last executing test programs: 5m1.843633944s ago: executing program 1 (id=1860): setresuid(0x0, 0x0, 0xee01) r0 = syz_clone(0x80000400, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x12) 5m1.735460795s ago: executing program 1 (id=1861): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') open_by_handle_at(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x0) r1 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r1, 0xc01064bd, &(0x7f00000001c0)={0x0}) r2 = userfaultfd(0x800) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) flistxattr(r1, &(0x7f0000000000)=""/10, 0xa) syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') (async) open_by_handle_at(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x0) (async) syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r1, 0xc01064bd, &(0x7f00000001c0)={0x0}) (async) userfaultfd(0x800) (async) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) (async) flistxattr(r1, &(0x7f0000000000)=""/10, 0xa) (async) 5m1.632158771s ago: executing program 1 (id=1862): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_mtu(r2, 0x0, 0xa, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r1, r0, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r5 = socket$inet(0xa, 0x801, 0x84) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r5, 0x8) r6 = accept4(r5, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x4}, 0x30) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r6, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x4, 0x3f}, 0x8) socket$packet(0x11, 0x3, 0x300) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) epoll_create1(0x80000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000680)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}, @flat=@handle={0x73682a85, 0x105}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) 5m1.426866048s ago: executing program 1 (id=1865): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f00000027c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) 5m1.319629334s ago: executing program 1 (id=1866): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000c40)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r1, 0xc0182101, &(0x7f00000000c0)={r2}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000002780)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000080)={r3, 0x3, r1, 0x5}) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x180c}}, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000340)={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x83, 0x1, "c4"}, 0x0, 0x0}) 4m58.224409826s ago: executing program 1 (id=1881): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, 0x0) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f00000000c0)={0x6, 0x81, 0x9, 0x0, 0x3, "615481061d770925d1614e7ace9a20504b2d80", 0x8, 0x3c3501d7}) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)=0xf6) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0x2000) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001c000100fcff0700040000001c9000000400488004000180"], 0x1c}, 0x1, 0x0, 0x0, 0x400c801}, 0x24008815) r4 = gettid() ioprio_set$pid(0x1, r4, 0x4004) mount$9p_fd(0x0, &(0x7f0000000500)='.\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESOCT=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) 4m43.060459075s ago: executing program 32 (id=1881): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$GIO_CMAP(r0, 0x4b70, 0x0) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f00000000c0)={0x6, 0x81, 0x9, 0x0, 0x3, "615481061d770925d1614e7ace9a20504b2d80", 0x8, 0x3c3501d7}) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)=0xf6) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0x2000) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001c000100fcff0700040000001c9000000400488004000180"], 0x1c}, 0x1, 0x0, 0x0, 0x400c801}, 0x24008815) r4 = gettid() ioprio_set$pid(0x1, r4, 0x4004) mount$9p_fd(0x0, &(0x7f0000000500)='.\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESOCT=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) 3m5.043172842s ago: executing program 0 (id=2335): syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="ffffff1002ddfffffffffffffffc"], 0xe) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f0000001b40)={0x0, 0x0, &(0x7f0000001b00)={&(0x7f0000001a00)={0x18, 0x1, 0x9, 0x3, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFCTH_TUPLE={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000885}, 0x800) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="04452b000000c802"], 0x8) r1 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) r3 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev={0xfe, 0x80, '\x00', 0x3}, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f0000000480)=[{0x18, 0x110, 0x1, '\x00'}, {0x10, 0x110, 0xa}], 0x28}, 0xfc40) ioctl$IOMMU_IOAS_MAP(r1, 0x3b85, &(0x7f00000001c0)={0x28, 0x3, r2, 0x0, &(0x7f0000000200)="b77b961326e8521292b94992c2c898d5539dc0eae957cbae44409c3daa6707000000e5bd29d31845b4b9400c39b16b0ba10466f5dcbac972ecff2a73a7b619b03c3adcfee476333cd1a0cb7bc051c893140a15e2b5e51223f98f5b5949e4801c444e68e4927cb68c1cfedca1d05ac3f6d95c358abe2987373c0725c2803de7ec689c0e3f6a09eb0f2ab37099209877d1eda69a6529daec20251305b0c019521e801c788276ffa850adb1f5185d1f53a349ff1f06c9154a458f11605e6d65083f2ab4f74a26f0d9c6c5617272655abf1e4bc5a2c4145d85b43edcea5024c9098e4f87136a1e65c46d41a56e32f88a727c1821223b1e57e973b786183351128c6e4c6cebe9ac", 0x105, 0x8}) 3m4.949208282s ago: executing program 0 (id=2336): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x1202, 0x3, 0x2}, 0x30, 0x0) landlock_restrict_self(r0, 0x6) r2 = socket$inet_smc(0x2b, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000001100)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000001140)='team0\x00', 0x10) connect$inet(r2, &(0x7f0000001200)={0x2, 0x4e20, @rand_addr=0x64010100}, 0x10) landlock_restrict_self(r1, 0xa) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) socket$packet(0x11, 0x3, 0x300) landlock_restrict_self(r0, 0xe) 3m4.595826887s ago: executing program 0 (id=2338): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETGEN(r0, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, 0x10, 0xa, 0x5, 0x0, 0x0, {0x3, 0x0, 0x5}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44804}, 0x4045) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x74, 0xb, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_DATA={0x48, 0x7, 0x0, 0x1, [@IPSET_ATTR_LINENO={0xfffffffffffffcf5, 0x9, 0x1, 0x0, 0x3}, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0xffffffffffffffff}, @IPSET_ATTR_NAME={0x9, 0x12, 'syz0\x00'}, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x65b8}, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @dev={0xfe, 0x80, '\x00', 0x44}}}]}, @IPSET_ATTR_DATA={0x10}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x74}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000280)=0x4, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='syscall\x00') readv(r3, &(0x7f0000000800)=[{&(0x7f00000001c0)=""/238, 0xee}], 0x1) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='net/psched\x00') renameat2(r3, &(0x7f00000002c0)='./file0\x00', r4, &(0x7f0000000380)='./file0\x00', 0x6) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000000c0)={'batadv_slave_0\x00'}) sendmsg$NL80211_CMD_ASSOCIATE(r3, &(0x7f0000000600)={&(0x7f00000004c0), 0xc, &(0x7f00000005c0)={&(0x7f0000000500)={0x98, 0x0, 0x1, 0x70bd27, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_FILS_KEK={0x17, 0xf2, "2590e317974d24b8d99c0ba2700302b4539635"}, @NL80211_ATTR_FILS_NONCES={0x24, 0xf3, [0xf, 0x8, 0x7, 0x272, 0x7, 0x7, 0xe, 0x8, 0x5, 0x3, 0x96, 0x1, 0xfe7, 0x7, 0x5, 0x29]}, @crypto_settings=[@NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x1}, @NL80211_ATTR_WPA_VERSIONS={0x8}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}], @NL80211_ATTR_SSID={0x17, 0x34, @random="3193d7030f2d03d8ae07d5f4c873abc68ba66f"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="c8d730e34015"}, @NL80211_ATTR_USE_RRM={0x4}]}, 0x98}}, 0x24000055) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x24, r2, 0x1, 0x70bf26, 0x25dfdbfb, {}, [@BATADV_ATTR_HOP_PENALTY={0x0, 0x35, 0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x0, 0x3c, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x40801}, 0x48050) 3m4.419572654s ago: executing program 0 (id=2339): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) mkdir(&(0x7f0000000000)='./control\x00', 0x0) rmdir(&(0x7f0000000040)='./control\x00') ioctl$KVM_CAP_X86_USER_SPACE_MSR(r0, 0x4068aea3, &(0x7f0000000080)={0xbc, 0x0, 0x2}) 3m4.397044121s ago: executing program 0 (id=2340): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) socket$inet6_mptcp(0xa, 0x1, 0x106) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x80) r3 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f0000000000)={r3}) ioctl$SIOCPNGETOBJECT(r4, 0x89e0, &(0x7f0000000040)=0x4) write$nci(0xffffffffffffffff, 0x0, 0x4) fstatfs(r0, &(0x7f0000000040)=""/134) mmap(&(0x7f0000192000/0x3000)=nil, 0x3000, 0xa, 0x12, r2, 0xaa898000) 3m3.360304269s ago: executing program 0 (id=2341): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x206, 0x20182) ioctl$USBDEVFS_BULK(r0, 0x5523, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000030d40), 0x80100, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000030d80)=0x7f) setrlimit(0x7, &(0x7f0000000400)) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x393}, 0x0, 0x0, 0x0) memfd_create(0x0, 0x20000002) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x18c}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x300, 0x6040000}) r3 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x6, 0x189083) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r3, 0x40045730, &(0x7f0000000000)=0x1002) 3m3.03107673s ago: executing program 33 (id=2341): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x206, 0x20182) ioctl$USBDEVFS_BULK(r0, 0x5523, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000030d40), 0x80100, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000030d80)=0x7f) setrlimit(0x7, &(0x7f0000000400)) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x393}, 0x0, 0x0, 0x0) memfd_create(0x0, 0x20000002) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x18c}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x300, 0x6040000}) r3 = syz_open_dev$dmmidi(&(0x7f0000000300), 0x6, 0x189083) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r3, 0x40045730, &(0x7f0000000000)=0x1002) 2m29.673683216s ago: executing program 3 (id=2448): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCSMASK(r0, 0x40104593, 0x0) syz_usb_connect$midi(0x5, 0x70, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100144be00103512138240000102030109025e000101a140030904000004010300010905098211399df7a50f11e63910ff0308060a0425010009050b0c4000031903092501"], 0x0) 2m27.641779264s ago: executing program 3 (id=2453): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmmsg$inet(r0, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}}], 0x1, 0x40) 2m27.487344041s ago: executing program 3 (id=2454): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$nci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r4, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r2}]}, 0x1c}}, 0x0) write$nci(r1, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000000)={0x0, 0x2, 0xefff, 0xfa64}) 2m27.126243615s ago: executing program 3 (id=2456): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x28402, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000040)={0x9, "dab940d165233a88e5ae9f9ea51c5f0d1d3fd366101a14e44d21ab511c33de97", 0xffffffffffffffff}) splice(r2, &(0x7f0000000080)=0xf28, r0, &(0x7f00000000c0)=0x5, 0x2, 0x2) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r3, r3, 0x0, 0x2000fb) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, 0x0) 2m25.527573505s ago: executing program 3 (id=2462): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x5ac, 0x263, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe0, 0x7, "", [{{0x9, 0x4, 0x0, 0xf, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x1008, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x9, 0x7c, 0x1}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0xb, &(0x7f0000000100)={0x0}) writev(r1, &(0x7f0000001300)=[{&(0x7f0000000200)="9ce519498c8223d77d262efb94f7fedf18a0d72467f94008a18be313054f04fe67c68d7ede6dd823a1a377fb3566f6b5c5d70f56ca18", 0x36}, {&(0x7f0000000240)="f9d96ef5b7b186589361b9d71f83eb4bfab903d3e54db0179da11d79da13bf007e5d3fbf17decd8c100aee0d5241ab6afc3b338b538c221badd02a67c23b411a2e0c8aa00d6dee2feea0f53aa2053500ffbbb0f3b6b7f8f3875e71db84ae544811d26dcffd160947f482ce0a17ccac64f60586fb041656d53c7fd0006f5232abb8ea8bbd6188de009df0cae165760d4b773374e9c8535f634f9f3c7317f1189a3c37588f9e9229a34bc1b3c31ab78c0ed47021cef751520dc1939783c6d30f946f26c20648bb3314813a3fb61c6f110ff12f659564c38ac927719104ea80435e02d25a760e60d727e77c46c6814cfb41d9dd9cbbe228dc7b17e6628cbf961af639d33f4c6233655b9605262635e653bd273544af2f0025ce736c907961ca5c081547934c9937383698e8e632e626f92843e3648e1d364d2d7b0b319a0048a947f7ed1582a7424ee9586224c2431cc701699ea428511b0d8ae2e6bc11ad68966ffe5e5f23cf26f350d63d1ec85b5d589afd8dd0857095c4ba2ccebde91a6d39fce9262bf008b1ee566a87ea1b10ffb52cd05c6131436ee73e085cc4acc188fdf0f3d00d6db868d5843da6967da0412f8191a78b82f78d46428ba70c4dbde822a8079dbeafd4bfb2ce7be78ef964d8045e8efcf59558c09e5889df2de95d09da1e0be56bdccc0f1eb04292e2ca7a2b7096b6b8d4f5bd2fe382fa6e96d8ecdd98cc0c895622828fa847003fcf37baaec8ae069e33ea8af6348a05b7b115a4c44391fd63fab189659c0be8bcf8129d3947833711db8b4a7850d80ebd50df73eec8850c57e8b3931c9e14bafae99f7223ea4dbff3227c785c0826f9af2d3dae3d42c1dad7935bd9d774a0eb9bbedb9498b39028023145707f3e91f1f4b6f8dc1a5ed7f83c4de7633e22d4c41adb102ac5d736381db17f7c2bcd9b2795efac57511ae4395bfc6f9e319dd5dffe9666b1f789fdaca4c4c424b05b5de3af811b2bf5894053ff76899800d53ac459b22419694c19ae8e98c3c62b95ee4e4ce8fd4b9684bc4819b9561d36c13b4854c092606b55515280cf33302b726e507e06fabc93c5accd0f487288e6d32f43ae31b18f78ec6d3d2e584d74d49d69da97c2950bca4338d5c8a47ba6bd0bb6c5456ece85b6d434c162f95f75142ec47c7ac0e393e19849569188eaec22a037545583d12b6e30a262a913cbdc7097b5fa1c87a9358c1a2320ff4084afdeb79e2b1fd5632301fb6af61f86c25cffa6e70d7b1520a6f1a1c9d8bc4ecb7ca8b6d77ad8269d1fd543a1bb5ccb6b1eb06b9ee0f5b5dc58d40dcf234d9f58c1ca1526fe4b5732c81e538382dd834d8aabbc7fbb9b0f44cf4766875b0bc893eb1801329a0178dd78848f86ce2484e61f5dbb01088243cc915365363fda7ea175b48100763867f8fd01c35418a94afdc40574c9980d00821b5e5c49225fed879c05b0b015e7fba73beb14575358923f00ce285ed74ffcee9ab120f40afcde2c0d26a318516990276e0f29d135ca5efc3c44159495f32eccd75fd4e0192c3fc56f94c570575f443b0e04774e022a87451acfa49ba5eb2d6fafc43b3d2bb8cb955b84b797f5c9544257fd3b20c254e9ca7be369bc56dd357a276693f8cdf0d00f28f90a8ea3068eb359ed74d8dab4479944cc81c594cab8998be75a50f8a40f5f87bcc52698c99427004222ccc346c918b4c9f00ed52b8906700adf2e5a16395c25ff4ca71b7a77a4dd83d88f898d50381229a9f32651fa54f7d75b87c31b0be82541317f1ce4926e92688a9e54f059facc4250a99565e5be4a18e5fdaf1518e92f62da54c72e74b179a45b08ede6231138f86293609702269cc52c6856cae12a40d509edb889741658e7cbcf82a2bfa457a314f1653966dcbef2cb71eaef207b33fd805ee856858f372db02660e8606ff1e10215ef5e5a01cfd4b0455e4a9d0f2cedffe749d69cbce79c32796b83063f6af8ee922fb75f5f0c9a3510e967cf9087869a2f02c4abba30fc9b545bc750452456be870864e92194f137ca69629e34bbe403d51a179ce408bc89bdf90c6febcf1e71bf432072c9b41a6643cb03cb79f66b681c2eab8eac076b74d54de1d8955bcbe65923319a1d957e4cb04cd858cde1c80023cb4cef192a3b7816e38f87299990df1175d1c0eb439f38aeebf3491ac4e1684ff5ed97addc9d9b68da3363a395ebe296efd77343f9e02cb613b6790f293a2afd95d8747bab2c4bfa8cdbb00088fbd7116ffc550569be1e0ba900433559d8a38a29cc3264dd8147e41b35ece580a8c7186be9d8a1ed9376d2864d70fc75a19218fdea0596ede32b049ef08a9dde554cd63745c5376e08903c764aaf13660d113ffbc0dece6f366b6adb47640bd59c1b30223190831905ddb4819a8cbfd9e9c715e74da0f8250c403af5f1a8b9046080a9c147864ca844f9b476c5a1ca7086b667899862cac7f03b2897b5cd465d6028bff96325b6139b6342c61df1008f665a8a60b1e4f40b0a57276494719c99628d94ee83e67a01848b71bbf3ee0ee55eb778db0af9c02d666cfbf4b50bfde4b5f03d7a7ef307b8bccbf67e149088a2e293fe10667b50c6d16fb64464ee8b38d32d514f8f2d6c5207b40f1698c3d542b97af4f6016ae76ef45c72fb02fa1077aa8239f00e8b7c7cc27ff7fa341f1b475bfc8f47df9a5145489b64b8aa5fa9f4d835f3af0011a25b194c82cf801bca73e7420460ab5b1d1e39d712df35ee06b67aff7678629c9cc13ba75659fbc3970856fb0486a8c0c8b1ca2c3d9de20a7da1dcffb774414e6fccd6529e849200d5a60347c97f5e036ee8dbbd65387c050cc35e19e51ee9f76f65fd012490664654ccf78f2b84a51e56b3aef0be09166315574dee62ee4ad379e542d5c18a03c82d819c38a7ab8b67ee378a42847e2adfbe2d571efa984ed4aedb94a937fec02e02694dd11ee9092afb732d9119d756aaec54893cb72fab8411cf1382bb8e9c31d05339f7f89e3ea957a7cb1e989e9dc25d6622cbf0c6b7edad87a6a24765441cbff2dff9772787bc671a182b592a5dd8b50729f1eb66ba23933172ffaf1a32b988e31fd6cacb237cbccfa714d95d7f81a3c54bf8b201b5b0c5dc3d448113236b48df5a052843abc6791e0820c38b46e0433fd06e67ed5e49ae5b279cb28b0ede7f1f34f4fca179d73b52f8dbf08f0f30de2af2da7f0f45957276781733afe78f6b19d59e14a6fdb867a5d168dc6bf4721cf1e727b25c1529375c9063715996d63cfe1f63d5af8f42f986257ccab232bccc8d0145f9ee32d71032303fb8491ff54f45e3bea892fb189b9f16bd41edcb068b62910ccb820fbf3e97d6705736c9573952ae139c69149f8f1b263ae6500039cb33e0cde57c84b9aadc323dd98b8daca8bb1e9aa7fac0781a13f3a297fd71420174e21d73f51b8f7524e60ea96dbae67b979a270152e10aea65a128431409bdf15c1070255af88fcfc383b62b712155c35d4040efb46b9d1fba38af40830d34e2f26193f537ce27433c9dff1af8aa62289f3c5fb54788b08ff6f68c555debb8d3585427a3fdb31c33559f7aaa70aad9a4c56cf73a2a6b63b4ac4e8bf7699eee46e6184b1776429a79a24d27c2d82e8b7b72ecebae5a1dddda0188ce015463147718fed6d716fdfe0fcfd8c4015db30763d0d5cbc557f2a0bfebf09677344e2bb9ae5ec9dd928a6a7d98a03b4da83420d283f1bd9070a06672ec8795796e99deae87401102e63c8e84d1f1e7c4ea182eba686c887971e473f1351eb7bb046a4bd9ffda1833f5ce6f53afbd2ba0572c73ab4e4601077c201602a2b5ffe60018a63b05d45257add6f2d9fde75cb6e046da112a53090f640450379be11b55c8347ebce5293006a6a11924c65d801585a0cd26c2ebd8ba7df335425b67f72a78d06069519027c5706a1ce101f6a6a78716749bf32e1ff2c77970ebdb6978d82af14d9fefbe1ff8f0db313ff1f0cf9e1bd4e7cea0eb418ec23cbbb981c211b308b972cb4be053d90ca4cb38029e3b5a1033e334ab0dfa7851ee395108abc853108d913256aa54da0bed6517380324455fc4ba458e4c726fdb4af2104e017ca6411a5011baaba419a69ad7c20250f9ee1044d6ddceea16c092293514aa4ebb9af7a7e4bbbbae6677ac48f4a62174d601dbfaba90bdbe82ab2e0e690e696cfe196c5eb7d53d5b1183163c5eadd9120d36af5751f9ea1970bb6b4c660e0038ceadb619110df2f83985931eae2c6ad9baa6e275dc3ada80d02bc61ebc2c1868f47d86c7a14208e05fced60d6859286a1165e45f4cf70479927aa77a5481822a3abab14508d0ac63547aeb5648346e9294eaf980b5abe02faed3648efaeb77a13152ab4fb7d92f34e1785ce980f85781dd095e6ae11107aa969a61bc34c12f8ff49845c8063b88d3b0f72c6e218ef0825539feea31579e4ee57e456ea11165c3fb8de44e0ba05dda63e8b175c3945d76c354d5cd96c2fea659ff368375d94bd1514d5124bcefdba4c22cbe903905ed6f4f194dff0ab5908673be6a4c08e097b7ec0b5007b368ee869c1436998c02aea5baa74d8c303bc7faeb82237cae4b356e8c7cd08e06d83afb1b57f7f9d137ffe8fcb9c5e4d379797a72aa69070fe34b2195bf112e4edb14f3b3c6f935716bea43094ca9fa73f0880ae7dbeeed100b0f2851117d8b9a51cb56d03f519a545269dfe01a008b563223b572b87e3c8de3168ae75d1e783c9ad4113654747db3c148f7b7b7f3797579c508ef5f6c922bdc5f4eab55dabed433a22f7006057d9e36b8d5367baeb963f969a8c677719c59fcf7695a802a4c892116bd46d55a76ae930235611662cb1cab8b9f6825256d2f45576e29cb0d4899e1a3517f66a401bc7778862b6180355868fcd61d141bf8e141b0b6c360a6df31605fe5617fabcf6340e4bbfd4cd00a4c42b560f6775e29a9db032b4bfcc29e9eebe76b14921cfb3eb19b2e5d9cc0a66cd5c350bbae812d0e7c85bb82f460aaa08f27dff11ef35ead3158222370b9cbbe0b9a979fe2d46344dbd7e85c75aa61cfb14b998dfe184d9ae91e1d5e0169cf85846a3c113b8bb7a8558a388c97331198482b5d3b06d72d68f8bcd030cad2fab2171ba43cfd7330aacb293d753e7f95bb7e5a24d6c56cd5ec544771b490b526b5d9ac34aa17815aff2160f290e7c0b68a105dbd23b1ceb9d0c88f8c545400dff76a51c591ab635461253433880d6519a44ce06d17c50fa56586c635788736ee5aa08c39ece023d9c3eb066c1f702a8770e13bacce49823d86d2c406efc24ad837d0ae4564a7ed4de0c904e049e19adbaaaa1c1849a8ed22bd0751c77f21ca58609c91416a4a1591d58982ed7bafc17d964779867d7a3eba32fbebd5d4cff36a5f31169b9e5b6afb3f45e8442d73786c34ad9236abd67b6066f2809290aa02db9d96ab371cb07ac698d058aa992f9070a8c07f869409355defa83d87f1527c078b12c29e07a40ee610b419519042f820d6c60acf6a3533e59b940e33891f38f28544884100c5b27de0fc7c9883321b4f78812f7d73fbb1d6ac6900410d907316e9aec5d076a1ed5c9ce65276e973cc3d7acc7b871905281615aa1deceb7b86db936a54cfcc84583b82c5d5728b52450a22fcd0fc40f15ec20f7cc13de8ce2a8d81da8a01243fe5dc3a7e3c1e861a0ed4f94e8ef51abe1e9be0e2fe65f6abadb6863649853e6f151c6815757b928d6a633904ee11a80e4cd1094d10ad4ffce41ae5921e969b987220fce2b1af367bae24cbbf16781a492bce3c2400e691fd", 0x1000}, {&(0x7f0000001240)="e90e88ad0aff253c6a1dcc8e5248a1c78402bfc938acb97834feb6475ad6fc456b103b34153643d97563bf7c52fc1c97b3f2b4bcfa03bc1868d63cc2490db72c715daab13f9977c1737d6ba8348107a3d0dd163f18124d67fe19db9aec01a1d4e3be41b9ffb25a2b37a18dd840a20c5e150b00d74dce565459b78341bc6e7e549670b7858d35d2e23fe7932a6a104259ed8e2b953959448fc9368a024079fbe3ce317a14c14c5de3706e5225a885", 0xae}], 0x3) r3 = syz_open_dev$dri(&(0x7f0000000000), 0xffffffffffffffff, 0x0) socket$kcm(0x21, 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101842, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f0000000080)=0x20) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYRES16=r4], 0x28}, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r3, 0xc06864b8, &(0x7f00000000c0)={0x0, 0xae, 0x5, 0x34325241, 0x0, [], [0x2b8, 0x0, 0x0, 0x8000], [], [0xfffffffffffffffd, 0x0, 0x0, 0x3]}) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="180000003500070124bd70fefedb9f25037c000004000180", @ANYRES32=r0, @ANYRESOCT=r3, @ANYRESDEC=r2, @ANYRES8=r0], 0x18}, 0x1, 0x0, 0x0, 0x48054}, 0x20008084) 2m24.021841833s ago: executing program 3 (id=2470): r0 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_GET_FP_MODE(0x2e) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000540), 0xffffffffffffffff) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r0) mount$cgroup(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100), 0x8, &(0x7f0000000040)={[{@xattr}]}) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x38, r1, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0x800623}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}]}, 0x38}}, 0x80) 2m8.821932667s ago: executing program 34 (id=2470): r0 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_GET_FP_MODE(0x2e) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000540), 0xffffffffffffffff) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r0) mount$cgroup(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100), 0x8, &(0x7f0000000040)={[{@xattr}]}) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x38, r1, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0x800623}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}]}, 0x38}}, 0x80) 1m56.775608249s ago: executing program 2 (id=2565): r0 = syz_usb_connect(0x0, 0x17d, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000fa5c531046084010c9d00102030101026b010100000000090462020243df270009050802100000fa00cd08dfa9a5fd67f84bd21113acd7fc0e3b35824deb14c9ec5d483d62169d56171de8bc4bc98d302e503f95cf970fcea2480ec47e33f438ea21d7203978d5e2904b6966f7096cf08bba8ddb7691bcbc9ce2c5760af21822ed33fc12a38222be6b3b70d8595ba08893f644fa53c1c55ad648952a80f17ece8bff775682c9a5167111725b5484fd0ab5d334dcfbe28eb0e02bd0fa90c776e4997388fc9442fd3e8657ac92601fd61a184cf49d513b7bf7cdcebe6423101690e5269a5b2be351ef182d84744d9664f21b1c4bd8c72c0905820240"], 0x0) r1 = socket$rds(0x15, 0x5, 0x0) sendmsg$inet(r1, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x4000, @multicast2}, 0x10, 0x0}, 0x0) (async) sendmsg$inet(r1, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x4000, @multicast2}, 0x10, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 1m53.600584062s ago: executing program 2 (id=2582): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x204, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_EXPRESSIONS={0x1d8, 0x4, 0x0, 0x1, [{0x1d4, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x1c4, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8}, @NFTA_MATCH_NAME={0xb, 0x1, 'policy\x00'}, @NFTA_MATCH_INFO={0x1aa, 0x3, "ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d1a3a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe04331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd62718006717fcc22963cff8d81a801d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d1813f9ea8451eeb2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c80000000b461f0c7ee914ca5c98c19442d0262a6d04a8e3e29360a9b5871812e08542d54775f5843d70b15871bc2475e9472ab1dd94536fe0105aafaa49da3edbec92dcc06608c18d01e1f8ae3ec1915d962c3756b5257e203f26f3b933b1b3c7bf952f5a1179188bae3a293d35ca5f64701e040508b88a5d47fe3ccad0454a4432a6dcc1f7d817b0d791f56406ffcf760704d71262b5634ec2818"}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x20, 0x0, 0x0, {0x7}}}, 0x22c}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) 1m53.158650612s ago: executing program 2 (id=2583): r0 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r0, &(0x7f0000001800)={&(0x7f0000000340)={0xa, 0x4e22, 0x5, @local, 0x3}, 0x1c, &(0x7f0000001700)=[{&(0x7f0000000380)="517aa40182e6f15251efc8e6bfebbb9734c6b9bb541a06454115320b2fd19ce1a5557eb990f5d731e27d989e794432338b13f59c8c8d126f07d25f845b1ffedec79f921fb1b16d9c2b98c9030d154ce4fef51e7702c90bfd126d001f6ddf4503b30fd8aa066206f5f4de3be42b6d2ff52898aa7754ff3e0eb5f08c151a7c05", 0x7f}, {&(0x7f0000000440)="1b756d7deb4eb37fabf173b729b89332634069c7235f9db601712d7d4f28618e5437b7eee110c2960d708a4197a1cc95b059079f8c27c127bf5dc7e05cc058f0e699a5d007c61d94bfd49302ba1fc7b805f92edb3682ddeeb63cbf798b125f1dc3e16da3fcc8600d84bd2404485ac9e7f7fe69752f88b7febe02784a654f38ee91380e2c44408fdbb0b2defd964a32f1dbd720869ef469c582b7f5e0e4695af52a28d645eb5ff49c3f313227f2852f49d4d320d3864b5a1339aa6f4b4539a9332c5a0f45c07604ec913a5b56f928e83106ad6c2d7797f9704d306bbc4d3b21e51908ea4dedef54d29f63137e359e3f8627", 0xf1}, {&(0x7f0000000540)="b21f1abac23c2a48a97e8fd2fc1440756ec05752e88f954ac192c5e4ab4d057821c08ba489dc7303800e2e6f", 0x2c}, {&(0x7f0000000600)="e7ddd6d836395083c7871fc52ce578fae5613fafcfea0987f6e70d7506cf0e6211c69070e38260db2e148bd5fafbabce2359fe5bf55d57e52be464327508903bec5e4aff80f91f256f800869fdef2e355d5958a6d965295de8e5ab2daf5ec9b75b19856231807060734d88f6e5084147b85dbd5daeae5a1ac506bf80c300df3c0f7e219b70d428fb2e292d0f828984dae1d962af56f3411e2639f7c2dc63eb33bf04392781464e356af95d30f90ed7a7c4e4deb30c9c8028455c00e2742855123836701535aa6bab80e40e5064b4532984b7440405b2b149e32a8216c8623d0dc10e6816de8861548a30d762ff887b06656570a896be0da00c1023ddbb69c1464cbdcccb657b56919428282203f5a352755480d3a19646d541eb8b671ff5cc70f94ed66f3786e9c8896f3172c43ebe9f9a1ff3d5b0735d118e0c12221f2cec87a543df9d505f22da9c21c5489cd0febb64c3a4355f74955e57a1a8fbee2d3803087e2cdef1337963085830f0665892f5116a5e46d9356d029bcfa3821fcd3a48f4248b34f5a71ea74a31c30cbce5e6f845f9cb0f8ac4a6c85e42a863aec20fac500b1a295f6fa9f43e40f3b9fe07ac95b24fd7353cc2bbbcf6c14c46bf8f59983989c889011114a2e9d00189bfe72cd52066a525d050939125808eedcedd8f379855d2531bb6a9f5170c5d6eadfde33491f903984a97ed412aaad0a0448bd7f1672d2358aa1312f6e9c5ccb9006a628def3e93d980108a0d2295657be7d943a3a7984871eedc08e716c01221107c5ed33984059da9ccb352bf8eae61fde50a7d3f3bef944f92abda32b1a8b52a607f7c783a277d052cb78b8834125cce2a65e5983b9cda6eaff85de67667d4e067271d64482dfbc9fbba704a15cd37c075baa4bca2db41c83a119b1626a49d7dcb9b5ea1f38081914d8d4a8caf6339154c21d2578ff94b08a9ea164966aba552ddf76d05a8b2f48f89cc91d9e96ea318c7be07ae37b108b5ad222f097eb8314f01d611f6f7e776375b2bdaa9a951c48a9e233c53420216f9f94bc2bb5290117653b87010fb0528475cd5d02f0ece39d29931a339ca2185de99cd573b88dacaaf1b329bd545e12ff42b3c5852e9a740e2557c9ac36053c883ecbb0bf231e5ca303b03c85aeb9d4e24a025eb1199d7db844e891fe1a19ae3260a203e8397f0ade978eb6fe3afe385535c32b8ea568e631eeba6cb3945058cf85cbe4bb4b0571552727dda3a180e3d70b5853a4872de87caadd7216b3bb76582b2c344df7c8792757e1455c3b0788bb4264b9fa72949c4ca695241a28190d1e0b427296c52f8ff0914078595fbc458c09e0841b7f1619ad28ae000eb3287a32808edd4ea0adad5fbaabdd0720c7d8a3e22afbefead01d8ff", 0x3dd}], 0x4, &(0x7f0000001780)=[@hopopts_2292={{0x38, 0x29, 0x36, {0x67, 0x3, '\x00', [@enc_lim, @hao={0xc9, 0x10, @mcast2}, @ra={0x5, 0x2, 0x1000}]}}}, @dontfrag={{0x14, 0x29, 0x3e, 0x1}}], 0x50, 0x3a000000}, 0x20000040) 1m52.811653226s ago: executing program 2 (id=2584): r0 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) keyctl$read(0xb, r0, &(0x7f0000000240)=""/112, 0x349b7f55) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000003e00010324bd7002fadbdf2501"], 0x14}}, 0xc004) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, r0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f00000000c0), 0x10) sendmmsg$inet(r2, &(0x7f0000000040)=[{{0x0, 0xfffffffffffffe1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}], 0x2}}], 0x1, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=ANY=[@ANYBLOB="07000000020a"], 0x80}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) syz_usb_connect(0x3, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b0001000000000904"], 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) (async) keyctl$read(0xb, r0, &(0x7f0000000240)=""/112, 0x349b7f55) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000003e00010324bd7002fadbdf2501"], 0x14}}, 0xc004) (async) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, r0) (async) socket$can_bcm(0x1d, 0x2, 0x2) (async) connect$can_bcm(r2, &(0x7f00000000c0), 0x10) (async) sendmmsg$inet(r2, &(0x7f0000000040)=[{{0x0, 0xfffffffffffffe1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}], 0x2}}], 0x1, 0x0) (async) sendmsg$can_bcm(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=ANY=[@ANYBLOB="07000000020a"], 0x80}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) (async) syz_usb_connect(0x3, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b0001000000000904"], 0x0) (async) 1m51.384801878s ago: executing program 2 (id=2592): ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(0xffffffffffffffff, 0xc0945662, &(0x7f0000000040)={0x0, 0x0, '\x00', {0x0, @bt={0x80, 0xa252, 0x0, 0x0, 0x6f, 0x4, 0x5b8, 0x800, 0x9, 0x101, 0xfb, 0x0, 0x5, 0x6, 0x1b, 0x2, {0xa, 0x15e3}, 0x9, 0xfe}}}) r0 = socket(0x400000000010, 0x3, 0x0) write(r0, &(0x7f0000000040)="3a03000018002551075c0165ff0ffc02802000030004000500e1000c0400072080000900", 0x33a) 1m50.779795382s ago: executing program 2 (id=2594): r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x1f, 0x0, &(0x7f0000001b00)) r1 = socket$netlink(0x10, 0x3, 0x4) socket$packet(0x11, 0x2, 0x300) r2 = socket(0x2, 0x3, 0xff) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000240)=0x7d27, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r3, &(0x7f0000000400)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, &(0x7f0000000040), 0x4) mkdir(&(0x7f0000000080)='./file0\x00', 0x1ba) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x989046, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, 0x0, 0x0) mount$cgroup(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x12a0422, &(0x7f0000000100)={[{@xattr}]}) sendto$inet(r2, &(0x7f00000002c0)="b401fcc8cd1bb8b66f7ee68e052af9c34b7d7494", 0x14, 0x800, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xfd}}, 0x10) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r6, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e22, @broadcast}, 0x2, 0x9800}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r7, 0x40047452, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000001080)={@host}) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xc, {"a2e3ad214fc752f91b25060987f70e06d038e7ff7fc6e5539b325d078b089b3b08386e090890e0878f0e1ac6e7049b334d959b429a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31303b305d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c0428918246d9e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff13d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1ccab2689bee59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae23034202210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ecdf5e08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x9) r8 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xc, 0x0, &(0x7f0000000000)) write(r1, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0xfdef) syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) 1m35.334741627s ago: executing program 35 (id=2594): r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x1f, 0x0, &(0x7f0000001b00)) r1 = socket$netlink(0x10, 0x3, 0x4) socket$packet(0x11, 0x2, 0x300) r2 = socket(0x2, 0x3, 0xff) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000240)=0x7d27, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r3, &(0x7f0000000400)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, &(0x7f0000000040), 0x4) mkdir(&(0x7f0000000080)='./file0\x00', 0x1ba) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x989046, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, 0x0, 0x0) mount$cgroup(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x12a0422, &(0x7f0000000100)={[{@xattr}]}) sendto$inet(r2, &(0x7f00000002c0)="b401fcc8cd1bb8b66f7ee68e052af9c34b7d7494", 0x14, 0x800, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xfd}}, 0x10) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r6, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e22, @broadcast}, 0x2, 0x9800}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r7, 0x40047452, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000001080)={@host}) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xc, {"a2e3ad214fc752f91b25060987f70e06d038e7ff7fc6e5539b325d078b089b3b08386e090890e0878f0e1ac6e7049b334d959b429a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31303b305d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c0428918246d9e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff13d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1ccab2689bee59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae23034202210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ecdf5e08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x9) r8 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xc, 0x0, &(0x7f0000000000)) write(r1, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0xfdef) syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) 51.019512435s ago: executing program 7 (id=2987): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/oops_count', 0x80200, 0x0) read$char_usb(r0, &(0x7f0000000500)=""/92, 0x5c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x24, 0x1, 0x4, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x7330}, @NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) sendmmsg(r1, &(0x7f0000000480)=[{{&(0x7f0000000000)=@un=@abs={0x3, 0x0, 0x4e24}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000080)}, {&(0x7f0000000100)="112ce333a025dd5c168b7c8be262a734aa3882b18104e021199eb5fc75ce4afe9c48c90149d5cfba2915d2a9b669487240c669c21ee049b0ce17d9366b5c8ecec8fee839096713bc", 0x48}, {&(0x7f0000000180)="251546034d2f643a586bbcf684896aae658ed74b3fb001413761253923e438092160e2a65f21f33f313450eb928138e915b3ffee52b77fade99a04f51d826a1cb7afd02c849bcc654fcc9b54b614d2670d2eeda66d10640722e2bf25ec7840ba1e716b08fb01e54e0138b8ab69d20521e54fe6aad28d", 0x76}], 0x3}}, {{&(0x7f0000000240)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x80, &(0x7f0000000440)=[{&(0x7f00000002c0)="9535baa455478945ce037ccbdb438f843fc2ae4e1391d955ceba94ba3ae7454249592829dd499408622fdc766b79b2b8b26659e9f12f3e76b9958490b8e808d43b55650891cb7e3761c3a5ea6ff9b3090e803fe8c5be2ca2ac63d0bc968b7d7baf23f6384b9b990b7a39d52951265e7cac44f4d7e583a661fbb8187a467525bf96b779182b38f422da80c6affbe8a993df5c7886609836130ebcbb4c625e34457ff618b89bbd0b8537d9f2f5378c77ac6246a3982a0a964a5cd349a9f21b3d8bc81e9228af06032ab0a27ea64911a0aca97902e3ffd4af87fd94e892dfe887fb2ba20c3bf6adad06a368bf40e54fb7ca0b8c4627f6871a", 0xf7}, {&(0x7f00000003c0)="ee7a6acb4502de77e3e2d58aac0c6367c5bdb6364a07d3db9686205d8cd9197c339d262e0f4bbe69c4d0eceeee0536399a8065090517192dd685e8c83138aefb1b72c670ac53f1cad5ac761a44abf55e131a48a1022adc9a12acd03298b0ec22539dc9aaf23fc63775a5433dabf950b23a194196d15a73df26", 0x79}], 0x2}}], 0x2, 0x4000040) 50.739563376s ago: executing program 7 (id=2990): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28400, 0x0) syz_usb_connect(0x1, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="120110030a430808376701008091010203010902240030c50510070904fb0b0282d2d20009059f024000070007098f0d8828560501024000070508e9cddc9fb7df71e6e59c4222b30a9724ca9c1ea1f069f6d0eeb32d92e70e12fb84cfd0646bd2dca4105565f7f08801baafedff8dd08fe74f81a4b9cb1526f98ed741a3bdccd7e519f0401a00088e646c731633fff8a3b6d58864261fd1ab279be59bfe69f38f4debc14a1cefb24eba1d7e5289ca827bfb7eb5"], &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000280)="5c00000013006bcc9e3be3206e17aa35066b876c3d0000007ea6e763160af36504001ac0080010000500e7daeb660000ef64bc76bd7b6278c206d83f38d833aa516adc24eab556a705251e618294ff0051f60a9553adac000e4509c5", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x10) fadvise64(r0, 0x1, 0x0, 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a1000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'netdevsim0\x00', &(0x7f0000000280)=@ethtool_ringparam={0x11, 0x83, 0x20000a2e, 0x401000, 0x8, 0x3, 0x7ff, 0x1, 0x3000000}}) r4 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_PANTHOR_SET_USER_MMIO_OFFSET(r4, 0xc008644e, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xe8) mount(&(0x7f0000000000)=@sg0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='ufs\x00', 0x0, 0x0) 49.695660987s ago: executing program 4 (id=2996): sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000dc0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16, @ANYBLOB="01000000"], 0x50}, 0x1, 0x0, 0x0, 0x85f41cd7669656e9}, 0x40094) prctl$PR_GET_TSC(0x43, &(0x7f0000000040)) r0 = syz_genetlink_get_family_id$gtp(&(0x7f0000000b00), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r3, 0x2000) write$binfmt_aout(r3, 0x0, 0xffffffdb) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x64, r0, 0x100, 0x70bdac, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_I_TEI={0x8}, @GTPA_PEER_ADDR6={0x14, 0xb, @remote}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_NET_NS_FD={0x8, 0x7, r3}, @GTPA_PEER_ADDR6={0x14, 0xb, @mcast1}, @GTPA_FLOW={0x6, 0x6, 0x1}]}, 0x64}}, 0x20000000) 49.390968154s ago: executing program 4 (id=2999): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="3000000000000000840000000107"], 0x30, 0x4c074}, 0x24040841) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r2 = socket$l2tp6(0xa, 0x2, 0x73) connect$l2tp6(r2, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @private1, 0xb}, 0x20) r3 = accept4(r1, 0x0, 0x0, 0x0) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f00000000c0)={'pcl818\x00', [0xf5a, 0x80000003, 0x2, 0xc, 0xfffffffe, 0x5, 0x79, 0x8001, 0x1, 0x0, 0x40, 0x1, 0x7, 0xa, 0x2, 0xfd, 0xffffffff, 0xd, 0x5, 0x80000000, 0xe08b, 0x5, 0x0, 0x20001e58, 0x0, 0xf3a2, 0x3, 0x80000009, 0xa6b6, 0x24a05ffd, 0xffffffff]}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r3) sendmsg$NL80211_CMD_GET_MPP(r5, &(0x7f0000000440)={&(0x7f0000000040), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x20, r6, 0x2, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x20}, 0x1, 0x0, 0x0, 0xc801}, 0x1) recvmsg$can_bcm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000003c0)=""/88, 0x58}], 0x1}, 0x10022) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x30, 0x0, 0x20, 0x70bd25, 0x25dfdbfc, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}}, 0x30}}, 0x4004) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x13, r3, 0x62497000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 49.171391096s ago: executing program 4 (id=3002): mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="66643d0c79d3846101009049ca56f0a2f705", @ANYRESHEX, @ANYRESDEC=0x0, @ANYBLOB=',group_']) syz_open_dev$sg(&(0x7f00000001c0), 0x508d48d4, 0x40902) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8abe3d983344da083b86aee35e6b", 0xe3}], 0x1, &(0x7f00000008c0)=ANY=[@ANYBLOB="b800000000d983fd49e32f4399000000a0000000bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16f4a0342bed8a3c79acd4bb1f9f46ef28a63b329e09a86c62f907539c9af6f1b0bc0051"], 0xb8, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d4", 0x7a}, {&(0x7f0000000ac0)="3fe4c8a3288f", 0x6}, {&(0x7f0000000b40)="86545d2157646172b815818bfd0e1457556266898579380233e0e3853e4a118a5a2bcc52eeea6b2dc4fc", 0x2a}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c", 0x77}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52d9dbd9e0fae7", 0xcb}], 0x5, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f00000001c0)={0xf4a, 0x7, 0x200, 0xfff, 0x1, 0xffffffff, 0x9, 0x3, r5}, &(0x7f0000000200)=0x20) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000002c0)={0x7ff, 0x8163, 0x8, 0x400, 0x3f, 0x9, 0x1000, 0x6, r5}, &(0x7f0000000300)=0x20) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r6 = accept4(r2, 0x0, 0x0, 0x800) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000340)={0x10000, 0x2, 0x8000000, 0x2000, &(0x7f0000001000/0x2000)=nil}) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) syz_io_uring_setup(0x3c5f, &(0x7f0000000240)={0x0, 0x0, 0x27, 0x2, 0x1}, 0x0, 0x0, 0x0) 49.010610614s ago: executing program 7 (id=3005): r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x60042, 0x0) readv(r0, &(0x7f0000001d00)=[{&(0x7f0000000240)=""/152, 0x98}], 0x1) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) capset(0x0, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r3) r4 = syz_usb_connect(0x0, 0x24, &(0x7f00000016c0)=ANY=[@ANYBLOB="12010000b1bd2f087d0403508c2f010203010902120001000000000904", @ANYRESHEX=r1, @ANYRES32=r0, @ANYRESHEX, @ANYRESDEC=r1, @ANYBLOB="7150e411852bea43305d4ef13b0689c23f17c523b76ef4f2ec31f36102fd59294b726958c44f0b1f51105b82493e932490052900d169a83f0d34f885155e18ef796eddba5b7fccf1a35a992c5c98dd529482e07b407d80fbf227d7fd2caf14df96f3"], 0x0) syz_usb_connect$uac2(0x5, 0xa4, &(0x7f0000000580)=ANY=[@ANYBLOB="120110030000002099040c1540000102030109029200030101e02b080b02010107200109040000000101200009240103000119000510240204117605039effffff7f0b7b08090401"], &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x24, 0x0}]}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000140), 0x2004890, &(0x7f0000000340)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wzdn\t>', @ANYRESHEX=r5, @ANYBLOB=',\x00']) syz_usb_control_io$cdc_ecm(r4, &(0x7f00000000c0)={0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="0000f50000000341e6"], 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000001980)=ANY=[@ANYBLOB="40138aed499e17d408a88b1800000000"], 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f0000000040)={@private2}, 0x14) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="340000004100070328bd7000fbdbdf2503"], 0x34}, 0x1, 0x0, 0x0, 0x48010}, 0x2000c080) r6 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r6, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000000)="020b070102000000e4a17c455b3a89e0", 0x10}], 0x1}, 0x0) r7 = socket$kcm(0xf, 0x3, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="603ca2d0fb6f103ee8dd3b00a8ee", @ANYRES16=r9, @ANYBLOB="010026bd7000fbdbdf2525000000080001007063690011000200303030303a30303a31302e300000000008008a00", @ANYRES32, @ANYBLOB="0e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=0x0, @ANYBLOB], 0x60}, 0x1, 0x0, 0x0, 0x4c000}, 0x30) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='autofs\x00', 0x80, &(0x7f0000000100)) r10 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0, 0x3f46137792f68265) ioctl$AUTOFS_DEV_IOCTL_VERSION(r10, 0xc0189371, 0x0) sendmsg$inet(r7, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a17c45c8d260c9", 0x33fe0}], 0x1}, 0x0) readv(r2, &(0x7f0000001640)=[{&(0x7f0000000300)=""/136, 0x88}, {&(0x7f00000003c0)=""/187, 0xbb}, {&(0x7f0000000480)=""/186, 0xba}, {&(0x7f0000000540)=""/59, 0x3b}, {&(0x7f0000000580)=""/31, 0x1f}, {&(0x7f00000005c0)=""/4096, 0x1000}, {&(0x7f00000015c0)=""/32, 0x20}, {&(0x7f0000001600)=""/4, 0x4}], 0x8) 48.422400207s ago: executing program 4 (id=3011): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f000007c000/0x1000)=nil, 0x1000}, 0x2}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000600), 0x2640, 0x0) ioctl$TIOCEXCL(r1, 0x540c) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001300), 0x40000, 0x0) arch_prctl$ARCH_SHSTK_DISABLE(0x5002, 0x1) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x1) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x1) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x2) arch_prctl$ARCH_SHSTK_DISABLE(0x5002, 0x2) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x2) ptrace(0x10, r2) ptrace$ARCH_SHSTK_DISABLE(0x1e, r2, 0x1, 0x5002) ptrace$ARCH_SHSTK_ENABLE(0x1e, r2, 0x1, 0x5001) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r2, 0x1, 0x5004) ptrace$getregset(0x4204, r2, 0x204, &(0x7f0000000000)={&(0x7f0000000080)=""/28, 0x1c}) ptrace$setregset(0x4205, r2, 0x204, &(0x7f00000000c0)={&(0x7f0000000100)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x8}) ptrace(0x11, r2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x32, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) map_shadow_stack(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x1) arch_prctl$ARCH_SHSTK_DISABLE(0x5002, 0x1) futex(0x0, 0x80, 0x2, &(0x7f0000000200)={0x77359400}, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) 47.827544194s ago: executing program 4 (id=3014): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000dc3f6e40130801000a3a0000000109021200010000000009044b036855e9c62b1066a04f700b84a26a51cddb71eab450064eb25f"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_usb_connect(0x2, 0x68, &(0x7f0000000600)=ANY=[@ANYBLOB="12010000a1121710950b2a17f4f7010203010902240001000000000904fb00026c5d650009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000640)={0x34, &(0x7f00000002c0)={0x20, 0x1a, 0x6, "471a2024df60"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f0000000780)={0x2c, &(0x7f0000000000)={0x0, 0xe, 0xb, "7b62fee54f21d12e5d8544"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r1, &(0x7f00000001c0)={0x14, &(0x7f0000000040)={0x5056e33aac07bca2, 0xb, 0x4d, {0x4d, 0x4, "62eeaa491eef6fd86bd53b66fab87725fbf3314e33835916840b2e4cc0a7bbb40e99fd0018df1913c96394e74588d06633df5abb912284e98c35dbaa25e82329b980c39031541ae35748c4"}}, &(0x7f00000000c0)={0x0, 0x3, 0xc9, @string={0xc9, 0x3, "5dad7d5229c5e83ff69b40d6f620347aaa49e3c451a3546e3b0762d23f9a8cb59cc0d42333c137c38f0763d5c76688fa8265fe8024d6f4a24017c551b84a097343ad8ffcb60d96b489fee0be91fee5b52408cc60d452cb10e679cefcaa8ebdd26d8443713ac19a2b60ad5993c8a51e93ea5eae7e75d2a52cfc4551fd782ab95258fc1c14818204cc3bc2cd04cd6425e94332fd1a28b712b1a2138364da7c6280dc3e63c8e9eac79ef8a4ebebe6363dbbb2af051727dcd13987013dd5b72db9eb227acc73185b8e"}}}, &(0x7f0000000480)={0x44, &(0x7f0000000200)={0x0, 0xd, 0xe, "a76bd1bb06edd37945f1c459707d"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x36}, &(0x7f0000000340)={0x20, 0x81, 0x1, "ec"}, &(0x7f0000000380)={0x20, 0x82, 0x1, "c9"}, &(0x7f00000003c0)={0x20, 0x83, 0x1, "81"}, &(0x7f0000000400)={0x20, 0x84, 0x3, "d5bb07"}, &(0x7f0000000440)={0x20, 0x85, 0x3, "914968"}}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000280)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f00000007c0)={0x20, 0x31}, 0x0, &(0x7f0000000880)={0x0, 0x8, 0x1, 0x7f}, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x40, 0x9, 0x1, 0x3}, &(0x7f00000009c0)={0x40, 0xb, 0x2, "d3de"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket(0xa, 0x3, 0xf) 46.435388636s ago: executing program 7 (id=3021): r0 = syz_open_dev$evdev(&(0x7f00000001c0), 0x2, 0x40000) r1 = socket(0x10, 0x2, 0x0) write(r1, &(0x7f0000000480)="1c0000001a009b8a140000003b00"/28, 0x1c) recvmmsg(r1, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f0000002d40)=[{&(0x7f0000000180)=""/62, 0x3e}, {&(0x7f0000001c40)=""/71, 0x47}, {&(0x7f0000000600)=""/4103, 0x1007}], 0x3}, 0xfffffff8}], 0x1, 0x12122, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e22, 0xffff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4}}, 0x7ff, 0x7}, &(0x7f00000009c0)=0x90) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000a80)={r2, 0x58, &(0x7f0000000a00)=[@in={0x2, 0x4e20, @rand_addr=0x64010102}, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e21, 0x443, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}, 0xa8000000}, @in6={0xa, 0x4e20, 0x1c7a, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10001}]}, &(0x7f0000000ac0)=0x10) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8b20, &(0x7f0000000040)={'virt_wifi0\x00', @random="72df853896af"}) ioctl$EVIOCGRAB(r0, 0x40044590, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r4, 0x0, 0x8008000000010, &(0x7f0000000000)="17000000020300000000000000e1768812003208380300ecff3f0002000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ab65761407a681f009cee4a5acb3da400001fb700674f39b44e09f9315033bf79ac2dff060115003901000000000000ea0000000000000000effeff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a01"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bind$inet(r4, &(0x7f0000001640)={0x2, 0x4e21, @local}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x6, 0x0, &(0x7f0000000280)) ioctl$XFS_IOC_FSBULKSTAT_SINGLE(r0, 0xc0205866, &(0x7f0000000200)={&(0x7f0000000040)=0xfffffffffffff801, 0x0, &(0x7f0000002440)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0xfffffffffffffffe}) 46.099221179s ago: executing program 4 (id=3023): prlimit64(0x0, 0xe, 0x0, 0x0) syz_clone3(0x0, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f000009058303"], 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)={0x14, 0x2f, 0x1, 0x70bd2d, 0x25dfdbfc, "", [@nested={0x4, 0x10f3}]}, 0x14}], 0x1, 0x0, 0x0, 0x1}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x3b, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40046f41, &(0x7f0000000440)=0x20000) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x14, [0x8000, 0xc95a, 0xf, 0x8, 0x83, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x20005, 0x87, 0x5, 0x8006, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x5, 0x5, 0x3e, 0x18e, 0x5, 0x6, 0x454f, 0x6, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x8000, 0x401, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0x67, 0xf1, 0xe, 0x2bf, 0x6c7, 0xa, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x9, 0x6, 0x1, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x9, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x1, 0x6, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x7f, 0xf, 0x3, 0x4000009, 0x6, 0x4000000, 0x3, 0xbc45, 0x48c93690, 0x42, 0x4], [0x4, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x8002, 0x0, 0x9, 0xb, 0x4, 0x45, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0xa9, 0x5, 0x0, 0xac8, 0xbf, 0x2, 0x80, 0x7ff, 0x12b, 0x1, 0xc921, 0xa, 0xffffffff, 0x5, 0x2, 0x120000, 0x807ff, 0x2006, 0x80a2ed, 0x1, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x1938, 0x6, 0xfffffff1, 0x0, 0xb9, 0xce4, 0x1ff, 0x6, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0x7, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x3, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0xf1, 0x803, 0xd7, 0x200, 0xfffffffa, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r3 = syz_open_dev$dri(0x0, 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, 0x0) bind$nfc_llcp(0xffffffffffffffff, 0x0, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f00000003c0)={r6}, 0x8) setsockopt$XDP_TX_RING(r4, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4) r7 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000040)=0x20000, 0x4) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000400)={'dummy0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r8}, 0x10) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x6, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x86, 0x2, 0x3, 0x7f, 0xa6, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7f9, 0x2017, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x0, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c4, 0x1, 0xfffffffc, 0x5, 0x0, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x2, 0x5, 0xfffffffd, 0xff, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0xfffffffd, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0x6, 0x34, 0x800003, 0x200, 0x80, 0x3, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x8a6, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x2008077f, 0x2006, 0x3ff, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x65, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 44.730382069s ago: executing program 7 (id=3028): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x20000) ioctl$FE_GET_PROPERTY(r0, 0x80106f53, &(0x7f0000000500)={0x20, &(0x7f00000000c0)=[{0x0, '\x00', @st={0x4, [{0x0, @uvalue=0x8}, {0x1, @svalue=0x9}, {0x1, @uvalue=0x9}, {0x30432c955a2d929e, @uvalue=0x97}]}}, {0x46, '\x00', @buffer={"6093b28c28e8bdca2d4d1606cee8338456a25ff93fb59f6827a3417e0159b3d3", 0x20}}, {0x46, '\x00', @buffer={"4713fc0f14e9868852ee98a305ee6d601ae73383d52e9a3bf911ff17b40c18ff", 0x20}, 0xffffff13}]}) 44.388571829s ago: executing program 7 (id=3030): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000002c0), 0x28200, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000000000000000024000380040001001c000380"], 0x50}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x1c, 0x0, 0x400, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x4000004) ioctl$sock_SIOCBRDELBR(r2, 0x89a2, &(0x7f0000000000)='bridge0\x00') mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f0000000400)='./bus\x00', 0x104) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000003c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r3 = open(&(0x7f0000000280)='./file0\x00', 0x325082, 0x43) mknodat$loop(r3, &(0x7f0000000200)='./file1\x00', 0x1000, 0x0) chdir(&(0x7f0000000100)='./file1\x00') r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$GTP_CMD_NEWPDP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x38, r4, 0x3c1ef5685f8d0157, 0x0, 0x0, {}, [@GTPA_VERSION={0x8}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_LINK={0x8, 0x1, r6}, @GTPA_TID={0xc, 0x3, 0x4}]}, 0x38}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000300), 0x121100, 0x0) read$FUSE(r8, &(0x7f0000004200)={0x2020}, 0x2020) getsockopt$inet_IP_XFRM_POLICY(r7, 0x0, 0x50, 0x0, &(0x7f0000000240)) socket$can_raw(0x1d, 0x3, 0x1) setxattr$trusted_overlay_nlink(&(0x7f0000000140)='./file1\x00', &(0x7f0000000240), 0x0, 0x0, 0x0) 43.751691475s ago: executing program 6 (id=3033): openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) syz_open_dev$video4linux(&(0x7f0000000480), 0x5, 0x2880) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x10, 0x701, 0x0, 0xa00, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='!\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r0}]}, 0x24}}, 0x0) 43.29515868s ago: executing program 6 (id=3034): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, 0x0) sendmsg$inet(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000540)="10cf6d49bac9ca0b8a67a554e16d1f0b0196201bece85f6067c480c9016b2469d0d44122f26bc9591a940dab7dd9c9018a17829b58a48aade98a58728db78303db91d1b262108ce115205a2156c66c5fe85ef997d851a3a59f965157e53a536857ee7056ba936ac06f0ff2fd93bbce905f0000000000000000000000000000486290cb1cb94406195c7979c7f609bf03eb30ad25f3ed91e52f6c60c5c791ea3154b4d32b9a773ebeed16357e794f245e6d7e95741a0d7436dc51ab26e77802a2872603cf969ff587add0a580840caff4a0669efccb43d80b13373337586dc3d9496e28bcba6e31dc3f843fc1076ef38b21346dc22fd1575192255e5f61937233f2fb0420aa5f8685b6f509d26a9cd04e31f60b84cdf7d8fd314d686077904ae866e1970c01adae4ac7d4be5ff336f86c39f4bbead3c0428b628e077b6d701d69be44ef72357b6d0bfb964c4b6cb0954bc0f9de01099d713314b69c99a5ab20fabab34f14d5094f9b6a89d7ea20f1f2499a400ffc511ca97ab02e91e021daa37b35dcde9a21f44561b437562f6afda3f568f087031eec066990ecf2fcec18b45efca19de7d23c7e242f60d8233a1646827abd5ab0e00e21cf6d2f9e47c7139f97f36f3bd3a57a86af8054fe9175281b7f420d96f8e302b3af6da4d213cd75a94843535536787a62edf64d33b00a784040e55fe88f649932cfdda8f8802ee06747a8c1e3795fed1ff6bcf27aed31d840d34d6cf760fd8aaeeb525653ade6fd5ce70992625c57670c5cffda82b2", 0x22c}], 0x1}, 0x84) ioctl$SYNC_IOC_FILE_INFO(r1, 0xc0383e04, &(0x7f00000003c0)={""/32, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000280)=[{}, {}]}) getsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f0000000040), &(0x7f0000000100)=0x4) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000400)={&(0x7f00000000c0)=[0x0, 0x0], 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 42.855185779s ago: executing program 6 (id=3035): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/reserved_size', 0x28042, 0xb) write$P9_RXATTRCREATE(r0, &(0x7f0000000000)={0x7, 0x21, 0x1}, 0x7) (async) sendmsg$AUDIT_USER_AVC(r0, &(0x7f0000001400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x21411000}, 0xc, &(0x7f00000013c0)={&(0x7f0000001300)={0xac, 0x453, 0x4, 0x70bd2c, 0x25dfdbfc, "9d1d8a2348bf479151f23095b01975d98e11c489d64138185cf11c50c5cffbb1b9830463a10b1f0355641dfafe78782e79f738fdfc3403a05b094dc0c23d39dd0e1563be859b6117caec85d911e43eb9cb2714631cc4950b614f6f47fe0636420f3273fb7de75dc7acd39d39fb6a55a60f6bfdde22c3661c16cf6036d93846ea0815350cb6e154776f684c47d9dbe01ee838fb42a6579cdbffa7"}, 0xac}, 0x1, 0x0, 0x0, 0x20044814}, 0x4040880) (async) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x0, @rand_addr=0x64010102}, 0x10) (async) sendmsg$rds(r1, &(0x7f0000001600)={&(0x7f00000002c0)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000180)=[@mask_cswp={0x58, 0x114, 0x9, {{0x6, 0x1}, &(0x7f0000000000)=0x2, 0x0, 0x2, 0x8, 0x10001, 0x1, 0x2f, 0x8}}, @cswp={0x58, 0x114, 0x7, {{0xfffffff8, 0x5}, 0x0, 0x0, 0x7, 0x7fffffff, 0x9, 0x7, 0x12, 0x42}}], 0xb0}, 0x0) (async) r2 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x40880, 0x0) sendmmsg$alg(r2, 0x0, 0x0, 0x48040) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000300)=""/4096) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) 42.451641036s ago: executing program 6 (id=3037): r0 = syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x110, 0xff, 0xff, 0x0, 0x40, 0xbda, 0x8150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x7f, 0x3, 0xff, 0x11, 0x1, 0x5, "", {{0x9, 0x5, 0x81, 0x2, 0x40, 0x6, 0x9, 0x4}, {0x9, 0x5, 0x2, 0x2, 0x20, 0x2, 0x57, 0x6e}, {0x9, 0x5, 0x83, 0x3, 0x240, 0x3, 0x82, 0x8}}}}}}]}}, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000580)={0x14, 0x0, &(0x7f0000000480)={0x0, 0x3, 0x3}}, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000002980)={0x14, 0x0, &(0x7f00000028c0)={0x0, 0x3, 0x3}}, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000080)={0x20, 0x15, 0x1c, "fe9b8c5c989fe524ab9dbc12962f483f0ee5fd25ec8d2dda891479d8"}, 0x0, 0x0, 0x0, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) memfd_create(&(0x7f0000000100)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xacVsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_UQji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xfc\x86\xb6B\xb5!:\x90bMTo\xf7\xba$\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00', 0x9) 42.270176752s ago: executing program 6 (id=3039): setsockopt$MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, 0x0, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x40000010001, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000cc0)={0x1, @pix={0x0, 0x0, 0x33524742, 0x0, 0x0, 0x500}}) 42.011666353s ago: executing program 6 (id=3040): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000500)={0x2c, r1, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x53eb2703}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040844}, 0x40048) (fail_nth: 11) 30.300562604s ago: executing program 36 (id=3023): prlimit64(0x0, 0xe, 0x0, 0x0) syz_clone3(0x0, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f000009058303"], 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)={0x14, 0x2f, 0x1, 0x70bd2d, 0x25dfdbfc, "", [@nested={0x4, 0x10f3}]}, 0x14}], 0x1, 0x0, 0x0, 0x1}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x3b, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40046f41, &(0x7f0000000440)=0x20000) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x14, [0x8000, 0xc95a, 0xf, 0x8, 0x83, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x20005, 0x87, 0x5, 0x8006, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x1, 0x5, 0x5, 0x3e, 0x18e, 0x5, 0x6, 0x454f, 0x6, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x8000, 0x401, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0x67, 0xf1, 0xe, 0x2bf, 0x6c7, 0xa, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x9, 0x6, 0x1, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x9, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x1, 0x6, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x7f, 0xf, 0x3, 0x4000009, 0x6, 0x4000000, 0x3, 0xbc45, 0x48c93690, 0x42, 0x4], [0x4, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x8002, 0x0, 0x9, 0xb, 0x4, 0x45, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0xa9, 0x5, 0x0, 0xac8, 0xbf, 0x2, 0x80, 0x7ff, 0x12b, 0x1, 0xc921, 0xa, 0xffffffff, 0x5, 0x2, 0x120000, 0x807ff, 0x2006, 0x80a2ed, 0x1, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x1938, 0x6, 0xfffffff1, 0x0, 0xb9, 0xce4, 0x1ff, 0x6, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0x7, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x3, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x3, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0xf1, 0x803, 0xd7, 0x200, 0xfffffffa, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r3 = syz_open_dev$dri(0x0, 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, 0x0) bind$nfc_llcp(0xffffffffffffffff, 0x0, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f00000003c0)={r6}, 0x8) setsockopt$XDP_TX_RING(r4, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4) r7 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000040)=0x20000, 0x4) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000400)={'dummy0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r8}, 0x10) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x6, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x86, 0x2, 0x3, 0x7f, 0xa6, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7f9, 0x2017, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x0, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c4, 0x1, 0xfffffffc, 0x5, 0x0, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x5, 0xfffff575, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x2, 0x5, 0xfffffffd, 0xff, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0xfffffffd, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0x6, 0x34, 0x800003, 0x200, 0x80, 0x3, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x8a6, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x2008077f, 0x2006, 0x3ff, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x65, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 29.202965622s ago: executing program 37 (id=3030): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000002c0), 0x28200, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000000000000000024000380040001001c000380"], 0x50}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x1c, 0x0, 0x400, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x4000004) ioctl$sock_SIOCBRDELBR(r2, 0x89a2, &(0x7f0000000000)='bridge0\x00') mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f0000000400)='./bus\x00', 0x104) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000003c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r3 = open(&(0x7f0000000280)='./file0\x00', 0x325082, 0x43) mknodat$loop(r3, &(0x7f0000000200)='./file1\x00', 0x1000, 0x0) chdir(&(0x7f0000000100)='./file1\x00') r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$GTP_CMD_NEWPDP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x38, r4, 0x3c1ef5685f8d0157, 0x0, 0x0, {}, [@GTPA_VERSION={0x8}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_LINK={0x8, 0x1, r6}, @GTPA_TID={0xc, 0x3, 0x4}]}, 0x38}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000300), 0x121100, 0x0) read$FUSE(r8, &(0x7f0000004200)={0x2020}, 0x2020) getsockopt$inet_IP_XFRM_POLICY(r7, 0x0, 0x50, 0x0, &(0x7f0000000240)) socket$can_raw(0x1d, 0x3, 0x1) setxattr$trusted_overlay_nlink(&(0x7f0000000140)='./file1\x00', &(0x7f0000000240), 0x0, 0x0, 0x0) 25.513550107s ago: executing program 38 (id=3040): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000500)={0x2c, r1, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x53eb2703}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040844}, 0x40048) (fail_nth: 11) 4.014478181s ago: executing program 5 (id=3066): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)=0x80000003) r1 = dup2(r0, r0) read$FUSE(r1, &(0x7f00000063c0)={0x2020}, 0x2020) syz_usb_connect(0x2, 0x2d, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x8, 0x80000000) syz_usb_connect(0x4, 0x2d, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x97, 0xef, 0x28, 0x20, 0x664, 0x306, 0x38af, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x6, 0x3, 0x80, 0x0, "", [{{0x9, 0x4, 0xa7, 0x7, 0x0, 0xcb, 0xb1, 0x44, 0x0, [@hid_hid={0x9, 0x21, 0xfffc, 0xff, 0x1, {0x22, 0x5d}}]}}]}}]}}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0x438}}]}) 3.052063832s ago: executing program 5 (id=3067): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r2, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000b80)={0x18, 0x3, 0x1, 0x101, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_FILTER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000040}, 0x8000) ioctl$KVM_CREATE_VM(r1, 0xae03, 0x5f) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r3, &(0x7f0000000140)={@val={0x3, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x14}, @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x8016, 0x1400, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @dest_unreach={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x11, 0x0, @local, @loopback}}}}, 0xfdef) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) 1.44088168s ago: executing program 5 (id=3068): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_INSN(r1, 0x8028640c, 0x0) r2 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(0xffffffffffffffff, 0x40a0ae49, 0x0) r4 = dup(0xffffffffffffffff) syz_ublk_setup_queues(r4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(0xffffffffffffffff, 0x40a0ae49, 0x0) close(0x5) bind$bt_hci(r0, 0x0, 0x0) timer_settime(r3, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}}, &(0x7f0000000100)) 624.569462ms ago: executing program 5 (id=3069): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x2, 0xa, &(0x7f0000000140)={0x0, 0x0}) 416.165005ms ago: executing program 5 (id=3070): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x801, 0x0) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f0000000000)={0x6666666666666ca, 0x0, [{0x0, 0x84, 0x4, 0x9, 0x4, 0x0, 0xb}, {0xb, 0x5, 0x0, 0xd, 0x6, 0x0, 0x9}, {0x80000000, 0xffffffff, 0x4, 0x2d, 0x3, 0x40007, 0x1000}, {0x40000001, 0x0, 0x4, 0x10001, 0x6, 0x3, 0x8}, {0xa, 0x3, 0x8, 0x2, 0xfffffff7, 0x8459, 0x401}, {0xc0000001, 0x10000, 0x4, 0x1, 0x203a, 0x9, 0x200}]}) (fail_nth: 39) 0s ago: executing program 5 (id=3071): connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x2710, @host}, 0x10) mount$fuse(0x0, 0x0, &(0x7f0000000140), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x3, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000080)={0x0, 0x13000, 0x1}) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000380), 0x8000, 0x0) syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) ioctl$KVM_GET_CLOCK(r2, 0x8030ae7c, &(0x7f00000000c0)) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r4, 0x40186f40, &(0x7f0000000700)={0x8, 0xf428c90210a0e6ac, 0xf3d, 0x1, '\x00', 0x10000}) write$cgroup_devices(r4, &(0x7f0000000180)=ANY=[@ANYBLOB="63202a3a2a2072776d001cbd28e41037d689e4cca928dbc64b54b5d26ae03f84e35b274c586a4834ad9cdf9bcde2949ed68b5f8f2ad90bad1c36b31b3466b581978d91921b46099b04cedb084bac627db2a6f9211a47600cd81860c92a68a10af59ff4736c487eab1eedf26693ca7ff75d1880ae46be22c3a660555301c302863f69911058ad3303f793217ebbb8723055972403548a4d7ef263b2ce8213f1d7f6789f"], 0xa) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x16}, {0x6}]}) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000000)={0x6000, 0x2000, 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) kernel console output (not intermixed with test programs): [ 640.946679][T13613] RIP: 0033:0x7f82a9e8de59 [ 640.946697][T13613] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 640.946713][T13613] RSP: 002b:00007f82a80e6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 640.946733][T13613] RAX: ffffffffffffffda RBX: 00007f82aa115fa0 RCX: 00007f82a9e8de59 [ 640.946746][T13613] RDX: 0000200000000040 RSI: 0000200000000200 RDI: 0000000000000000 [ 640.946758][T13613] RBP: 00007f82a80e6090 R08: 0000200000000100 R09: 0000000000000000 [ 640.946770][T13613] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000002 [ 640.946781][T13613] R13: 00007f82aa116038 R14: 00007f82aa115fa0 R15: 00007ffedcba2838 [ 640.946806][T13613] [ 641.037301][T10532] Bluetooth: hci5: command tx timeout [ 641.361571][ T11] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 641.522117][ T11] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 641.522150][ T11] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 641.522172][ T11] usb 6-1: config 1 interface 0 has no altsetting 0 [ 641.557952][ T11] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 641.557986][ T11] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.558017][ T11] usb 6-1: Product: syz [ 641.558032][ T11] usb 6-1: Manufacturer: syz [ 641.558049][ T11] usb 6-1: SerialNumber: syz [ 641.612783][T13611] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 641.612933][T13611] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 641.659799][T13539] team0: Port device team_slave_0 added [ 641.766401][T13539] team0: Port device team_slave_1 added [ 641.785244][ T9] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 641.937952][T13539] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 641.937967][T13539] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 641.938011][T13539] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 641.954505][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 641.981528][T13539] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 641.981549][T13539] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 641.981647][T13539] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 642.044458][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 642.046092][ T9] usb 3-1: config 1 has an invalid descriptor of length 235, skipping remainder of the config [ 642.046234][ T9] usb 3-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 642.095475][ T9] usb 3-1: New USB device found, idVendor=17cc, idProduct=1021, bcdDevice= 0.40 [ 642.095504][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 642.095523][ T9] usb 3-1: Product: syz [ 642.095609][ T9] usb 3-1: Manufacturer: syz [ 642.095623][ T9] usb 3-1: SerialNumber: syz [ 642.323774][T13539] hsr_slave_0: entered promiscuous mode [ 642.326228][T13539] hsr_slave_1: entered promiscuous mode [ 642.328369][T13539] debugfs: 'hsr0' already exists in 'hsr' [ 642.328397][T13539] Cannot create hsr debugfs directory [ 642.417428][ T9] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 642.446548][ T9] usb 3-1: unable to issue vendor read request (ret = -71) [ 642.468693][ T9] usb 3-1: unable to issue vendor read request (ret = -71) [ 642.478728][ T9] usb 3-1: unable to issue vendor read request (ret = -71) [ 642.479541][ T9] usb 3-1: unable to issue vendor read request (ret = -71) [ 642.495787][ T9] usb 3-1: unable to issue vendor read request (ret = -71) [ 642.496618][ T9] usb 3-1: unable to issue vendor read request (ret = -71) [ 642.497433][ T9] usb 3-1: unable to issue vendor read request (ret = -71) [ 642.498230][ T9] usb 3-1: unable to issue vendor read request (ret = -71) [ 642.653056][ T9] usb 3-1: USB disconnect, device number 24 [ 642.755755][ T11] rtl8150 6-1:1.0: couldn't reset the device [ 642.756169][ T11] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 642.818283][ T5612] udevd[5612]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 642.884388][ T11] usb 6-1: USB disconnect, device number 10 [ 643.060751][T10532] Bluetooth: hci5: command tx timeout [ 643.113910][ T32] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 643.259612][T13639] vivid-001: ================= START STATUS ================= [ 643.275623][T13639] vivid-001: ================== END STATUS ================== [ 643.279864][ T32] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 643.279890][ T32] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 643.279919][ T32] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 643.279937][ T32] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.332131][ T32] usb 5-1: config 0 descriptor?? [ 643.500969][ T11] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 643.663314][ T11] usb 3-1: Using ep0 maxpacket: 8 [ 643.667569][ T11] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 643.667629][ T11] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 643.667655][ T11] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 643.667683][ T11] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 643.667728][ T11] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 643.667775][ T11] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 643.667803][ T11] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.778117][ T32] hid_parser_main: 1204 callbacks suppressed [ 643.778142][ T32] cp2112 0003:10C4:EA90.0024: unknown main item tag 0x0 [ 643.778176][ T32] cp2112 0003:10C4:EA90.0024: unknown main item tag 0x0 [ 643.778204][ T32] cp2112 0003:10C4:EA90.0024: unknown main item tag 0x0 [ 643.778233][ T32] cp2112 0003:10C4:EA90.0024: unknown main item tag 0x0 [ 643.778261][ T32] cp2112 0003:10C4:EA90.0024: unknown main item tag 0x0 [ 643.778290][ T32] cp2112 0003:10C4:EA90.0024: unknown main item tag 0x0 [ 643.778317][ T32] cp2112 0003:10C4:EA90.0024: unknown main item tag 0x0 [ 643.993379][ T32] cp2112 0003:10C4:EA90.0024: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.4-1/input0 [ 644.050839][ T11] usb 3-1: usb_control_msg returned -32 [ 644.050891][ T11] usbtmc 3-1:16.0: can't read capabilities [ 644.072913][ T32] cp2112 0003:10C4:EA90.0024: Part Number: 0x00 Device Version: 0x00 [ 644.389159][ T9] usb 3-1: USB disconnect, device number 25 [ 644.553194][ T11] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 644.685747][ T11] usb 6-1: device descriptor read/64, error -71 [ 644.867889][ T32] cp2112 0003:10C4:EA90.0024: error reading lock byte: -71 [ 644.934985][ T11] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 644.939040][ T32] usb 5-1: USB disconnect, device number 43 [ 645.066813][ T11] usb 6-1: device descriptor read/64, error -71 [ 645.145390][T10532] Bluetooth: hci5: command tx timeout [ 645.171107][ T11] usb usb6-port1: attempt power cycle [ 645.236569][T13539] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 645.281139][T13539] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 645.282618][T13539] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 645.348373][T13539] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 645.387770][T13539] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 645.456143][T13539] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 645.459369][T13539] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 645.525276][T13539] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 645.549295][ T11] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 645.573902][ T11] usb 6-1: device descriptor read/8, error -71 [ 645.662261][ T5719] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 645.811660][ T11] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 645.828961][ T5719] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 645.828997][ T5719] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 645.829038][ T5719] usb 3-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 645.829072][ T5719] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.831960][ T11] usb 6-1: device descriptor read/8, error -71 [ 645.884975][ T5719] usb 3-1: config 0 descriptor?? [ 645.946714][ T11] usb usb6-port1: unable to enumerate USB device [ 645.987194][T13539] 8021q: adding VLAN 0 to HW filter on device bond0 [ 646.020769][ T8343] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 646.153832][T13539] 8021q: adding VLAN 0 to HW filter on device team0 [ 646.234496][ T7971] bridge0: port 1(bridge_slave_0) entered blocking state [ 646.234928][ T7971] bridge0: port 1(bridge_slave_0) entered forwarding state [ 646.250970][ T8343] usb 5-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 646.251006][ T8343] usb 5-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 646.251035][ T8343] usb 5-1: config 1 interface 0 has no altsetting 0 [ 646.297957][ T8343] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 646.297989][ T8343] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.298009][ T8343] usb 5-1: Product: syz [ 646.298025][ T8343] usb 5-1: Manufacturer: syz [ 646.298042][ T8343] usb 5-1: SerialNumber: syz [ 646.345982][T13665] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 646.346209][T13665] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 646.481644][ T5719] usbhid 3-1:0.0: can't add hid device: -71 [ 646.481782][ T5719] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 646.490437][ T5719] usb 3-1: USB disconnect, device number 26 [ 646.520080][ T3411] bridge0: port 2(bridge_slave_1) entered blocking state [ 646.526923][ T3411] bridge0: port 2(bridge_slave_1) entered forwarding state [ 647.529721][ T8343] rtl8150 5-1:1.0: couldn't reset the device [ 647.530087][ T8343] rtl8150 5-1:1.0: probe with driver rtl8150 failed with error -5 [ 647.663284][ T8343] usb 5-1: USB disconnect, device number 44 [ 648.040718][ T9] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 648.230694][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 648.233037][ T9] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 648.233079][ T9] usb 3-1: can't read configurations, error -22 [ 648.361975][ T9] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 648.513334][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 648.515738][ T9] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 648.515777][ T9] usb 3-1: can't read configurations, error -22 [ 648.516385][ T9] usb usb3-port1: attempt power cycle [ 648.774906][T13711] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2574'. [ 648.896574][T13713] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 648.909160][ T9] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 648.926224][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 648.928642][ T9] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 648.928683][ T9] usb 3-1: can't read configurations, error -22 [ 648.969492][T13539] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 649.080634][ T9] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 649.114089][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 649.116640][ T9] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 649.116681][ T9] usb 3-1: can't read configurations, error -22 [ 649.117105][ T9] usb usb3-port1: unable to enumerate USB device [ 649.579184][T13539] veth0_vlan: entered promiscuous mode [ 649.680248][T13539] veth1_vlan: entered promiscuous mode [ 649.802104][T13539] veth0_macvtap: entered promiscuous mode [ 649.884714][T13539] veth1_macvtap: entered promiscuous mode [ 650.008425][T13539] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 650.125828][T13539] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 650.176730][T11723] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 650.177023][T11723] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 650.177065][T11723] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 650.177104][T11723] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 651.655776][T13742] trusted_key: encrypted_key: insufficient parameters specified [ 652.010638][ T32] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 652.179711][ T7968] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 652.179734][ T7968] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 652.224998][ T32] usb 3-1: Using ep0 maxpacket: 8 [ 652.241096][ T32] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 652.248001][ T32] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 652.248081][ T32] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 652.248140][ T32] usb 3-1: Product: syz [ 652.248176][ T32] usb 3-1: Manufacturer: syz [ 652.248192][ T32] usb 3-1: SerialNumber: syz [ 652.414110][ T32] usb 3-1: config 0 descriptor?? [ 652.492586][T13751] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2588'. [ 652.512662][ T32] streamzap 3-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 652.622582][T13743] trusted_key: encrypted_key: insufficient parameters specified [ 652.848074][ T5719] usb 3-1: USB disconnect, device number 31 [ 652.910643][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 652.910667][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 653.116582][T13762] FAULT_INJECTION: forcing a failure. [ 653.116582][T13762] name failslab, interval 1, probability 0, space 0, times 0 [ 653.116616][T13762] CPU: 1 UID: 0 PID: 13762 Comm: syz.4.2591 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 653.116642][T13762] Tainted: [L]=SOFTLOCKUP [ 653.116648][T13762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 653.116660][T13762] Call Trace: [ 653.116667][T13762] [ 653.116675][T13762] dump_stack_lvl+0xe8/0x150 [ 653.116704][T13762] should_fail_ex+0x467/0x600 [ 653.116739][T13762] should_failslab+0xa8/0x100 [ 653.116765][T13762] __kmalloc_noprof+0xfb/0x790 [ 653.116788][T13762] ? __vb2_queue_alloc+0x2a0/0x1660 [ 653.116960][T13762] ? __vb2_queue_alloc+0x2a0/0x1660 [ 653.116991][T13762] __vb2_queue_alloc+0x2a0/0x1660 [ 653.117037][T13762] vb2_core_reqbufs+0xc3f/0x1470 [ 653.117085][T13762] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 653.117111][T13762] ? vb2_verify_memory_type+0x1fc/0x570 [ 653.117139][T13762] ? vb2_reqbufs+0x399/0x630 [ 653.117203][T13762] v4l2_m2m_ioctl_reqbufs+0x110/0x200 [ 653.117257][T13762] __video_do_ioctl+0x8b2/0xc70 [ 653.117306][T13762] ? __pfx___video_do_ioctl+0x10/0x10 [ 653.117335][T13762] video_usercopy+0x860/0x1430 [ 653.117360][T13762] ? __pfx___video_do_ioctl+0x10/0x10 [ 653.117380][T13762] ? __pfx_video_usercopy+0x10/0x10 [ 653.117409][T13762] ? __fget_files+0x2a/0x420 [ 653.117434][T13762] ? __fget_files+0x2a/0x420 [ 653.117452][T13762] ? __fget_files+0x3a8/0x420 [ 653.117474][T13762] v4l2_ioctl+0x190/0x1e0 [ 653.117503][T13762] ? __pfx_v4l2_ioctl+0x10/0x10 [ 653.117531][T13762] __se_sys_ioctl+0xff/0x170 [ 653.117557][T13762] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.117582][T13762] do_syscall_64+0x174/0x580 [ 653.117607][T13762] ? trace_irq_disable+0x3b/0x140 [ 653.117633][T13762] ? clear_bhb_loop+0x40/0x90 [ 653.117660][T13762] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.117683][T13762] RIP: 0033:0x7f82a9e8de59 [ 653.117705][T13762] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 653.117726][T13762] RSP: 002b:00007f82a80e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 653.117751][T13762] RAX: ffffffffffffffda RBX: 00007f82aa115fa0 RCX: 00007f82a9e8de59 [ 653.117766][T13762] RDX: 0000200000000040 RSI: 00000000c0145608 RDI: 0000000000000003 [ 653.117777][T13762] RBP: 00007f82a80e6090 R08: 0000000000000000 R09: 0000000000000000 [ 653.117788][T13762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 653.117798][T13762] R13: 00007f82aa116038 R14: 00007f82aa115fa0 R15: 00007ffedcba2838 [ 653.117825][T13762] [ 653.446748][T13764] netlink: 666 bytes leftover after parsing attributes in process `syz.2.2592'. [ 654.050751][ T32] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 654.213099][ T32] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 654.213144][ T32] usb 7-1: config 0 interface 0 has no altsetting 0 [ 654.216129][ T32] usb 7-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 654.216161][ T32] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.216184][ T32] usb 7-1: Product: syz [ 654.216199][ T32] usb 7-1: Manufacturer: syz [ 654.216216][ T32] usb 7-1: SerialNumber: syz [ 654.365298][ T32] usb 7-1: config 0 descriptor?? [ 654.389601][ T32] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 654.428728][ T32] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 654.430000][ T32] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 654.430060][ T32] usb 7-1: media controller created [ 654.550745][ T5719] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 654.656617][ T32] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 654.703727][ T5719] usb 6-1: unable to get BOS descriptor or descriptor too short [ 654.707548][ T5719] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 654.707577][ T5719] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 654.707631][ T5719] usb 6-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 654.707672][ T5719] usb 6-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 654.707716][ T5719] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 654.707754][ T5719] usb 6-1: config 1 interface 1 has no altsetting 0 [ 654.794635][ T5719] usb 6-1: string descriptor 0 read error: -22 [ 654.794919][ T5719] usb 6-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 654.794950][ T5719] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.869956][T13792] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2600'. [ 654.952609][ T32] DVB: Unable to find symbol tda10046_attach() [ 654.952622][ T32] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 654.952635][ T32] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 655.169342][ T8343] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 655.340295][ T8343] usb 5-1: config 0 has an invalid interface number: 11 but max is 0 [ 655.340327][ T8343] usb 5-1: config 0 has no interface number 0 [ 655.340429][ T8343] usb 5-1: config 0 interface 11 altsetting 253 endpoint 0x7 has an invalid bInterval 129, changing to 11 [ 655.340460][ T8343] usb 5-1: config 0 interface 11 altsetting 253 has an endpoint descriptor with address 0x61, changing to 0x1 [ 655.343461][ T8343] usb 5-1: config 0 interface 11 altsetting 253 endpoint 0x1 has an invalid bInterval 97, changing to 7 [ 655.343834][ T8343] usb 5-1: config 0 interface 11 altsetting 253 endpoint 0x1 has invalid maxpacket 24929, setting to 1024 [ 655.344540][ T8343] usb 5-1: config 0 interface 11 has no altsetting 0 [ 655.344961][ T8343] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 655.345670][ T8343] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.463251][T13773] lo speed is unknown, defaulting to 1000 [ 655.499297][ T8343] usb 5-1: config 0 descriptor?? [ 655.524253][ T8343] keyspan 5-1:0.11: Keyspan 2 port adapter converter detected [ 655.525028][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 87 [ 655.560100][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 81 [ 655.560254][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 82 [ 655.568553][ T8343] keyspan 5-1:0.11: unsupported endpoint type 1 [ 655.569090][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 2 [ 655.569600][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 85 [ 655.569811][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 5 [ 655.935903][ T8343] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 655.983939][ T50] usb 6-1: USB disconnect, device number 15 [ 656.188476][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 83 [ 656.188583][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 84 [ 656.188685][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 3 [ 656.188743][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 4 [ 656.188839][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 86 [ 656.188896][ T8343] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 6 [ 656.336132][ T8343] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 656.469502][ T8343] usb 5-1: USB disconnect, device number 45 [ 656.703135][ T8343] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 656.822612][ T8343] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 656.831845][ T8343] keyspan 5-1:0.11: device disconnected [ 657.001288][ T32] dvb_usb_m920x 7-1:0.0: probe with driver dvb_usb_m920x failed with error -110 [ 657.329078][ T5719] usb 7-1: USB disconnect, device number 2 [ 657.400850][ T50] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 657.543456][ T50] usb 6-1: device descriptor read/64, error -71 [ 657.707709][T13805] syzkaller0: tun_chr_ioctl cmd 1074025675 [ 657.707735][T13805] syzkaller0: persist enabled [ 657.709381][T13806] syzkaller0: tun_chr_ioctl cmd 1074025675 [ 657.709396][T13806] syzkaller0: persist enabled [ 657.894355][ T50] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 657.897358][T13804] vim2m vim2m.0: Fourcc format (0x47524247) invalid. [ 658.112670][ T50] usb 6-1: device descriptor read/64, error -71 [ 658.226889][ T50] usb usb6-port1: attempt power cycle [ 658.484606][T13816] nfs: Unknown parameter '' [ 658.630690][ T50] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 658.654845][ T50] usb 6-1: device descriptor read/8, error -71 [ 658.890840][ T50] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 658.912754][ T50] usb 6-1: device descriptor read/8, error -71 [ 659.021216][ T50] usb usb6-port1: unable to enumerate USB device [ 659.613957][T13845] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 659.613957][T13845] Please contact the netfilter-devel mailing list or update your nftables rules. [ 659.826990][T13848] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2617'. [ 660.830948][ T5345] usb 5-1: new low-speed USB device number 46 using dummy_hcd [ 660.960748][ T5345] usb 5-1: device descriptor read/64, error -71 [ 660.993168][T13891] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2629'. [ 661.200799][ T5345] usb 5-1: new low-speed USB device number 47 using dummy_hcd [ 661.288219][T13895] FAULT_INJECTION: forcing a failure. [ 661.288219][T13895] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 661.288257][T13895] CPU: 1 UID: 0 PID: 13895 Comm: syz.5.2630 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 661.288280][T13895] Tainted: [L]=SOFTLOCKUP [ 661.288287][T13895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 661.288297][T13895] Call Trace: [ 661.288304][T13895] [ 661.288311][T13895] dump_stack_lvl+0xe8/0x150 [ 661.288335][T13895] should_fail_ex+0x467/0x600 [ 661.288366][T13895] prepare_alloc_pages+0x223/0x690 [ 661.288391][T13895] __alloc_frozen_pages_noprof+0x12f/0x390 [ 661.288415][T13895] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 661.288439][T13895] ? __pfx_policy_nodemask+0x10/0x10 [ 661.288463][T13895] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 661.288489][T13895] alloc_pages_mpol+0xce/0x280 [ 661.288513][T13895] folio_alloc_mpol_noprof+0x3b/0x1e0 [ 661.288536][T13895] vma_alloc_folio_noprof+0xe1/0x1e0 [ 661.288556][T13895] ? lockdep_hardirqs_on+0x7a/0x110 [ 661.288579][T13895] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 661.288599][T13895] ? up_write+0x5a/0x190 [ 661.288619][T13895] ? __anon_vma_prepare+0x416/0x4e0 [ 661.288641][T13895] do_pte_missing+0x835/0x28f0 [ 661.288693][T13895] ? rt_spin_unlock+0x163/0x200 [ 661.288718][T13895] ? __pmd_alloc+0x41b/0x5e0 [ 661.288747][T13895] handle_mm_fault+0xe0b/0x1520 [ 661.288778][T13895] ? handle_mm_fault+0xe9/0x1520 [ 661.288804][T13895] ? __pfx_handle_mm_fault+0x10/0x10 [ 661.288827][T13895] ? __lock_acquire+0x683/0x2ce0 [ 661.288877][T13895] __get_user_pages+0x166b/0x2590 [ 661.288925][T13895] get_user_pages_remote+0x307/0xb10 [ 661.288953][T13895] ? __pfx_down_read+0x10/0x10 [ 661.288977][T13895] ? __pfx_get_user_pages_remote+0x10/0x10 [ 661.289001][T13895] ? create_init_stack_vma+0x840/0x9b0 [ 661.289027][T13895] ? mmap_read_lock_maybe_expand+0xc6/0x3a0 [ 661.289050][T13895] copy_string_kernel+0x2f9/0x5f0 [ 661.289079][T13895] ? __pfx_copy_string_kernel+0x10/0x10 [ 661.289097][T13895] ? rt_spin_unlock+0x163/0x200 [ 661.289114][T13895] ? alloc_bprm+0x582/0x640 [ 661.289137][T13895] do_execveat_common+0x373/0x670 [ 661.289161][T13895] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.289178][T13895] __x64_sys_execve+0x97/0xc0 [ 661.289200][T13895] do_syscall_64+0x174/0x580 [ 661.289221][T13895] ? trace_irq_disable+0x3b/0x140 [ 661.289247][T13895] ? clear_bhb_loop+0x40/0x90 [ 661.289268][T13895] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.289284][T13895] RIP: 0033:0x7fc253acde59 [ 661.289299][T13895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 661.289313][T13895] RSP: 002b:00007fc251d26028 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 661.289330][T13895] RAX: ffffffffffffffda RBX: 00007fc253d55fa0 RCX: 00007fc253acde59 [ 661.289343][T13895] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 661.289353][T13895] RBP: 00007fc251d26090 R08: 0000000000000000 R09: 0000000000000000 [ 661.289363][T13895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 661.289373][T13895] R13: 00007fc253d56038 R14: 00007fc253d55fa0 R15: 00007ffd4c0aa5e8 [ 661.289398][T13895] [ 661.333076][ T5345] usb 5-1: device descriptor read/64, error -71 [ 661.554079][ T5345] usb usb5-port1: attempt power cycle [ 661.926138][T13903] netlink: 104 bytes leftover after parsing attributes in process `syz.5.2634'. [ 661.930756][ T5345] usb 5-1: new low-speed USB device number 48 using dummy_hcd [ 661.954267][ T5345] usb 5-1: device descriptor read/8, error -71 [ 662.190915][ T5345] usb 5-1: new low-speed USB device number 49 using dummy_hcd [ 662.214441][ T5345] usb 5-1: device descriptor read/8, error -71 [ 662.321832][ T5345] usb usb5-port1: unable to enumerate USB device [ 662.380757][ T50] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 662.544707][ T50] usb 6-1: unable to get BOS descriptor or descriptor too short [ 662.546319][ T50] usb 6-1: config 63 has an invalid interface number: 66 but max is 0 [ 662.546349][ T50] usb 6-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 662.546372][ T50] usb 6-1: config 63 has no interface number 0 [ 662.546409][ T50] usb 6-1: config 63 interface 66 has no altsetting 0 [ 662.548884][ T50] usb 6-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 662.548905][ T50] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.548921][ T50] usb 6-1: Product: syz [ 662.548932][ T50] usb 6-1: Manufacturer: syz [ 662.548944][ T50] usb 6-1: SerialNumber: syz [ 662.635522][ T5345] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 662.803488][ T5345] usb 7-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 662.803560][ T5345] usb 7-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 662.803581][ T5345] usb 7-1: config 1 interface 0 has no altsetting 0 [ 662.806376][ T5345] usb 7-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 662.806410][ T5345] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.806466][ T5345] usb 7-1: Product: syz [ 662.806477][ T5345] usb 7-1: Manufacturer: syz [ 662.806488][ T5345] usb 7-1: SerialNumber: syz [ 662.926525][T13913] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 662.926649][T13913] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 663.230210][ T50] uvcvideo 6-1:63.66: Found UVC 0.07 device syz (174f:8acf) [ 663.238587][ T50] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 6 on unit 1: -71 (exp. 1). [ 663.239399][ T50] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 9 on unit 1: -71 (exp. 1). [ 663.239840][ T50] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 1 on unit 1: -71 (exp. 1). [ 663.240284][ T50] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 4 on unit 1: -71 (exp. 1). [ 663.243240][ T50] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 17 on unit 1: -71 (exp. 1). [ 663.244348][ T50] uvcvideo 6-1:63.66: No streaming interface found for terminal 29. [ 663.245267][ T50] uvcvideo 6-1:63.66: Entity type for entity Output 32773 was not initialized! [ 663.381160][ T50] usb 6-1: USB disconnect, device number 20 [ 663.496576][ T5345] rtl8150 7-1:1.0: couldn't reset the device [ 663.497200][ T5345] rtl8150 7-1:1.0: probe with driver rtl8150 failed with error -5 [ 663.539364][ T5345] usb 7-1: USB disconnect, device number 3 [ 663.655195][T13918] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2640'. [ 663.970685][ T5720] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 664.100799][ T5720] usb 5-1: device descriptor read/64, error -71 [ 664.348717][ T5720] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 664.470757][ T5720] usb 5-1: device descriptor read/64, error -71 [ 664.586502][ T5720] usb usb5-port1: attempt power cycle [ 664.660934][ T9] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 664.750713][ T5345] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 664.810833][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 664.814456][ T9] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 664.814478][ T9] usb 6-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 664.814496][ T9] usb 6-1: config 0 interface 0 has no altsetting 0 [ 664.816923][ T9] usb 6-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 664.816952][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.816978][ T9] usb 6-1: Product: syz [ 664.816995][ T9] usb 6-1: Manufacturer: syz [ 664.817006][ T9] usb 6-1: SerialNumber: syz [ 664.896610][ T9] usb 6-1: config 0 descriptor?? [ 664.914535][ T5345] usb 7-1: unable to get BOS descriptor or descriptor too short [ 664.916162][ T5345] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 664.916189][ T5345] usb 7-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 664.916258][ T5345] usb 7-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 664.916320][ T5345] usb 7-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 664.916367][ T5345] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 664.916395][ T5345] usb 7-1: config 1 interface 1 has no altsetting 0 [ 664.932664][ T5720] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 664.965884][ T5720] usb 5-1: device descriptor read/8, error -71 [ 664.976950][ T5345] usb 7-1: string descriptor 0 read error: -22 [ 664.977195][ T5345] usb 7-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 664.977259][ T5345] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 665.200669][ T5720] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 665.265523][ T5720] usb 5-1: device descriptor read/8, error -71 [ 665.334786][ T9] gs_usb 6-1:0.0: Configuring for 58 interfaces [ 665.395398][ T5720] usb usb5-port1: unable to enumerate USB device [ 665.742099][ T9] gs_usb 6-1:0.0: Couldn't get bit timing const for channel 1 (-EPROTO) [ 665.824674][ T5345] usb 7-1: 2:0: failed to get current value for ch 1 (-32) [ 665.981929][ T9] gs_usb 6-1:0.0: probe with driver gs_usb failed with error -71 [ 665.997947][ T9] usb 6-1: USB disconnect, device number 21 [ 666.091888][ T5694] usb 7-1: USB disconnect, device number 4 [ 666.570628][ T5345] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 666.939779][ T5345] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 666.939818][ T5345] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 666.939848][ T5345] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 667.438298][T13955] FAULT_INJECTION: forcing a failure. [ 667.438298][T13955] name failslab, interval 1, probability 0, space 0, times 0 [ 667.438344][T13955] CPU: 1 UID: 0 PID: 13955 Comm: syz.4.2653 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 667.438376][T13955] Tainted: [L]=SOFTLOCKUP [ 667.438385][T13955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 667.438399][T13955] Call Trace: [ 667.438409][T13955] [ 667.438419][T13955] dump_stack_lvl+0xe8/0x150 [ 667.438453][T13955] should_fail_ex+0x467/0x600 [ 667.438492][T13955] should_failslab+0xa8/0x100 [ 667.438522][T13955] __kmalloc_node_track_caller_noprof+0xfb/0x7b0 [ 667.438547][T13955] ? lockdep_hardirqs_on+0x7a/0x110 [ 667.438576][T13955] ? vfs_parse_monolithic_sep+0x21b/0x360 [ 667.438604][T13955] ? vfs_parse_monolithic_sep+0x21b/0x360 [ 667.438640][T13955] kmemdup_nul+0x36/0xf0 [ 667.438683][T13955] vfs_parse_monolithic_sep+0x21b/0x360 [ 667.438711][T13955] ? fuse_init_fs_context+0x55/0x210 [ 667.438830][T13955] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 667.438860][T13955] ? __pfx_vfs_parse_monolithic_sep+0x10/0x10 [ 667.438898][T13955] ? alloc_fs_context+0x9b7/0xd00 [ 667.438936][T13955] do_new_mount+0x2e2/0xdc0 [ 667.438966][T13955] ? __pfx_do_new_mount+0x10/0x10 [ 667.438992][T13955] ? ns_capable+0x89/0xe0 [ 667.439027][T13955] ? path_mount+0x647/0x1040 [ 667.439054][T13955] ? user_path_at+0xd4/0x160 [ 667.439084][T13955] __se_sys_mount+0x31d/0x420 [ 667.439109][T13955] ? preempt_schedule_thunk+0x16/0x40 [ 667.439143][T13955] ? __pfx___se_sys_mount+0x10/0x10 [ 667.439175][T13955] ? __x64_sys_mount+0x20/0xc0 [ 667.439199][T13955] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.439223][T13955] do_syscall_64+0x174/0x580 [ 667.439254][T13955] ? clear_bhb_loop+0x40/0x90 [ 667.439281][T13955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.439303][T13955] RIP: 0033:0x7f82a9e8de59 [ 667.439325][T13955] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 667.439344][T13955] RSP: 002b:00007f82a80e6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 667.439368][T13955] RAX: ffffffffffffffda RBX: 00007f82aa115fa0 RCX: 00007f82a9e8de59 [ 667.439385][T13955] RDX: 0000200000000080 RSI: 00002000000020c0 RDI: 0000000000000000 [ 667.439400][T13955] RBP: 00007f82a80e6090 R08: 00002000000010c0 R09: 0000000000000000 [ 667.439414][T13955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 667.439428][T13955] R13: 00007f82aa116038 R14: 00007f82aa115fa0 R15: 00007ffedcba2838 [ 667.439462][T13955] [ 667.869110][ T5345] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 667.869144][ T5345] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.869166][ T5345] usb 6-1: Product: syz [ 667.869182][ T5345] usb 6-1: Manufacturer: syz [ 667.869198][ T5345] usb 6-1: SerialNumber: syz [ 667.912909][ T5345] usb 6-1: config 0 descriptor?? [ 668.030849][T13943] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 668.448972][ T50] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 668.574839][T13943] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 668.705938][ T50] usb 7-1: config 0 has no interfaces? [ 668.706046][ T50] usb 7-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 668.706073][ T50] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.793448][ T50] usb 7-1: config 0 descriptor?? [ 669.395140][ T9] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 669.550616][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 669.558337][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 669.558366][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 669.559857][ T9] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 669.559888][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 669.559912][ T9] usb 5-1: SerialNumber: syz [ 669.653875][ T9] usb 5-1: 0:2 : does not exist [ 670.199948][ T61] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 670.283684][ T61] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 670.285901][ T61] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 670.396657][ T61] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 670.411666][ T61] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 670.770070][ T9] usb 5-1: 5:0: cannot get min/max values for control 5 (id 5) [ 670.806881][ T9] usb 5-1: 5:0: cannot get min/max values for control 5 (id 5) [ 670.845489][ T5720] usb 7-1: USB disconnect, device number 5 [ 670.920386][ T9] usb 5-1: 5:0: cannot get min/max values for control 5 (id 5) [ 671.099378][ T9] usb 5-1: USB disconnect, device number 54 [ 671.361692][T13995] FAULT_INJECTION: forcing a failure. [ 671.361692][T13995] name failslab, interval 1, probability 0, space 0, times 0 [ 671.361743][T13995] CPU: 1 UID: 0 PID: 13995 Comm: syz.4.2665 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 671.361767][T13995] Tainted: [L]=SOFTLOCKUP [ 671.361773][T13995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 671.361784][T13995] Call Trace: [ 671.361791][T13995] [ 671.361799][T13995] dump_stack_lvl+0xe8/0x150 [ 671.361823][T13995] should_fail_ex+0x467/0x600 [ 671.361853][T13995] should_failslab+0xa8/0x100 [ 671.361897][T13995] __kmalloc_noprof+0xfb/0x790 [ 671.361924][T13995] ? tomoyo_encode+0x2ad/0x570 [ 671.361959][T13995] ? tomoyo_encode+0x2ad/0x570 [ 671.361988][T13995] tomoyo_encode+0x2ad/0x570 [ 671.362017][T13995] tomoyo_realpath_from_path+0x5fa/0x640 [ 671.362050][T13995] ? tomoyo_path_number_perm+0x219/0x5f0 [ 671.362071][T13995] tomoyo_path_number_perm+0x246/0x5f0 [ 671.362095][T13995] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 671.362119][T13995] ? __lock_acquire+0x683/0x2ce0 [ 671.362152][T13995] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 671.362174][T13995] ? hook_file_ioctl+0x1f3/0x600 [ 671.362196][T13995] ? lockdep_hardirqs_on+0x7a/0x110 [ 671.362233][T13995] ? __fget_files+0x2a/0x420 [ 671.362254][T13995] ? __fget_files+0x2a/0x420 [ 671.362271][T13995] ? __fget_files+0x3a8/0x420 [ 671.362288][T13995] ? __fget_files+0x2a/0x420 [ 671.362308][T13995] security_file_ioctl+0xc3/0x2a0 [ 671.362330][T13995] __se_sys_ioctl+0x47/0x170 [ 671.362352][T13995] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 671.362371][T13995] do_syscall_64+0x174/0x580 [ 671.362391][T13995] ? trace_irq_disable+0x3b/0x140 [ 671.362413][T13995] ? clear_bhb_loop+0x40/0x90 [ 671.362433][T13995] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 671.362449][T13995] RIP: 0033:0x7f82a9e8de59 [ 671.362464][T13995] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 671.362479][T13995] RSP: 002b:00007f82a80e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 671.362496][T13995] RAX: ffffffffffffffda RBX: 00007f82aa115fa0 RCX: 00007f82a9e8de59 [ 671.362509][T13995] RDX: 0000000000000004 RSI: 0000000000003b65 RDI: 0000000000000003 [ 671.362519][T13995] RBP: 00007f82a80e6090 R08: 0000000000000000 R09: 0000000000000000 [ 671.362529][T13995] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 671.362539][T13995] R13: 00007f82aa116038 R14: 00007f82aa115fa0 R15: 00007ffedcba2838 [ 671.362564][T13995] [ 671.362579][T13995] ERROR: Out of memory at tomoyo_realpath_from_path. [ 671.977702][T13978] lo speed is unknown, defaulting to 1000 [ 672.820737][T10532] Bluetooth: hci6: command tx timeout [ 673.658079][T13978] bridge0: port 1(bridge_slave_0) entered blocking state [ 673.658754][T13978] bridge0: port 1(bridge_slave_0) entered disabled state [ 673.659029][T13978] bridge_slave_0: entered allmulticast mode [ 673.682227][T13978] bridge_slave_0: entered promiscuous mode [ 673.770432][T13978] bridge0: port 2(bridge_slave_1) entered blocking state [ 673.777833][T13978] bridge0: port 2(bridge_slave_1) entered disabled state [ 673.778213][T13978] bridge_slave_1: entered allmulticast mode [ 673.791349][T13978] bridge_slave_1: entered promiscuous mode [ 673.926383][T13978] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 674.018604][T13978] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 674.293041][T13978] team0: Port device team_slave_0 added [ 674.307613][T13978] team0: Port device team_slave_1 added [ 674.447302][T13978] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 674.447322][T13978] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.447355][T13978] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 674.517709][T13978] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 674.517729][T13978] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.517762][T13978] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 674.901718][T10532] Bluetooth: hci6: command tx timeout [ 675.142974][ T5345] usb 5-1: new full-speed USB device number 55 using dummy_hcd [ 675.216282][T13978] hsr_slave_0: entered promiscuous mode [ 675.218855][T13978] hsr_slave_1: entered promiscuous mode [ 675.232459][T13978] debugfs: 'hsr0' already exists in 'hsr' [ 675.232491][T13978] Cannot create hsr debugfs directory [ 675.297327][ T5345] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 675.312556][ T5345] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 675.312592][ T5345] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.312613][ T5345] usb 5-1: Product: syz [ 675.312629][ T5345] usb 5-1: Manufacturer: syz [ 675.312645][ T5345] usb 5-1: SerialNumber: syz [ 675.366308][ T5345] usb 5-1: config 0 descriptor?? [ 675.382775][ T5345] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 675.733331][ T5720] usb 6-1: USB disconnect, device number 22 [ 676.757704][ T5345] gspca_zc3xx: reg_w_i err -110 [ 676.986164][T10532] Bluetooth: hci6: command tx timeout [ 677.342654][ T5345] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 677.342766][ T5345] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 677.547680][ T5719] usb 5-1: USB disconnect, device number 55 [ 678.336999][T13978] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 678.539023][T13978] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 678.548474][T13978] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 678.602992][T13978] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 678.810964][ T5720] usb 5-1: new full-speed USB device number 56 using dummy_hcd [ 678.942075][T13978] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 678.961793][ T5720] usb 5-1: no configurations [ 678.961813][ T5720] usb 5-1: can't read configurations, error -22 [ 678.996469][T13978] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 679.004214][T13978] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 679.060764][T10532] Bluetooth: hci6: command tx timeout [ 679.085113][T13978] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 679.091205][ T5720] usb 5-1: new full-speed USB device number 57 using dummy_hcd [ 679.251513][ T5720] usb 5-1: no configurations [ 679.251531][ T5720] usb 5-1: can't read configurations, error -22 [ 679.251987][ T5720] usb usb5-port1: attempt power cycle [ 679.621552][ T5720] usb 5-1: new full-speed USB device number 58 using dummy_hcd [ 679.646663][ T5720] usb 5-1: no configurations [ 679.646684][ T5720] usb 5-1: can't read configurations, error -22 [ 679.805700][T13978] 8021q: adding VLAN 0 to HW filter on device bond0 [ 679.820693][ T5720] usb 5-1: new full-speed USB device number 59 using dummy_hcd [ 679.843143][ T5720] usb 5-1: no configurations [ 679.843164][ T5720] usb 5-1: can't read configurations, error -22 [ 679.843838][ T5720] usb usb5-port1: unable to enumerate USB device [ 679.844027][T13978] 8021q: adding VLAN 0 to HW filter on device team0 [ 679.982877][ T1546] bridge0: port 1(bridge_slave_0) entered blocking state [ 679.983071][ T1546] bridge0: port 1(bridge_slave_0) entered forwarding state [ 680.059732][ T1546] bridge0: port 2(bridge_slave_1) entered blocking state [ 680.059909][ T1546] bridge0: port 2(bridge_slave_1) entered forwarding state [ 680.075604][ T5345] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 680.233058][ T5345] usb 6-1: Using ep0 maxpacket: 16 [ 680.235762][ T5345] usb 6-1: config 0 has an invalid interface number: 34 but max is 0 [ 680.235798][ T5345] usb 6-1: config 0 has no interface number 0 [ 680.235847][ T5345] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 680.235876][ T5345] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 680.301637][ T5345] usb 6-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 680.301669][ T5345] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 680.301685][ T5345] usb 6-1: Product: syz [ 680.301696][ T5345] usb 6-1: Manufacturer: syz [ 680.301707][ T5345] usb 6-1: SerialNumber: syz [ 680.362709][ T5345] usb 6-1: config 0 descriptor?? [ 680.365579][T14072] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 680.365700][T14072] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 680.574388][T14072] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 680.574520][T14072] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 680.745061][ T5345] asix 6-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 680.745361][ T5345] asix 6-1:0.34: probe with driver asix failed with error -71 [ 680.817336][ T5345] usb 6-1: USB disconnect, device number 23 [ 680.949765][T14083] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2693'. [ 681.454258][T14098] nft_compat: unsupported protocol 1 [ 681.774764][T13978] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 682.153424][T14117] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2703'. [ 682.290684][ T50] usb 6-1: new full-speed USB device number 24 using dummy_hcd [ 682.441355][T14126] 9pnet_fd: p9_fd_create_unix (14126): problem connecting socket: ./file0: -111 [ 682.470938][ T50] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 682.470969][ T50] usb 6-1: config 0 has no interfaces? [ 682.477248][ T50] usb 6-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 2.23 [ 682.477281][ T50] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.477303][ T50] usb 6-1: Product: syz [ 682.477319][ T50] usb 6-1: Manufacturer: syz [ 682.477335][ T50] usb 6-1: SerialNumber: syz [ 682.557309][ T50] usb 6-1: config 0 descriptor?? [ 682.599255][T13978] veth0_vlan: entered promiscuous mode [ 682.658691][T13978] veth1_vlan: entered promiscuous mode [ 682.913610][T14113] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 682.914253][T14113] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 682.958525][T14133] syzkaller1: entered promiscuous mode [ 682.958544][T14133] syzkaller1: entered allmulticast mode [ 682.998559][T13978] veth0_macvtap: entered promiscuous mode [ 683.041876][T13978] veth1_macvtap: entered promiscuous mode [ 683.127390][T13978] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 683.187071][T13978] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 683.276264][T11721] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 683.296488][T11721] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 683.300081][T11721] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 683.319810][T11721] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 683.962086][T14157] FAULT_INJECTION: forcing a failure. [ 683.962086][T14157] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 683.962127][T14157] CPU: 1 UID: 0 PID: 14157 Comm: syz.4.2717 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 683.962158][T14157] Tainted: [L]=SOFTLOCKUP [ 683.962166][T14157] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 683.962181][T14157] Call Trace: [ 683.962191][T14157] [ 683.962201][T14157] dump_stack_lvl+0xe8/0x150 [ 683.962234][T14157] should_fail_ex+0x467/0x600 [ 683.962275][T14157] prepare_alloc_pages+0x223/0x690 [ 683.962310][T14157] __alloc_frozen_pages_noprof+0x12f/0x390 [ 683.962343][T14157] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 683.962376][T14157] ? __pfx_policy_nodemask+0x10/0x10 [ 683.962408][T14157] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 683.962444][T14157] alloc_pages_mpol+0xce/0x280 [ 683.962478][T14157] folio_alloc_mpol_noprof+0x3b/0x1e0 [ 683.962509][T14157] vma_alloc_folio_noprof+0xe1/0x1e0 [ 683.962542][T14157] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 683.962584][T14157] do_wp_page+0x115e/0x3d90 [ 683.962605][T14157] ? rt_spin_lock+0x1e0/0x400 [ 683.962629][T14157] ? rt_spin_lock+0x1e0/0x400 [ 683.962658][T14157] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 683.962689][T14157] ? preempt_count_add+0x91/0x190 [ 683.962834][T14157] ? __pfx_do_wp_page+0x10/0x10 [ 683.962853][T14157] ? rt_spin_lock+0x2ce/0x400 [ 683.962878][T14157] ? __pfx_rt_spin_lock+0x10/0x10 [ 683.962905][T14157] ? pte_offset_map_rw_nolock+0xea/0x160 [ 683.962930][T14157] handle_mm_fault+0xae2/0x1520 [ 683.962960][T14157] ? handle_mm_fault+0xe9/0x1520 [ 683.962987][T14157] ? __pfx_handle_mm_fault+0x10/0x10 [ 683.963012][T14157] ? follow_page_pte+0x9cf/0xe80 [ 683.963045][T14157] ? __pfx_follow_page_pte+0x10/0x10 [ 683.963080][T14157] __get_user_pages+0x166b/0x2590 [ 683.963167][T14157] __gup_longterm_locked+0xd52/0x15c0 [ 683.963194][T14157] ? lock_acquire+0x106/0x350 [ 683.963233][T14157] ? sanity_check_pinned_pages+0x810/0x8d0 [ 683.963275][T14157] gup_fast_fallback+0x1cf7/0x2040 [ 683.963330][T14157] ? __pfx_gup_fast_fallback+0x10/0x10 [ 683.963361][T14157] ? pin_user_pages_fast+0x4d/0xb0 [ 683.963386][T14157] iov_iter_extract_pages+0x369/0x5f0 [ 683.963424][T14157] extract_iter_to_sg+0xee0/0x25f0 [ 683.963527][T14157] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 683.963573][T14157] ? rcu_is_watching+0x15/0xb0 [ 683.963613][T14157] ? __asan_memset+0x22/0x50 [ 683.963652][T14157] af_alg_get_rsgl+0x493/0x8d0 [ 683.963689][T14157] ? af_alg_alloc_areq+0xac/0x200 [ 683.963721][T14157] skcipher_recvmsg+0x39d/0xe10 [ 683.963754][T14157] ? aa_sk_perm+0x703/0x950 [ 683.963792][T14157] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 683.963816][T14157] ? __lock_acquire+0x683/0x2ce0 [ 683.963851][T14157] ? aa_sock_msg_perm+0x122/0x200 [ 683.963883][T14157] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 683.963911][T14157] sock_recvmsg_nosec+0x130/0x170 [ 683.963940][T14157] ____sys_recvmsg+0x242/0x4f0 [ 683.963982][T14157] ? __pfx_____sys_recvmsg+0x10/0x10 [ 683.964050][T14157] ? import_iovec+0x73/0xa0 [ 683.964081][T14157] ___sys_recvmsg+0x213/0x5a0 [ 683.964120][T14157] ? __pfx____sys_recvmsg+0x10/0x10 [ 683.964156][T14157] ? __fget_files+0x2a/0x420 [ 683.964206][T14157] ? __fget_files+0x3a8/0x420 [ 683.964243][T14157] __x64_sys_recvmsg+0x1b4/0x290 [ 683.964278][T14157] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 683.964331][T14157] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 683.964357][T14157] do_syscall_64+0x174/0x580 [ 683.964386][T14157] ? trace_irq_disable+0x3b/0x140 [ 683.964415][T14157] ? clear_bhb_loop+0x40/0x90 [ 683.964443][T14157] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 683.964466][T14157] RIP: 0033:0x7f82a9e8de59 [ 683.964488][T14157] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 683.964508][T14157] RSP: 002b:00007f82a80e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 683.964532][T14157] RAX: ffffffffffffffda RBX: 00007f82aa115fa0 RCX: 00007f82a9e8de59 [ 683.964549][T14157] RDX: 0000000000002120 RSI: 00002000000000c0 RDI: 0000000000000004 [ 683.964564][T14157] RBP: 00007f82a80e6090 R08: 0000000000000000 R09: 0000000000000000 [ 683.964578][T14157] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 683.964591][T14157] R13: 00007f82aa116038 R14: 00007f82aa115fa0 R15: 00007ffedcba2838 [ 683.964625][T14157] [ 684.526336][ T5345] usb 6-1: USB disconnect, device number 24 [ 684.720190][T14162] jffs2: Unknown parameter 'DidVi•¿ŽqRÅ™û÷' [ 685.053599][ T50] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 685.229753][ T50] usb 5-1: unable to get BOS descriptor or descriptor too short [ 685.256811][ T50] usb 5-1: New USB device found, idVendor=041e, idProduct=3048, bcdDevice= 0.40 [ 685.256845][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 685.256867][ T50] usb 5-1: Product: syz [ 685.256883][ T50] usb 5-1: Manufacturer: syz [ 685.256899][ T50] usb 5-1: SerialNumber: syz [ 685.717754][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.784217][ T50] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 685.784276][ T50] usb 5-1: MIDIStreaming interface descriptor not found [ 685.889207][ T50] usb 5-1: USB disconnect, device number 60 [ 685.976426][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 686.437415][T14183] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2725'. [ 686.626460][ T3411] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 686.626493][ T3411] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 687.320757][ T11] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 687.513661][ T3411] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 687.513683][ T3411] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 687.522229][ T11] usb 5-1: Using ep0 maxpacket: 32 [ 687.553335][ T11] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 687.553377][ T11] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 687.608872][ T11] usb 5-1: config 0 descriptor?? [ 687.835078][ T11] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 687.857239][ T11] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 687.882620][ T11] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 687.882676][ T11] usb 5-1: media controller created [ 688.042805][T14215] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 688.147526][ T11] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 688.621202][ T11] az6027: usb out operation failed. (-71) [ 688.621225][ T11] stb0899_attach: Driver disabled by Kconfig [ 688.621236][ T11] az6027: no front-end attached [ 688.621236][ T11] [ 688.623265][ T11] az6027: usb out operation failed. (-71) [ 688.623286][ T11] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 688.627294][ T11] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input46 [ 688.640998][ T11] dvb-usb: schedule remote query interval to 400 msecs. [ 688.641023][ T11] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 688.678602][ T11] usb 5-1: USB disconnect, device number 61 [ 689.197092][T14243] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 689.198694][T14243] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 689.369541][ T11] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 689.675667][T14250] 9p: Unknown access argument 18446744073709551615: -34 [ 689.816609][T14253] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2747'. [ 689.818047][T14254] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2747'. [ 689.952133][T14256] sg_write: data in/out 360505/136 bytes for SCSI command 0x0-- guessing data in; [ 689.952133][T14256] program syz.4.2748 not setting count and/or reply_len properly [ 690.410666][ T9] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 690.526878][T14280] sg_write: data in/out 491484/136 bytes for SCSI command 0x0-- guessing data in; [ 690.526878][T14280] program syz.6.2756 not setting count and/or reply_len properly [ 690.560883][ T9] usb 8-1: Using ep0 maxpacket: 32 [ 690.564105][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 690.564130][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 690.564158][ T9] usb 8-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 690.564176][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 690.581860][ T9] usb 8-1: config 0 descriptor?? [ 691.042557][ C0] raw-gadget.0 gadget.7: ignoring, device is not running [ 691.043514][ T9] usbhid 8-1:0.0: can't add hid device: -71 [ 691.043649][ T9] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 691.053741][ T9] usb 8-1: USB disconnect, device number 2 [ 692.213075][T14328] xt_NFQUEUE: number of queues (62232) out of range (got 67565) [ 692.387789][T14337] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2782'. [ 692.405089][T14337] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2782'. [ 693.123956][ T5345] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 693.270652][ T5345] usb 6-1: Using ep0 maxpacket: 8 [ 693.273088][ T5345] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 693.273120][ T5345] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 693.273149][ T5345] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 693.273172][ T5345] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 693.273198][ T5345] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 693.273243][ T5345] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 693.273269][ T5345] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 693.368299][ T5345] usbtmc 6-1:16.0: probe with driver usbtmc failed with error -22 [ 694.194449][T14370] lo speed is unknown, defaulting to 1000 [ 694.802391][T14405] FAULT_INJECTION: forcing a failure. [ 694.802391][T14405] name failslab, interval 1, probability 0, space 0, times 0 [ 694.802434][T14405] CPU: 0 UID: 0 PID: 14405 Comm: syz.6.2813 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 694.802465][T14405] Tainted: [L]=SOFTLOCKUP [ 694.802473][T14405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 694.802487][T14405] Call Trace: [ 694.802496][T14405] [ 694.802507][T14405] dump_stack_lvl+0xe8/0x150 [ 694.802538][T14405] should_fail_ex+0x467/0x600 [ 694.802578][T14405] should_failslab+0xa8/0x100 [ 694.802614][T14405] __kvmalloc_node_noprof+0x176/0x880 [ 694.802652][T14405] ? alloc_fdtable+0x169/0x2c0 [ 694.802674][T14405] ? alloc_fdtable+0x169/0x2c0 [ 694.802703][T14405] alloc_fdtable+0x169/0x2c0 [ 694.802730][T14405] dup_fd+0x821/0xb20 [ 694.802759][T14405] ? apparmor_task_alloc+0x1bd/0x240 [ 694.802792][T14405] copy_files+0xaf/0x120 [ 694.802827][T14405] ? copy_process+0xd3c/0x43f0 [ 694.802857][T14405] copy_process+0x1d2d/0x43f0 [ 694.802890][T14405] ? _parse_integer_limit+0x192/0x1e0 [ 694.802929][T14405] ? copy_process+0xd3c/0x43f0 [ 694.802980][T14405] ? __pfx_copy_process+0x10/0x10 [ 694.803015][T14405] ? get_pid_task+0x20/0x1f0 [ 694.803058][T14405] ? get_pid_task+0x20/0x1f0 [ 694.803093][T14405] kernel_clone+0x2d7/0x940 [ 694.803119][T14405] ? __pfx_kernel_clone+0x10/0x10 [ 694.803150][T14405] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 694.803190][T14405] __x64_sys_clone+0x1b6/0x230 [ 694.803217][T14405] ? __pfx___x64_sys_clone+0x10/0x10 [ 694.803258][T14405] ? __pfx_ksys_write+0x10/0x10 [ 694.803297][T14405] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 694.803323][T14405] do_syscall_64+0x174/0x580 [ 694.803350][T14405] ? trace_irq_disable+0x3b/0x140 [ 694.803380][T14405] ? clear_bhb_loop+0x40/0x90 [ 694.803409][T14405] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 694.803432][T14405] RIP: 0033:0x7f6a0a5dde59 [ 694.803454][T14405] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 694.803474][T14405] RSP: 002b:00007f6a08835fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 694.803500][T14405] RAX: ffffffffffffffda RBX: 00007f6a0a865fa0 RCX: 00007f6a0a5dde59 [ 694.803517][T14405] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c800011 [ 694.803532][T14405] RBP: 00007f6a08836090 R08: 0000000000000000 R09: 0000000000000000 [ 694.803547][T14405] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000002 [ 694.803561][T14405] R13: 00007f6a0a866038 R14: 00007f6a0a865fa0 R15: 00007ffe87d27f38 [ 694.803595][T14405] [ 695.957677][ T9] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 695.965912][ T5719] usb 6-1: USB disconnect, device number 25 [ 696.135550][ T9] usb 8-1: Using ep0 maxpacket: 32 [ 696.141514][ T9] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC4, changing to 0x84 [ 696.141609][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 255, changing to 11 [ 696.141685][ T9] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 59391, setting to 1024 [ 696.180830][ T9] usb 8-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.16 [ 696.180860][ T9] usb 8-1: New USB device strings: Mfr=154, Product=2, SerialNumber=3 [ 696.182039][ T9] usb 8-1: Product: syz [ 696.182060][ T9] usb 8-1: Manufacturer: syz [ 696.182076][ T9] usb 8-1: SerialNumber: syz [ 696.226752][ T9] usb 8-1: config 0 descriptor?? [ 696.229185][T14424] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 696.294700][T14438] FAULT_INJECTION: forcing a failure. [ 696.294700][T14438] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 696.294743][T14438] CPU: 1 UID: 0 PID: 14438 Comm: syz.4.2828 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 696.294774][T14438] Tainted: [L]=SOFTLOCKUP [ 696.294783][T14438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 696.294797][T14438] Call Trace: [ 696.294805][T14438] [ 696.294816][T14438] dump_stack_lvl+0xe8/0x150 [ 696.294850][T14438] should_fail_ex+0x467/0x600 [ 696.294890][T14438] _copy_from_user+0x2d/0xb0 [ 696.294919][T14438] dvb_usercopy+0x15c/0x2e0 [ 696.295064][T14438] ? __pfx_dvb_frontend_do_ioctl+0x10/0x10 [ 696.295095][T14438] ? __pfx_dvb_usercopy+0x10/0x10 [ 696.295140][T14438] ? __fget_files+0x2a/0x420 [ 696.295164][T14438] ? __fget_files+0x3a8/0x420 [ 696.295189][T14438] ? __fget_files+0x2a/0x420 [ 696.295217][T14438] ? __pfx_dvb_frontend_ioctl+0x10/0x10 [ 696.295247][T14438] dvb_frontend_ioctl+0x5c/0x80 [ 696.295279][T14438] __se_sys_ioctl+0xff/0x170 [ 696.295310][T14438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 696.295336][T14438] do_syscall_64+0x174/0x580 [ 696.295365][T14438] ? trace_irq_disable+0x3b/0x140 [ 696.295395][T14438] ? clear_bhb_loop+0x40/0x90 [ 696.295423][T14438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 696.295447][T14438] RIP: 0033:0x7f82a9e8de59 [ 696.295478][T14438] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 696.295498][T14438] RSP: 002b:00007f82a80e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 696.295522][T14438] RAX: ffffffffffffffda RBX: 00007f82aa115fa0 RCX: 00007f82a9e8de59 [ 696.295539][T14438] RDX: 0000200000000040 RSI: 0000000080106f53 RDI: 0000000000000003 [ 696.295553][T14438] RBP: 00007f82a80e6090 R08: 0000000000000000 R09: 0000000000000000 [ 696.295566][T14438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 696.295580][T14438] R13: 00007f82aa116038 R14: 00007f82aa115fa0 R15: 00007ffedcba2838 [ 696.295614][T14438] [ 696.557468][T14431] block nbd6: shutting down sockets [ 696.668741][ T9] usb 8-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 696.713410][ T9] usb 8-1: USB disconnect, device number 3 [ 696.852938][ T1546] usb 8-1: Failed to submit usb control message: -19 [ 696.852980][ T1546] usb 8-1: unable to send the bmi data to the device: -19 [ 696.853000][ T1546] usb 8-1: unable to get target info from device [ 696.853121][ T1546] usb 8-1: could not get target info (-19) [ 696.889524][ T5345] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 696.890277][ T1546] usb 8-1: could not probe fw (-19) [ 697.091876][ T5345] usb 7-1: Using ep0 maxpacket: 32 [ 697.095258][ T5345] usb 7-1: config index 0 descriptor too short (expected 156, got 27) [ 697.095304][ T5345] usb 7-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 697.095347][ T5345] usb 7-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 697.095371][ T5345] usb 7-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 697.095392][ T5345] usb 7-1: config 0 interface 0 has no altsetting 0 [ 697.098396][ T5345] usb 7-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 697.098427][ T5345] usb 7-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 697.098449][ T5345] usb 7-1: Product: syz [ 697.098469][ T5345] usb 7-1: Manufacturer: syz [ 697.098480][ T5345] usb 7-1: SerialNumber: syz [ 697.102171][ T5694] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 697.114436][ T5345] usb 7-1: config 0 descriptor?? [ 697.140163][ T5345] ldusb 7-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 697.254197][ T5345] ldusb 7-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 697.283586][ T5694] usb 6-1: Using ep0 maxpacket: 16 [ 697.322217][ T5694] usb 6-1: New USB device found, idVendor=046d, idProduct=0721, bcdDevice=9c.25 [ 697.322249][ T5694] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 697.322272][ T5694] usb 6-1: Product: syz [ 697.322287][ T5694] usb 6-1: Manufacturer: syz [ 697.322304][ T5694] usb 6-1: SerialNumber: syz [ 697.487680][ T5694] usb 6-1: config 0 descriptor?? [ 697.697510][ T11] usb 6-1: USB disconnect, device number 26 [ 697.726239][T14443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 697.726876][T14443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 697.811947][T14460] netlink: 740 bytes leftover after parsing attributes in process `syz.7.2833'. [ 697.932793][T14466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 697.933453][T14466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 697.936657][T14466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 697.938418][T14466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 697.975947][T14466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 697.976629][T14466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 697.985399][T14466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 698.006508][T14466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 698.141228][ T5694] usb 8-1: new full-speed USB device number 4 using dummy_hcd [ 698.293863][ T5694] usb 8-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 698.293900][ T5694] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 698.319180][ T5694] usb 8-1: config 0 descriptor?? [ 698.358592][ T5694] cp210x 8-1:0.0: cp210x converter detected [ 698.610724][ T5345] usb 6-1: new full-speed USB device number 27 using dummy_hcd [ 698.769057][ T5345] usb 6-1: unable to get BOS descriptor or descriptor too short [ 698.779155][ T5345] usb 6-1: not running at top speed; connect to a high speed hub [ 698.788869][ T5345] usb 6-1: config 12 has an invalid interface number: 104 but max is 0 [ 698.788898][ T5345] usb 6-1: config 12 has no interface number 0 [ 698.788955][ T5345] usb 6-1: config 12 interface 104 has no altsetting 0 [ 698.810166][ T5694] usb 8-1: cp210x converter now attached to ttyUSB0 [ 698.823375][ T5345] usb 6-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=e6.f3 [ 698.823407][ T5345] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 698.823429][ T5345] usb 6-1: Product: syz [ 698.823444][ T5345] usb 6-1: Manufacturer: syz [ 698.823459][ T5345] usb 6-1: SerialNumber: syz [ 699.143123][T14471] comedi comedi3: pcl816: I/O base address not correctly aligned [ 699.436916][T14483] FAULT_INJECTION: forcing a failure. [ 699.436916][T14483] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 699.436959][T14483] CPU: 1 UID: 0 PID: 14483 Comm: syz.4.2840 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 699.436995][T14483] Tainted: [L]=SOFTLOCKUP [ 699.437004][T14483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 699.437018][T14483] Call Trace: [ 699.437026][T14483] [ 699.437037][T14483] dump_stack_lvl+0xe8/0x150 [ 699.437070][T14483] should_fail_ex+0x467/0x600 [ 699.437111][T14483] _copy_from_user+0x2d/0xb0 [ 699.437140][T14483] do_sock_getsockopt+0x200/0x7e0 [ 699.437177][T14483] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 699.437235][T14483] ? __fget_files+0x3a8/0x420 [ 699.437260][T14483] ? __fget_files+0x2a/0x420 [ 699.437291][T14483] __x64_sys_getsockopt+0x1aa/0x250 [ 699.437328][T14483] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.437354][T14483] do_syscall_64+0x174/0x580 [ 699.437383][T14483] ? trace_irq_disable+0x3b/0x140 [ 699.437413][T14483] ? clear_bhb_loop+0x40/0x90 [ 699.437442][T14483] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.437464][T14483] RIP: 0033:0x7f82a9e8de59 [ 699.437485][T14483] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 699.437505][T14483] RSP: 002b:00007f82a80e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 699.437529][T14483] RAX: ffffffffffffffda RBX: 00007f82aa115fa0 RCX: 00007f82a9e8de59 [ 699.437547][T14483] RDX: 0000000000000081 RSI: 0000000000000084 RDI: 0000000000000004 [ 699.437561][T14483] RBP: 00007f82a80e6090 R08: 00002000000000c0 R09: 0000000000000000 [ 699.437576][T14483] R10: 0000200000002300 R11: 0000000000000246 R12: 0000000000000001 [ 699.437589][T14483] R13: 00007f82aa116038 R14: 00007f82aa115fa0 R15: 00007ffedcba2838 [ 699.437623][T14483] [ 699.647128][ T9] usb 7-1: USB disconnect, device number 7 [ 699.734231][ T9] ldusb 7-1:0.0: LD USB Device #0 now disconnected [ 700.121167][T14490] binder: BINDER_SET_CONTEXT_MGR already set [ 700.121411][T14490] binder: 14485:14490 ioctl 4018620d 2000000002c0 returned -16 [ 700.845574][ T5694] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 701.017561][ T50] usb 8-1: USB disconnect, device number 4 [ 701.083801][ T50] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 701.093758][ T5694] usb 5-1: Using ep0 maxpacket: 32 [ 701.098582][ T5694] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 701.100993][ T5694] usb 5-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice= 0.03 [ 701.101041][ T5694] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 701.101065][ T5694] usb 5-1: SerialNumber: syz [ 701.258385][ T5694] usb 5-1: config 0 descriptor?? [ 701.477874][ T5694] usb 5-1: No union descriptors [ 701.508854][ T5694] usb 5-1: unsupported MDLM descriptors [ 701.572115][ T5694] usb 5-1: USB disconnect, device number 63 [ 701.655453][ T50] cp210x 8-1:0.0: device disconnected [ 701.730416][ T5345] usbserial_generic 6-1:12.104: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 701.730444][ T5345] usbserial_generic 6-1:12.104: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 701.758206][ T5345] usbserial_generic 6-1:12.104: device has no bulk endpoints [ 701.794272][ T5345] usb 6-1: USB disconnect, device number 27 [ 702.160667][ T5345] usb 6-1: new full-speed USB device number 28 using dummy_hcd [ 702.300679][ T5345] usb 6-1: device descriptor read/64, error -71 [ 702.540641][ T5345] usb 6-1: new full-speed USB device number 29 using dummy_hcd [ 702.668530][T14532] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 702.679036][ T5345] usb 6-1: device descriptor read/64, error -71 [ 702.704459][T14532] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 702.704521][T14532] overlayfs: overlapping lowerdir path [ 702.781062][ T5345] usb usb6-port1: attempt power cycle [ 703.039313][T14540] openvswitch: netlink: IP tunnel dst address not specified [ 703.045277][T10532] Bluetooth: hci3: unexpected event for opcode 0x6976 [ 703.120769][ T5345] usb 6-1: new full-speed USB device number 30 using dummy_hcd [ 703.141419][ T5345] usb 6-1: device descriptor read/8, error -71 [ 703.382466][ T5345] usb 6-1: new full-speed USB device number 31 using dummy_hcd [ 703.412929][ T5345] usb 6-1: device descriptor read/8, error -71 [ 703.524253][ T5345] usb usb6-port1: unable to enumerate USB device [ 703.624243][T14550] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2865'. [ 704.136820][T14575] netlink: 'syz.7.2871': attribute type 12 has an invalid length. [ 704.136846][T14575] netlink: 132 bytes leftover after parsing attributes in process `syz.7.2871'. [ 704.180073][T14573] fuse: Unknown parameter 'ft' [ 704.203859][T14577] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 705.202553][T14617] netlink: 277 bytes leftover after parsing attributes in process `syz.5.2888'. [ 705.241425][T14618] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2888'. [ 705.450736][ T11] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 705.581306][ T11] usb 8-1: device descriptor read/64, error -71 [ 705.880701][ T11] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 706.022606][ T11] usb 8-1: device descriptor read/64, error -71 [ 706.132479][ T11] usb usb8-port1: attempt power cycle [ 706.325104][T14653] FAULT_INJECTION: forcing a failure. [ 706.325104][T14653] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 706.325133][T14653] CPU: 0 UID: 0 PID: 14653 Comm: syz.6.2903 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 706.325156][T14653] Tainted: [L]=SOFTLOCKUP [ 706.325162][T14653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 706.325172][T14653] Call Trace: [ 706.325178][T14653] [ 706.325192][T14653] dump_stack_lvl+0xe8/0x150 [ 706.325217][T14653] should_fail_ex+0x467/0x600 [ 706.325247][T14653] _copy_from_user+0x2d/0xb0 [ 706.325267][T14653] kvm_vm_ioctl+0x509/0xd30 [ 706.325372][T14653] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 706.325405][T14653] ? kasan_quarantine_put+0xbb/0x1f0 [ 706.325429][T14653] ? tomoyo_path_number_perm+0x219/0x5f0 [ 706.325452][T14653] ? tomoyo_path_number_perm+0x219/0x5f0 [ 706.325475][T14653] ? do_vfs_ioctl+0x1184/0x1550 [ 706.325501][T14653] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 706.325532][T14653] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 706.325556][T14653] ? hook_file_ioctl+0x1f3/0x600 [ 706.325577][T14653] ? lockdep_hardirqs_on+0x7a/0x110 [ 706.325611][T14653] ? __fget_files+0x2a/0x420 [ 706.325631][T14653] ? __fget_files+0x2a/0x420 [ 706.325647][T14653] ? __fget_files+0x3a8/0x420 [ 706.325664][T14653] ? __fget_files+0x2a/0x420 [ 706.325684][T14653] ? bpf_lsm_file_ioctl+0x9/0x20 [ 706.325706][T14653] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 706.325724][T14653] __se_sys_ioctl+0xff/0x170 [ 706.325747][T14653] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.325765][T14653] do_syscall_64+0x174/0x580 [ 706.325786][T14653] ? trace_irq_disable+0x3b/0x140 [ 706.325807][T14653] ? clear_bhb_loop+0x40/0x90 [ 706.325827][T14653] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.325844][T14653] RIP: 0033:0x7f6a0a5dde59 [ 706.325859][T14653] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 706.325874][T14653] RSP: 002b:00007f6a08815028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 706.325891][T14653] RAX: ffffffffffffffda RBX: 00007f6a0a866090 RCX: 00007f6a0a5dde59 [ 706.325903][T14653] RDX: 0000200000000000 RSI: 000000004020aed2 RDI: 0000000000000004 [ 706.325914][T14653] RBP: 00007f6a08815090 R08: 0000000000000000 R09: 0000000000000000 [ 706.325925][T14653] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 706.325935][T14653] R13: 00007f6a0a866128 R14: 00007f6a0a866090 R15: 00007ffe87d27f38 [ 706.325959][T14653] [ 706.579787][ T11] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 706.601488][ T11] usb 8-1: device descriptor read/8, error -71 [ 706.788710][T14657] netlink: 'syz.5.2906': attribute type 2 has an invalid length. [ 706.788732][T14657] netlink: 'syz.5.2906': attribute type 11 has an invalid length. [ 706.788748][T14657] netlink: 132 bytes leftover after parsing attributes in process `syz.5.2906'. [ 706.840868][ T11] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 706.864591][ T11] usb 8-1: device descriptor read/8, error -71 [ 706.971347][ T11] usb usb8-port1: unable to enumerate USB device [ 708.261782][T10532] Bluetooth: hci2: command 0x0406 tx timeout [ 709.205009][T14744] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2944'. [ 710.350827][ T61] Bluetooth: hci3: command 0x0c1a tx timeout [ 710.801201][ T5345] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 710.954973][T14805] FAULT_INJECTION: forcing a failure. [ 710.954973][T14805] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 710.955022][T14805] CPU: 0 UID: 0 PID: 14805 Comm: syz.6.2966 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 710.955059][T14805] Tainted: [L]=SOFTLOCKUP [ 710.955068][T14805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 710.955082][T14805] Call Trace: [ 710.955091][T14805] [ 710.955101][T14805] dump_stack_lvl+0xe8/0x150 [ 710.955137][T14805] should_fail_ex+0x467/0x600 [ 710.955167][T14805] strncpy_from_user+0x36/0x2c0 [ 710.955220][T14805] do_getname+0x77/0x250 [ 710.955248][T14805] do_sys_openat2+0xcc/0x200 [ 710.955275][T14805] ? __pfx_do_sys_openat2+0x10/0x10 [ 710.955298][T14805] ? ksys_write+0x248/0x270 [ 710.955330][T14805] ? __pfx_ksys_write+0x10/0x10 [ 710.955375][T14805] __x64_sys_openat+0x138/0x170 [ 710.955404][T14805] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 710.955430][T14805] do_syscall_64+0x174/0x580 [ 710.955458][T14805] ? trace_irq_disable+0x3b/0x140 [ 710.955492][T14805] ? clear_bhb_loop+0x40/0x90 [ 710.955512][T14805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 710.955547][T14805] RIP: 0033:0x7f6a0a5dde59 [ 710.955569][T14805] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 710.955590][T14805] RSP: 002b:00007f6a08836028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 710.955614][T14805] RAX: ffffffffffffffda RBX: 00007f6a0a865fa0 RCX: 00007f6a0a5dde59 [ 710.955630][T14805] RDX: 000000000018d002 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 710.955645][T14805] RBP: 00007f6a08836090 R08: 0000000000000000 R09: 0000000000000000 [ 710.955663][T14805] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 710.955673][T14805] R13: 00007f6a0a866038 R14: 00007f6a0a865fa0 R15: 00007ffe87d27f38 [ 710.955717][T14805] [ 710.957131][ T5345] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 710.957166][ T5345] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 710.957204][ T5345] usb 6-1: config 1 interface 0 has no altsetting 0 [ 710.986303][ T5345] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 710.986336][ T5345] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 710.986360][ T5345] usb 6-1: Product: syz [ 710.986377][ T5345] usb 6-1: Manufacturer: syz [ 710.986393][ T5345] usb 6-1: SerialNumber: syz [ 711.243957][T14788] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 711.244091][T14788] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 711.650707][ T50] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 711.737249][ T5345] rtl8150 6-1:1.0: couldn't reset the device [ 711.737516][ T5345] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 711.763784][ T5345] usb 6-1: USB disconnect, device number 32 [ 711.801796][ T50] usb 7-1: Using ep0 maxpacket: 16 [ 711.808617][ T50] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 711.827938][ T50] usb 7-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=7b.55 [ 711.827972][ T50] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.827996][ T50] usb 7-1: Product: syz [ 711.828011][ T50] usb 7-1: Manufacturer: syz [ 711.828027][ T50] usb 7-1: SerialNumber: syz [ 711.868699][ T50] usb 7-1: config 0 descriptor?? [ 711.877538][ T50] hub 7-1:0.0: bad descriptor, ignoring hub [ 711.877602][ T50] hub 7-1:0.0: probe with driver hub failed with error -5 [ 711.897755][ T50] usb 7-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 711.970837][ T3411] usb 7-1: Failed to submit usb control message: -71 [ 711.970870][ T3411] usb 7-1: unable to send the bmi data to the device: -71 [ 711.970886][ T3411] usb 7-1: unable to get target info from device [ 711.970900][ T3411] usb 7-1: could not get target info (-71) [ 711.970915][ T3411] usb 7-1: could not probe fw (-71) [ 712.122112][T14820] binder: 14819:14820 ioctl 640f 0 returned -22 [ 712.122699][T14820] netlink: 140 bytes leftover after parsing attributes in process `syz.4.2971'. [ 712.223127][ T11] usb 7-1: USB disconnect, device number 8 [ 713.401863][ T50] usb 5-1: new full-speed USB device number 64 using dummy_hcd [ 713.481217][ T5345] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 713.555231][ T50] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 713.555261][ T50] usb 5-1: config 0 has no interfaces? [ 713.558302][ T50] usb 5-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 2.23 [ 713.558335][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 713.558358][ T50] usb 5-1: Product: syz [ 713.558374][ T50] usb 5-1: Manufacturer: syz [ 713.558390][ T50] usb 5-1: SerialNumber: syz [ 713.616613][ T50] usb 5-1: config 0 descriptor?? [ 713.633089][ T5345] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 713.633127][ T5345] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 713.633155][ T5345] usb 6-1: config 1 interface 0 has no altsetting 0 [ 713.636610][ T5345] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 713.636643][ T5345] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 713.636666][ T5345] usb 6-1: Product: syz [ 713.636681][ T5345] usb 6-1: Manufacturer: syz [ 713.636697][ T5345] usb 6-1: SerialNumber: syz [ 713.727556][T14859] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 713.739588][T14859] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 713.919804][T14875] C: renamed from veth1_to_team (while UP) [ 713.973352][ T9] usb 5-1: USB disconnect, device number 64 [ 713.988150][T14875] netlink: 'syz.6.2991': attribute type 3 has an invalid length. [ 713.988173][T14875] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 714.111304][ T5719] usb 8-1: new low-speed USB device number 9 using dummy_hcd [ 714.239365][ T5345] rtl8150 6-1:1.0: couldn't reset the device [ 714.239741][ T5345] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 714.278496][ T5345] usb 6-1: USB disconnect, device number 33 [ 714.287766][ T5719] usb 8-1: unable to get BOS descriptor or descriptor too short [ 714.299403][ T5719] usb 8-1: config 197 has too many interfaces: 48, using maximum allowed: 32 [ 714.299432][ T5719] usb 8-1: config 197 has an invalid interface number: 251 but max is 47 [ 714.299456][ T5719] usb 8-1: config 197 has 1 interface, different from the descriptor's value: 48 [ 714.299479][ T5719] usb 8-1: config 197 has no interface number 0 [ 714.299526][ T5719] usb 8-1: config 197 interface 251 altsetting 11 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 714.299554][ T5719] usb 8-1: config 197 interface 251 altsetting 11 endpoint 0x8F is Bulk; changing to Interrupt [ 714.299579][ T5719] usb 8-1: config 197 interface 251 altsetting 11 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 714.299608][ T5719] usb 8-1: config 197 interface 251 has no altsetting 0 [ 714.378936][ T5719] usb 8-1: string descriptor 0 read error: -22 [ 714.379061][ T5719] usb 8-1: New USB device found, idVendor=6737, idProduct=0001, bcdDevice=91.80 [ 714.379081][ T5719] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 714.475543][T14871] raw-gadget.2 gadget.7: fail, usb_ep_enable returned -22 [ 714.500979][ T5719] cypress_m8 8-1:197.251: HID->COM RS232 Adapter converter detected [ 714.524600][T14888] netlink: 5 bytes leftover after parsing attributes in process `syz.4.2995'. [ 714.552394][ T5719] cyphidcom ttyUSB0: required endpoint is missing [ 714.693046][T14871] netlink: 'syz.7.2990': attribute type 16 has an invalid length. [ 714.693073][T14871] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2990'. [ 714.693122][T14871] veth0_macvtap: entered allmulticast mode [ 714.758429][T14871] /dev/sg0: Can't lookup blockdev [ 714.778662][ T5719] usb 8-1: USB disconnect, device number 9 [ 714.846197][ T5719] cypress_m8 8-1:197.251: device disconnected [ 715.117455][T14902] comedi comedi3: pcl818: I/O base address or length out of range [ 715.833208][ T5694] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 715.981620][ T5694] usb 8-1: Using ep0 maxpacket: 8 [ 715.985736][ T5694] usb 8-1: config 0 has an invalid interface number: 48 but max is 0 [ 715.985767][ T5694] usb 8-1: config 0 has no interface number 0 [ 715.985802][ T5694] usb 8-1: too many endpoints for config 0 interface 48 altsetting 120: 48, using maximum allowed: 30 [ 715.985854][ T5694] usb 8-1: config 0 interface 48 altsetting 120 has 0 endpoint descriptors, different from the interface descriptor's value: 48 [ 715.985887][ T5694] usb 8-1: config 0 interface 48 has no altsetting 0 [ 715.998947][ T5694] usb 8-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 715.998982][ T5694] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 715.999004][ T5694] usb 8-1: Product: syz [ 715.999020][ T5694] usb 8-1: Manufacturer: syz [ 715.999035][ T5694] usb 8-1: SerialNumber: syz [ 716.087103][ T5694] usb 8-1: config 0 descriptor?? [ 716.241342][T14933] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3013'. [ 716.241372][T14933] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3013'. [ 716.317113][T14917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 716.334563][T14917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 716.357614][T14933] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3013'. [ 716.357712][T14933] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3013'. [ 716.438528][T14940] 9p: Bad value for 'rfdno' [ 716.646786][T14945] netlink: 140 bytes leftover after parsing attributes in process `syz.6.3015'. [ 716.646816][T14945] nbd: must specify an index to disconnect [ 716.693948][T14947] netlink: 140 bytes leftover after parsing attributes in process `syz.6.3015'. [ 716.693978][T14947] nbd: must specify an index to disconnect [ 716.727764][T14917] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3005'. [ 716.832919][ T8343] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 717.023594][ T8343] usb 5-1: config 0 has an invalid interface number: 75 but max is 0 [ 717.023626][ T8343] usb 5-1: config 0 has no interface number 0 [ 717.023662][ T8343] usb 5-1: too many endpoints for config 0 interface 75 altsetting 3: 104, using maximum allowed: 30 [ 717.023702][ T8343] usb 5-1: config 0 interface 75 altsetting 3 has 0 endpoint descriptors, different from the interface descriptor's value: 104 [ 717.023733][ T8343] usb 5-1: config 0 interface 75 has no altsetting 0 [ 717.023770][ T8343] usb 5-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.0a [ 717.023798][ T8343] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 717.111805][ T8343] usb 5-1: config 0 descriptor?? [ 717.357995][ T5694] gspca_main: se401-2.14.0 probing 047d:5003 [ 717.402044][T14943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 717.403319][T14943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 717.437197][ T8343] usb 5-1: string descriptor 0 read error: -71 [ 717.465836][ T8343] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 717.466480][ T8343] gspca_cpia1: usb_control_msg 05, error -71 [ 717.466882][ T8343] gspca_cpia1: usb_control_msg 01, error -71 [ 717.466900][ T8343] cpia1 5-1:0.75: only firmware version 1 is supported (got: 0) [ 717.542079][ T8343] usb 5-1: USB disconnect, device number 65 [ 717.777118][T14963] input: syz0 as /devices/virtual/input/input49 [ 717.836499][ T11] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 718.080873][ T11] usb 6-1: Using ep0 maxpacket: 16 [ 718.083260][ T11] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 718.083319][ T11] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 718.083351][ T11] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 718.083376][ T11] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 718.083402][ T11] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 718.085360][ T11] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 718.085400][ T11] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 718.085421][ T11] usb 6-1: Manufacturer: syz [ 718.218510][ T11] usb 6-1: config 0 descriptor?? [ 718.772230][ T11] rc_core: IR keymap rc-hauppauge not found [ 718.772253][ T11] Registered IR keymap rc-empty [ 718.773299][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 718.786394][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 718.854214][ T5761] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 718.963178][ T11] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 719.069202][ T11] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input50 [ 719.085906][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 719.126089][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 719.151417][ T5761] usb 5-1: Using ep0 maxpacket: 8 [ 719.155188][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 719.163322][ T5761] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 719.163729][ T5761] usb 5-1: config 179 has no interface number 0 [ 719.164435][ T5761] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 719.164836][ T5761] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 719.165195][ T5761] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 719.165225][ T5761] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 719.165249][ T5761] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 719.165397][ T5761] usb 5-1: config 179 interface 65 has no altsetting 0 [ 719.165438][ T5761] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 719.165475][ T5761] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 719.171077][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 719.190896][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 719.211021][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 719.326128][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 719.346847][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 719.369580][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 719.381933][ T11] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 719.440681][ T11] mceusb 6-1:0.0: Registered ê’¬ with mce emulator interface version 1 [ 719.440769][ T11] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 719.913725][ T5720] usb 6-1: USB disconnect, device number 34 [ 720.227256][ T5694] gspca_se401: read req failed req 0x06 error -19 [ 720.300351][ T5694] usb 8-1: USB disconnect, device number 10 [ 720.668425][ T5761] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input51 [ 721.792830][T15005] bridge0: port 3(syz_tun) entered blocking state [ 721.806265][T15005] bridge0: port 3(syz_tun) entered disabled state [ 721.954798][T15005] syz_tun: entered allmulticast mode [ 722.270287][T15005] syz_tun: entered promiscuous mode [ 722.435882][T15005] bridge0: port 3(syz_tun) entered blocking state [ 722.436130][T15005] bridge0: port 3(syz_tun) entered forwarding state [ 723.200873][ T9] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 723.330771][ T9] usb 6-1: device descriptor read/64, error -71 [ 723.602914][ T9] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 723.740682][ T9] usb 6-1: device descriptor read/64, error -71 [ 723.851201][ T9] usb usb6-port1: attempt power cycle [ 724.200670][ T9] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 724.222359][ T9] usb 6-1: device descriptor read/8, error -71 [ 724.488310][ T9] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 724.505497][ T9] usb 6-1: device descriptor read/8, error -71 [ 724.628601][ T9] usb usb6-port1: unable to enumerate USB device [ 725.861173][ T8343] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 725.861201][ T8343] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 725.871155][ T61] Bluetooth: hci4: command 0x0c1a tx timeout [ 728.581786][ T61] Bluetooth: hci3: command 0x0c1a tx timeout [ 728.630594][ T8343] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 728.630623][ T8343] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 731.140740][ T8343] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 731.140770][ T8343] Bluetooth: hci2: Error when powering off device on rfkill (-110) [ 731.160033][ T61] Bluetooth: hci2: command 0x0406 tx timeout [ 733.701236][ T61] Bluetooth: hci5: command 0x0c1a tx timeout [ 733.701850][ T8343] Bluetooth: hci5: Opcode 0x0c1a failed: -110 [ 733.701872][ T8343] Bluetooth: hci5: Error when powering off device on rfkill (-110) [ 736.420704][ T61] Bluetooth: hci6: command 0x0c1a tx timeout [ 736.421198][ T8343] Bluetooth: hci6: Opcode 0x0c1a failed: -110 [ 736.421236][ T8343] Bluetooth: hci6: Error when powering off device on rfkill (-110) [ 737.393220][T15118] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 737.511848][T10532] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 737.602633][T15118] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 737.619070][T15118] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 737.631991][T15118] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 737.641153][T15118] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 737.721399][T10532] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 737.741092][T10532] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 737.747305][T15118] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 737.784302][T10532] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 739.640675][ T5720] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 739.641882][ C1] raw-gadget.0 gadget.5: ignoring, device is not running [ 739.770660][ T5720] usb 6-1: device descriptor read/64, error -32 [ 740.010678][ T5720] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 740.010931][ C1] raw-gadget.0 gadget.5: ignoring, device is not running [ 740.195828][ T5720] usb 6-1: device descriptor read/64, error -32 [ 740.305096][ T5720] usb usb6-port1: attempt power cycle [ 740.642943][ T5720] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 740.674924][ T5720] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 740.674966][ T5720] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 740.674999][ T5720] usb 6-1: config 1 interface 0 has no altsetting 0 [ 740.729033][ T5720] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 740.729069][ T5720] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 740.729093][ T5720] usb 6-1: Product: syz [ 740.729109][ T5720] usb 6-1: Manufacturer: syz [ 740.729124][ T5720] usb 6-1: SerialNumber: syz [ 740.743349][T10532] Bluetooth: hci7: command tx timeout [ 740.823958][T10532] Bluetooth: hci8: command tx timeout [ 740.992587][T15131] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 740.992797][T15131] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 741.552386][T15112] lo speed is unknown, defaulting to 1000 [ 742.012294][T15114] lo speed is unknown, defaulting to 1000 [ 742.206575][ T8343] Bluetooth: hci7: Opcode 0x0c1a failed: -110 [ 742.206606][ T8343] Bluetooth: hci7: Error when powering off device on rfkill (-110) [ 742.234469][ T5720] rtl8150 6-1:1.0: couldn't reset the device [ 742.235114][ T5720] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 742.286614][ T5720] usb 6-1: USB disconnect, device number 41 [ 742.907040][T10532] Bluetooth: hci8: command tx timeout [ 743.063759][T15159] netlink: 'syz.5.3049': attribute type 21 has an invalid length. [ 743.063845][T15159] IPv6: NLM_F_CREATE should be specified when creating new route [ 743.303995][T15164] sctp: [Deprecated]: syz.5.3049 (pid 15164) Use of int in maxseg socket option. [ 743.303995][T15164] Use struct sctp_assoc_value instead [ 743.600723][ T11] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 743.762690][ T11] usb 6-1: Using ep0 maxpacket: 8 [ 743.783989][ T11] usb 6-1: config index 0 descriptor too short (expected 63780, got 36) [ 743.784020][ T11] usb 6-1: config 0 has an invalid interface descriptor of length 8, skipping [ 743.784042][ T11] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 743.784121][ T11] usb 6-1: config 0 has no interfaces? [ 743.784154][ T11] usb 6-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00 [ 743.784179][ T11] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 743.902732][ T11] usb 6-1: config 0 descriptor?? [ 744.820771][ T32] Bluetooth: hci8: Opcode 0x0c1a failed: -110 [ 744.820797][ T32] Bluetooth: hci8: Error when powering off device on rfkill (-110) [ 744.983812][T10532] Bluetooth: hci8: command 0x040f tx timeout [ 745.451673][ T61] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 745.570881][ T61] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 745.593852][ T61] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 745.807657][ T61] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 745.810012][ T61] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 746.229652][T10532] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 746.230181][T10532] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 746.232468][T10532] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 746.240809][ T11] usb 6-1: USB disconnect, device number 42 [ 746.311737][T10532] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 746.312956][T10532] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 746.683249][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 746.683374][ T5694] usb 5-1: USB disconnect, device number 66 [ 747.118609][T15004] bridge0: port 3(syz_tun) entered disabled state [ 747.201878][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.245595][T15004] syz_tun (unregistering): left allmulticast mode [ 747.245622][T15004] syz_tun (unregistering): left promiscuous mode [ 747.245722][T15004] bridge0: port 3(syz_tun) entered disabled state [ 747.497839][T15112] bridge0: port 1(bridge_slave_0) entered blocking state [ 747.498557][T15112] bridge0: port 1(bridge_slave_0) entered disabled state [ 747.498831][T15112] bridge_slave_0: entered allmulticast mode [ 747.504832][T15112] bridge_slave_0: entered promiscuous mode [ 747.626146][T15112] bridge0: port 2(bridge_slave_1) entered blocking state [ 747.626512][T15112] bridge0: port 2(bridge_slave_1) entered disabled state [ 747.626913][T15112] bridge_slave_1: entered allmulticast mode [ 747.655663][T15112] bridge_slave_1: entered promiscuous mode [ 748.055166][ T7968] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.188338][T15112] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 748.252940][T15112] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 748.253431][T15114] bridge0: port 1(bridge_slave_0) entered blocking state [ 748.253905][T15114] bridge0: port 1(bridge_slave_0) entered disabled state [ 748.254228][T15114] bridge_slave_0: entered allmulticast mode [ 748.308720][T15114] bridge_slave_0: entered promiscuous mode [ 748.378543][T15114] bridge0: port 2(bridge_slave_1) entered blocking state [ 748.378917][T15114] bridge0: port 2(bridge_slave_1) entered disabled state [ 748.379237][T15114] bridge_slave_1: entered allmulticast mode [ 748.411802][T15114] bridge_slave_1: entered promiscuous mode [ 748.433753][ T61] Bluetooth: hci9: command tx timeout [ 748.614917][T15112] team0: Port device team_slave_0 added [ 748.764348][T15112] team0: Port device team_slave_1 added [ 748.779909][T15114] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 749.005704][ T7968] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 749.117207][T15114] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 749.224958][T15112] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 749.224973][T15112] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 749.224994][T15112] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 749.301663][T15112] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 749.301683][T15112] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 749.301715][T15112] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 749.499167][ T7968] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 749.536210][T15114] team0: Port device team_slave_0 added [ 749.560091][T15134] lo speed is unknown, defaulting to 1000 [ 749.582078][T15114] team0: Port device team_slave_1 added [ 750.068318][ T7968] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.086726][ T32] usb 6-1: new full-speed USB device number 43 using dummy_hcd [ 750.126239][T15114] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 750.126254][T15114] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 750.126275][T15114] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 750.202330][T15114] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 750.202346][T15114] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 750.202370][T15114] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 750.288238][ T32] usb 6-1: config 150 has an invalid interface number: 204 but max is 2 [ 750.288271][ T32] usb 6-1: config 150 has 2 interfaces, different from the descriptor's value: 3 [ 750.288295][ T32] usb 6-1: config 150 has no interface number 0 [ 750.288343][ T32] usb 6-1: config 150 interface 204 has no altsetting 0 [ 750.324355][ T32] usb 6-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 750.324388][ T32] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 750.324410][ T32] usb 6-1: Product: syz [ 750.324426][ T32] usb 6-1: Manufacturer: syz [ 750.324441][ T32] usb 6-1: SerialNumber: syz [ 750.382141][T15112] hsr_slave_0: entered promiscuous mode [ 750.384777][T15112] hsr_slave_1: entered promiscuous mode [ 750.386807][T15112] debugfs: 'hsr0' already exists in 'hsr' [ 750.386834][T15112] Cannot create hsr debugfs directory [ 750.500811][ T61] Bluetooth: hci9: command tx timeout [ 750.585255][T15200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 750.585845][T15200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 750.630382][T15200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 750.631105][T15201] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 750.655480][T15200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 750.655611][T15201] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 750.704593][ T32] xr_serial 6-1:150.204: skipping garbage [ 750.704641][ T32] xr_serial 6-1:150.204: xr_serial converter detected [ 750.717580][ T32] xr_serial ttyUSB0: Failed to set reg 0x60: -71 [ 750.717645][ T32] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 750.785480][ T32] usb 6-1: USB disconnect, device number 43 [ 750.819579][ T32] xr_serial 6-1:150.204: device disconnected [ 750.977386][T15114] hsr_slave_0: entered promiscuous mode [ 750.980402][T15114] hsr_slave_1: entered promiscuous mode [ 751.000067][T15114] debugfs: 'hsr0' already exists in 'hsr' [ 751.000092][T15114] Cannot create hsr debugfs directory [ 752.600731][ T61] Bluetooth: hci9: command tx timeout [ 752.602171][ T32] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 752.772734][ T32] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 752.772771][ T32] usb 6-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 752.772791][ T32] usb 6-1: config 1 interface 0 has no altsetting 0 [ 752.775098][ T32] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 752.775133][ T32] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.775148][ T32] usb 6-1: Product: syz [ 752.775159][ T32] usb 6-1: Manufacturer: syz [ 752.775171][ T32] usb 6-1: SerialNumber: syz [ 752.784291][T15210] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 752.784492][T15210] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 752.813465][ T7968] bridge_slave_1: left allmulticast mode [ 752.813531][ T7968] bridge_slave_1: left promiscuous mode [ 752.821670][ T7968] bridge0: port 2(bridge_slave_1) entered disabled state [ 752.952357][ T7968] bridge_slave_0: left allmulticast mode [ 752.952397][ T7968] bridge_slave_0: left promiscuous mode [ 752.952694][ T7968] bridge0: port 1(bridge_slave_0) entered disabled state [ 754.081408][ T32] rtl8150 6-1:1.0: couldn't reset the device [ 754.081669][ T32] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 754.104749][ T32] usb 6-1: USB disconnect, device number 44 [ 754.184268][ T7968] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 754.251684][ T7968] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 754.323860][ T7968] bond0 (unregistering): Released all slaves [ 754.664306][ T61] Bluetooth: hci9: command tx timeout [ 755.090805][ T5719] usb 6-1: new full-speed USB device number 45 using dummy_hcd [ 755.303253][T15214] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3058'. [ 755.426151][ T5719] usb 6-1: unable to get BOS descriptor or descriptor too short [ 755.435630][ T5719] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 755.435732][ T5719] usb 6-1: can't read configurations, error -71 [ 755.827079][T15134] bridge0: port 1(bridge_slave_0) entered blocking state [ 755.832680][T15134] bridge0: port 1(bridge_slave_0) entered disabled state [ 755.835386][T15134] bridge_slave_0: entered allmulticast mode [ 755.857318][T15134] bridge_slave_0: entered promiscuous mode [ 756.105406][ T7968] hsr_slave_0: left promiscuous mode [ 756.141254][ T7968] hsr_slave_1: left promiscuous mode [ 756.142505][ T7968] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 756.142533][ T7968] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 756.185900][ T7968] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 756.185931][ T7968] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 756.266882][T15228] FAULT_INJECTION: forcing a failure. [ 756.266882][T15228] name failslab, interval 1, probability 0, space 0, times 0 [ 756.266928][T15228] CPU: 1 UID: 0 PID: 15228 Comm: syz.5.3060 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 756.266959][T15228] Tainted: [L]=SOFTLOCKUP [ 756.266968][T15228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 756.266983][T15228] Call Trace: [ 756.266992][T15228] [ 756.267003][T15228] dump_stack_lvl+0xe8/0x150 [ 756.267047][T15228] should_fail_ex+0x467/0x600 [ 756.267090][T15228] should_failslab+0xa8/0x100 [ 756.267121][T15228] __kmalloc_cache_noprof+0xa1/0x670 [ 756.267148][T15228] ? io_wq_create+0x6b/0x7b0 [ 756.267292][T15228] ? io_wq_create+0x6b/0x7b0 [ 756.267322][T15228] io_wq_create+0x6b/0x7b0 [ 756.267352][T15228] io_uring_alloc_task_context+0x271/0x6c0 [ 756.267392][T15228] ? __pfx_io_uring_alloc_task_context+0x10/0x10 [ 756.267434][T15228] ? alloc_file_pseudo+0x156/0x1e0 [ 756.267457][T15228] ? __might_fault+0xaf/0x130 [ 756.267483][T15228] __io_uring_add_tctx_node+0x48d/0x630 [ 756.267515][T15228] ? __pfx___io_uring_add_tctx_node+0x10/0x10 [ 756.267543][T15228] ? __anon_inode_getfile+0x16c/0x210 [ 756.267582][T15228] io_uring_create+0x596/0x990 [ 756.267620][T15228] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 756.267647][T15228] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 756.267672][T15228] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 756.267714][T15228] ? __pfx_ksys_write+0x10/0x10 [ 756.267753][T15228] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.267778][T15228] do_syscall_64+0x174/0x580 [ 756.267808][T15228] ? trace_irq_disable+0x3b/0x140 [ 756.267840][T15228] ? clear_bhb_loop+0x40/0x90 [ 756.267866][T15228] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.267889][T15228] RIP: 0033:0x7fc253acde59 [ 756.267910][T15228] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 756.267929][T15228] RSP: 002b:00007fc251d25fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 756.267954][T15228] RAX: ffffffffffffffda RBX: 0000200000000040 RCX: 00007fc253acde59 [ 756.267971][T15228] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000020 [ 756.267986][T15228] RBP: 00007fc251d26090 R08: 0000000000000000 R09: 0000000000000101 [ 756.268000][T15228] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 756.268014][T15228] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffd4c0aa5e8 [ 756.268052][T15228] [ 756.634182][ T7968] veth1_macvtap: left promiscuous mode [ 756.637062][ T7968] veth0_macvtap: left promiscuous mode [ 756.700213][ T7968] veth1_vlan: left promiscuous mode [ 756.759176][ T7968] veth0_vlan: left promiscuous mode [ 758.282905][ T7968] team0 (unregistering): Port device team_slave_1 removed [ 758.376324][ T7968] team0 (unregistering): Port device team_slave_0 removed [ 758.692235][T15112] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 758.735606][T15112] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 758.736378][T15134] bridge0: port 2(bridge_slave_1) entered blocking state [ 758.736816][T15134] bridge0: port 2(bridge_slave_1) entered disabled state [ 758.737084][T15134] bridge_slave_1: entered allmulticast mode [ 758.739797][T15134] bridge_slave_1: entered promiscuous mode [ 758.879507][ T5274] 8021q: adding VLAN 0 to HW filter on device eth4 [ 758.909966][T15112] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 758.953545][T15112] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 758.986258][T15112] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 759.022237][ T32] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 759.049684][T15112] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 759.324282][ T32] usb 6-1: unable to get BOS descriptor or descriptor too short [ 759.334739][ T32] usb 6-1: config 10 has an invalid interface number: 98 but max is 0 [ 759.334768][ T32] usb 6-1: config 10 has no interface number 0 [ 759.334839][ T32] usb 6-1: config 10 interface 98 has no altsetting 0 [ 759.338218][ T32] usb 6-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice= a.91 [ 759.338278][ T32] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 759.338341][ T32] usb 6-1: Product: syz [ 759.338389][ T32] usb 6-1: Manufacturer: syz [ 759.338431][ T32] usb 6-1: SerialNumber: syz [ 759.591730][T15112] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 759.652352][T15112] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 759.685119][ T32] imon 6-1:10.98: unable to register, err -19 [ 759.692385][ T32] usb 6-1: USB disconnect, device number 47 [ 759.742081][T15134] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 759.763141][T15134] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 760.259264][T15134] team0: Port device team_slave_0 added [ 760.304181][T15134] team0: Port device team_slave_1 added [ 760.450270][T15134] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 760.450289][T15134] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 760.450319][T15134] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 760.598318][T15134] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 760.598338][T15134] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 760.598370][T15134] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 760.600412][T15114] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 760.835876][T15114] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 760.937079][T15114] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 761.042583][T15114] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 761.094733][T15114] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 761.138431][T15114] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 761.167093][T15114] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 761.197598][T15114] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 761.482684][T15134] hsr_slave_0: entered promiscuous mode [ 761.484995][T15134] hsr_slave_1: entered promiscuous mode [ 761.489422][T15134] debugfs: 'hsr0' already exists in 'hsr' [ 761.489468][T15134] Cannot create hsr debugfs directory [ 762.805512][ T5274] 8021q: adding VLAN 0 to HW filter on device eth6 [ 763.228654][ T8343] libceph: connect (1)[c::]:6789 error -101 [ 763.229955][ T8343] libceph: mon0 (1)[c::]:6789 connect error [ 763.318843][ T8343] libceph: connect (1)[c::]:6789 error -101 [ 763.319073][ T8343] libceph: mon0 (1)[c::]:6789 connect error [ 763.359620][T15294] ceph: No mds server is up or the cluster is laggy [ 763.595378][ T8343] libceph: connect (1)[c::]:6789 error -101 [ 763.595602][ T8343] libceph: mon0 (1)[c::]:6789 connect error [ 764.079055][T15301] FAULT_INJECTION: forcing a failure. [ 764.079055][T15301] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 764.079085][T15301] CPU: 1 UID: 0 PID: 15301 Comm: syz.5.3070 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 764.079107][T15301] Tainted: [L]=SOFTLOCKUP [ 764.079113][T15301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 764.079124][T15301] Call Trace: [ 764.079130][T15301] [ 764.079137][T15301] dump_stack_lvl+0xe8/0x150 [ 764.079161][T15301] should_fail_ex+0x467/0x600 [ 764.079192][T15301] _copy_from_user+0x2d/0xb0 [ 764.079214][T15301] kvm_dev_ioctl_get_cpuid+0x174/0x7d0 [ 764.079325][T15301] ? __pfx_kvm_dev_ioctl_get_cpuid+0x10/0x10 [ 764.079353][T15301] kvm_arch_dev_ioctl+0x34e/0x660 [ 764.079408][T15301] ? __pfx_kvm_arch_dev_ioctl+0x10/0x10 [ 764.079441][T15301] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 764.079462][T15301] ? hook_file_ioctl+0x1f3/0x600 [ 764.079485][T15301] ? lockdep_hardirqs_on+0x7a/0x110 [ 764.079516][T15301] kvm_dev_ioctl+0x606/0x1620 [ 764.079539][T15301] ? __fget_files+0x2a/0x420 [ 764.079559][T15301] ? __fget_files+0x2a/0x420 [ 764.079577][T15301] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 764.079596][T15301] ? __fget_files+0x2a/0x420 [ 764.079616][T15301] ? bpf_lsm_file_ioctl+0x9/0x20 [ 764.079637][T15301] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 764.079658][T15301] __se_sys_ioctl+0xff/0x170 [ 764.079681][T15301] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 764.079699][T15301] do_syscall_64+0x174/0x580 [ 764.079720][T15301] ? trace_irq_disable+0x3b/0x140 [ 764.079744][T15301] ? clear_bhb_loop+0x40/0x90 [ 764.079764][T15301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 764.079780][T15301] RIP: 0033:0x7fc253acde59 [ 764.079796][T15301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 764.079810][T15301] RSP: 002b:00007fc251d26028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 764.079827][T15301] RAX: ffffffffffffffda RBX: 00007fc253d55fa0 RCX: 00007fc253acde59 [ 764.079839][T15301] RDX: 0000200000000000 RSI: 00000000c008ae09 RDI: 0000000000000003 [ 764.079851][T15301] RBP: 00007fc251d26090 R08: 0000000000000000 R09: 0000000000000000 [ 764.079861][T15301] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 764.079871][T15301] R13: 00007fc253d56038 R14: 00007fc253d55fa0 R15: 00007ffd4c0aa5e8 [ 764.079895][T15301] [ 764.419043][ T7968] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 764.711882][ T8343] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 764.860670][ T8343] usb 6-1: Using ep0 maxpacket: 32 [ 764.909725][ T8343] usb 6-1: unable to get BOS descriptor or descriptor too short [ 764.912228][ T8343] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 764.912255][ T8343] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 764.912278][ T8343] usb 6-1: config 14 has no interface number 0 [ 764.912296][ T8343] usb 6-1: config 14 has no interface number 1 [ 764.912370][ T8343] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 764.912397][ T8343] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 764.912426][ T8343] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 764.912455][ T8343] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 764.912486][ T8343] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 764.912515][ T8343] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 764.912544][ T8343] usb 6-1: config 14 interface 57 has no altsetting 0 [ 764.912564][ T8343] usb 6-1: config 14 interface 228 has no altsetting 0 [ 764.978809][ T8343] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 764.978842][ T8343] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.978863][ T8343] usb 6-1: Product: syz [ 764.978878][ T8343] usb 6-1: Manufacturer: syz [ 764.978894][ T8343] usb 6-1: SerialNumber: syz [ 765.080711][ T38] INFO: task syz.3.2470:13336 blocked for more than 143 seconds. [ 765.080733][ T38] Tainted: G L syzkaller #0 [ 765.080743][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 765.080751][ T38] task:syz.3.2470 state:D stack:26184 pid:13336 tgid:13334 ppid:8895 task_flags:0x400140 flags:0x00080002 [ 765.080803][ T38] Call Trace: [ 765.080809][ T38] [ 765.080820][ T38] __schedule+0x1709/0x5530 [ 765.080848][ T38] ? __lock_acquire+0x683/0x2ce0 [ 765.080891][ T38] ? __pfx___schedule+0x10/0x10 [ 765.080917][ T38] ? schedule+0x90/0x2b0 [ 765.080938][ T38] schedule+0x164/0x2b0 [ 765.080958][ T38] cgroup_lock_and_drain_offline+0x51a/0x650 [ 765.081062][ T38] ? __pfx_cgroup_lock_and_drain_offline+0x10/0x10 [ 765.081084][ T38] ? __pfx_autoremove_wake_function+0x10/0x10 [ 765.081107][ T38] ? bpf_lsm_capable+0x9/0x20 [ 765.081129][ T38] ? security_capable+0x7e/0x2c0 [ 765.081159][ T38] cgroup1_get_tree+0x9d/0x890 [ 765.081277][ T38] ? apparmor_capable+0x126/0x170 [ 765.081297][ T38] ? bpf_lsm_capable+0x9/0x20 [ 765.081322][ T38] vfs_get_tree+0x92/0x2a0 [ 765.081348][ T38] do_new_mount+0x319/0xdc0 [ 765.081371][ T38] ? __pfx_do_new_mount+0x10/0x10 [ 765.081391][ T38] ? ns_capable+0x89/0xe0 [ 765.081418][ T38] ? path_mount+0x647/0x1040 [ 765.081438][ T38] ? user_path_at+0xd4/0x160 [ 765.081460][ T38] __se_sys_mount+0x31d/0x420 [ 765.081483][ T38] ? __pfx___se_sys_mount+0x10/0x10 [ 765.081507][ T38] ? __x64_[ 765.081507][ T38] ? __x64_sys_mount+0x20/0xc0 [ 765.081524][ T38] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.081543][ T38] do_syscall_64+0x174/0x580 [ 765.081565][ T38] ? trace_irq_disable+0x3b/0x140 [ 765.081587][ T38] ? clear_bhb_loop+0x40/0x90 [ 765.081608][ T38] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.081625][ T38] RIP: 0033:0x7fdf6903de59 [ 765.081640][ T38] RSP: 002b:00007fdf67296028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 765.081657][ T38] RAX: ffffffffffffffda RBX: 00007fdf692c5fa0 RCX: 00007fdf6903de59 [ 765.081672][ T38] RDX: 0000200000000100 RSI: 00002000000000c0 RDI: 0000000000000000 [ 765.081684][ T38] RBP: 00007fdf690d3e6f R08: 0000200000000040 R09: 0000000000000000 [ 765.081696][ T38] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 [ 765.081706][ T38] R13: 00007fdf692c6038 R14: 00007fdf692c5fa0 R15: 00007ffe4c567a88 [ 765.081732][ T38] [ 765.081766][ T38] [ 765.081766][ T38] Showing all locks held in the system: [ 765.081776][ T38] 1 lock held by khungtaskd/38: [ 765.081785][ T38] #0: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 765.081854][ T38] 6 locks held by kworker/u8:2/43: [ 765.081864][ T38] #0: ffff88813fe54138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.081908][ T38] #1: ffffc90000b57c60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.081953][ T38] #2: ffff88803bedc310 (&devlink->lock_key#4){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 [ 765.082041][ T38] #3: ffff888036916520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 [ 765.096404][ T38] #4: ffff8880369164e0 (_T->lock){....}-{2:2}, at: rt_mutex_slowunlock+0xbf/0xa20 [ 765.096582][ T38] #5: ffff8880b863baa0 (&rq->__lock){-...}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 765.096817][ T38] 2 locks held by kworker/u8:12/1495: [ 765.096850][ T38] #0: ffff88803333d938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.097017][ T38] #1: ffffc90006c27c60 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.097273][ T38] 3 locks held by klogd/4968: [ 765.097305][ T38] #0: ffffffff8e0591e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 765.097492][ T38] #1: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 765.097651][ T38] #2: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 765.097800][ T38] 2 locks held by getty/5367: [ 765.097824][ T38] #0: ffff8880333420a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 765.118606][ T38] #1: ffffc90003cbe2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 [ 765.118824][ T38] 4 locks held by syz-executor/5599: [ 765.118858][ T38] #0: ffff888036de5530 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 765.119002][ T38] #1: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 765.119181][ T38] #2: ffff888027312c58 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 765.119329][ T38] #3: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 765.119467][ T38] 11 locks held by kworker/0:3/5694: [ 765.119506][ T38] #0: ffff88803303e538 ((wq_completion)mld){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.119674][ T38] #1: ffffc90004b67c60 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.119873][ T38] #2: ffff88805b870628 (&idev->mc_lock){+.+.}-{4:4}, at: mld_ifc_work+0x2d/0xe70 [ 765.128140][ T38] #3: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: mld_sendpack+0x206/0xe10 [ 765.128336][ T38] #4: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x11e/0x540 [ 765.128486][ T38] #5: ffffffff8e0591e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 765.128665][ T38] #6: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 765.128831][ T38] #7: ffffffff8e1c3120 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x291/0x3890 [ 765.129024][ T38] #8: ffff88803a8aa328 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: __dev_queue_xmit+0x113c/0x3890 [ 765.129195][ T38] #9: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x10c/0x2b0 [ 765.129321][ T38] #10: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 765.129485][ T38] 6 locks held by kworker/u8:23/7968: [ 765.129530][ T38] #0: ffff88801bae6138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.149775][ T38] #1: ffffc90004627c60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.149933][ T38] #2: ffffffff8f58ccc0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 [ 765.150082][ T38] #3: ffff88803446a160 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x420 [ 765.150372][ T38] #4: ffff88803bf0c310 (&devlink->lock_key#8){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x142/0x420 [ 765.150950][ T38] #5: ffffffff8f59bff8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0 [ 765.151088][ T38] 5 locks held by kworker/1:8/8343: [ 765.151102][ T38] #0: ffff88801afcd538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.151342][ T38] #1: ffffc90005047c60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.160430][ T38] #2: ffff88802a878210 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4cf0 [ 765.160623][ T38] #3: ffffffff8f944538 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x281/0x560 [ 765.160675][ T38] #4: ffff88801e2a3858 (&n->list_lock){+.+.}-{3:3}, at: __refill_objects_node+0x89/0x5b0 [ 765.160739][ T38] 8 locks held by kworker/u8:28/11723: [ 765.160751][ T38] #0: ffff88813fe54138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.160808][ T38] #1: ffffc90006657c60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.160866][ T38] #2: ffff88805c200310 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 [ 765.160928][ T38] #3: ffff8880336d0d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 [ 765.160988][ T38] #4: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 765.161031][ T38] #5: ffffffff8e0591e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 765.161082][ T38] #6: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 765.161133][ T38] #7: ffff88805c2007a8 (&nsim_dev->fa_cookie_lock){+...}-{3:3}, at: nsim_dev_trap_report_work+0x7b4/0xcb0 [ 765.161198][ T38] 6 locks held by kworker/u8:30/11726: [ 765.161209][ T38] #0: ffff88813fe54138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.161260][ T38] #1: ffffc90006d27c60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.161323][ T38] #2: ffff88805fe8e310 (&devlink->lock_key#10){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 [ 765.161390][ T38] #3: ffff888047105920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 [ 765.161445][ T38] #4: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 765.161495][ T38] #5: ffff8880b8636e90 ((crngs.lock)){+.+.}-{3:3}, at: crng_make_state+0x158/0x5d0 [ 765.161672][ T38] 3 locks held by kworker/u8:37/11735: [ 765.161684][ T38] #0: ffff888032d66938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.161740][ T38] #1: ffffc90007737c60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.161805][ T38] #2: ffffffff8f59bff8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x123/0x16e0 [ 765.169191][ T38] 4 locks held by kworker/u8:39/11737: [ 765.169233][ T38] #0: ffff88803333d938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.169404][ T38] #1: ffffc90007757c60 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 765.169570][ T38] #2: ffffffff8e0591e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 765.169748][ T38] #3: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 765.169960][ T38] 1 lock held by syz.2.2594/13769: [ 765.169992][ T38] #0: ffff8880378780d0 (&type->s_umount_key#45){++++}-{4:4}, at: path_mount+0xd04/0x1040 [ 765.170169][ T38] 1 lock held by syz-executor/15112: [ 765.170203][ T38] #0: ffffffff8f59bff8 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x65e/0xdf0 [ 765.170360][ T38] 1 lock held by syz-executor/15114: [ 765.170392][ T38] #0: ffffffff8f59bff8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 [ 765.212356][ T38] 11 locks held by syz-executor/15134: [ 765.212398][ T38] #0: ffff888036cdc500 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 765.212568][ T38] #1: ffff88805abd3078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 765.212740][ T38] #2: ffff888029d76f08 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 765.212917][ T38] #3: ffffffff8ee10bd8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 765.213065][ T38] #4: ffff88805bd43160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 765.213241][ T38] #5: ffff88803ac84310 (&devlink->lock_key){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 [ 765.213389][ T38] #6: ffffffff8f59bff8 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x16b/0x800 [ 765.213545][ T38] #7: ffff888040a39070 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x5bb/0x2120 [ 765.225606][ T38] #8: ffffffff8e0591e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 765.225820][ T38] #9: ffffffff8e1c30c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 765.225985][ T38] #10: ffff88805c306328 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{3:3}, at: dev_reset_queue+0x144/0x1f0 [ 765.226142][ T38] 2 locks held by sed/15309: [ 765.226196][ T38] #0: ffff888038a991b0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1e0/0x4e0 [ 765.226362][ T38] #1: ffffffff8e2ee3c0 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_noprof+0x5c/0x680 [ 765.226510][ T38] [ 765.226532][ T38] ============================================= [ 765.226532][ T38] [ 765.226556][ T38] NMI backtrace for cpu 0 [ 765.226607][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 765.226693][ T38] Tainted: [L]=SOFTLOCKUP [ 765.226715][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 765.226754][ T38] Call Trace: [ 765.226777][ T38] [ 765.226799][ T38] dump_stack_lvl+0xe8/0x150 [ 765.226873][ T38] nmi_cpu_backtrace+0x274/0x2d0 [ 765.226945][ T38] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 765.227113][ T38] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 765.227194][ T38] sys_info+0x135/0x170 [ 765.227280][ T38] watchdog+0xfd7/0x1030 [ 765.227383][ T38] ? watchdog+0x1c7/0x1030 [ 765.227468][ T38] kthread+0x388/0x470 [ 765.227495][ T38] ? __pfx_watchdog+0x10/0x10 [ 765.227555][ T38] ? __pfx_kthread+0x10/0x10 [ 765.227646][ T38] ret_from_fork+0x514/0xb70 [ 765.227715][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 765.227810][ T38] ? __switch_to+0xc89/0x1420 [ 765.227881][ T38] ? __pfx_kthread+0x10/0x10 [ 765.227954][ T38] ret_from_fork_asm+0x1a/0x30 [ 765.228061][ T38] [ 765.228143][ T38] Sending NMI from CPU 0 to CPUs 1: [ 765.228209][ C1] NMI backtrace for cpu 1 [ 765.228227][ C1] CPU: 1 UID: 0 PID: 17 Comm: pr/legacy Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 765.228254][ C1] Tainted: [L]=SOFTLOCKUP [ 765.228261][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 765.228273][ C1] RIP: 0010:io_serial_in+0x77/0xc0 [ 765.228348][ C1] Code: e8 0e ae 77 fc 44 89 f9 d3 e3 49 83 ee 80 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 ef 8a e3 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f e9 ca f3 f0 05 cc 44 89 f9 80 e1 07 [ 765.228365][ C1] RSP: 0018:ffffc90000167a28 EFLAGS: 00000202 [ 765.228382][ C1] RAX: 1ffffffff33c0d00 RBX: 00000000000003fd RCX: 0000000000000000 [ 765.228396][ C1] RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000000 [ 765.228407][ C1] RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000 [ 765.228421][ C1] R10: dffffc0000000000 R11: ffffffff854d8a90 R12: dffffc0000000000 [ 765.228436][ C1] R13: 0000000000000000 R14: ffffffff99e06da0 R15: 0000000000000000 [ 765.228449][ C1] FS: 0000000000000000(0000) GS:ffff888125d85000(0000) knlGS:0000000000000000 [ 765.228465][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 765.228479][ C1] CR2: 00007f7d0e517e20 CR3: 0000000041bb2000 CR4: 00000000003526f0 [ 765.228496][ C1] Call Trace: [ 765.228504][ C1] [ 765.228513][ C1] wait_for_lsr+0x190/0x300 [ 765.228542][ C1] serial8250_console_write+0x113a/0x1b40 [ 765.228575][ C1] ? __pfx_serial8250_console_write+0x10/0x10 [ 765.228602][ C1] ? console_flush_one_record+0xfa/0xb50 [ 765.228661][ C1] ? console_flush_one_record+0x472/0xb50 [ 765.228689][ C1] console_flush_one_record+0x642/0xb50 [ 765.228715][ C1] ? console_flush_one_record+0xfa/0xb50 [ 765.228742][ C1] ? __pfx_console_flush_one_record+0x10/0x10 [ 765.228767][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 765.228796][ C1] legacy_kthread_func+0x1b6/0x250 [ 765.228821][ C1] ? __pfx_legacy_kthread_func+0x10/0x10 [ 765.228845][ C1] ? __pfx_autoremove_wake_function+0x10/0x10 [ 765.228869][ C1] ? __kthread_parkme+0x71/0x1f0 [ 765.228887][ C1] ? __kthread_parkme+0x196/0x1f0 [ 765.228908][ C1] kthread+0x388/0x470 [ 765.228930][ C1] ? __pfx_legacy_kthread_func+0x10/0x10 [ 765.228952][ C1] ? __pfx_kthread+0x10/0x10 [ 765.228977][ C1] ret_from_fork+0x514/0xb70 [ 765.229001][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 765.229023][ C1] ? __switch_to+0xc89/0x1420 [ 765.229042][ C1] ? __pfx_kthread+0x10/0x10 [ 765.229064][ C1] ret_from_fork_asm+0x1a/0x30 [ 765.229096][ C1] [ 765.246308][ T38] Kernel panic - not syncing: hung_task: blocked tasks [ 765.246374][ T38] CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 765.246456][ T38] Tainted: [L]=SOFTLOCKUP [ 765.246479][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 765.246519][ T38] Call Trace: [ 765.246543][ T38] [ 765.246573][ T38] vpanic+0x56c/0xa60 [ 765.246681][ T38] ? __pfx___schedule+0x10/0x10 [ 765.246762][ T38] ? __pfx_vpanic+0x10/0x10 [ 765.246869][ T38] panic+0xc5/0xd0 [ 765.246945][ T38] ? __pfx_panic+0x10/0x10 [ 765.247029][ T38] ? preempt_schedule_common+0x82/0xd0 [ 765.247057][ T38] ? preempt_schedule_thunk+0x16/0x40 [ 765.247159][ T38] ? nmi_trigger_cpumask_backtrace+0x314/0x380 [ 765.247246][ T38] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 765.247320][ T38] watchdog+0x1030/0x1030 [ 765.247413][ T38] ? watchdog+0x1c7/0x1030 [ 765.247498][ T38] kthread+0x388/0x470 [ 765.247563][ T38] ? __pfx_watchdog+0x10/0x10 [ 765.247634][ T38] ? __pfx_kthread+0x10/0x10 [ 765.247703][ T38] ret_from_fork+0x514/0xb70 [ 765.247784][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 765.247856][ T38] ? __switch_to+0xc89/0x1420 [ 765.247924][ T38] ? __pfx_kthread+0x10/0x10 [ 765.247997][ T38] ret_from_fork_asm+0x1a/0x30 [ 765.248111][ T38] [ 765.248742][ T38] Kernel Offset: disabled