500f48ddec3835d033dbfca1989064d9d576f3e7bdbc797b8334b2c64a3b98d4deca1e3c7a2b67aa92cbf2ba8130f9e801e1b6e176a66205ff5cdf3926bf73646a1d51ea59d609095dea9deb809c0e7bb3ca3503e55c3433c176210f847d21175dc9726dff5dd8c59b975722e21c91f83314e6ff57898c45997a5303a9b53c4f3dd79da0555c90d17e520daec223e0ef002c9122f09804ce55a7da6b9b76544a8f4f058a8e4c024376c556fa8851c5339a7dece9ce7d7b665244168b897fabba900bac7b458e5385a8e99a16c744ee49a9f263aa84026b781725bf07aa2c184775ebb178a9366e89e892545deecc1d7f35823c03b4632dbdac56a7125b3940d53c1f9713e74b3698a533e39aa41f9a6ba027d4450563c54bae9175e119cb62c28f3898164011eedfb2701d9ea1a619105ca143fcb082c77a5366f14bc7cea22bbf31f7fc7317695b8f1e2d0436807daa3f042cf56c2f1199adf8c9edbe074c2cbca7799d30a08618463f7bf99ac952db257ad670f2446ed8a2409922dbc1de11e7831e38019fbd09a5e2c797945b98509150139a3c329c78bf7caa44b8f8224595be262d7df155d5ec2bd53956921474bbf7d7dfa5543d9fc2cd7d597fb830afc56fd63cc1f6b2ab776f6eb414339dd7bcf3321d03afb490d36bf5f223770d3175366d44e25f6ab1da5f226252319bc04499a4a216025f4a863913c14e64398a3497f159e3996d9dd0a116152db40e43dbf3a0eaad1e3052f7ca5d58bc8707f557d7e2614f98470b4a15385f0bde6da43eadf1af6c7f2e48b54c64f22456327f4271f50cb402a6e189ed516540a2eef52efe0ab96c6f56f8ffd209ebc1de5ecda977e2193d91ff45659a9a627e12d11193b09f2759ba2c095cf8f5b635339e319533b740ac69ff01a4950b1a53c5b9e0039e7494de63a5ac56852bee4717cff27df34a6d60354bea635d583ae0b763d61fcab21b79b235274c0d3b69b677a9623e2e55d73d7e19c93719f05f6601a073b4ac5f3dc65e3c5c25ca6318794082dbaf5aa38779948122f2d10ac82614560d6e16695dece72db069b4cabde8b67c2b1f4a2432fe2845d61fed239c130397d4081181cfd76f0fcfd1f73c9f94d97eae5f786ef668f093e94c91e1249d9ad0b1e7bb726673ab105e30f92cd27b1425d39ff016aae5caf916eb09aa43be31d567f18e85b97fd1c04348210fac9e81782b14b611f1f4a2f7fc3ce37cbdfb5c3a0ef58dbce77cf2ed9de6eb8bb43dd0e5605a3bd6df393899de897a97976c5e53eae2e92067d363d4427895d0d2e8f5e16911fb9ae7ac47cf24ba8389627eb4c1fef6aaf8b68c81dee9d33d3b16322ce4208d8967f2bc0fca7b56c806c6230942dedd04af482b9c56bc19c03ccc2144238806d2d460cd7367e24efd5207640191143bc2e4dfca061d309f9d15b3b04859fbcb9433d75f32cd09ec3eee11500d2b3812e729c9873bb818939d36934443a35d33de5e53b68a1a772f40ab40d322a13b91819572a61d9167454284149baadc55f8550054c5de6ceabd636b8f0416e47a7d44923cad35157f4ffecae8b7f7cc0a0ff2d86952ed6f90f45e363d60acd5442eb590cf0034f5efb68a3c3945035181e6e7fefc8fb40e27b31f3a87929b85141e4bdb335e67814f2afe6ccbfdaecd966cd7e5d46a7a555e3fca0b1175d7fb00672ca50756f340cf06c46f5b30dd826b76e8b426487bd734846dafa939134e87e12ca0c1bce81927744c8e3c09b13ae80294554ba21aadfb5114ea9091db2427268b67b2c4731fce677aeba92f33f41f177620551505e0709df7d7f67b141e69b68dafbd89845a090717989488f96f596678ce5747a104ff3293fcaca4f4c767f9930c24a1f2e640419259148155fe508645191f0727309438400aaa28f1b84a6c51b2ed4be39ec69f781144358031f3b491779054f30b356c639addfc4fcbc42b81c2bfc852ad418820fdcb06df4b24cc9dbbf9cf941e4271a7aed9c415c5393d594e62a7a0124f10dfe1b5abb87f150434e6c10e477e7c58c5421afdc306cf14e29165b62abd9d8f3f6699a2fdf30fc6791ea9aa4eff7da283826aa76aec87e923c031292619be201021dd8a1e8398b3b80bea0a46b6a2921be3ea8a5dac2dc132fc38bf866d169121f7c39673444622b17313fa9397da41e0ed5a5de122faba002cacd6e3ffc3bdc90e0a235f44abf32e806bcd540fa0d11dedcbadcbd84c6e05c0e9f39e5d1ebf6f501de0d88cce3addf3d99819d5253da3a9cd26227a2a137b14e3152467d0215e03baf272ed73dea029022008ed8b058d89614160c854eaee6afecc1d0baec29306ef21af9cff9279d58939d2c9dc923361c0fdb80aecb662005207510b538505bc4a84907bbd9e3dbe0441048acfa28c6ef5cc9022ec59a67193f613c6ce7b13bdfa02c9cd06c1fd5be44325cba1fbc56cc746884211b557381edea02eb607eebcc77df8fcc36fe8205ff5375ddccd6a97b4690f3291d49eeb5a419b95e190fed7d19957e418f5b71766a314e49cd09c436d9b8183ab62d7b8ca174b52aeaeb14c1e37e05ca9d37e367528ae2884315d72372d71d725c893f03d53e67b83fd5f59e78ce8b3ead0c35172f49199be339a0fe1f9150fa359a280b84cb7d84c90194cd8f11a3181a043c039f905a4f5c7f9548edf10eca4018e5da2967a11f492ae22126ab0ca2ecda935a2afc10c4e32bf4fabd3e9079682aeae878c20130b7eeb57f326ec189121cf71177947e543a39fafd54c4cdad80f412af9f7dfcb2a47b3c0a485fe83e78dc136c6870149232205f1aa39de8de89894ad2436f06753d2f99073a691ad0ebf7140f7b2fce2a05db6c870ed33323a2cae4ac7f007767ebcbf10436cd82436d6cb5fe991b007fea6d319d594902708fb971ccd9160b263cc4725f66b9e814a247171530906b90522212be389246845cda3af6fab326c4894532b0c55a10a9addc47dfa840a890dafd149e4453906751dccfc10f961b82ad02b6d96653d5b2254ccb68b5be4921a3d7d739aba2414fb81dce0a72df8d952ced60377de23bcdfd281fa2b06a62ae3128069cfee42fd38348e9339310cdfcbad92dd207450b7426476783691614550af28b87e1591163c0c46b2963bd1181691b74aa25839c0b97838534af2e55ac0a7c12512055e437ec5e8cff2e392a01bc638e52359d6ce20626e1de6f700cd098734ca8e2ba18e6370bfc35858be5077a61a014d1158e0c067dab29bcc8ad728fb1bb4dcd39fc47ded485f460d587e730264dd2c9f61a6f906577b5ff35d02be39391e7c7eadb046a15c80500337bcc0e3eef899ec85f7c82dfdf3a497091f39a33c07840b8842ef29c92ecf8619ec2a0c77b2d33c39420c2c35239f35ddfe98b72398f927f8d8bdfa1d86cdd6be8330db799bab7b16cde879c8420955567d0aa0411d30e9b5598573d2bf4e01722a28326c77e6b8922dcdfb85f197dadabb0365bd74c63573f400e4f53ec4ee69ade569fbf1b9984712b67fdc80ababd0d6e01fe63619b344edc237d5eae9c504d9fd7ec9d39fd2df7d11280b9b6fc3ffd0d2cb05d4b90c516d50cf00e5aa071a1c4be4ef27e17a4432a032e1d74ca03df1f40755ff4d89fc20f01192c4ba6b97a51eeccbb04adb6787424f140ee657468ba079041f06fb2d5a3f8da37bb2406ab0d5a7c9acb50e2bac6fb7f254334ce5e81a77ac6fd5dd2eb0146668b5f3ac1d77cbf8c37f746c2fcf19ba79b2b07f9e08930d165d576363324d934902c50fe841cadfed19f487b942fd2f7b709fc48fb3b561f76d24dfe35c9b8c1927fd4bb19f015ddb4d62e1f4502759f1dd33489a8fc9f97c40bd2fbf074b9af7a6eaf982f58b3ec353e9f380a658dd9b809aa97083db62ed86bbedad42a4835073aea47533a5c6236e144d6024c04421f0e18fffe7ec8dd899b1d2c007b19fbb34dc6ca3bb8e6598265919c3a3c1d74747870b5c7acb64ad5d3d7290704ef6e588031dc85493ab41f847875aa5a92864ddc79fc6685ce001ddc5992ed65d3b1f16f288f76241d96e2768ddc95dccadab9a72c31d64481a6257d8568c8f1d1f8b5abcf19d5d9e3478f9713ecdef27ff28f4827e833662d7ada0531430adac5219cfb018fe011af7da42fcb91a5c48951e98f61212967b03ee599892480fe459bfcb73c7815097945a8149aac7ab7a898fcdcef66aeb423d656f48fb24d379f078b1635d34b48c41ac4f8cf661cb3370ce96dcc8f81bbcaec7cc7be2cc3e9076646957493cb15f450e9901c2bb85bc6cd569c8f5117fe3e6e35447d996e5a89303700253ba182a58f5cf4254009e034781531fa727a7213bea5e6bdd1dd488b7060c25e0a931e4b75656e5849556e01b779123e3f4a86489e16bab9c751ced7f135ea2dc79c3d716b3a1b095164ffe58c68edae259da2d47be2733ca4b2a1ccd8345919cef6959274243c21c993cb20ee6c7faeaf39154e423c6837d6fbe00bac3d3602a1392232e97f88bba9b82ecb060f0170694ae8a2f16e13e1a1349d9fc10d0e950c2e84e34b0a367b44ea7b7e6bdf31859bfabd843f4306e785adc11e34f7369ec6e26d415bce9db78ba4e9df3b33930f165d7c1a29ef3b2e038af6e7c838396c51ac2eb99c8bc543525c96e0be6f42de70ce21346b22368e51f4711d594d2b58a9422ddbf2456463c29ce4f9a7046c8acd37401a699b2ef016b4c38faee7c4c929ca2e5e49fd441ec7366a22437a0b5a6748494c24e024492d739da409f2635a9179a7e97e7f5a91bb135611f7ff4ee92c46641bfb07584809cc7dfb99d92eb7eade84fc57e0731076e0cf164150a40ee07aacdf6848fc6629ce833a796f9e5b34f974ca6ec7b5dde2308e665988b7336927072350c5d81ba90f8bdfbc753791e68e677f8467fcf0767dfe78586839406c51b02b08c9909f4436bc733316ae4a5b74dd0513d757f2c5772cb3ad7d1e1fd22d0fe81b60ffe0c165690a7b363423f0280df9be59bbccd4c71447d1579a5a95b85d6d9f3514e9c351a232dd75acbbf37a4867dd80bde209089d0919353d91065e650432e7d416b1f93beb85bd393fd616fb5bde626a950cc9eccf781bb4544ae5951adb11bb71e2b13dd069d9ee9e267c3d9a35b5fd4f01883a6bfba682b4718fb8151fc3fcf300159d8648f724898aaeebf477f02c9851ea00f610cad4a0325cf243a13e9e44edbf6c407704afafa2fec52245d7a145bb97d03ab38caddda6bb4112e029807c2eb0077f9c43b57ed0a699735d6bce2a7fa8f41847aa245d2e8963e361f8a3a0a21849d7acb281073701e3244f45ea5a320f57abdfb2c55e8471c31f417b0e2deda683d8f1e480c058f45ff967a31ca998ef316f197da79e6d"}) 1m25.490860828s ago: executing program 1 (id=3316): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0xff8d, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="f78d9ca311b4b6302d2a5cc7d422f8ecba00"/36, 0x24}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e3", 0xd}], 0x2}], 0x1, 0x40800) 1m23.264772376s ago: executing program 1 (id=3318): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='setgroups\x00') close_range(r1, 0xffffffffffffffff, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x60, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x1}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x4840}, 0x0) 1m20.60971179s ago: executing program 1 (id=3319): openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x6000, 0x1) r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x0, 0x4}, 0xc) setsockopt$MRT6_DEL_MIF(r0, 0x29, 0xcb, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x7fffffff}, 0xc) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000040), 0x10001, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303036303030a98e90302c757365725f69643d44b6571e3c310f4a64b7606f02000000c4", @ANYRESDEC=0x0, @ANYRESDEC=0x0, @ANYBLOB=',\x00']) mount(&(0x7f00000001c0)=@filename='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='fuseblk\x00', 0x0, 0x0) quotactl$Q_GETNEXTQUOTA(0xffffffff80000900, &(0x7f0000000680)=@filename='./file0\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x401c8d1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000200)={0x3, 0x0, 0xf52, 0x1}) (fail_nth: 1) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0xd0f, 0xfffffffd, 0xffffffff, {0x60, 0x0, 0x0, 0x0, {0xffe0, 0x2}, {0xfff2, 0x10}, {0xfff3, 0xfff2}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x4c}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000844}, 0x2000c8d1) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0xfffffffd, 0xffffffffffffffff, 0x4}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r4) socket(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRES32], 0x48) ioctl$SIOCSIFHWADDR(r4, 0x8b34, 0x0) ioctl$FS_IOC_GETFSMAP(r3, 0xc0c0583b, &(0x7f0000000500)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000010000800800000000000000db450000000000000100000000000080040000000000000000000082000000000000000000000000000000000000000008000000ff00000007000000040000000000000002000000000000000200"/191]) write$cgroup_subtree(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x9) ioctl$SNAPSHOT_FREE(r3, 0x3305) r5 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r5, &(0x7f0000019300)=""/102392, 0x18ff8) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, 0x0, 0x0) 1m3.687863013s ago: executing program 34 (id=3319): openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x6000, 0x1) r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x0, 0x4}, 0xc) setsockopt$MRT6_DEL_MIF(r0, 0x29, 0xcb, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x7fffffff}, 0xc) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000040), 0x10001, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303036303030a98e90302c757365725f69643d44b6571e3c310f4a64b7606f02000000c4", @ANYRESDEC=0x0, @ANYRESDEC=0x0, @ANYBLOB=',\x00']) mount(&(0x7f00000001c0)=@filename='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='fuseblk\x00', 0x0, 0x0) quotactl$Q_GETNEXTQUOTA(0xffffffff80000900, &(0x7f0000000680)=@filename='./file0\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x401c8d1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000200)={0x3, 0x0, 0xf52, 0x1}) (fail_nth: 1) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0xd0f, 0xfffffffd, 0xffffffff, {0x60, 0x0, 0x0, 0x0, {0xffe0, 0x2}, {0xfff2, 0x10}, {0xfff3, 0xfff2}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x4c}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000844}, 0x2000c8d1) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0xfffffffd, 0xffffffffffffffff, 0x4}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r4) socket(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRES32], 0x48) ioctl$SIOCSIFHWADDR(r4, 0x8b34, 0x0) ioctl$FS_IOC_GETFSMAP(r3, 0xc0c0583b, &(0x7f0000000500)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000010000800800000000000000db450000000000000100000000000080040000000000000000000082000000000000000000000000000000000000000008000000ff00000007000000040000000000000002000000000000000200"/191]) write$cgroup_subtree(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x9) ioctl$SNAPSHOT_FREE(r3, 0x3305) r5 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r5, &(0x7f0000019300)=""/102392, 0x18ff8) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, 0x0, 0x0) 20.507395992s ago: executing program 2 (id=3351): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = openat(r0, &(0x7f0000000140)='root/proc/sys\x00', 0x10000, 0x0) fsetxattr$security_evm(r0, &(0x7f0000000180), &(0x7f00000001c0)=@md5={0x1, "afcef25a25eabc612cf1e79f80fe22a6"}, 0x11, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, 0x0, 0x4, 0x70bd29, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'macvtap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @local}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008001}, 0x20004850) lseek(r1, 0x1, 0x0) getdents64(r1, &(0x7f0000000000)=""/256, 0x100) 18.00771076s ago: executing program 2 (id=3352): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f00000002c0)={0xc, r1}) r2 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_int(r2, 0x0, 0x13, &(0x7f0000000000)=0x2, 0x4) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010101}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x6, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2f, &(0x7f0000000200)={0x1, {{0xa, 0x4e20, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0xa4fffffb, @mcast1}}}, 0x108) write(r5, &(0x7f0000000000), 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00'}, 0x1c) listen(0xffffffffffffffff, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x1, @empty, @local, {[], {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x4, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@generic={0x3, 0x2}]}}}}}}}}, 0x0) ioctl$IOMMU_VFIO_SET_IOMMU(r0, 0x3b66, 0x1) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, &(0x7f0000000440)=ANY=[@ANYBLOB="1800007f0000000000200000000000000001"]) 15.970555183s ago: executing program 2 (id=3353): mount(&(0x7f00000001c0)=@rnullb, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='jffs2\x00', 0x0, &(0x7f00000002c0)='/dev/dma_heap/system\x00') 8.280524605s ago: executing program 2 (id=3354): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x400000001, 0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000000140)=0x1, 0x4) socket(0x23, 0x4, 0xff) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg(r0, &(0x7f0000001100)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4010) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000ac0)=@newqdisc={0x78, 0x24, 0xf0b, 0x70bd2c, 0x200, {0x0, 0x0, 0x12, 0x0, {0xc, 0xd}, {0xffff, 0xffff}, {0x3, 0x5}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x853, 0x1ff, 0x43ff, 0x1, 0x8005}, 0x0, 0x10000000, 0x2, 0x5, 0x6, 0x19, 0x13, 0xa, 0x0, 0xfffffffe, {0x4, 0x2521, 0xff, 0x9, 0x81, 0x8}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x4048810}, 0x2404c040) r2 = socket$netlink(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x63) openat$fuse(0xffffffffffffff9c, &(0x7f0000000200), 0x42, 0x0) r3 = socket(0x8, 0x5, 0x0) listen(r3, 0x100) r4 = dup(r3) sendmsg$inet_sctp(r4, 0x0, 0x8054) r5 = syz_ublk_setup_io_uring(0x1943, &(0x7f0000000480)={0x0, 0x5fc5, 0x1, 0xffffffff, 0x3b5}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x12, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, 0x0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x257, 0x0, r10}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffa, 0x80800, 0x1000000, 0x10000004, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x800, 0x2, 0x146, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1, 0x2f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0xe1}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x7, 0x0, 0x0}}, 0x0) r12 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$sock_int(r12, 0x1, 0xf, &(0x7f0000000040)=0x7, 0x4) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000000000020000000900010073797a30000000002c000000030a01040000000000000000020000000900010073797a30000000000900030073797a300000000098000000060a01040000000000000000020000000900010073797a30000000000900020073797a30000000006c000480680001800a0001006d61746368000000580002800e000100686173686c696d697400000008000240000000013c000300"], 0x10c}}, 0x0) fstat(r11, &(0x7f0000000080)) 497.953665ms ago: executing program 2 (id=3355): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0xfffffffd, 0xfffffffd}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) bind$tipc(r0, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) bind$tipc(r1, 0x0, 0x0) (fail_nth: 2) 0s ago: executing program 2 (id=3356): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1e, 0x0, 0x2, 0xff}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x4, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1fe) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x210800, &(0x7f0000000280)={[{}]}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000003480)={&(0x7f0000003040)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010004200000fddbdf2502020200140002006e7230000000000000000000000000000900010073"], 0x70}, 0x1, 0x40030000000000, 0x0, 0x24040001}, 0x4800) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, 0x0, 0x4004000) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_CQM(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x20, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_CQM={0x4}]}, 0x20}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="210025bd7200000000003900000008000300", @ANYRES32=r9, @ANYBLOB="0c005a690800008004000104"], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000480)={&(0x7f0000000700)={0x158, 0x0, 0x400, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x7}, @NL80211_ATTR_INACTIVITY_TIMEOUT={0x6, 0x96, 0x3}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_SMPS_MODE={0x5}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x2}, @acl_policy=[@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x34, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}]}, @NL80211_ATTR_MAC_ADDRS={0x28, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}]}, @NL80211_ATTR_MAC_ADDRS={0x70, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @device_b}, {0xa}, {0xa}, {0xa, 0x6, @device_b}, {0xa}, {0xa}, {0xa}]}, @NL80211_ATTR_MAC_ADDRS={0x28, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa}, {0xa}]}]]}, 0x158}, 0x1, 0x0, 0x0, 0x10048000}, 0x802) rseq(&(0x7f0000000300), 0x20, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close_range(r6, 0xffffffffffffffff, 0x2) dup3(r5, r11, 0x80000) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000100)={'ip_vti0\x00', 0x0, 0x700, 0x700, 0x3, 0x2, {{0x15, 0x4, 0x1, 0x16, 0x54, 0x67, 0x0, 0x9, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@lsrr={0x83, 0xf, 0x67, [@dev={0xac, 0x14, 0x14, 0x2f}, @loopback, @loopback]}, @lsrr={0x83, 0x13, 0xa9, [@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @remote, @dev={0xac, 0x14, 0x14, 0x13}]}, @rr={0x7, 0x3, 0xbe}, @rr={0x7, 0xb, 0x85, [@dev={0xac, 0x14, 0x14, 0x28}, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @lsrr={0x83, 0x7, 0xd0, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp={0x44, 0x8, 0x21, 0x0, 0x1, [0x4]}]}}}}}) sendmsg$MPTCP_PM_CMD_REMOVE(r3, &(0x7f00000002c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x7c, r4, 0x8, 0x70bd2b, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x4) kernel console output (not intermixed with test programs): 3/0x2ce0 [ 509.817513][T12415] ? _parse_integer_limit+0x192/0x1e0 [ 509.817552][T12415] ? kstrtoull+0x12f/0x1d0 [ 509.817623][T12415] ? bpf_lsm_bpf+0x9/0x20 [ 509.817645][T12415] ? security_bpf+0x7e/0x2d0 [ 509.817677][T12415] __sys_bpf+0xa50/0xd90 [ 509.817711][T12415] ? __pfx___sys_bpf+0x10/0x10 [ 509.817738][T12415] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 509.817773][T12415] ? rt_mutex_slowunlock+0x219/0x460 [ 509.817817][T12415] ? ksys_write+0x248/0x270 [ 509.817849][T12415] ? __pfx_ksys_write+0x10/0x10 [ 509.817884][T12415] __x64_sys_bpf+0xba/0xd0 [ 509.817919][T12415] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.817944][T12415] do_syscall_64+0x174/0x580 [ 509.817973][T12415] ? trace_irq_disable+0x3b/0x140 [ 509.817995][T12415] ? clear_bhb_loop+0x40/0x90 [ 509.818023][T12415] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.818046][T12415] RIP: 0033:0x7f46f27ee019 [ 509.818067][T12415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 509.818087][T12415] RSP: 002b:00007f46f0a46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 509.818111][T12415] RAX: ffffffffffffffda RBX: 00007f46f2a75fa0 RCX: 00007f46f27ee019 [ 509.818128][T12415] RDX: 0000000000000010 RSI: 00002000000001c0 RDI: 000000000000000f [ 509.818142][T12415] RBP: 00007f46f0a46090 R08: 0000000000000000 R09: 0000000000000000 [ 509.818157][T12415] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 509.818170][T12415] R13: 00007f46f2a76038 R14: 00007f46f2a75fa0 R15: 00007ffe6f0940a8 [ 509.818213][T12415] [ 510.920276][T12417] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2430'. [ 511.305587][T12437] overlayfs: cannot append lower layer [ 511.336194][T12437] 9pnet_fd: Insufficient options for proto=fd [ 511.845713][T12451] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 511.851634][T12451] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 511.860337][T12451] vhci_hcd vhci_hcd.0: Device attached [ 512.558918][T12452] vhci_hcd: connection closed [ 512.575203][ T12] vhci_hcd vhci_hcd.0: stop threads [ 512.575293][ T12] vhci_hcd vhci_hcd.0: release socket [ 512.575480][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 512.644182][ T820] usb 34-1: enqueue for inactive port 0 [ 514.042223][ T820] usb usb34-port1: attempt power cycle [ 514.272303][T12469] FAULT_INJECTION: forcing a failure. [ 514.272303][T12469] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 514.272341][T12469] CPU: 0 UID: 0 PID: 12469 Comm: syz.0.2448 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 514.272366][T12469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 514.272380][T12469] Call Trace: [ 514.272388][T12469] [ 514.272397][T12469] dump_stack_lvl+0xe8/0x150 [ 514.272438][T12469] should_fail_ex+0x467/0x600 [ 514.272481][T12469] _copy_from_iter+0x1d3/0x1660 [ 514.272505][T12469] ? smk_ipv4_check+0xef/0x6f0 [ 514.272566][T12469] ? __pfx__copy_from_iter+0x10/0x10 [ 514.272600][T12469] ? raw_sendmsg+0x6b8/0x1a20 [ 514.272638][T12469] raw_sendmsg+0x10a0/0x1a20 [ 514.272687][T12469] ? __pfx_raw_sendmsg+0x10/0x10 [ 514.272716][T12469] ? __lock_acquire+0x683/0x2ce0 [ 514.272765][T12469] ? __pfx_smack_socket_sendmsg+0x10/0x10 [ 514.272815][T12469] ? sock_rps_record_flow+0x19/0x350 [ 514.272855][T12469] ? inet_sendmsg+0x298/0x320 [ 514.272899][T12469] ? __pfx_inet_sendmsg+0x10/0x10 [ 514.272941][T12469] sock_sendmsg_nosec+0x10e/0x180 [ 514.272979][T12469] __sys_sendto+0x41e/0x5d0 [ 514.273015][T12469] ? __pfx___sys_sendto+0x10/0x10 [ 514.273072][T12469] ? __pfx_ksys_write+0x10/0x10 [ 514.273113][T12469] __x64_sys_sendto+0xde/0x100 [ 514.273140][T12469] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 514.273166][T12469] do_syscall_64+0x174/0x580 [ 514.273196][T12469] ? trace_irq_disable+0x3b/0x140 [ 514.273219][T12469] ? clear_bhb_loop+0x40/0x90 [ 514.273257][T12469] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 514.273281][T12469] RIP: 0033:0x7f46f27ee019 [ 514.273303][T12469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 514.273323][T12469] RSP: 002b:00007f46f0a46028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 514.273347][T12469] RAX: ffffffffffffffda RBX: 00007f46f2a75fa0 RCX: 00007f46f27ee019 [ 514.273363][T12469] RDX: 000000000000ffec RSI: 0000200000000040 RDI: 0000000000000003 [ 514.273376][T12469] RBP: 00007f46f0a46090 R08: 0000200000000340 R09: 0000000000000010 [ 514.273398][T12469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 514.273411][T12469] R13: 00007f46f2a76038 R14: 00007f46f2a75fa0 R15: 00007ffe6f0940a8 [ 514.273443][T12469] [ 514.651470][T12475] overlayfs: cannot append lower layer [ 514.686640][T12475] 9pnet_fd: Insufficient options for proto=fd [ 514.803532][ T820] usb usb34-port1: unable to enumerate USB device [ 515.436840][T12490] overlayfs: cannot append lower layer [ 515.482658][T12490] 9pnet_fd: Insufficient options for proto=fd [ 515.653673][T12495] netlink: 'syz.0.2459': attribute type 61 has an invalid length. [ 515.662619][ T5606] Bluetooth: hci0: unexpected event for opcode 0x0c2d [ 516.740084][T12501] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2461'. [ 516.740205][T12501] netlink: 7 bytes leftover after parsing attributes in process `syz.0.2461'. [ 517.129070][T12511] overlayfs: cannot append lower layer [ 517.187301][T12511] 9pnet_fd: Insufficient options for proto=fd [ 517.370796][T12521] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2469'. [ 518.184038][T12545] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 518.184137][T12545] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 518.187331][T12545] vhci_hcd vhci_hcd.0: Device attached [ 518.839519][T12546] vhci_hcd: connection closed [ 518.852035][ T13] vhci_hcd vhci_hcd.4: stop threads [ 518.852106][ T13] vhci_hcd vhci_hcd.4: release socket [ 518.852269][ T13] vhci_hcd vhci_hcd.4: disconnect device [ 519.243579][T12552] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2478'. [ 519.716230][ T5606] Bluetooth: hci0: unexpected event for opcode 0x0c2d [ 519.880571][T12559] overlayfs: cannot append lower layer [ 519.916924][T12559] 9pnet_fd: Insufficient options for proto=fd [ 520.193511][ T37] audit: type=1326 audit(1785541772.059:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12565 comm="syz.1.2483" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 520.193880][ T37] audit: type=1326 audit(1785541772.059:485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12565 comm="syz.1.2483" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 520.197742][ T37] audit: type=1326 audit(1785541772.059:486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12565 comm="syz.1.2483" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 520.200397][ T37] audit: type=1326 audit(1785541772.059:487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12565 comm="syz.1.2483" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 520.202363][ T37] audit: type=1326 audit(1785541772.059:488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12565 comm="syz.1.2483" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 520.202672][ T37] audit: type=1326 audit(1785541772.059:489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12565 comm="syz.1.2483" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=292 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 520.203589][ T5755] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 520.224236][ T37] audit: type=1326 audit(1785541772.079:490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12565 comm="syz.1.2483" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 520.373608][ T37] audit: type=1326 audit(1785541772.149:491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12565 comm="syz.1.2483" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 520.426644][ T37] audit: type=1326 audit(1785541772.289:492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12565 comm="syz.1.2483" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 520.426709][ T37] audit: type=1326 audit(1785541772.289:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12565 comm="syz.1.2483" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 520.563388][ T5755] usb 1-1: Using ep0 maxpacket: 16 [ 520.566045][ T5755] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 520.566077][ T5755] usb 1-1: config 0 interface 0 has no altsetting 0 [ 520.566109][ T5755] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 520.566130][ T5755] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 520.658012][ T5755] usb 1-1: config 0 descriptor?? [ 521.034042][T12585] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2488'. [ 521.333240][ T5755] nzxt-smart2 0003:1E71:2009.0005: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.0-1/input0 [ 521.959615][ T5755] usb 1-1: USB disconnect, device number 23 [ 521.962359][T12604] overlayfs: cannot append lower layer [ 522.004650][T12604] 9pnet_fd: Insufficient options for proto=fd [ 522.724662][ T5603] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 522.886245][ T5603] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 522.886279][ T5603] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 522.915169][ T5603] usb 5-1: config 0 descriptor?? [ 522.937565][ T5603] cp210x 5-1:0.0: cp210x converter detected [ 523.294233][ T5606] Bluetooth: hci0: unexpected event for opcode 0x0c2d [ 523.329260][ T5603] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 523.438655][ T5603] usb 5-1: cp210x converter now attached to ttyUSB0 [ 523.569858][ T5603] usb 5-1: USB disconnect, device number 15 [ 523.630962][ T5603] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 523.895694][ T5603] cp210x 5-1:0.0: device disconnected [ 524.228994][T12650] overlayfs: cannot append lower layer [ 524.255595][T12650] 9pnet_fd: Insufficient options for proto=fd [ 524.429099][T12656] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2513'. [ 524.429218][T12656] bridge_slave_1: left promiscuous mode [ 524.482443][T12656] bridge0: port 2(bridge_slave_1) entered disabled state [ 524.787580][T12656] bridge_slave_0: left allmulticast mode [ 524.787616][T12656] bridge_slave_0: left promiscuous mode [ 524.787872][T12656] bridge0: port 1(bridge_slave_0) entered disabled state [ 525.032975][ T5714] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 525.199191][ T5714] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 525.199227][ T5714] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 525.206443][ T5714] usb 5-1: New USB device found, idVendor=0bda, idProduct=8152, bcdDevice=30.11 [ 525.206530][ T5714] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.206552][ T5714] usb 5-1: Product: syz [ 525.206596][ T5714] usb 5-1: Manufacturer: syz [ 525.206640][ T5714] usb 5-1: SerialNumber: syz [ 525.272049][ T5714] r8152-cfgselector 5-1: Unknown version 0x0000 [ 525.397919][T12675] FAULT_INJECTION: forcing a failure. [ 525.397919][T12675] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 525.397960][T12675] CPU: 0 UID: 0 PID: 12675 Comm: syz.0.2521 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 525.397985][T12675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 525.397998][T12675] Call Trace: [ 525.398007][T12675] [ 525.398016][T12675] dump_stack_lvl+0xe8/0x150 [ 525.398055][T12675] should_fail_ex+0x467/0x600 [ 525.398096][T12675] _copy_from_user+0x2d/0xb0 [ 525.398123][T12675] ucma_write+0x166/0x2f0 [ 525.398152][T12675] ? __pfx_ucma_write+0x10/0x10 [ 525.398175][T12675] ? security_file_permission+0x75/0x260 [ 525.398202][T12675] ? rw_verify_area+0x209/0x4d0 [ 525.398233][T12675] ? __pfx_ucma_write+0x10/0x10 [ 525.398255][T12675] vfs_write+0x29f/0xbb0 [ 525.398291][T12675] ? __pfx_vfs_write+0x10/0x10 [ 525.398320][T12675] ? __fget_files+0x2a/0x420 [ 525.398346][T12675] ? __fget_files+0x2a/0x420 [ 525.398366][T12675] ? __fget_files+0x3a8/0x420 [ 525.398388][T12675] ? __fget_files+0x2a/0x420 [ 525.398418][T12675] ksys_write+0x156/0x270 [ 525.398450][T12675] ? __pfx_ksys_write+0x10/0x10 [ 525.398487][T12675] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 525.398512][T12675] do_syscall_64+0x174/0x580 [ 525.398542][T12675] ? clear_bhb_loop+0x40/0x90 [ 525.398570][T12675] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 525.398591][T12675] RIP: 0033:0x7f46f27ee019 [ 525.398612][T12675] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 525.398630][T12675] RSP: 002b:00007f46f0a46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 525.398654][T12675] RAX: ffffffffffffffda RBX: 00007f46f2a75fa0 RCX: 00007f46f27ee019 [ 525.398670][T12675] RDX: 00000000000000a0 RSI: 0000200000000240 RDI: 0000000000000003 [ 525.398684][T12675] RBP: 00007f46f0a46090 R08: 0000000000000000 R09: 0000000000000000 [ 525.398699][T12675] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 525.398713][T12675] R13: 00007f46f2a76038 R14: 00007f46f2a75fa0 R15: 00007ffe6f0940a8 [ 525.398748][T12675] [ 526.113278][ T5714] r8152-cfgselector 5-1: Unknown version 0x0000 [ 526.228192][ T5714] r8152-cfgselector 5-1: USB disconnect, device number 16 [ 527.802781][ T5603] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 527.940993][T12727] bpf: Bad value for 'mode' [ 527.955596][ T5603] usb 5-1: config index 0 descriptor too short (expected 1572, got 36) [ 527.955632][ T5603] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 527.958774][ T5603] usb 5-1: New USB device found, idVendor=05ac, idProduct=0238, bcdDevice= 0.40 [ 527.958808][ T5603] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.958832][ T5603] usb 5-1: Product: syz [ 527.958849][ T5603] usb 5-1: Manufacturer: syz [ 527.958867][ T5603] usb 5-1: SerialNumber: syz [ 528.095703][ T820] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 528.110551][ T5603] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input11 [ 528.245977][ T820] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 528.246009][ T820] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 528.282108][ T820] usb 1-1: config 0 descriptor?? [ 528.299247][ T820] cp210x 1-1:0.0: cp210x converter detected [ 528.353258][ T4949] bcm5974 5-1:1.0: could not read from device [ 528.357459][ T5603] usb 5-1: USB disconnect, device number 17 [ 528.697390][ T820] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 528.816193][ T820] usb 1-1: cp210x converter now attached to ttyUSB0 [ 528.911721][ T5755] usb 1-1: USB disconnect, device number 24 [ 529.087377][ T5755] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 529.339943][ T5755] cp210x 1-1:0.0: device disconnected [ 529.415528][T12750] bpf: Bad value for 'mode' [ 530.225499][ T37] kauditd_printk_skb: 22 callbacks suppressed [ 530.225520][ T37] audit: type=1326 audit(1785541782.090:516): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12772 comm="syz.2.2559" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3e397e019 code=0x7ffc0000 [ 530.225650][ T37] audit: type=1326 audit(1785541782.090:517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12772 comm="syz.2.2559" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3e397e019 code=0x7ffc0000 [ 530.226128][ T37] audit: type=1326 audit(1785541782.090:518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12772 comm="syz.2.2559" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3e397e019 code=0x7ffc0000 [ 530.226364][ T37] audit: type=1326 audit(1785541782.090:519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12772 comm="syz.2.2559" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3e397e019 code=0x7ffc0000 [ 530.226532][ T37] audit: type=1326 audit(1785541782.090:520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12772 comm="syz.2.2559" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3e397e019 code=0x7ffc0000 [ 530.226708][ T37] audit: type=1326 audit(1785541782.090:521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12772 comm="syz.2.2559" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=166 compat=0 ip=0x7fc3e397e019 code=0x7ffc0000 [ 530.227099][ T37] audit: type=1326 audit(1785541782.090:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12772 comm="syz.2.2559" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3e397e019 code=0x7ffc0000 [ 530.227287][ T37] audit: type=1326 audit(1785541782.090:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12772 comm="syz.2.2559" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3e397e019 code=0x7ffc0000 [ 530.227427][ T37] audit: type=1326 audit(1785541782.090:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12772 comm="syz.2.2559" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3e397e019 code=0x7ffc0000 [ 530.227671][ T37] audit: type=1326 audit(1785541782.090:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12772 comm="syz.2.2559" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc3e397e019 code=0x7ffc0000 [ 530.954021][ T10] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 531.005006][T12786] bpf: Bad value for 'mode' [ 531.104948][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 531.108380][ T10] usb 5-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice= 1.41 [ 531.108413][ T10] usb 5-1: New USB device strings: Mfr=0, Product=246, SerialNumber=2 [ 531.108444][ T10] usb 5-1: Product: syz [ 531.108460][ T10] usb 5-1: SerialNumber: syz [ 531.177495][ T10] usb 5-1: config 0 descriptor?? [ 531.271426][ T10] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 531.596884][ T10] usb 5-1: Detected SIO [ 531.602341][ T10] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 531.637175][T12778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 531.637791][T12778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 533.012227][T12778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 533.013140][T12778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 533.920734][ T31] usb 5-1: USB disconnect, device number 18 [ 534.155258][ T31] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 534.170091][ T31] ftdi_sio 5-1:0.0: device disconnected [ 534.777250][T12819] bpf: Bad value for 'mode' [ 535.121799][T12821] bridge0: port 2(bridge_slave_1) entered disabled state [ 535.666329][T12839] overlayfs: cannot append lower layer [ 535.768698][T12834] 9pnet_fd: Insufficient options for proto=fd [ 535.802671][ T37] kauditd_printk_skb: 8 callbacks suppressed [ 535.802691][ T37] audit: type=1326 audit(1785541787.660:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12838 comm="syz.3.2584" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7fde1780ee09 code=0x7ffc0000 [ 535.802743][ T37] audit: type=1326 audit(1785541787.670:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12838 comm="syz.3.2584" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde1780e019 code=0x7ffc0000 [ 535.802792][ T37] audit: type=1326 audit(1785541787.670:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12838 comm="syz.3.2584" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde1780e019 code=0x7ffc0000 [ 535.808703][ T37] audit: type=1326 audit(1785541787.670:537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12838 comm="syz.3.2584" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=273 compat=0 ip=0x7fde177ca46c code=0x7ffc0000 [ 535.808748][ T37] audit: type=1326 audit(1785541787.670:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12838 comm="syz.3.2584" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7fde177ca4ce code=0x7ffc0000 [ 535.808782][ T37] audit: type=1326 audit(1785541787.670:539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12838 comm="syz.3.2584" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde1780e019 code=0x7ffc0000 [ 535.812916][ T37] audit: type=1326 audit(1785541787.670:540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12838 comm="syz.3.2584" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7fde177cad7b code=0x7ffc0000 [ 535.812974][ T37] audit: type=1326 audit(1785541787.670:541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12838 comm="syz.3.2584" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde1780e019 code=0x7ffc0000 [ 535.813165][ T37] audit: type=1326 audit(1785541787.670:542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12838 comm="syz.3.2584" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde1780e019 code=0x7ffc0000 [ 535.813476][ T37] audit: type=1326 audit(1785541787.670:543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12838 comm="syz.3.2584" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fde1780dcab code=0x7ffc0000 [ 535.962897][T12840] fuse: fd is not a fuse device [ 536.285130][T12848] netlink: 'syz.0.2587': attribute type 2 has an invalid length. [ 536.285154][T12848] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2587'. [ 536.607296][T12853] bpf: Bad value for 'mode' [ 537.333848][T12829] Bluetooth: hci0: command 0x0406 tx timeout [ 538.955997][T12884] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2600'. [ 539.354910][T12889] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 539.354939][T12889] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 539.355036][T12889] vhci_hcd vhci_hcd.0: Device attached [ 539.380611][T12889] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(6) [ 539.380714][T12889] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 539.380848][T12889] vhci_hcd vhci_hcd.0: Device attached [ 539.482571][T12894] sctp: [Deprecated]: syz.4.2601 (pid 12894) Use of int in maxseg socket option. [ 539.482571][T12894] Use struct sctp_assoc_value instead [ 539.561278][T12889] ip6gre2: entered promiscuous mode [ 539.561299][T12889] ip6gre2: entered allmulticast mode [ 539.628356][T12890] vhci_hcd: connection closed [ 539.629755][T12892] vhci_hcd: connection closed [ 539.630141][ T12] vhci_hcd vhci_hcd.4: stop threads [ 539.630160][ T12] vhci_hcd vhci_hcd.4: release socket [ 539.630227][ T12] vhci_hcd vhci_hcd.4: disconnect device [ 539.631491][ T12] vhci_hcd vhci_hcd.4: stop threads [ 539.631505][ T12] vhci_hcd vhci_hcd.4: release socket [ 539.631666][ T12] vhci_hcd vhci_hcd.4: disconnect device [ 539.653035][ T5714] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 539.869390][T12903] bpf: Bad value for 'mode' [ 539.983052][T12898] ªªªªªª: renamed from vlan0 (while UP) [ 540.037137][T12901] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2602'. [ 540.104541][T12901] unsupported nlmsg_type 40 [ 542.882586][T12933] netlink: 'syz.1.2613': attribute type 7 has an invalid length. [ 543.825711][ T5603] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 544.783851][ T5603] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 544.783876][ T5603] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 544.851390][ T5603] usb 5-1: config 0 descriptor?? [ 544.878882][ T5603] cp210x 5-1:0.0: cp210x converter detected [ 545.220144][T12949] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2622'. [ 545.288761][ T5603] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 545.496144][ T5603] usb 5-1: cp210x converter now attached to ttyUSB0 [ 545.792776][ T5603] usb 5-1: USB disconnect, device number 19 [ 546.698867][ T5603] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 546.935850][ T5603] cp210x 5-1:0.0: device disconnected [ 547.187898][T12960] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2626'. [ 550.592324][T13017] netlink: 'syz.2.2644': attribute type 21 has an invalid length. [ 551.130239][T13028] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2651'. [ 551.211197][ T5606] Bluetooth: hci3: unexpected event for opcode 0x0c47 [ 552.360808][T13043] FAULT_INJECTION: forcing a failure. [ 552.360808][T13043] name failslab, interval 1, probability 0, space 0, times 0 [ 552.360846][T13043] CPU: 1 UID: 0 PID: 13043 Comm: syz.4.2656 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 552.360872][T13043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 552.360886][T13043] Call Trace: [ 552.360894][T13043] [ 552.360904][T13043] dump_stack_lvl+0xe8/0x150 [ 552.360946][T13043] should_fail_ex+0x467/0x600 [ 552.360992][T13043] should_failslab+0xa8/0x100 [ 552.361023][T13043] kmem_cache_alloc_noprof+0xa4/0x650 [ 552.361047][T13043] ? copy_fs_struct+0x4f/0x270 [ 552.361068][T13043] ? copy_fs_struct+0x4f/0x270 [ 552.361098][T13043] copy_fs_struct+0x4f/0x270 [ 552.361123][T13043] __se_sys_setns+0x422/0x1b80 [ 552.361173][T13043] ? __pfx___se_sys_setns+0x10/0x10 [ 552.361214][T13043] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.361238][T13043] do_syscall_64+0x174/0x580 [ 552.361268][T13043] ? trace_irq_disable+0x3b/0x140 [ 552.361290][T13043] ? clear_bhb_loop+0x40/0x90 [ 552.361319][T13043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.361341][T13043] RIP: 0033:0x7ff0ee96e019 [ 552.361363][T13043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 552.361383][T13043] RSP: 002b:00007ff0ecbc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000134 [ 552.361407][T13043] RAX: ffffffffffffffda RBX: 00007ff0eebf5fa0 RCX: 00007ff0ee96e019 [ 552.361424][T13043] RDX: 0000000000000000 RSI: 0000000008020000 RDI: 0000000000000003 [ 552.361438][T13043] RBP: 00007ff0ecbc6090 R08: 0000000000000000 R09: 0000000000000000 [ 552.361452][T13043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 552.361466][T13043] R13: 00007ff0eebf6038 R14: 00007ff0eebf5fa0 R15: 00007ffdca283a68 [ 552.361503][T13043] [ 552.703822][T13045] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2657'. [ 554.063250][T13055] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2657'. [ 554.063346][T13045] veth1_macvtap: left promiscuous mode [ 554.071499][T13045] macsec0: entered promiscuous mode [ 554.071572][T13045] macsec0: entered allmulticast mode [ 554.152337][T13054] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 554.152519][T13054] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 554.160307][T13054] vhci_hcd vhci_hcd.0: Device attached [ 554.641936][ T31] usb 42-1: SetAddress Request (11) to port 0 [ 554.642177][ T31] usb 42-1: new SuperSpeed USB device number 11 using vhci_hcd [ 555.203342][T13056] vhci_hcd: connection reset by peer [ 555.286357][ T66] vhci_hcd vhci_hcd.4: stop threads [ 555.286429][ T66] vhci_hcd vhci_hcd.4: release socket [ 555.286738][ T66] vhci_hcd vhci_hcd.4: disconnect device [ 555.884458][T13068] overlayfs: cannot append lower layer [ 555.891411][T13048] veth1_macvtap: entered promiscuous mode [ 555.891440][T13048] veth1_macvtap: entered allmulticast mode [ 555.891828][T13048] macsec0: left promiscuous mode [ 555.892044][T13048] macsec0: left allmulticast mode [ 555.892056][T13048] veth1_macvtap: left allmulticast mode [ 555.933468][ T5603] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 555.976282][T13069] 9pnet_fd: Insufficient options for proto=fd [ 556.093502][ T5603] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 556.093536][ T5603] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 556.122225][ T5603] usb 1-1: config 0 descriptor?? [ 556.129701][ T5603] cp210x 1-1:0.0: cp210x converter detected [ 556.535587][ T5603] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 556.537000][ T5603] cp210x 1-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 556.537031][ T5603] cp210x 1-1:0.0: GPIO initialisation failed: -71 [ 556.634994][ T5603] usb 1-1: cp210x converter now attached to ttyUSB0 [ 556.639895][ T5603] usb 1-1: USB disconnect, device number 25 [ 556.687277][ T5603] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 556.688091][ T5603] cp210x 1-1:0.0: device disconnected [ 556.734618][ T5606] Bluetooth: hci4: unexpected event for opcode 0x0c47 [ 557.230614][T13093] bpf: Bad value for 'mode' [ 558.886189][T13099] overlayfs: cannot append lower layer [ 558.915741][T13099] 9pnet_fd: Insufficient options for proto=fd [ 559.693620][T13115] kAFS: unable to lookup cell '(,c¾Ì' [ 560.227956][T13118] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2680'. [ 560.569270][ T31] usb 42-1: device descriptor read/8, error -110 [ 560.802856][T13124] bpf: Bad value for 'mode' [ 560.981114][ T31] usb usb42-port1: attempt power cycle [ 561.171872][ T5727] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 561.450928][ T5727] usb 1-1: device descriptor read/64, error -71 [ 561.581763][T13133] overlayfs: cannot append lower layer [ 561.598347][ T31] usb usb42-port1: unable to enumerate USB device [ 561.638140][T13136] 9pnet_fd: Insufficient options for proto=fd [ 561.690919][ T5727] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 561.820881][ T5727] usb 1-1: device descriptor read/64, error -71 [ 562.095033][T13142] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 562.095231][T13142] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 562.096050][T13142] vhci_hcd vhci_hcd.0: Device attached [ 562.102045][ T5727] usb usb1-port1: attempt power cycle [ 563.038268][ T197] usb 42-1: SetAddress Request (15) to port 0 [ 563.097046][ T197] usb 42-1: new SuperSpeed USB device number 15 using vhci_hcd [ 564.041514][T13144] vhci_hcd: connection reset by peer [ 564.042764][ T45] vhci_hcd vhci_hcd.4: stop threads [ 564.042790][ T45] vhci_hcd vhci_hcd.4: release socket [ 564.121745][ T45] vhci_hcd vhci_hcd.4: disconnect device [ 564.800184][T13151] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2692'. [ 565.067893][ T5727] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 565.290706][ T5727] usb 1-1: device not accepting address 28, error -71 [ 565.363034][T13158] bpf: Bad value for 'mode' [ 565.698033][T13170] overlayfs: cannot append lower layer [ 565.808814][T13174] 9p: Bad value for 'wfdno' [ 567.588348][T13193] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2708'. [ 567.921106][T13201] bpf: Bad value for 'mode' [ 568.210703][ T197] usb 42-1: device descriptor read/8, error -110 [ 568.530669][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.530746][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 568.982476][ T197] usb usb42-port1: attempt power cycle [ 570.830017][T13226] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2717'. [ 571.663202][T13237] bpf: Bad value for 'mode' [ 571.665457][ T197] usb usb42-port1: unable to enumerate USB device [ 572.176418][T13247] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2727'. [ 572.176498][T13247] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2727'. [ 572.922823][T13247] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2727'. [ 572.922852][T13247] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2727'. [ 573.847613][ T1062] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 573.849856][T11206] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 573.849891][T11206] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 573.849918][T11206] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 574.308440][T13260] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2732'. [ 574.326160][T13273] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2734'. [ 574.600724][T13277] bpf: Bad value for 'mode' [ 575.063894][T13283] bpf: Bad value for 'mode' [ 575.480078][ T5714] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 575.638740][ T5606] Bluetooth: hci0: ISO packet too small [ 575.640057][ T5714] usb 5-1: Using ep0 maxpacket: 16 [ 575.658240][ T5714] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 575.659476][ T5714] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 575.659513][ T5714] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 575.659536][ T5714] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 575.659561][ T5714] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 575.680015][ T5714] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 575.680050][ T5714] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 575.680071][ T5714] usb 5-1: Manufacturer: syz [ 575.809697][T13302] bpf: Bad value for 'mode' [ 575.811429][ T5714] usb 5-1: config 0 descriptor?? [ 576.670306][ T5714] rc_core: IR keymap rc-hauppauge not found [ 576.670329][ T5714] Registered IR keymap rc-empty [ 576.670981][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 576.690313][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 576.747513][ T5714] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 576.800894][ T5714] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input12 [ 576.827443][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 576.840304][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 576.860276][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 576.880153][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 576.900272][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 576.930628][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 576.962433][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 576.980190][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 577.000058][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 577.035526][ T5714] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 577.098862][T13311] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2751'. [ 577.177758][ T5714] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 577.177785][ T5714] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 577.299290][T13320] netlink: 112 bytes leftover after parsing attributes in process `syz.1.2752'. [ 577.319194][ T5714] usb 5-1: USB disconnect, device number 20 [ 580.693753][T13349] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2765'. [ 580.887980][T13361] overlayfs: cannot append lower layer [ 580.930342][T13361] 9pnet_fd: Insufficient options for proto=fd [ 581.089848][ T5755] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 581.250415][ T5755] usb 1-1: Using ep0 maxpacket: 16 [ 581.253312][ T5755] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 581.253371][ T5755] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 581.253402][ T5755] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 581.253426][ T5755] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 581.253451][ T5755] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 581.258353][ T5755] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 581.258386][ T5755] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 581.258408][ T5755] usb 1-1: Manufacturer: syz [ 581.309829][ T5755] usb 1-1: config 0 descriptor?? [ 581.964677][ T10] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 581.999730][ T5755] rc_core: IR keymap rc-hauppauge not found [ 581.999754][ T5755] Registered IR keymap rc-empty [ 581.999890][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.006334][T13381] bpf: Bad value for 'mode' [ 582.020026][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.080805][ T5755] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 582.087487][ T5755] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input13 [ 582.099680][ T10] usb 5-1: device descriptor read/64, error -71 [ 582.148573][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.170001][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.288099][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.434519][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.461952][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.479890][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.499980][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.519809][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.519980][ T10] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 582.541072][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.569930][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 582.637496][ T5755] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 582.637529][ T5755] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 582.643936][T13389] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2781'. [ 582.650547][ T10] usb 5-1: device descriptor read/64, error -71 [ 582.751811][ T5755] usb 1-1: USB disconnect, device number 30 [ 582.763987][ T10] usb usb5-port1: attempt power cycle [ 583.953080][T13407] bpf: Bad value for 'mode' [ 584.039929][ T10] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 584.061847][ T10] usb 5-1: device descriptor read/8, error -71 [ 584.319635][ T10] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 584.340581][ T10] usb 5-1: device descriptor read/8, error -71 [ 584.460330][ T10] usb usb5-port1: unable to enumerate USB device [ 588.120014][ T31] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 588.719722][ T31] usb 5-1: Using ep0 maxpacket: 16 [ 588.722916][ T31] usb 5-1: device descriptor read/all, error -61 [ 588.855260][ T31] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 589.001824][ T31] usb 5-1: device descriptor read/64, error -71 [ 589.109714][ T31] usb usb5-port1: attempt power cycle [ 589.469452][ T31] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 589.490547][ T31] usb 5-1: device descriptor read/8, error -71 [ 590.347892][T13491] overlayfs: cannot append lower layer [ 590.401283][T13492] 9pnet_fd: Insufficient options for proto=fd [ 596.236331][ T37] kauditd_printk_skb: 29 callbacks suppressed [ 596.236352][ T37] audit: type=1326 audit(1785541847.763:573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13512 comm="syz.3.2828" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fde1780e019 code=0x0 [ 599.063517][T13534] overlayfs: cannot append lower layer [ 599.094538][T13534] 9pnet_fd: Insufficient options for proto=fd [ 601.757794][T13567] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 601.757854][T13567] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 601.815198][T13567] vhci_hcd vhci_hcd.0: Device attached [ 602.811590][T13568] vhci_hcd: connection closed [ 602.979010][ T5603] usb 42-1: SetAddress Request (19) to port 0 [ 602.979491][ T5603] usb 42-1: new SuperSpeed USB device number 19 using vhci_hcd [ 603.052441][T13570] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 603.124703][ T66] vhci_hcd vhci_hcd.4: stop threads [ 603.124734][ T66] vhci_hcd vhci_hcd.4: release socket [ 603.157570][ T66] vhci_hcd vhci_hcd.4: disconnect device [ 607.116704][T13581] FAULT_INJECTION: forcing a failure. [ 607.116704][T13581] name failslab, interval 1, probability 0, space 0, times 0 [ 607.116748][T13581] CPU: 0 UID: 0 PID: 13581 Comm: syz.4.2846 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 607.116779][T13581] Tainted: [L]=SOFTLOCKUP [ 607.116787][T13581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 607.116801][T13581] Call Trace: [ 607.116809][T13581] [ 607.116819][T13581] dump_stack_lvl+0xe8/0x150 [ 607.116860][T13581] should_fail_ex+0x467/0x600 [ 607.116901][T13581] should_failslab+0xa8/0x100 [ 607.116931][T13581] __kvmalloc_node_noprof+0x17a/0x8a0 [ 607.116962][T13581] ? fuse_dev_splice_write+0x1a0/0xa70 [ 607.116995][T13581] ? fuse_dev_splice_write+0x1a0/0xa70 [ 607.117029][T13581] ? fuse_dev_splice_write+0x11f/0xa70 [ 607.117066][T13581] fuse_dev_splice_write+0x1a0/0xa70 [ 607.117107][T13581] ? get_pid_task+0x20/0x1f0 [ 607.117146][T13581] ? __lock_acquire+0x683/0x2ce0 [ 607.117174][T13581] ? __pfx_fuse_dev_splice_write+0x10/0x10 [ 607.117217][T13581] ? bpf_lsm_file_permission+0x9/0x20 [ 607.117249][T13581] ? security_file_permission+0x75/0x260 [ 607.117278][T13581] ? rw_verify_area+0x209/0x4d0 [ 607.117306][T13581] ? __pfx_fuse_dev_splice_write+0x10/0x10 [ 607.117341][T13581] do_splice+0xf29/0x1990 [ 607.117397][T13581] ? __pfx_do_splice+0x10/0x10 [ 607.117435][T13581] __se_sys_splice+0x353/0x490 [ 607.117468][T13581] ? __pfx___se_sys_splice+0x10/0x10 [ 607.117504][T13581] ? __x64_sys_splice+0x21/0xf0 [ 607.117547][T13581] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.117571][T13581] do_syscall_64+0x174/0x580 [ 607.117601][T13581] ? trace_irq_disable+0x3b/0x140 [ 607.117623][T13581] ? clear_bhb_loop+0x40/0x90 [ 607.117651][T13581] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.117673][T13581] RIP: 0033:0x7ff0ee96e019 [ 607.117694][T13581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 607.117713][T13581] RSP: 002b:00007ff0ecbc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 607.117737][T13581] RAX: ffffffffffffffda RBX: 00007ff0eebf5fa0 RCX: 00007ff0ee96e019 [ 607.117753][T13581] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 607.117766][T13581] RBP: 00007ff0ecbc6090 R08: 0000000000000012 R09: 0000000000000004 [ 607.117780][T13581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 607.117794][T13581] R13: 00007ff0eebf6038 R14: 00007ff0eebf5fa0 R15: 00007ffdca283a68 [ 607.117831][T13581] [ 607.392894][T13583] overlayfs: cannot append lower layer [ 607.446786][T13585] 9pnet_fd: Insufficient options for proto=fd [ 607.848042][T13596] /dev/nullb0: Can't lookup blockdev [ 608.048304][ T5603] usb 42-1: device descriptor read/8, error -110 [ 608.098430][ T10] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 608.264614][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 608.266232][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 608.266288][ T10] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 9 [ 608.266315][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 608.266343][ T10] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 0 [ 608.307872][ T10] usb 5-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=94.39 [ 608.307961][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.308008][ T10] usb 5-1: Product: syz [ 608.308132][ T10] usb 5-1: Manufacturer: syz [ 608.308148][ T10] usb 5-1: SerialNumber: syz [ 608.408678][ T5606] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 608.439830][ T5603] usb usb42-port1: attempt power cycle [ 608.472041][ T5606] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 608.479871][ T5606] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 608.533167][ T10] usb 5-1: config 0 descriptor?? [ 608.534212][T13594] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 608.642816][ C0] usb 5-1: NFC: Urb failure (status -71) [ 608.698655][ T10] usb 5-1: NFC: Unable to get FW version [ 608.733080][ T10] pn533_usb 5-1:0.0: probe with driver pn533_usb failed with error -90 [ 608.864379][ T5606] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 608.870791][ T5606] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 610.207734][ T5727] usb 5-1: USB disconnect, device number 29 [ 610.244479][T13630] overlayfs: cannot append lower layer [ 610.289842][T13630] 9pnet_fd: Insufficient options for proto=fd [ 610.334258][ T5603] usb usb42-port1: unable to enumerate USB device [ 610.573316][T13636] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2862'. [ 611.911374][T12829] Bluetooth: hci5: command tx timeout [ 612.581967][T13664] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2870'. [ 612.984482][T13670] overlayfs: cannot append lower layer [ 613.019591][T13670] 9pnet_fd: Insufficient options for proto=fd [ 613.317208][T13677] netlink: 'syz.4.2873': attribute type 4 has an invalid length. [ 613.326119][ T1062] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.371489][ T37] audit: type=1326 audit(1785541865.244:574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13676 comm="syz.1.2874" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 613.371555][ T37] audit: type=1326 audit(1785541865.244:575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13676 comm="syz.1.2874" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 613.377524][ T37] audit: type=1326 audit(1785541865.244:576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13676 comm="syz.1.2874" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 613.377582][ T37] audit: type=1326 audit(1785541865.244:577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13676 comm="syz.1.2874" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 613.377629][ T37] audit: type=1326 audit(1785541865.244:578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13676 comm="syz.1.2874" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 613.377693][ T37] audit: type=1326 audit(1785541865.244:579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13676 comm="syz.1.2874" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 613.382674][ T37] audit: type=1326 audit(1785541865.254:580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13676 comm="syz.1.2874" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 613.382768][ T37] audit: type=1326 audit(1785541865.254:581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13676 comm="syz.1.2874" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=52 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 613.382897][ T37] audit: type=1326 audit(1785541865.254:582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13676 comm="syz.1.2874" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 613.382984][ T37] audit: type=1326 audit(1785541865.254:583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13676 comm="syz.1.2874" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f03f49fe019 code=0x7ffc0000 [ 614.064219][T13683] fuse: fd is not a fuse device [ 614.222447][T12829] Bluetooth: hci5: command tx timeout [ 616.288858][T12829] Bluetooth: hci5: command tx timeout [ 617.455402][T13693] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2877'. [ 618.243930][T13716] overlayfs: cannot append lower layer [ 618.367997][T12829] Bluetooth: hci5: command tx timeout [ 618.410694][T13722] 9p: Bad value for 'wfdno' [ 618.621866][T12829] Bluetooth: hci3: unexpected event for opcode 0x0c2d [ 620.315973][ T1062] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 622.150168][ T37] kauditd_printk_skb: 121 callbacks suppressed [ 622.150191][ T37] audit: type=1326 audit(1785541874.005:705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13746 comm="syz.2.2894" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc3e397e019 code=0x0 [ 622.331014][ T1062] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.868558][ T1062] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 624.348465][T13773] overlayfs: cannot append lower layer [ 625.002558][T13782] 9p: Bad value for 'wfdno' [ 625.002846][T13608] bridge0: port 1(bridge_slave_0) entered blocking state [ 625.004741][T13608] bridge0: port 1(bridge_slave_0) entered disabled state [ 625.004983][T13608] bridge_slave_0: entered allmulticast mode [ 625.038883][T13608] bridge_slave_0: entered promiscuous mode [ 625.125456][T13608] bridge0: port 2(bridge_slave_1) entered blocking state [ 625.125760][T13608] bridge0: port 2(bridge_slave_1) entered disabled state [ 625.125991][T13608] bridge_slave_1: entered allmulticast mode [ 625.159405][T13608] bridge_slave_1: entered promiscuous mode [ 625.572549][T13608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 625.588911][T13608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 625.644672][T13608] team0: Port device team_slave_0 added [ 625.660017][T13608] team0: Port device team_slave_1 added [ 625.719771][T13608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 625.719789][T13608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 625.719821][T13608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 625.722442][T13608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 625.722458][T13608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 625.722490][T13608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 625.957890][T13791] sctp: [Deprecated]: syz.0.2904 (pid 13791) Use of int in max_burst socket option. [ 625.957890][T13791] Use struct sctp_assoc_value instead [ 627.744241][T13608] hsr_slave_0: entered promiscuous mode [ 627.745667][T13608] hsr_slave_1: entered promiscuous mode [ 627.766599][T13608] debugfs: 'hsr0' already exists in 'hsr' [ 627.766630][T13608] Cannot create hsr debugfs directory [ 629.059476][T13816] overlayfs: cannot append lower layer [ 629.161875][T13823] 9pnet_fd: Insufficient options for proto=fd [ 629.319920][ T1062] bridge_slave_1: left allmulticast mode [ 629.320207][ T1062] bridge_slave_1: left promiscuous mode [ 629.375336][ T1062] bridge0: port 2(bridge_slave_1) entered disabled state [ 629.669335][ T1062] bridge_slave_0: left allmulticast mode [ 629.669379][ T1062] bridge_slave_0: left promiscuous mode [ 629.669840][ T1062] bridge0: port 1(bridge_slave_0) entered disabled state [ 629.766052][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 629.766129][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 632.456974][ T197] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 632.627489][ T197] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 632.627523][ T197] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 632.668441][ T197] usb 1-1: config 0 descriptor?? [ 632.765353][ T197] cp210x 1-1:0.0: cp210x converter detected [ 633.105999][ T197] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 633.301785][ T197] usb 1-1: cp210x converter now attached to ttyUSB0 [ 633.384731][ T197] usb 1-1: USB disconnect, device number 31 [ 633.479160][T13870] overlayfs: cannot append lower layer [ 633.500957][T13870] 9pnet_fd: Insufficient options for proto=fd [ 633.566101][ T197] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 633.908306][ T197] cp210x 1-1:0.0: device disconnected [ 634.468746][ T1062] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 634.526898][ T1062] bond0 (unregistering): Released all slaves [ 634.681781][ T5259] 8021q: adding VLAN 0 to HW filter on device eth1 [ 635.087901][ T5755] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 635.236762][ T5755] usb 1-1: Using ep0 maxpacket: 16 [ 635.244514][ T5755] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 635.244573][ T5755] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 635.244604][ T5755] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 635.244627][ T5755] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 635.244652][ T5755] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 635.246165][ T5755] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 635.246194][ T5755] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 635.246216][ T5755] usb 1-1: Manufacturer: syz [ 635.403215][ T5755] usb 1-1: config 0 descriptor?? [ 637.230462][ T5755] rc_core: IR keymap rc-hauppauge not found [ 637.230485][ T5755] Registered IR keymap rc-empty [ 637.230726][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.255100][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.276722][ T5755] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 637.321136][ T5755] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input14 [ 637.360077][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.386720][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.417014][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.436609][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.456627][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.486674][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.506651][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.540797][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.566979][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.597407][ T5755] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.632310][ T5755] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 637.632338][ T5755] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 637.663175][ T5755] usb 1-1: USB disconnect, device number 32 [ 639.330639][ T5259] 8021q: adding VLAN 0 to HW filter on device eth2 [ 639.725179][T13956] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2953'. [ 639.982376][T13963] CIFS mount error: No usable UNC path provided in device string! [ 639.982376][T13963] [ 639.982600][T13963] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 640.201323][T13966] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2958'. [ 640.456437][ T5727] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 640.589544][T13972] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 640.589590][T13972] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 640.602901][T13972] vhci_hcd vhci_hcd.0: Device attached [ 641.132132][ T5755] usb 34-1: SetAddress Request (16) to port 0 [ 641.180887][ T5755] usb 34-1: new SuperSpeed USB device number 16 using vhci_hcd [ 641.602085][T13973] vhci_hcd: connection reset by peer [ 641.626577][T10861] vhci_hcd vhci_hcd.0: stop threads [ 641.626643][T10861] vhci_hcd vhci_hcd.0: release socket [ 641.629177][T10861] vhci_hcd vhci_hcd.0: disconnect device [ 642.059833][T13981] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2961'. [ 642.330613][ T5727] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 642.330658][ T5727] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 642.359635][ T5727] usb 5-1: config 0 descriptor?? [ 642.376471][ T5727] cp210x 5-1:0.0: cp210x converter detected [ 642.978149][ T5727] cp210x 5-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 642.978183][ T5727] cp210x 5-1:0.0: GPIO initialisation failed: -71 [ 643.076585][ T5727] usb 5-1: cp210x converter now attached to ttyUSB0 [ 643.108906][ T5727] usb 5-1: USB disconnect, device number 30 [ 643.279661][ T5727] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 643.364983][ T5727] cp210x 5-1:0.0: device disconnected [ 643.381229][T13989] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2964'. [ 643.456339][ T1062] hsr_slave_0: left promiscuous mode [ 643.496823][ T1062] hsr_slave_1: left promiscuous mode [ 643.499768][ T1062] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 643.499904][ T1062] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 645.042192][ T1062] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 645.042223][ T1062] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 645.171851][ T1062] veth1_macvtap: left promiscuous mode [ 645.172198][ T1062] veth0_macvtap: left promiscuous mode [ 645.172533][ T1062] veth1_vlan: left promiscuous mode [ 645.172959][ T1062] veth0_vlan: left promiscuous mode [ 645.856136][ T5603] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 646.006324][ T5603] usb 5-1: Using ep0 maxpacket: 16 [ 646.008355][ T5603] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 646.008411][ T5603] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 646.008442][ T5603] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 646.008466][ T5603] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 646.008490][ T5603] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 646.009705][ T5603] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 646.009736][ T5603] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 646.009751][ T5603] usb 5-1: Manufacturer: syz [ 646.014118][ T5603] usb 5-1: config 0 descriptor?? [ 646.286281][ T5755] usb 34-1: device descriptor read/8, error -110 [ 646.486239][ T5603] rc_core: IR keymap rc-hauppauge not found [ 646.486255][ T5603] Registered IR keymap rc-empty [ 646.486363][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 646.506294][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 646.529981][ T5603] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 646.533318][ T5603] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input15 [ 646.565960][ T1062] team0 (unregistering): Port device team_slave_1 removed [ 646.606760][ T1062] team0 (unregistering): Port device team_slave_0 removed [ 646.685664][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 646.707422][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 646.726278][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 646.746226][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 646.766256][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 646.826817][ T5755] usb usb34-port1: attempt power cycle [ 646.887503][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 646.906546][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 646.927484][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 646.962021][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 646.981296][ T5603] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 647.045508][ T5603] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 647.045533][ T5603] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 647.076142][ T5603] usb 5-1: USB disconnect, device number 31 [ 647.658645][ T5755] usb usb34-port1: unable to enumerate USB device [ 647.661038][T14016] xt_hashlimit: size too large, truncated to 1048576 [ 647.976215][T14021] netlink: 236 bytes leftover after parsing attributes in process `syz.4.2974'. [ 647.980088][T14021] netlink: 9275 bytes leftover after parsing attributes in process `syz.4.2974'. [ 648.251914][T14027] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2975'. [ 649.837395][T14033] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 649.916826][T14033] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 649.986355][T14033] bond0 (unregistering): Released all slaves [ 650.052073][T14056] overlayfs: cannot append lower layer [ 650.066187][T14043] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2978'. [ 650.099834][T14056] 9pnet_fd: Insufficient options for proto=fd [ 650.644830][T14068] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2985'. [ 650.796516][T14070] FAULT_INJECTION: forcing a failure. [ 650.796516][T14070] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 650.796561][T14070] CPU: 1 UID: 0 PID: 14070 Comm: syz.0.2984 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 650.796591][T14070] Tainted: [L]=SOFTLOCKUP [ 650.796599][T14070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 650.796612][T14070] Call Trace: [ 650.796620][T14070] [ 650.796629][T14070] dump_stack_lvl+0xe8/0x150 [ 650.796670][T14070] should_fail_ex+0x467/0x600 [ 650.796713][T14070] _copy_from_user+0x2d/0xb0 [ 650.796741][T14070] kstrtouint_from_user+0xd6/0x180 [ 650.796782][T14070] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 650.796823][T14070] ? __lock_acquire+0x683/0x2ce0 [ 650.796868][T14070] proc_fail_nth_write+0x8e/0x210 [ 650.796894][T14070] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 650.796929][T14070] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 650.796954][T14070] vfs_write+0x29f/0xbb0 [ 650.796994][T14070] ? __pfx_vfs_write+0x10/0x10 [ 650.797027][T14070] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 650.797057][T14070] ? lockdep_hardirqs_on+0x7a/0x110 [ 650.797087][T14070] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 650.797115][T14070] ? mutex_lock_nested+0x152/0x1d0 [ 650.797135][T14070] ? fdget_pos+0x252/0x320 [ 650.797171][T14070] ksys_write+0x156/0x270 [ 650.797203][T14070] ? __pfx_ksys_write+0x10/0x10 [ 650.797242][T14070] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 650.797267][T14070] do_syscall_64+0x174/0x580 [ 650.797295][T14070] ? trace_irq_disable+0x3b/0x140 [ 650.797318][T14070] ? clear_bhb_loop+0x40/0x90 [ 650.797347][T14070] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 650.797370][T14070] RIP: 0033:0x7f46f27ae84e [ 650.797391][T14070] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 650.797410][T14070] RSP: 002b:00007f46f0a24fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 650.797434][T14070] RAX: ffffffffffffffda RBX: 00007f46f0a256c0 RCX: 00007f46f27ae84e [ 650.797451][T14070] RDX: 0000000000000001 RSI: 00007f46f0a250a0 RDI: 0000000000000005 [ 650.797465][T14070] RBP: 00007f46f0a25090 R08: 0000000000000000 R09: 0000000000000000 [ 650.797480][T14070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 650.797493][T14070] R13: 00007f46f2a76128 R14: 00007f46f2a76090 R15: 00007ffe6f0940a8 [ 650.797531][T14070] [ 651.666765][ T5603] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 651.784250][T13608] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 651.827597][ T5603] usb 1-1: Using ep0 maxpacket: 16 [ 651.831399][ T5603] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 651.831456][ T5603] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 651.831486][ T5603] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 651.831508][ T5603] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 651.831533][ T5603] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 651.833746][ T5603] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 651.833775][ T5603] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 651.833798][ T5603] usb 1-1: Manufacturer: syz [ 651.938463][ T5603] usb 1-1: config 0 descriptor?? [ 652.000843][T13608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 652.011455][T14093] overlayfs: cannot append lower layer [ 652.067884][T14096] 9pnet_fd: Insufficient options for proto=fd [ 652.278973][T13608] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 652.375759][ T5603] rc_core: IR keymap rc-hauppauge not found [ 652.375784][ T5603] Registered IR keymap rc-empty [ 652.376024][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.404842][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.419156][ T5603] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 652.440297][ T5603] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input16 [ 652.558684][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.576040][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.596129][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.615919][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.636086][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.658036][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.675931][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.695878][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.715945][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.735938][ T5603] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 652.812466][ T5603] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 652.812496][ T5603] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 652.959934][T13608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 653.084867][T13608] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 653.216579][T13060] usb 1-1: USB disconnect, device number 33 [ 653.240728][T13608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 653.250952][T14110] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2995'. [ 653.350341][T13608] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 653.448822][T13608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 655.323250][T13608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 655.448159][T14148] overlayfs: cannot append lower layer [ 655.480287][T14148] 9pnet_fd: Insufficient options for proto=fd [ 655.522896][T13608] 8021q: adding VLAN 0 to HW filter on device team0 [ 655.544349][T10862] bridge0: port 1(bridge_slave_0) entered blocking state [ 655.544873][T10862] bridge0: port 1(bridge_slave_0) entered forwarding state [ 655.660952][ T1460] bridge0: port 2(bridge_slave_1) entered blocking state [ 655.661103][ T1460] bridge0: port 2(bridge_slave_1) entered forwarding state [ 656.477913][T14176] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3009'. [ 656.795494][ T5755] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 656.951770][ T5755] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 656.951806][ T5755] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.987864][ T5755] usb 5-1: config 0 descriptor?? [ 657.002578][ T5755] cp210x 5-1:0.0: cp210x converter detected [ 657.596770][ T5755] cp210x 5-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 657.596804][ T5755] cp210x 5-1:0.0: GPIO initialisation failed: -71 [ 657.636264][ T5755] usb 5-1: cp210x converter now attached to ttyUSB0 [ 657.656000][ T5755] usb 5-1: USB disconnect, device number 32 [ 657.737890][ T5755] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 657.741000][ T5755] cp210x 5-1:0.0: device disconnected [ 658.439844][T13608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 658.890639][T13608] veth0_vlan: entered promiscuous mode [ 658.932939][T13608] veth1_vlan: entered promiscuous mode [ 658.980175][T14226] overlayfs: cannot append lower layer [ 659.026068][T14226] 9pnet_fd: Insufficient options for proto=fd [ 659.292742][T13608] veth0_macvtap: entered promiscuous mode [ 659.420463][T13608] veth1_macvtap: entered promiscuous mode [ 659.516830][T14234] netlink: 100 bytes leftover after parsing attributes in process `syz.1.3018'. [ 659.526185][T13608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 659.682079][T13608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 659.966909][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.969038][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 660.439309][ T1246] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 660.641696][T14257] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3023'. [ 660.642399][T10862] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 660.647596][ T1246] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 660.647646][ T1246] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 660.647676][ T1246] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 660.647722][ T1246] usb 1-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 660.647746][ T1246] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 660.675695][T10862] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 660.805333][T13060] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 660.908277][ T1246] usb 1-1: config 0 descriptor?? [ 660.991141][T13060] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 660.991176][T13060] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 661.096235][T13060] usb 5-1: config 0 descriptor?? [ 661.103465][T13060] cp210x 5-1:0.0: cp210x converter detected [ 661.499126][ T10] usb 1-1: USB disconnect, device number 34 [ 661.708729][T13060] cp210x 5-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 661.708761][T13060] cp210x 5-1:0.0: GPIO initialisation failed: -71 [ 661.742184][T13060] usb 5-1: cp210x converter now attached to ttyUSB0 [ 661.777329][T14272] overlayfs: cannot append lower layer [ 661.778699][T13060] usb 5-1: USB disconnect, device number 33 [ 661.798133][T13060] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 661.799068][T13060] cp210x 5-1:0.0: device disconnected [ 662.052421][T14270] 9pnet_fd: Insufficient options for proto=fd [ 663.155111][ T1286] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 663.155135][ T1286] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 663.555097][T11204] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 663.555120][T11204] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 663.561925][T14288] netlink: 100 bytes leftover after parsing attributes in process `syz.1.3030'. [ 667.078783][T14323] netlink: 100 bytes leftover after parsing attributes in process `syz.3.3042'. [ 667.448661][ T5606] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 667.494609][ T5606] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 667.507182][T14332] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 667.539303][T14332] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 667.540156][T14332] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 667.956733][T14339] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 667.956809][T14339] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 667.957210][T14339] vhci_hcd vhci_hcd.0: Device attached [ 668.779451][T14340] vhci_hcd: connection closed [ 668.820269][ T1062] vhci_hcd vhci_hcd.3: stop threads [ 668.820594][ T1062] vhci_hcd vhci_hcd.3: release socket [ 668.820777][ T1062] vhci_hcd vhci_hcd.3: disconnect device [ 668.845986][T13060] usb 40-1: enqueue for inactive port 0 [ 669.546489][T13060] usb usb40-port1: attempt power cycle [ 669.724895][T12829] Bluetooth: hci1: command tx timeout [ 669.893809][T14351] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3045'. [ 670.166894][T13060] usb usb40-port1: unable to enumerate USB device [ 670.866657][T14374] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3048'. [ 671.804707][T12829] Bluetooth: hci1: command tx timeout [ 671.866410][T14351] bond0: entered promiscuous mode [ 671.866443][T14351] bond_slave_0: entered promiscuous mode [ 671.866698][T14351] bond_slave_1: entered promiscuous mode [ 671.870793][T14351] bond0: entered allmulticast mode [ 671.870824][T14351] bond_slave_0: entered allmulticast mode [ 671.870853][T14351] bond_slave_1: entered allmulticast mode [ 672.536099][ T37] audit: type=1326 audit(1785541924.408:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14403 comm="syz.3.3057" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fac4e48e019 code=0x0 [ 673.890740][T12829] Bluetooth: hci1: command tx timeout [ 674.006121][T14327] bridge0: port 1(bridge_slave_0) entered blocking state [ 674.006374][T14327] bridge0: port 1(bridge_slave_0) entered disabled state [ 674.006564][T14327] bridge_slave_0: entered allmulticast mode [ 674.010904][T14327] bridge_slave_0: entered promiscuous mode [ 674.030874][T14327] bridge0: port 2(bridge_slave_1) entered blocking state [ 674.031453][T14327] bridge0: port 2(bridge_slave_1) entered disabled state [ 674.031987][T14327] bridge_slave_1: entered allmulticast mode [ 674.040386][T14327] bridge_slave_1: entered promiscuous mode [ 674.238554][T14327] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 674.242484][T14327] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 674.588918][T14327] team0: Port device team_slave_0 added [ 674.621469][T14327] team0: Port device team_slave_1 added [ 674.884841][T14327] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 674.884861][T14327] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.884893][T14327] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 674.940741][T14327] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 674.940761][T14327] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.940793][T14327] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 676.356212][T12829] Bluetooth: hci1: command tx timeout [ 676.574538][ T197] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 676.622172][T14327] hsr_slave_0: entered promiscuous mode [ 676.634099][T14327] hsr_slave_1: entered promiscuous mode [ 676.643054][T14327] debugfs: 'hsr0' already exists in 'hsr' [ 676.643076][T14327] Cannot create hsr debugfs directory [ 676.746857][ T197] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 676.746925][ T197] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 676.746953][ T197] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 676.746994][ T197] usb 4-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 676.747017][ T197] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 676.810205][ T197] usb 4-1: config 0 descriptor?? [ 677.069488][ T5727] usb 4-1: USB disconnect, device number 5 [ 677.486328][T12829] Bluetooth: hci2: unexpected event for opcode 0x0c2d [ 678.875882][T14327] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.734099][T13060] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 684.888195][T13060] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 684.888253][T13060] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 684.888283][T13060] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 684.888327][T13060] usb 1-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 684.888352][T13060] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 684.972887][T13060] usb 1-1: config 0 descriptor?? [ 686.084792][T13060] usb 1-1: USB disconnect, device number 35 [ 688.505266][T14327] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 689.462178][T12829] Bluetooth: hci3: unexpected event for opcode 0x0c2d [ 689.480245][T14529] FAULT_INJECTION: forcing a failure. [ 689.480245][T14529] name failslab, interval 1, probability 0, space 0, times 0 [ 689.480285][T14529] CPU: 0 UID: 0 PID: 14529 Comm: syz.0.3092 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 689.480316][T14529] Tainted: [L]=SOFTLOCKUP [ 689.480325][T14529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 689.480339][T14529] Call Trace: [ 689.480351][T14529] [ 689.480360][T14529] dump_stack_lvl+0xe8/0x150 [ 689.480403][T14529] should_fail_ex+0x467/0x600 [ 689.480446][T14529] should_failslab+0xa8/0x100 [ 689.480475][T14529] __kmalloc_noprof+0xfe/0x780 [ 689.480500][T14529] ? tomoyo_encode+0x2ad/0x570 [ 689.480528][T14529] ? tomoyo_encode+0x2ad/0x570 [ 689.480572][T14529] tomoyo_encode+0x2ad/0x570 [ 689.480607][T14529] tomoyo_realpath_from_path+0x5fa/0x640 [ 689.480648][T14529] ? tomoyo_path_number_perm+0x219/0x5f0 [ 689.480673][T14529] tomoyo_path_number_perm+0x246/0x5f0 [ 689.480708][T14529] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 689.480732][T14529] ? __lock_acquire+0x683/0x2ce0 [ 689.480774][T14529] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 689.480801][T14529] ? hook_file_ioctl+0x1f3/0x600 [ 689.480834][T14529] ? lockdep_hardirqs_on+0x7a/0x110 [ 689.480883][T14529] ? __fget_files+0x2a/0x420 [ 689.480910][T14529] ? __fget_files+0x2a/0x420 [ 689.480933][T14529] ? __fget_files+0x3a8/0x420 [ 689.480957][T14529] ? __fget_files+0x2a/0x420 [ 689.480986][T14529] security_file_ioctl+0xc3/0x2a0 [ 689.481015][T14529] __se_sys_ioctl+0x47/0x170 [ 689.481045][T14529] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.481070][T14529] do_syscall_64+0x174/0x580 [ 689.481097][T14529] ? trace_irq_disable+0x3b/0x140 [ 689.481119][T14529] ? clear_bhb_loop+0x40/0x90 [ 689.481147][T14529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.481169][T14529] RIP: 0033:0x7f46f27ee019 [ 689.481190][T14529] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 689.481209][T14529] RSP: 002b:00007f46f0a46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 689.481233][T14529] RAX: ffffffffffffffda RBX: 00007f46f2a75fa0 RCX: 00007f46f27ee019 [ 689.481249][T14529] RDX: 0000200000000040 RSI: 000000004020ae46 RDI: 0000000000000004 [ 689.481264][T14529] RBP: 00007f46f0a46090 R08: 0000000000000000 R09: 0000000000000000 [ 689.481277][T14529] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 689.481290][T14529] R13: 00007f46f2a76038 R14: 00007f46f2a75fa0 R15: 00007ffe6f0940a8 [ 689.481327][T14529] [ 689.491835][T14529] ERROR: Out of memory at tomoyo_realpath_from_path. [ 692.142063][T14543] FAULT_INJECTION: forcing a failure. [ 692.142063][T14543] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 692.142106][T14543] CPU: 0 UID: 0 PID: 14543 Comm: syz.3.3095 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 692.142138][T14543] Tainted: [L]=SOFTLOCKUP [ 692.142147][T14543] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 692.142161][T14543] Call Trace: [ 692.142169][T14543] [ 692.142179][T14543] dump_stack_lvl+0xe8/0x150 [ 692.142220][T14543] should_fail_ex+0x467/0x600 [ 692.142262][T14543] _copy_from_iter+0x1d3/0x1660 [ 692.142287][T14543] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 692.142321][T14543] ? __pfx_policy_nodemask+0x10/0x10 [ 692.142350][T14543] ? unwind_next_frame+0x8f/0x2550 [ 692.142378][T14543] ? __pfx__copy_from_iter+0x10/0x10 [ 692.142407][T14543] ? alloc_pages_mpol+0x115/0x280 [ 692.142446][T14543] copy_page_from_iter+0x219/0x2d0 [ 692.142475][T14543] tun_get_user+0x1b68/0x4380 [ 692.142512][T14543] ? is_bpf_text_address+0x292/0x2b0 [ 692.142541][T14543] ? tun_get_user+0x6e7/0x4380 [ 692.142598][T14543] ? __pfx_tun_get_user+0x10/0x10 [ 692.142636][T14543] ? __lock_acquire+0x683/0x2ce0 [ 692.142676][T14543] ? ref_tracker_alloc+0x353/0x4c0 [ 692.142697][T14543] ? get_pid_task+0x20/0x1f0 [ 692.142733][T14543] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 692.142758][T14543] ? tun_get+0x1c/0x2f0 [ 692.142793][T14543] ? tun_get+0x1c/0x2f0 [ 692.142835][T14543] ? tun_get+0x1c/0x2f0 [ 692.142879][T14543] ? tun_get+0x1c/0x2f0 [ 692.142921][T14543] tun_chr_write_iter+0x119/0x200 [ 692.142961][T14543] vfs_write+0x61e/0xbb0 [ 692.143000][T14543] ? __pfx_vfs_write+0x10/0x10 [ 692.143042][T14543] ? __fget_files+0x2a/0x420 [ 692.143079][T14543] ksys_write+0x156/0x270 [ 692.143112][T14543] ? __pfx_ksys_write+0x10/0x10 [ 692.143153][T14543] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.143178][T14543] do_syscall_64+0x174/0x580 [ 692.143211][T14543] ? clear_bhb_loop+0x40/0x90 [ 692.143240][T14543] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.143264][T14543] RIP: 0033:0x7fac4e44e84e [ 692.143285][T14543] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 692.143306][T14543] RSP: 002b:00007fac4c6a3fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 692.143333][T14543] RAX: ffffffffffffffda RBX: 00007fac4c6a46c0 RCX: 00007fac4e44e84e [ 692.143349][T14543] RDX: 000000000000004f RSI: 0000200000000a80 RDI: 00000000000000c8 [ 692.143363][T14543] RBP: 00007fac4c6a4090 R08: 0000000000000000 R09: 0000000000000000 [ 692.143378][T14543] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 692.143392][T14543] R13: 00007fac4e716218 R14: 00007fac4e716180 R15: 00007ffdc065de78 [ 692.143430][T14543] [ 692.842868][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 692.843003][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 693.121028][T14327] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 693.636243][ T10] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 694.664413][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 694.671073][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 694.687602][ T10] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 206, changing to 7 [ 694.713038][ T10] usb 1-1: New USB device found, idVendor=2a39, idProduct=3fd2, bcdDevice= 0.40 [ 694.713073][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 694.713095][ T10] usb 1-1: Product: syz [ 694.713109][ T10] usb 1-1: Manufacturer: syz [ 694.713125][ T10] usb 1-1: SerialNumber: syz [ 694.824400][ T10] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 695.031349][ T10] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 695.146057][T14327] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 695.192154][T14576] fuse: fd is not a fuse device [ 698.330172][ T10] usb 1-1: USB disconnect, device number 36 [ 698.867570][T14601] overlayfs: failed to resolve './cgroup': -2 [ 699.607051][T14600] FAULT_INJECTION: forcing a failure. [ 699.607051][T14600] name failslab, interval 1, probability 0, space 0, times 0 [ 699.607092][T14600] CPU: 0 UID: 0 PID: 14600 Comm: syz.0.3116 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 699.607122][T14600] Tainted: [L]=SOFTLOCKUP [ 699.607130][T14600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 699.607144][T14600] Call Trace: [ 699.607152][T14600] [ 699.607162][T14600] dump_stack_lvl+0xe8/0x150 [ 699.607202][T14600] should_fail_ex+0x467/0x600 [ 699.607243][T14600] should_failslab+0xa8/0x100 [ 699.607272][T14600] __kmalloc_noprof+0xfe/0x780 [ 699.607297][T14600] ? tomoyo_encode+0x2ad/0x570 [ 699.607325][T14600] ? tomoyo_encode+0x2ad/0x570 [ 699.607362][T14600] tomoyo_encode+0x2ad/0x570 [ 699.607400][T14600] tomoyo_realpath_from_path+0x5fa/0x640 [ 699.607449][T14600] ? tomoyo_path_number_perm+0x219/0x5f0 [ 699.607475][T14600] tomoyo_path_number_perm+0x246/0x5f0 [ 699.607505][T14600] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 699.607529][T14600] ? __lock_acquire+0x683/0x2ce0 [ 699.607571][T14600] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 699.607599][T14600] ? hook_file_ioctl+0x1f3/0x600 [ 699.607632][T14600] ? lockdep_hardirqs_on+0x7a/0x110 [ 699.607681][T14600] ? __fget_files+0x2a/0x420 [ 699.607708][T14600] ? __fget_files+0x2a/0x420 [ 699.607731][T14600] ? __fget_files+0x3a8/0x420 [ 699.607753][T14600] ? __fget_files+0x2a/0x420 [ 699.607781][T14600] security_file_ioctl+0xc3/0x2a0 [ 699.607811][T14600] __se_sys_ioctl+0x47/0x170 [ 699.607849][T14600] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.607874][T14600] do_syscall_64+0x174/0x580 [ 699.607901][T14600] ? trace_irq_disable+0x3b/0x140 [ 699.607924][T14600] ? clear_bhb_loop+0x40/0x90 [ 699.607952][T14600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.607974][T14600] RIP: 0033:0x7f46f27ee019 [ 699.607995][T14600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 699.608014][T14600] RSP: 002b:00007f46f0a46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 699.608038][T14600] RAX: ffffffffffffffda RBX: 00007f46f2a75fa0 RCX: 00007f46f27ee019 [ 699.608054][T14600] RDX: 0000200000000080 RSI: 00000000404c4701 RDI: 0000000000000003 [ 699.608069][T14600] RBP: 00007f46f0a46090 R08: 0000000000000000 R09: 0000000000000000 [ 699.608083][T14600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 699.608096][T14600] R13: 00007f46f2a76038 R14: 00007f46f2a75fa0 R15: 00007ffe6f0940a8 [ 699.608133][T14600] [ 699.613245][T14600] ERROR: Out of memory at tomoyo_realpath_from_path. [ 700.612341][T14610] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3118'. [ 701.734194][T14621] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 701.734383][T14621] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 701.734884][T14621] vhci_hcd vhci_hcd.0: Device attached [ 702.073367][T13060] usb 34-1: SetAddress Request (20) to port 0 [ 702.073519][T13060] usb 34-1: new SuperSpeed USB device number 20 using vhci_hcd [ 702.489772][T14622] vhci_hcd: connection reset by peer [ 702.534529][ T1460] vhci_hcd vhci_hcd.0: stop threads [ 702.534596][ T1460] vhci_hcd vhci_hcd.0: release socket [ 702.677857][ T1460] vhci_hcd vhci_hcd.0: disconnect device [ 703.691464][T14633] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3125'. [ 704.617877][T12829] Bluetooth: hci0: unexpected event for opcode 0x0c2d [ 704.647918][T14327] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 704.852121][T14327] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 704.951777][T14327] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 705.085626][T14327] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 705.092327][T14327] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 705.243068][ T5727] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 705.246483][T12829] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 705.268486][T14327] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 705.292272][T14327] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 705.372973][ T5727] usb 1-1: device descriptor read/64, error -71 [ 705.395692][T14327] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 705.397879][T14656] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3130'. [ 705.572837][ T5603] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 705.612757][ T5727] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 705.686785][T14327] 8021q: adding VLAN 0 to HW filter on device bond0 [ 705.728357][ T5603] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 705.728390][ T5603] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 705.728982][T14327] 8021q: adding VLAN 0 to HW filter on device team0 [ 705.758162][ T5727] usb 1-1: device descriptor read/64, error -71 [ 705.770376][ T5603] usb 4-1: config 0 descriptor?? [ 705.781931][ T5603] cp210x 4-1:0.0: cp210x converter detected [ 705.853082][T11206] bridge0: port 1(bridge_slave_0) entered blocking state [ 705.853299][T11206] bridge0: port 1(bridge_slave_0) entered forwarding state [ 705.878828][ T5727] usb usb1-port1: attempt power cycle [ 705.901435][T11204] bridge0: port 2(bridge_slave_1) entered blocking state [ 705.901630][T11204] bridge0: port 2(bridge_slave_1) entered forwarding state [ 706.244367][ T5727] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 706.264093][ T5727] usb 1-1: device descriptor read/8, error -71 [ 706.402967][ T5603] cp210x 4-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 706.402998][ T5603] cp210x 4-1:0.0: GPIO initialisation failed: -71 [ 706.447666][ T5603] usb 4-1: cp210x converter now attached to ttyUSB0 [ 706.499375][ T5603] usb 4-1: USB disconnect, device number 6 [ 706.511610][ T5727] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 706.527747][ T5727] usb 1-1: device descriptor read/8, error -71 [ 706.634702][ T5727] usb usb1-port1: unable to enumerate USB device [ 706.700789][ T5603] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 706.711648][ T5603] cp210x 4-1:0.0: device disconnected [ 707.038551][T14682] overlayfs: failed to resolve './cgroup': -2 [ 707.800940][T13060] usb 34-1: device descriptor read/8, error -110 [ 708.828330][T14693] fuse: fd is not a fuse device [ 709.344106][T13060] usb usb34-port1: attempt power cycle [ 710.312972][T14332] Bluetooth: hci2: unexpected event for opcode 0x0c2d [ 711.756944][T14327] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 711.896798][T13060] usb usb34-port1: unable to enumerate USB device [ 712.348186][T14727] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3147'. [ 713.042398][T13060] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 713.122337][ T5727] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 713.261349][T13060] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 713.261383][T13060] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 713.307225][T13060] usb 1-1: config 0 descriptor?? [ 713.369987][T13060] cp210x 1-1:0.0: cp210x converter detected [ 713.376701][ T5727] usb 4-1: Using ep0 maxpacket: 8 [ 713.518444][ T5727] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 713.518575][ T5727] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 713.518601][ T5727] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 713.518629][ T5727] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 713.518714][ T5727] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 713.518761][ T5727] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 713.518786][ T5727] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 715.193084][T13060] cp210x 1-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 715.193115][T13060] cp210x 1-1:0.0: GPIO initialisation failed: -71 [ 715.265379][ T5727] usb 4-1: can't set config #16, error -71 [ 715.337425][ T5727] usb 4-1: USB disconnect, device number 7 [ 715.364136][T13060] usb 1-1: cp210x converter now attached to ttyUSB0 [ 715.371272][T13060] usb 1-1: USB disconnect, device number 41 [ 715.444240][T13060] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 715.445064][T13060] cp210x 1-1:0.0: device disconnected [ 715.839844][T14749] overlayfs: missing 'lowerdir' [ 717.308514][T14327] veth0_vlan: entered promiscuous mode [ 717.377151][T14327] veth1_vlan: entered promiscuous mode [ 717.450442][T14327] veth0_macvtap: entered promiscuous mode [ 717.506633][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 717.649802][T14761] netlink: 100 bytes leftover after parsing attributes in process `syz.2.3154'. [ 717.664535][T14327] veth1_macvtap: entered promiscuous mode [ 717.772942][T14327] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 717.895357][T14327] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 719.472890][T14775] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(9) [ 719.472921][T14775] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 719.473019][T14775] vhci_hcd vhci_hcd.0: Device attached [ 719.758385][ T5727] usb 40-1: SetAddress Request (10) to port 0 [ 719.758483][ T5727] usb 40-1: new SuperSpeed USB device number 10 using vhci_hcd [ 720.142082][T14776] vhci_hcd: connection reset by peer [ 720.165730][ T1286] vhci_hcd vhci_hcd.3: stop threads [ 720.165758][ T1286] vhci_hcd vhci_hcd.3: release socket [ 720.165830][ T1286] vhci_hcd vhci_hcd.3: disconnect device [ 721.249141][T14765] bond1: option ad_user_port_key: mode dependency failed, not supported in mode active-backup(1) [ 721.451653][T14784] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3160'. [ 721.619220][T14765] bond1 (unregistering): Released all slaves [ 725.206851][T14332] Bluetooth: hci3: unexpected event for opcode 0x0c2d [ 725.443470][ T5727] usb 40-1: device descriptor read/8, error -110 [ 725.495732][T14807] FAULT_INJECTION: forcing a failure. [ 725.495732][T14807] name failslab, interval 1, probability 0, space 0, times 0 [ 725.495773][T14807] CPU: 0 UID: 0 PID: 14807 Comm: syz.3.3167 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 725.495803][T14807] Tainted: [L]=SOFTLOCKUP [ 725.495812][T14807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 725.495825][T14807] Call Trace: [ 725.495838][T14807] [ 725.495848][T14807] dump_stack_lvl+0xe8/0x150 [ 725.495889][T14807] should_fail_ex+0x467/0x600 [ 725.495932][T14807] should_failslab+0xa8/0x100 [ 725.495961][T14807] __kmalloc_noprof+0xfe/0x780 [ 725.495988][T14807] ? tomoyo_encode+0x2ad/0x570 [ 725.496026][T14807] ? tomoyo_encode+0x2ad/0x570 [ 725.496064][T14807] tomoyo_encode+0x2ad/0x570 [ 725.496103][T14807] tomoyo_realpath_from_path+0x5fa/0x640 [ 725.496145][T14807] ? tomoyo_path_number_perm+0x219/0x5f0 [ 725.496169][T14807] tomoyo_path_number_perm+0x246/0x5f0 [ 725.496214][T14807] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 725.496236][T14807] ? __lock_acquire+0x683/0x2ce0 [ 725.496276][T14807] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 725.496301][T14807] ? hook_file_ioctl+0x1f3/0x600 [ 725.496333][T14807] ? lockdep_hardirqs_on+0x7a/0x110 [ 725.496383][T14807] ? __fget_files+0x2a/0x420 [ 725.496411][T14807] ? __fget_files+0x2a/0x420 [ 725.496433][T14807] ? __fget_files+0x3a8/0x420 [ 725.496455][T14807] ? __fget_files+0x2a/0x420 [ 725.496483][T14807] security_file_ioctl+0xc3/0x2a0 [ 725.496511][T14807] __se_sys_ioctl+0x47/0x170 [ 725.496541][T14807] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.496566][T14807] do_syscall_64+0x174/0x580 [ 725.496593][T14807] ? trace_irq_disable+0x3b/0x140 [ 725.496616][T14807] ? clear_bhb_loop+0x40/0x90 [ 725.496643][T14807] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.496665][T14807] RIP: 0033:0x7fac4e48e019 [ 725.496686][T14807] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 725.496704][T14807] RSP: 002b:00007fac4c6e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 725.496727][T14807] RAX: ffffffffffffffda RBX: 00007fac4e715fa0 RCX: 00007fac4e48e019 [ 725.496744][T14807] RDX: 0000200000000240 RSI: 00000000000007b1 RDI: 0000000000000003 [ 725.496758][T14807] RBP: 00007fac4c6e6090 R08: 0000000000000000 R09: 0000000000000000 [ 725.496771][T14807] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 725.496784][T14807] R13: 00007fac4e716038 R14: 00007fac4e715fa0 R15: 00007ffdc065de78 [ 725.496820][T14807] [ 725.838986][T14807] ERROR: Out of memory at tomoyo_realpath_from_path. [ 727.524858][ T5727] usb usb40-port1: attempt power cycle [ 727.746039][T12829] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 727.794918][T12829] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 727.879470][T12829] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 727.936868][T12829] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 727.943347][T12829] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 728.699265][ T5727] usb usb40-port1: unable to enumerate USB device [ 728.763435][T11206] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.764370][T11206] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.202530][T14332] Bluetooth: hci4: command tx timeout [ 730.223478][T11206] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.241458][ T1023] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.489336][T14826] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 732.291261][T14332] Bluetooth: hci4: command tx timeout [ 734.241210][T14332] Bluetooth: hci5: command 0x0406 tx timeout [ 734.369019][T14332] Bluetooth: hci4: command tx timeout [ 736.447716][T14332] Bluetooth: hci4: command tx timeout [ 736.748692][ T197] IPVS: starting estimator thread 0... [ 736.991135][T14868] IPVS: using max 8 ests per chain, 19200 per kthread [ 737.483875][ T37] audit: type=1800 audit(1785541989.331:707): pid=14874 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.1.3183" name="nullb0" dev="tmpfs" ino=1382 res=0 errno=0 [ 737.917524][T14873] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3184'. [ 738.065503][T14332] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 738.119253][T14332] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 738.122488][T14332] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 738.161091][T14332] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 738.216304][T14332] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 740.394462][T14332] Bluetooth: hci6: command tx timeout [ 741.580098][T14904] FAULT_INJECTION: forcing a failure. [ 741.580098][T14904] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 741.580139][T14904] CPU: 0 UID: 0 PID: 14904 Comm: syz.3.3193 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 741.580169][T14904] Tainted: [L]=SOFTLOCKUP [ 741.580177][T14904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 741.580199][T14904] Call Trace: [ 741.580208][T14904] [ 741.580218][T14904] dump_stack_lvl+0xe8/0x150 [ 741.580259][T14904] should_fail_ex+0x467/0x600 [ 741.580306][T14904] _copy_from_iter+0x1d3/0x1660 [ 741.580330][T14904] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 741.580364][T14904] ? __pfx_policy_nodemask+0x10/0x10 [ 741.580393][T14904] ? unwind_next_frame+0x8f/0x2550 [ 741.580421][T14904] ? __pfx__copy_from_iter+0x10/0x10 [ 741.580449][T14904] ? alloc_pages_mpol+0x115/0x280 [ 741.580488][T14904] copy_page_from_iter+0x219/0x2d0 [ 741.580518][T14904] tun_get_user+0x1b68/0x4380 [ 741.580551][T14904] ? is_bpf_text_address+0x292/0x2b0 [ 741.580580][T14904] ? tun_get_user+0x6e7/0x4380 [ 741.580638][T14904] ? __pfx_tun_get_user+0x10/0x10 [ 741.580675][T14904] ? __lock_acquire+0x683/0x2ce0 [ 741.580716][T14904] ? ref_tracker_alloc+0x353/0x4c0 [ 741.580737][T14904] ? get_pid_task+0x20/0x1f0 [ 741.580772][T14904] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 741.580798][T14904] ? tun_get+0x1c/0x2f0 [ 741.580831][T14904] ? tun_get+0x1c/0x2f0 [ 741.580873][T14904] ? tun_get+0x1c/0x2f0 [ 741.580906][T14904] ? tun_get+0x1c/0x2f0 [ 741.580945][T14904] tun_chr_write_iter+0x119/0x200 [ 741.580984][T14904] vfs_write+0x61e/0xbb0 [ 741.581022][T14904] ? __pfx_vfs_write+0x10/0x10 [ 741.581061][T14904] ? __fget_files+0x2a/0x420 [ 741.581096][T14904] ksys_write+0x156/0x270 [ 741.581127][T14904] ? __pfx_ksys_write+0x10/0x10 [ 741.581167][T14904] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 741.581199][T14904] do_syscall_64+0x174/0x580 [ 741.581228][T14904] ? trace_irq_disable+0x3b/0x140 [ 741.581250][T14904] ? clear_bhb_loop+0x40/0x90 [ 741.581279][T14904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 741.581301][T14904] RIP: 0033:0x7fac4e44e84e [ 741.581322][T14904] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 741.581340][T14904] RSP: 002b:00007fac4c6e5fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 741.581365][T14904] RAX: ffffffffffffffda RBX: 00007fac4c6e66c0 RCX: 00007fac4e44e84e [ 741.581382][T14904] RDX: 000000000000002a RSI: 0000200000000080 RDI: 00000000000000c8 [ 741.581396][T14904] RBP: 00007fac4c6e6090 R08: 0000000000000000 R09: 0000000000000000 [ 741.581410][T14904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 741.581422][T14904] R13: 00007fac4e716038 R14: 00007fac4e715fa0 R15: 00007ffdc065de78 [ 741.581458][T14904] [ 742.441974][T14332] Bluetooth: hci6: command tx timeout [ 744.828516][T14332] Bluetooth: hci6: command tx timeout [ 746.841290][T12829] Bluetooth: hci6: command tx timeout [ 747.899899][T14935] netlink: 'syz.1.3202': attribute type 1 has an invalid length. [ 747.940288][T14935] 8021q: adding VLAN 0 to HW filter on device bond2 [ 748.826647][T14816] bridge0: port 1(bridge_slave_0) entered blocking state [ 748.828475][T14816] bridge0: port 1(bridge_slave_0) entered disabled state [ 748.828741][T14816] bridge_slave_0: entered allmulticast mode [ 748.883682][T14816] bridge_slave_0: entered promiscuous mode [ 749.893857][T14816] bridge0: port 2(bridge_slave_1) entered blocking state [ 749.893990][T14816] bridge0: port 2(bridge_slave_1) entered disabled state [ 749.894253][T14816] bridge_slave_1: entered allmulticast mode [ 749.913744][T14816] bridge_slave_1: entered promiscuous mode [ 751.341570][T14816] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 751.389543][T14816] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 752.981464][T14816] team0: Port device team_slave_0 added [ 753.043154][T14816] team0: Port device team_slave_1 added [ 756.035315][T14816] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 756.035333][T14816] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 756.035365][T14816] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 756.442808][T14816] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 756.442828][T14816] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 756.442860][T14816] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 757.730730][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 757.730805][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 758.923483][T14974] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3216'. [ 761.628390][T14987] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3221'. [ 764.624587][T14816] hsr_slave_0: entered promiscuous mode [ 764.636204][T14816] hsr_slave_1: entered promiscuous mode [ 764.651787][T14816] debugfs: 'hsr0' already exists in 'hsr' [ 764.651817][T14816] Cannot create hsr debugfs directory [ 767.729588][T15014] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3233'. [ 767.917392][T15017] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3231'. [ 773.201910][ T37] audit: type=1800 audit(1785542024.993:708): pid=15035 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.1.3238" name="nullb0" dev="tmpfs" ino=1382 res=0 errno=0 [ 783.833408][ T37] audit: type=1800 audit(1785542035.664:709): pid=15080 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.2.3249" name="nullb0" dev="tmpfs" ino=3690 res=0 errno=0 [ 784.962199][T14816] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 786.403183][T15054] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3243'. [ 787.926023][T14876] bridge0: port 1(bridge_slave_0) entered blocking state [ 787.936332][T14876] bridge0: port 1(bridge_slave_0) entered disabled state [ 787.936610][T14876] bridge_slave_0: entered allmulticast mode [ 787.983601][T14876] bridge_slave_0: entered promiscuous mode [ 788.034656][T14876] bridge0: port 2(bridge_slave_1) entered blocking state [ 788.037562][T14876] bridge0: port 2(bridge_slave_1) entered disabled state [ 788.055081][T14876] bridge_slave_1: entered allmulticast mode [ 788.073406][T14876] bridge_slave_1: entered promiscuous mode [ 788.991127][T14876] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 789.219188][T14876] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 790.949770][T14332] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 791.040183][T14332] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 791.074428][T14332] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 791.076783][T14332] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 791.094136][T14332] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 793.320622][T12829] Bluetooth: hci1: command tx timeout [ 794.654640][T14876] team0: Port device team_slave_0 added [ 794.760505][T14876] team0: Port device team_slave_1 added [ 795.469606][T12829] Bluetooth: hci1: command tx timeout [ 797.643127][T12829] Bluetooth: hci1: command tx timeout [ 798.019009][T14332] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 799.046192][T14332] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 799.073070][T14332] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 799.078357][T14332] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 799.320881][T14332] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 799.717826][T14332] Bluetooth: hci1: command tx timeout [ 801.035580][T12829] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 801.094021][T12829] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 801.133209][T12829] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 801.177867][T12829] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 801.187059][T12829] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 801.477366][T12829] Bluetooth: hci2: command tx timeout [ 803.407343][T12829] Bluetooth: hci7: command tx timeout [ 803.567502][T12829] Bluetooth: hci2: command tx timeout [ 805.487272][T12829] Bluetooth: hci7: command tx timeout [ 805.639493][T12829] Bluetooth: hci2: command tx timeout [ 807.557044][T12829] Bluetooth: hci7: command tx timeout [ 807.745333][T12829] Bluetooth: hci2: command tx timeout [ 809.646126][T12829] Bluetooth: hci7: command tx timeout [ 819.188683][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 819.188761][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 823.926526][T15098] bridge0: port 1(bridge_slave_0) entered blocking state [ 823.926659][T15098] bridge0: port 1(bridge_slave_0) entered disabled state [ 823.926939][T15098] bridge_slave_0: entered allmulticast mode [ 823.933020][T15098] bridge_slave_0: entered promiscuous mode [ 824.344731][T15098] bridge0: port 2(bridge_slave_1) entered blocking state [ 824.344892][T15098] bridge0: port 2(bridge_slave_1) entered disabled state [ 824.350409][T15098] bridge_slave_1: entered allmulticast mode [ 824.376716][T15098] bridge_slave_1: entered promiscuous mode [ 824.971359][T15235] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3283'. [ 826.145303][T15098] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 826.932400][T15098] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 829.610276][T15098] team0: Port device team_slave_0 added [ 829.824987][T15098] team0: Port device team_slave_1 added [ 834.238023][T15098] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 834.238044][T15098] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 834.238076][T15098] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 835.166990][T15098] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 835.167010][T15098] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 835.167043][T15098] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 836.260876][T15116] bridge0: port 1(bridge_slave_0) entered blocking state [ 836.261013][T15116] bridge0: port 1(bridge_slave_0) entered disabled state [ 836.261222][T15116] bridge_slave_0: entered allmulticast mode [ 836.525143][T15116] bridge_slave_0: entered promiscuous mode [ 836.976788][T15116] bridge0: port 2(bridge_slave_1) entered blocking state [ 836.976922][T15116] bridge0: port 2(bridge_slave_1) entered disabled state [ 836.977205][T15116] bridge_slave_1: entered allmulticast mode [ 836.980165][T15116] bridge_slave_1: entered promiscuous mode [ 836.984650][T15289] netlink: 144 bytes leftover after parsing attributes in process `syz.2.3298'. [ 838.922758][T15098] hsr_slave_0: entered promiscuous mode [ 839.084162][T15098] hsr_slave_1: entered promiscuous mode [ 839.085699][T15098] debugfs: 'hsr0' already exists in 'hsr' [ 839.085727][T15098] Cannot create hsr debugfs directory [ 841.842137][T15116] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 842.483353][T15116] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 842.609874][T15308] netlink: 124 bytes leftover after parsing attributes in process `syz.1.3305'. [ 842.952187][T15135] bridge0: port 1(bridge_slave_0) entered blocking state [ 842.952411][T15135] bridge0: port 1(bridge_slave_0) entered disabled state [ 842.952633][T15135] bridge_slave_0: entered allmulticast mode [ 842.989812][T15135] bridge_slave_0: entered promiscuous mode [ 843.760156][T15135] bridge0: port 2(bridge_slave_1) entered blocking state [ 843.760327][T15135] bridge0: port 2(bridge_slave_1) entered disabled state [ 843.760623][T15135] bridge_slave_1: entered allmulticast mode [ 843.850777][T15135] bridge_slave_1: entered promiscuous mode [ 844.021454][T15116] team0: Port device team_slave_0 added [ 846.332729][T15116] team0: Port device team_slave_1 added [ 849.971251][T15330] netlink: 'syz.1.3311': attribute type 12 has an invalid length. [ 849.971281][T15330] netlink: 'syz.1.3311': attribute type 29 has an invalid length. [ 849.971298][T15330] netlink: 148 bytes leftover after parsing attributes in process `syz.1.3311'. [ 849.971356][T15330] netlink: 'syz.1.3311': attribute type 1 has an invalid length. [ 849.971374][T15330] netlink: 'syz.1.3311': attribute type 2 has an invalid length. [ 850.202499][T15135] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 850.413653][T15135] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 850.583635][ T5605] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 850.650320][ T5605] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 850.671305][ T5605] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 850.694507][ T5605] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 850.695677][ T5605] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 852.020230][T14332] Bluetooth: hci4: command 0x0406 tx timeout [ 852.240685][T15116] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 852.240704][T15116] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 852.240737][T15116] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 852.844485][T14332] Bluetooth: hci5: command tx timeout [ 853.320301][T15116] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 853.320319][T15116] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 853.320351][T15116] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 854.915603][T12829] Bluetooth: hci5: command tx timeout [ 855.988823][T15135] team0: Port device team_slave_0 added [ 856.342153][T15135] team0: Port device team_slave_1 added [ 857.434188][T12829] Bluetooth: hci5: command tx timeout [ 859.495570][T12829] Bluetooth: hci5: command tx timeout [ 860.301561][T12829] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 860.377759][T12829] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 860.383493][T12829] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 860.412699][T12829] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 860.424434][T12829] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 860.624307][T15364] jffs2: Unknown parameter '/dev/dma_heap/system' [ 861.771043][T15379] fuse: fd is not a fuse device [ 862.060406][T12829] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 862.122507][T12829] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 862.150825][T12829] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 862.528646][T12829] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 862.529577][T12829] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 862.973900][T14332] Bluetooth: hci1: command tx timeout [ 864.743905][T12829] Bluetooth: hci6: command tx timeout [ 865.005320][T12829] Bluetooth: hci1: command tx timeout [ 865.110224][T15391] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3323'. [ 865.295430][T15373] pim6reg: entered allmulticast mode [ 865.329610][T15377] pim6reg: left allmulticast mode [ 866.753938][T12829] Bluetooth: hci6: command tx timeout [ 867.077450][T12829] Bluetooth: hci1: command tx timeout [ 868.833491][T12829] Bluetooth: hci6: command tx timeout [ 869.220931][T12829] Bluetooth: hci1: command tx timeout [ 871.195239][T12829] Bluetooth: hci6: command tx timeout [ 872.138544][T15406] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3326'. [ 880.598356][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 880.598432][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 881.428196][T14332] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 881.512605][T14332] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 881.531717][T14332] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 881.555550][T14332] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 881.560998][T14332] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 883.872828][T14332] Bluetooth: hci2: command tx timeout [ 886.021134][T14332] Bluetooth: hci2: command tx timeout [ 887.981016][T15451] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3335'. [ 888.112543][T14332] Bluetooth: hci2: command tx timeout [ 890.228674][T14332] Bluetooth: hci2: command tx timeout [ 892.553668][T15461] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3336'. [ 896.913535][T15474] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3338'. [ 903.774135][T15333] bridge0: port 1(bridge_slave_0) entered blocking state [ 903.774378][T15333] bridge0: port 1(bridge_slave_0) entered disabled state [ 903.774683][T15333] bridge_slave_0: entered allmulticast mode [ 903.803751][T15333] bridge_slave_0: entered promiscuous mode [ 904.115542][T15501] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3342'. [ 904.608679][T15333] bridge0: port 2(bridge_slave_1) entered blocking state [ 904.647241][T15333] bridge0: port 2(bridge_slave_1) entered disabled state [ 904.647556][T15333] bridge_slave_1: entered allmulticast mode [ 904.676168][T15333] bridge_slave_1: entered promiscuous mode [ 910.213450][T15333] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 911.610132][T15523] jffs2: Unknown parameter '/dev/dma_heap/system' [ 911.755647][T15368] bridge0: port 1(bridge_slave_0) entered blocking state [ 911.755782][T15368] bridge0: port 1(bridge_slave_0) entered disabled state [ 911.756090][T15368] bridge_slave_0: entered allmulticast mode [ 911.788397][T15368] bridge_slave_0: entered promiscuous mode [ 911.806573][T15378] bridge0: port 1(bridge_slave_0) entered blocking state [ 911.806708][T15378] bridge0: port 1(bridge_slave_0) entered disabled state [ 911.807000][T15378] bridge_slave_0: entered allmulticast mode [ 911.836588][T15378] bridge_slave_0: entered promiscuous mode [ 911.879896][T15368] bridge0: port 2(bridge_slave_1) entered blocking state [ 911.880031][T15368] bridge0: port 2(bridge_slave_1) entered disabled state [ 911.880339][T15368] bridge_slave_1: entered allmulticast mode [ 911.922897][T15368] bridge_slave_1: entered promiscuous mode [ 912.042740][T15378] bridge0: port 2(bridge_slave_1) entered blocking state [ 912.072845][T15378] bridge0: port 2(bridge_slave_1) entered disabled state [ 912.116619][T15378] bridge_slave_1: entered allmulticast mode [ 912.146623][T15378] bridge_slave_1: entered promiscuous mode [ 913.273209][T12829] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 913.361964][T12829] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 913.365581][T12829] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 913.395939][T12829] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 913.402698][T12829] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 915.135678][T15542] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3349'. [ 915.553757][T12829] Bluetooth: hci7: command tx timeout [ 915.576538][T15368] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 916.142116][T15378] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 916.851546][T15368] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 917.370244][T15378] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 917.631270][T12829] Bluetooth: hci7: command tx timeout [ 919.736805][T12829] Bluetooth: hci7: command tx timeout [ 922.234687][T12829] Bluetooth: hci7: command tx timeout [ 923.989890][T14332] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 924.064552][T14332] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 924.072648][T14332] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 924.189457][T14332] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 924.190766][T14332] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 924.678026][T12829] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 925.694476][T12829] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 925.715819][T12829] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 925.718047][T12829] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 925.719737][T12829] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 926.350473][T12829] Bluetooth: hci5: command tx timeout [ 928.270705][T12829] Bluetooth: hci8: command tx timeout [ 928.483517][T12829] Bluetooth: hci5: command tx timeout [ 930.350593][T12829] Bluetooth: hci8: command tx timeout [ 930.510028][T12829] Bluetooth: hci5: command tx timeout [ 932.444571][T12829] Bluetooth: hci8: command tx timeout [ 932.650271][T12829] Bluetooth: hci5: command tx timeout [ 934.579835][T12829] Bluetooth: hci8: command tx timeout [ 937.956285][T15584] xt_hashlimit: size too large, truncated to 1048576 [ 942.044606][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 942.044700][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 943.063499][T15604] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3356'. [ 943.597474][T14332] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 943.657751][T14332] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 943.870498][ T5605] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 943.871964][ T5605] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 943.932107][ T5605] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 945.869434][ T38] INFO: task syz-executor:14816 blocked for more than 143 seconds. [ 945.869466][ T38] Tainted: G L syzkaller #0 [ 945.869480][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 945.869491][ T38] task:syz-executor state:D stack:19064 pid:14816 tgid:14816 ppid:1 task_flags:0x480140 flags:0x00080002 [ 945.869555][ T38] Call Trace: [ 945.869563][ T38] [ 945.869579][ T38] __schedule+0x16dc/0x5500 [ 945.869648][ T38] ? __pfx___schedule+0x10/0x10 [ 945.869695][ T38] rt_mutex_schedule+0x76/0xf0 [ 945.869723][ T38] rt_mutex_slowlock_block+0x55c/0x680 [ 945.869779][ T38] rt_mutex_slowlock+0x2d4/0x780 [ 945.869806][ T38] ? rt_mutex_slowlock+0x1f2/0x780 [ 945.869840][ T38] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 945.869877][ T38] ? rcu_barrier+0x4c/0x530 [ 945.869916][ T38] ? rcu_barrier+0x4c/0x530 [ 945.869962][ T38] ? rcu_barrier+0x4c/0x530 [ 945.869992][ T38] mutex_lock_nested+0x168/0x1d0 [ 945.870013][ T38] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 945.870043][ T38] rcu_barrier+0x4c/0x530 [ 945.870093][ T38] netdev_run_todo+0x2ff/0x10d0 [ 945.870135][ T38] ? __pfx_netdev_run_todo+0x10/0x10 [ 945.870165][ T38] ? lockdep_hardirqs_on+0x7a/0x110 [ 945.870201][ T38] ? kfree+0x1c5/0x6c0 [ 945.870230][ T38] nsim_destroy+0x42b/0x800 [ 945.870275][ T38] __nsim_dev_port_del+0x14e/0x200 [ 945.870308][ T38] nsim_dev_reload_destroy+0x288/0x490 [ 945.870334][ T38] ? nsim_drv_remove+0x50/0x160 [ 945.870364][ T38] nsim_drv_remove+0x58/0x160 [ 945.870392][ T38] ? __pfx_nsim_bus_remove+0x10/0x10 [ 945.870426][ T38] device_release_driver_internal+0x48b/0x880 [ 945.870468][ T38] bus_remove_device+0x449/0x560 [ 945.870501][ T38] ? __pfx_bus_remove_device+0x10/0x10 [ 945.870529][ T38] ? up_read+0x34/0x180 [ 945.870562][ T38] ? kernfs_remove_by_name_ns+0x101/0x140 [ 945.870598][ T38] device_del+0x528/0x8f0 [ 945.870640][ T38] ? __pfx_device_del+0x10/0x10 [ 945.870672][ T38] ? lockdep_hardirqs_on+0x7a/0x110 [ 945.870702][ T38] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 945.870736][ T38] device_unregister+0x21/0xf0 [ 945.870768][ T38] del_device_store+0x2b5/0x370 [ 945.870794][ T38] ? __pfx_del_device_store+0x10/0x10 [ 945.870825][ T38] ? sysfs_file_kobj+0x1e4/0x230 [ 945.870862][ T38] ? sysfs_kf_write+0x166/0x260 [ 945.870888][ T38] ? __pfx_sysfs_kf_write+0x10/0x10 [ 945.870908][ T38] kernfs_fop_write_iter+0x3a5/0x540 [ 945.870947][ T38] vfs_write+0x61e/0xbb0 [ 945.870989][ T38] ? __pfx_vfs_write+0x10/0x10 [ 945.871030][ T38] ? do_sys_openat2+0x14e/0x200 [ 945.871051][ T38] ? kmem_cache_free+0x187/0x6c0 [ 945.871097][ T38] ksys_write+0x156/0x270 [ 945.871130][ T38] ? __pfx_ksys_write+0x10/0x10 [ 945.871171][ T38] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 945.871197][ T38] do_syscall_64+0x174/0x580 [ 945.871229][ T38] ? clear_bhb_loop+0x40/0x90 [ 945.871257][ T38] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 945.871282][ T38] RIP: 0033:0x7f9e5b87e84e [ 945.871303][ T38] RSP: 002b:00007ffd08b94888 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 945.871327][ T38] RAX: ffffffffffffffda RBX: 000055558c871500 RCX: 00007f9e5b87e84e [ 945.871344][ T38] RDX: 0000000000000001 RSI: 00007ffd08b94910 RDI: 0000000000000005 [ 945.871358][ T38] RBP: 00007f9e5b95588f R08: 0000000000000000 R09: 0000000000000000 [ 945.871373][ T38] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 945.871388][ T38] R13: 00007ffd08b94910 R14: 00007f9e5c674620 R15: 0000000000000003 [ 945.871425][ T38] [ 945.871440][ T38] INFO: task syz.3.3247:15072 blocked for more than 143 seconds. [ 945.871460][ T38] Tainted: G L syzkaller #0 [ 945.871472][ T38] Blocked by coredump. [ 945.871479][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 945.871490][ T38] task:syz.3.3247 state:D stack:26888 pid:15072 tgid:15069 ppid:13608 task_flags:0x40044c flags:0x00080001 [ 945.871562][ T38] Call Trace: [ 945.871569][ T38] [ 945.871583][ T38] __schedule+0x16dc/0x5500 [ 945.871644][ T38] ? __pfx___schedule+0x10/0x10 [ 945.871689][ T38] rt_mutex_schedule+0x76/0xf0 [ 945.871716][ T38] rt_mutex_slowlock_block+0x55c/0x680 [ 945.871771][ T38] rt_mutex_slowlock+0x2d4/0x780 [ 945.871797][ T38] ? rt_mutex_slowlock+0x1f2/0x780 [ 945.871828][ T38] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 945.871865][ T38] ? rcu_barrier+0x4c/0x530 [ 945.871900][ T38] ? rcu_barrier+0x4c/0x530 [ 945.871937][ T38] ? rcu_barrier+0x4c/0x530 [ 945.871966][ T38] mutex_lock_nested+0x168/0x1d0 [ 945.871995][ [ 945.871995][ T38] rcu_barrier+0x4c/0x530 [ 945.872028][ T38] ? rt_write_unlock+0x1a8/0x360 [ 945.872058][ T38] kvm_mmu_uninit_vm+0x53/0x90 [ 945.872086][ T38] kvm_arch_destroy_vm+0x26e/0x2d0 [ 945.872126][ T38] kvm_put_kvm+0x772/0xb50 [ 945.872161][ T38] ? __pfx_kvm_vm_release+0x10/0x10 [ 945.872183][ T38] kvm_vm_release+0x46/0x50 [ 945.872204][ T38] __fput+0x42a/0xa80 [ 945.872237][ T38] task_work_run+0x1d9/0x270 [ 945.872264][ T38] ? __pfx_task_work_run+0x10/0x10 [ 945.872289][ T38] ? rt_spin_unlock+0x163/0x200 [ 945.872321][ T38] do_exit+0x73a/0x2360 [ 945.872342][ T38] ? lockdep_hardirqs_on+0x7a/0x110 [ 945.872372][ T38] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 945.872408][ T38] ? __pfx_do_exit+0x10/0x10 [ 945.872442][ T38] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 945.872464][ T38] ? rt_spin_lock+0x1e0/0x400 [ 945.872496][ T38] ? rt_spin_unlock+0x157/0x200 [ 945.872521][ T38] do_group_exit+0x22d/0x2f0 [ 945.872542][ T38] ? rt_spin_unlock+0x163/0x200 [ 945.872568][ T38] get_signal+0x121b/0x12c0 [ 945.872609][ T38] ? lockdep_hardirqs_on+0x7a/0x110 [ 945.872648][ T38] arch_do_signal_or_restart+0xbb/0x860 [ 945.872684][ T38] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 945.872726][ T38] ? ksys_write+0x248/0x270 [ 945.872766][ T38] exit_to_user_mode_loop+0x104/0x730 [ 945.872790][ T38] ? rcu_is_watching+0x15/0xb0 [ 945.872826][ T38] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 945.872853][ T38] do_syscall_64+0x353/0x580 [ 945.872881][ T38] ? trace_irq_disable+0x3b/0x140 [ 945.872905][ T38] ? clear_bhb_loop+0x40/0x90 [ 945.872933][ T38] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 945.872957][ T38] RIP: 0033:0x7fac4e48e019 [ 945.872977][ T38] RSP: 002b:00007fac4c6c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 945.872999][ T38] RAX: 0000000000011000 RBX: 00007fac4e716090 RCX: 00007fac4e48e019 [ 945.873016][ T38] RDX: 000000000208e24b RSI: 0000200000000000 RDI: 0000000000000008 [ 945.873031][ T38] RBP: 00007fac4e52500c R08: 0000000000000000 R09: 0000000000000000 [ 945.873046][ T38] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 945.873060][ T38] R13: 00007fac4e716128 R14: 00007fac4e716090 R15: 00007ffdc065de78 [ 945.873098][ T38] [ 945.873149][ T38] [ 945.873149][ T38] Showing all locks held in the system: [ 945.873165][ T38] 6 locks held by kworker/u8:0/12: [ 945.873179][ T38] #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 945.873243][ T38] #1: ffffc90000117c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 945.873304][ T38] #2: ffff888021f34310 (&devlink->lock_key#5){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 [ 945.873373][ T38] #3: ffff888060c4b920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 [ 945.873437][ T38] #4: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 945.873490][ T38] #5: ffff8880b8636d10 ((crngs.lock)){+.+.}-{3:3}, at: crng_make_state+0x158/0x5d0 [ 945.873545][ T38] 5 locks held by kworker/u8:1/13: [ 945.873560][ T38] 3 locks held by rcuc/1/28: [ 945.873574][ T38] 1 lock held by khungtaskd/38: [ 945.873586][ T38] #0: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 945.873652][ T38] 2 locks held by kworker/u8:6/1023: [ 945.873665][ T38] #0: ffff88801e751938 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 945.873724][ T38] #1: ffffc90005e4fc40 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 945.873793][ T38] 2 locks held by kworker/u8:8/1062: [ 945.873806][ T38] #0: ffff88801e751938 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 945.873873][ T38] #1: ffffc90005f3fc40 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 945.873936][ T38] 2 locks held by kworker/0:3/1246: [ 945.873949][ T38] #0: ffff88813ff1f938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 945.874009][ T38] #1: ffffc9000647fc40 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 945.874083][ T38] 2 locks held by getty/5349: [ 945.874097][ T38] #0: ffff88803650b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 945.874157][ T38] #1: ffffc90003cbe2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 [ 945.874231][ T38] 6 locks held by kworker/u8:16/10861: [ 945.874244][ T38] #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 945.874311][ T38] #1: ffffc9000462fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 945.874374][ T38] #2: ffff88801a70e310 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 [ 945.874448][ T38] #3: ffff888060356920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 [ 945.874513][ T38] #4: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 945.874583][ T38] #5: ffff8880b8636d10 ((crngs.lock)){+.+.}-{3:3}, at: crng_make_state+0x158/0x5d0 [ 945.874636][ T38] 6 locks held by kworker/u8:25/11206: [ 945.874650][ T38] 2 locks held by kworker/1:1/13060: [ 945.874667][ T38] 1 lock held by syz.0.3157/14765: [ 945.874680][ T38] #0: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.874744][ T38] 7 locks held by syz-executor/14816: [ 945.874756][ T38] #0: ffff8880350e2500 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 945.874836][ T38] #1: ffff88805eb6fc78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 945.874899][ T38] #2: ffff888028e29a58 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 945.874967][ T38] #3: ffffffff8ee27078 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 945.875027][ T38] #4: ffff888035ab3160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 945.875092][ T38] #5: ffff88803ff0c310 (&devlink->lock_key#7){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 [ 945.875154][ T38] #6: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.875216][ T38] 1 lock held by syz-executor/14876: [ 945.875229][ T38] #0: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.875292][ T38] 1 lock held by syz.3.3241/15047: [ 945.875306][ T38] #0: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.875370][ T38] 1 lock held by syz.3.3247/15072: [ 945.875383][ T38] #0: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.875447][ T38] 1 lock held by syz-executor/15098: [ 945.875460][ T38] #0: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.875523][ T38] 1 lock held by syz-executor/15116: [ 945.875535][ T38] #0: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.875598][ T38] 1 lock held by syz-executor/15135: [ 945.875611][ T38] #0: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.875677][ T38] 1 lock held by syz-executor/15333: [ 945.875689][ T38] #0: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.875753][ T38] 1 lock held by syz-executor/15368: [ 945.875766][ T38] #0: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.875837][ T38] 1 lock held by syz.1.3319/15377: [ 945.875850][ T38] #0: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.875913][ T38] 1 lock held by syz-executor/15378: [ 945.875926][ T38] #0: ffffffff8e1c91b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 945.875989][ T38] 1 lock held by syz-executor/15438: [ 945.876005][ T38] 4 locks held by syz-executor/15524: [ 945.876018][ T38] 2 locks held by syz-executor/15557: [ 945.876032][ T38] 3 locks held by syz-executor/15559: [ 945.876045][ T38] 4 locks held by syz.2.3356/15598: [ 945.876057][ T38] 6 locks held by syz-executor/15603: [ 945.876071][ T38] [ 945.876076][ T38] ============================================= [ 945.876076][ T38] [ 945.876087][ T38] NMI backtrace for cpu 0 [ 945.876109][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 945.876161][ T38] Tainted: [L]=SOFTLOCKUP [ 945.876170][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 945.876183][ T38] Call Trace: [ 945.876191][ T38] [ 945.876211][ T38] dump_stack_lvl+0xe8/0x150 [ 945.876249][ T38] nmi_cpu_backtrace+0x274/0x2d0 [ 945.876274][ T38] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 945.876311][ T38] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 945.876339][ T38] sys_info+0x135/0x170 [ 945.876371][ T38] watchdog+0xfd7/0x1030 [ 945.876400][ T38] ? watchdog+0x1c7/0x1030 [ 945.876429][ T38] kthread+0x388/0x470 [ 945.876463][ T38] ? __pfx_watchdog+0x10/0x10 [ 945.876483][ T38] ? __pfx_kthread+0x10/0x10 [ 945.876518][ T38] ret_from_fork+0x514/0xb70 [ 945.876558][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 945.876592][ T38] ? __switch_to+0xc89/0x1420 [ 945.876625][ T38] ? __pfx_kthread+0x10/0x10 [ 945.876660][ T38] ret_from_fork_asm+0x1a/0x30 [ 945.876701][ T38] [ 945.876719][ T38] Sending NMI from CPU 0 to CPUs 1: [ 945.876757][ C1] NMI backtrace for cpu 1 [ 945.876778][ C1] CPU: 1 UID: 0 PID: 28 Comm: rcuc/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 945.876817][ C1] Tainted: [L]=SOFTLOCKUP [ 945.876823][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 945.876833][ C1] RIP: 0010:debug_lockdep_rcu_enabled+0x0/0x40 [ 945.876863][ C1] Code: 48 8d 3d 33 98 6e 04 48 c7 c6 41 ea 86 8d 67 48 0f b9 3a 90 eb ca cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 31 c0 83 3d a3 35 6b 04 00 74 1d 83 3d ba 47 6b 04 00 [ 945.876880][ C1] RSP: 0018:ffffc90000a2eb58 EFLAGS: 00000296 [ 945.876896][ C1] RAX: f5c5b03beca43700 RBX: ffffffff8192e62c RCX: 0000000000000046 [ 945.876910][ C1] RDX: 00000000beb03aa1 RSI: ffffffff8daf6356 RDI: ffffffff8bca7880 [ 945.876924][ C1] RBP: 1ffff92000145d88 R08: ffffffff8177825f R09: 0000000000000000 [ 945.876937][ C1] R10: 0000000000000000 R11: ffffffff8e1c3000 R12: dffffc0000000000 [ 945.876950][ C1] R13: ffffffff8177825f R14: ffffc90000a2ec08 R15: 1ffff92000145d81 [ 945.876966][ C1] FS: 0000000000000000(0000) GS:ffff888125d3e000(0000) knlGS:0000000000000000 [ 945.876981][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 945.876993][ C1] CR2: 00007fc3d4000020 CR3: 00000000357fc000 CR4: 00000000003526f0 [ 945.877010][ C1] Call Trace: [ 945.877017][ C1] [ 945.877023][ C1] unwind_next_frame+0xb5/0x2550 [ 945.877049][ C1] ? rcu_cpu_kthread+0x99f/0x1480 [ 945.877070][ C1] ? unwind_next_frame+0x8f/0x2550 [ 945.877092][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 945.877110][ C1] arch_stack_walk+0x11b/0x150 [ 945.877134][ C1] ? smpboot_thread_fn+0x57c/0xa80 [ 945.877164][ C1] stack_trace_save+0xa9/0x100 [ 945.877193][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 945.877220][ C1] ? kfree+0x1c5/0x6c0 [ 945.877240][ C1] ? __lock_acquire+0x683/0x2ce0 [ 945.877261][ C1] kasan_save_track+0x3e/0x80 [ 945.877279][ C1] ? kasan_save_track+0x3e/0x80 [ 945.877295][ C1] ? kasan_save_free_info+0x40/0x50 [ 945.877326][ C1] ? __kasan_slab_free+0x5c/0x80 [ 945.877344][ C1] ? kmem_cache_free+0x187/0x6c0 [ 945.877364][ C1] ? nft_synproxy_eval_v4+0x36a/0x4e0 [ 945.877382][ C1] ? nft_synproxy_do_eval+0x335/0x550 [ 945.877399][ C1] ? nft_do_chain+0x48d/0x1b10 [ 945.877417][ C1] ? nft_do_chain_inet+0x360/0x4b0 [ 945.877434][ C1] ? nf_hook_slow+0xc5/0x220 [ 945.877459][ C1] ? NF_HOOK+0x21f/0x3c0 [ 945.877480][ C1] ? NF_HOOK+0x336/0x3c0 [ 945.877500][ C1] ? process_backlog+0x564/0xc50 [ 945.877517][ C1] ? __napi_poll+0xae/0x550 [ 945.877544][ C1] ? net_rx_action+0x621/0xd70 [ 945.877560][ C1] ? handle_softirqs+0x1d9/0x6c0 [ 945.877582][ C1] ? __local_bh_enable_ip+0x170/0x2b0 [ 945.877604][ C1] ? rcu_cpu_kthread+0x99f/0x1480 [ 945.877624][ C1] ? smpboot_thread_fn+0x57c/0xa80 [ 945.877673][ C1] ? nft_synproxy_eval_v4+0x36a/0x4e0 [ 945.877691][ C1] kasan_save_free_info+0x40/0x50 [ 945.877717][ C1] __kasan_slab_free+0x5c/0x80 [ 945.877736][ C1] kmem_cache_free+0x187/0x6c0 [ 945.877756][ C1] ? nft_synproxy_eval_v4+0x36a/0x4e0 [ 945.877778][ C1] nft_synproxy_eval_v4+0x36a/0x4e0 [ 945.877800][ C1] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 945.877821][ C1] ? nf_ip_checksum+0x13c/0x510 [ 945.877844][ C1] nft_synproxy_do_eval+0x335/0x550 [ 945.877864][ C1] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 945.877886][ C1] ? __lock_acquire+0x683/0x2ce0 [ 945.877911][ C1] nft_do_chain+0x48d/0x1b10 [ 945.877929][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 945.877954][ C1] ? rcu_is_watching+0x15/0xb0 [ 945.877981][ C1] ? ktime_get+0x45/0x220 [ 945.877998][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 945.878022][ C1] ? ktime_get+0x45/0x220 [ 945.878046][ C1] ? __lock_acquire+0x683/0x2ce0 [ 945.878068][ C1] ? __lock_acquire+0x683/0x2ce0 [ 945.878091][ C1] nft_do_chain_inet+0x360/0x4b0 [ 945.878112][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 945.878129][ C1] ? __lock_acquire+0x683/0x2ce0 [ 945.878154][ C1] ? NF_HOOK+0x9e/0x3c0 [ 945.878176][ C1] ? NF_HOOK+0x9e/0x3c0 [ 945.878200][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 945.878219][ C1] nf_hook_slow+0xc5/0x220 [ 945.878249][ C1] NF_HOOK+0x21f/0x3c0 [ 945.878272][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 945.878296][ C1] ? NF_HOOK+0x9e/0x3c0 [ 945.878322][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 945.878345][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 945.878373][ C1] ? ip_local_deliver+0x113/0x190 [ 945.878398][ C1] NF_HOOK+0x336/0x3c0 [ 945.878421][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 945.878443][ C1] ? NF_HOOK+0x9e/0x3c0 [ 945.878464][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 945.878487][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 945.878513][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 945.878535][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 945.878556][ C1] ? process_backlog+0x261/0xc50 [ 945.878573][ C1] process_backlog+0x564/0xc50 [ 945.878591][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 945.878630][ C1] __napi_poll+0xae/0x550 [ 945.878660][ C1] net_rx_action+0x621/0xd70 [ 945.878686][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 945.878702][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 945.878730][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 945.878764][ C1] handle_softirqs+0x1d9/0x6c0 [ 945.878794][ C1] __local_bh_enable_ip+0x170/0x2b0 [ 945.878817][ C1] ? __pfx_dst_destroy_rcu+0x10/0x10 [ 945.878845][ C1] ? rcu_cpu_kthread+0x20b/0x1480 [ 945.878865][ C1] rcu_cpu_kthread+0x99f/0x1480 [ 945.878892][ C1] ? rcu_cpu_kthread+0x20b/0x1480 [ 945.878920][ C1] ? __pfx_rcu_cpu_kthread+0x10/0x10 [ 945.878939][ C1] ? preempt_schedule_thunk+0x16/0x40 [ 945.878963][ C1] ? preempt_schedule_common+0x82/0xd0 [ 945.878996][ C1] smpboot_thread_fn+0x57c/0xa80 [ 945.879024][ C1] ? smpboot_thread_fn+0x4e/0xa80 [ 945.879056][ C1] kthread+0x388/0x470 [ 945.879085][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 945.879110][ C1] ? __pfx_kthread+0x10/0x10 [ 945.879139][ C1] ret_from_fork+0x514/0xb70 [ 945.879170][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 945.879200][ C1] ? __switch_to+0xc89/0x1420 [ 945.879227][ C1] ? __pfx_kthread+0x10/0x10 [ 945.879256][ C1] ret_from_fork_asm+0x1a/0x30 [ 945.879285][ C1] [ 946.189860][ T5605] Bluetooth: hci1: command tx timeout [ 946.750964][ T38] Kernel panic - not syncing: hung_task: blocked tasks [ 946.750991][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 946.751024][ T38] Tainted: [L]=SOFTLOCKUP [ 946.751032][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 946.751047][ T38] Call Trace: [ 946.751057][ T38] [ 946.751068][ T38] vpanic+0x56c/0xa60 [ 946.751096][ T38] ? __pfx___schedule+0x10/0x10 [ 946.751126][ T38] ? __pfx_vpanic+0x10/0x10 [ 946.751160][ T38] panic+0xc5/0xd0 [ 946.751182][ T38] ? __pfx_panic+0x10/0x10 [ 946.751202][ T38] ? preempt_schedule_common+0x82/0xd0 [ 946.751229][ T38] ? preempt_schedule_thunk+0x16/0x40 [ 946.751258][ T38] ? nmi_trigger_cpumask_backtrace+0x314/0x380 [ 946.751285][ T38] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 946.751322][ T38] watchdog+0x1030/0x1030 [ 946.751353][ T38] ? watchdog+0x1c7/0x1030 [ 946.751384][ T38] kthread+0x388/0x470 [ 946.751419][ T38] ? __pfx_watchdog+0x10/0x10 [ 946.751438][ T38] ? __pfx_kthread+0x10/0x10 [ 946.751472][ T38] ret_from_fork+0x514/0xb70 [ 946.751512][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 946.751545][ T38] ? __switch_to+0xc89/0x1420 [ 946.751579][ T38] ? __pfx_kthread+0x10/0x10 [ 946.751616][ T38] ret_from_fork_asm+0x1a/0x30 [ 946.751657][ T38] [ 946.752267][ T38] Kernel Offset: disabled