last executing test programs: 2m43.140701827s ago: executing program 0 (id=354): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000300)="3e0000000b000100000000000003400000", 0x11) 2m41.764425555s ago: executing program 0 (id=358): socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000240)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) semtimedop(0x0, 0x0, 0x0, 0x0) msgget$private(0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) ioctl$SIOCSIFHWADDR(r4, 0x8914, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) 2m40.497780488s ago: executing program 0 (id=359): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000404c05f20dafd60000000109022400010000000009040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="000657"], 0x0, 0x0, 0x0, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) 2m34.252237134s ago: executing program 0 (id=378): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000440)={{r1, &(0x7f00000000c0)='/dev/sg#\x00', 0x201, 0x0, 0xfffffff8, 0x0, 0x0}, {[0xd, 0x80000000, 0xa, 0x6]}, 0x1c7, 0x0, 0x0}) connect$can_bcm(r2, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x2000000, @loopback}, 0x1c) accept(r0, 0x0, 0x0) 2m32.278221296s ago: executing program 0 (id=385): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xb, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x7313}, [@printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 2m32.194120615s ago: executing program 0 (id=386): r0 = socket$packet(0x11, 0x3, 0x300) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = accept$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000280)={0x30, 0x7, 0x6, 0x201, 0x0, 0x0, {0x3, 0x0, 0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x7}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r6, &(0x7f000001a240)=""/102400, 0x19000, 0x1000000000) ioctl$UI_SET_EVBIT(r6, 0x40045564, 0x1a) bind$packet(r6, &(0x7f0000000180)={0x11, 0x8, r2, 0x1, 0x9, 0x6, @local}, 0x14) fcntl$dupfd(r5, 0x406, r5) sendto$inet(r5, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) unshare(0x8000000) semget$private(0x0, 0x4000, 0x555) semtimedop(0x0, &(0x7f0000000000)=[{0x3, 0x1000, 0x1800}], 0x1, 0x0) r7 = syz_open_dev$ndb(&(0x7f0000000240), 0x0, 0x22180) ioctl$NBD_DISCONNECT(r7, 0xab08) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r0, &(0x7f00000007c0)="ffffffff0b000211223344550806000108000604000242054305123400000000ff43058a9afe00000000", 0x2a, 0x24048010, &(0x7f0000000200)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @broadcast}, 0x14) 2m16.9983073s ago: executing program 32 (id=386): r0 = socket$packet(0x11, 0x3, 0x300) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = accept$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000280)={0x30, 0x7, 0x6, 0x201, 0x0, 0x0, {0x3, 0x0, 0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x7}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r6, &(0x7f000001a240)=""/102400, 0x19000, 0x1000000000) ioctl$UI_SET_EVBIT(r6, 0x40045564, 0x1a) bind$packet(r6, &(0x7f0000000180)={0x11, 0x8, r2, 0x1, 0x9, 0x6, @local}, 0x14) fcntl$dupfd(r5, 0x406, r5) sendto$inet(r5, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) unshare(0x8000000) semget$private(0x0, 0x4000, 0x555) semtimedop(0x0, &(0x7f0000000000)=[{0x3, 0x1000, 0x1800}], 0x1, 0x0) r7 = syz_open_dev$ndb(&(0x7f0000000240), 0x0, 0x22180) ioctl$NBD_DISCONNECT(r7, 0xab08) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r0, &(0x7f00000007c0)="ffffffff0b000211223344550806000108000604000242054305123400000000ff43058a9afe00000000", 0x2a, 0x24048010, &(0x7f0000000200)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @broadcast}, 0x14) 19.127829362s ago: executing program 4 (id=605): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) socket$tipc(0x1e, 0x2, 0x0) syz_open_dev$media(&(0x7f0000000380), 0x13, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x101900, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x170bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe5, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0xfffd}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000080)) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) r11 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/stat\x00', 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x11, r11, 0x0) r12 = socket$alg(0x26, 0x5, 0x0) bind$alg(r12, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x18}, 0x1, 0x0, 0x0, 0x4010}, 0x0) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdc1, 0x400, 0x2100, 0x10000004, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc7e, 0x4, 0xfffffffe, 0xae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x0, 0x1f0, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x40, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000000)={{0x100}, 'syz1\x00', 0x19}) 15.664666084s ago: executing program 2 (id=608): socket$inet_sctp(0x2, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r0, 0x1e, &(0x7f0000000040)=0x6) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@const={0x0, 0x0, 0x0, 0x2, 0x1}]}}, 0x0, 0x26}, 0x28) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, 0x0, 0x0) 13.860356322s ago: executing program 4 (id=611): mount(0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) dup3(0xffffffffffffffff, r2, 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r3, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 11.920951786s ago: executing program 4 (id=613): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x8, &(0x7f00000002c0)=0x80000000000003) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1c, 0x7, 0x8, 0x8, 0x45}, 0x50) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000000)={0x11, @broadcast, 0x800, 0x3, 'lc\x00', 0x2, 0x7ff, 0x3e}, 0x2c) getsockopt$IP_VS_SO_GET_SERVICE(r3, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000180)=0x68) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x88b02, 0x0) write$P9_RSTATu(r4, &(0x7f0000000340)={0x230, 0x7d, 0x0, {{0x500, 0xef, 0x3, 0x0, {0x0, 0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x1b, '\x04nodev{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1', 0x14, '\xcf\xc2m\xd7\xc5\x00\xf0L\xd8_*p\xf5\xe9\x93\x0e<]\xb4Z', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xe2\x89\xdad\x9a7\x00'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300, 0xee00}}, 0x230) 11.90163763s ago: executing program 1 (id=614): socket$rds(0x15, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000240)='2', 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000001380)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="110025bd7000ffdbdf258200000008000300", @ANYRES32=r2, @ANYBLOB="11a618d2e891dc211fcbd63613b406000000000000005769dec77549b34c927eeb38afeb7957e88ed2ceaf57648af5bb8003f157d5e5122e3fac0717bf8b6016ad62e91bdbc1456148b202a9d9b45bf168568862"], 0x1c}, 0x1, 0x0, 0x0, 0x404c0c4}, 0x800) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r3 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x69ee, 0xc00, 0x5, 0x50}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, r8, 0x0) syz_ublk_setup_queues(r3, 0x0, 0x0, &(0x7f0000019180)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2067, 0x8000, 0x1, 0x17, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xce5e, 0x10, 0x2, 0x2c4, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xecae, 0x200, 0x3, 0x11e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcdf8, 0x800, 0x0, 0x3be, 0x0, r3}}], 0x4, 0x0, &(0x7f000001a480)) r9 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r10 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r10, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r9, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r9, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0x7, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r9, &(0x7f0000007fc0), 0x800001d, 0x1c) 10.714576306s ago: executing program 2 (id=616): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000e00)=ANY=[@ANYBLOB="02098e0502"], 0x10}}, 0x0) 10.5288518s ago: executing program 3 (id=618): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f00000002c0)=0x80000000000003) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1c, 0x7, 0x8, 0x8, 0x45}, 0x50) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000000)={0x11, @broadcast, 0x800, 0x3, 'lc\x00', 0x2, 0x7ff, 0x3e}, 0x2c) getsockopt$IP_VS_SO_GET_SERVICE(r4, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000180)=0x68) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x88b02, 0x0) write$P9_RSTATu(r5, &(0x7f0000000340)={0x230, 0x7d, 0x0, {{0x500, 0xef, 0x3, 0x0, {0x0, 0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x1b, '\x04nodev{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1', 0x14, '\xcf\xc2m\xd7\xc5\x00\xf0L\xd8_*p\xf5\xe9\x93\x0e<]\xb4Z', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xe2\x89\xdad\x9a7\x00'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300, 0xee00}}, 0x230) 9.682466424s ago: executing program 3 (id=619): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48004}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r3, {0xc, 0x10}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 9.580422553s ago: executing program 2 (id=620): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x8, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x132, 0xffffffffffffffff, 0xffffd000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x8) write(r1, &(0x7f0000000000)='3', 0x4e) 9.448684587s ago: executing program 2 (id=621): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x3, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r4, 0x6, 0x21, &(0x7f0000000000)="b2e8d43f4aaacffdcb6f1a4216bb2d7b", 0x10) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r4, 0x6, 0x21, &(0x7f0000000100)="00ebffffff00", 0x10) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x18) 8.192703146s ago: executing program 2 (id=622): mount(0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) dup3(0xffffffffffffffff, r2, 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r3, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 7.312308556s ago: executing program 4 (id=623): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r4, &(0x7f0000000f80)={'syz0\x00', {0x5, 0xfff7, 0x4, 0x8}, 0x50, [0x800006, 0x9, 0x0, 0x1, 0x8, 0x80ea45, 0x800000e, 0x1, 0x63, 0xffffffff, 0x7f, 0xc, 0x4, 0x9, 0x1, 0x4, 0x8001080, 0x80000002, 0x1, 0x200008, 0x40, 0xa4d, 0x3ff, 0x40000005, 0x6, 0x10001, 0xffff, 0x0, 0x4, 0x6, 0x401, 0x100, 0x9, 0x4, 0x2, 0x0, 0x2, 0x4, 0x1, 0x4, 0xa, 0x6, 0x3, 0x5ff, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x8, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x80000001, 0xd77, 0x5, 0x2a, 0x1, 0x23], [0x8, 0x401, 0x9, 0x9, 0x8, 0x12, 0x7fc, 0xc, 0x0, 0x2729, 0xfd8, 0x3, 0x7, 0x7, 0x0, 0xd8, 0x2, 0xfffffff7, 0x2, 0x3, 0x5, 0x4009, 0x401, 0xb, 0xfffffff8, 0x9, 0xa1, 0x10000, 0xffffffff, 0x5, 0x10004, 0x9e, 0x2, 0xae3, 0x6, 0x7, 0xfffffffd, 0x9, 0xffff3f16, 0xa, 0x0, 0x9, 0xa, 0x5, 0xfffffeff, 0x9, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x3, 0xfffe7ff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x8, 0x6, 0x6, 0x200007, 0x8], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x3, 0xc, 0x2, 0x5, 0x7aae, 0x80000000, 0x2, 0x7ffffff7, 0x7ffe, 0x1, 0x1, 0x5, 0x400, 0x80000002, 0x2b0, 0xfffffff4, 0x97f82544, 0x8, 0xfffffffd, 0x0, 0x1, 0x5, 0x4, 0x9, 0xc90, 0xffffff3c, 0xd, 0x13, 0x4, 0x8, 0x1, 0x4, 0x2, 0x1000000c, 0x0, 0x2, 0x3, 0x8007c12, 0x5, 0x1, 0x17, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x1, 0xffffff00, 0x100, 0x1fff80, 0x5, 0x0, 0xc, 0xdd, 0x1, 0x1400, 0xc3, 0x20ffff, 0x79c], [0x9, 0x3a8e, 0xffff9a7f, 0x200, 0x6, 0x2001, 0x6, 0xfffffff3, 0xd077, 0x2, 0xf, 0x21, 0x200, 0xa, 0x6, 0x2, 0x1ff, 0xfe, 0x2, 0x66608000, 0x5e82, 0x7fb, 0x6, 0x0, 0x3, 0x5, 0x80000001, 0xffff, 0xd, 0x40, 0xfffffffd, 0x3, 0x10001, 0x8000, 0x10, 0x1002, 0xc, 0x104, 0x8, 0x20000000, 0x8, 0x9, 0xb32a, 0xec000000, 0x8001, 0x1900, 0x4, 0xc, 0x40, 0x7ff, 0x280, 0x5, 0xffffffff, 0x7, 0x6e79, 0x0, 0xc, 0x9371, 0x4f89, 0x7, 0xf, 0x2d1, 0x83, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) openat$cachefiles(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) 7.29094362s ago: executing program 2 (id=624): socket$inet_sctp(0x2, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r0, 0x1e, &(0x7f0000000040)=0x6) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@const={0x0, 0x0, 0x0, 0x2, 0x1}]}}, 0x0, 0x26}, 0x28) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 4.571387256s ago: executing program 4 (id=625): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000100)=ANY=[@ANYBLOB="20c81e0000004d61501d01000000000000001000fcffffff7f0700000000000038"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.289843157s ago: executing program 1 (id=626): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/uprobe_events\x00', 0x2, 0x0) write(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x4000004897}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socketpair$unix(0x1, 0x3, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000000c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000280)='\\\':\x00') r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0xc0803, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS(r3, 0x4b72, &(0x7f0000000080)={0x5, 0x7d, 0x8, 0xffffffff, 0xe, "00602100000000f60000000000000000000800"}) openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$nbd(r5, 0x0, 0x40) connect$vsock_stream(r2, &(0x7f0000000380)={0x28, 0x0, 0x2711, @hyper}, 0x10) setrlimit(0x0, &(0x7f0000000040)={0x6, 0x9}) bind$inet(r2, &(0x7f00000028c0)={0x2, 0x4e20, @multicast2}, 0x10) 3.816151304s ago: executing program 3 (id=627): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x8, &(0x7f00000002c0)=0x80000000000003) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1c, 0x7, 0x8, 0x8, 0x45}, 0x50) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000000)={0x11, @broadcast, 0x800, 0x3, 'lc\x00', 0x2, 0x7ff, 0x3e}, 0x2c) getsockopt$IP_VS_SO_GET_SERVICE(r3, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000180)=0x68) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x88b02, 0x0) write$P9_RSTATu(r4, &(0x7f0000000340)={0x230, 0x7d, 0x0, {{0x500, 0xef, 0x3, 0x0, {0x0, 0x0, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x1b, '\x04nodev{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1', 0x14, '\xcf\xc2m\xd7\xc5\x00\xf0L\xd8_*p\xf5\xe9\x93\x0e<]\xb4Z', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xe2\x89\xdad\x9a7\x00'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300, 0xee00}}, 0x230) 2.946158712s ago: executing program 1 (id=628): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x5, &(0x7f0000000540)=ANY=[@ANYRES8=r0], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fffffff}, 0x94) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/kernel/mm/ksm/pages_to_scan\x00', 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r4) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0x74) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r7, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) 2.631641s ago: executing program 1 (id=629): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x8, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x132, 0xffffffffffffffff, 0xffffd000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x8) write(r1, &(0x7f0000000000)='3', 0x4e) 2.044370527s ago: executing program 1 (id=630): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1c00000000000000000000000700000044"], 0x38}, 0x140) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffffffffffffc6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.947222994s ago: executing program 3 (id=631): fcntl$notify(0xffffffffffffffff, 0x402, 0x80000037) syz_open_procfs(0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000000000002}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) sendmmsg$inet6(r0, &(0x7f0000000a80)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4d7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}, 0x1c, &(0x7f0000000900)=[{&(0x7f0000000400)="fc", 0x1}], 0x1}}], 0x1, 0x4c040) 1.577387172s ago: executing program 3 (id=632): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) getrlimit(0xb, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x62f82, 0x0) mkdir(0x0, 0x1ff) mkdir(0x0, 0x1ff) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) recvmmsg(r5, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x2, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x48, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYRESDEC=0x0], 0x50}, 0x1, 0x0, 0x0, 0x20048040}, 0x400c004) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a1b000000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x48000) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x11, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000040000000000000a20000000000a0300"], 0x122}}, 0x0) ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000012c0)=ANY=[@ANYBLOB="9feb01070000000000000000100000001000000007000000050000000000000e0300000000005f000000"], 0x0, 0x2f, 0x0, 0x2}, 0x28) sendmsg$unix(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="140000"], 0x18}, 0x0) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[@ANYRESDEC=r3], 0xff70) ioctl$TCXONC(r0, 0x540a, 0x2) ioctl$TCXONC(r0, 0x540a, 0x3) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) 164.50975ms ago: executing program 4 (id=633): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) write(r0, &(0x7f0000000000)='6', 0x32) fsopen(&(0x7f0000000180)='gfs2meta\x00', 0x0) 14.909687ms ago: executing program 3 (id=634): socket(0x80000000000000a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x5c}}, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x401, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xee) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, &(0x7f0000000000)) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4000810}, 0x4008804) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_open_dev$dri(&(0x7f0000000140), 0x4, 0x400) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000001080)={&(0x7f0000000f80)=[0x0, 0x0], &(0x7f0000000fc0)=[0x0], &(0x7f0000000280)=[0x0], &(0x7f0000001040), 0x2, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r8, 0xc05064a7, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c0000002500090122bd7008f9ffffff0200000008003f8004002280080003004700000008003e00", @ANYRES32, @ANYBLOB], 0x2c}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0x340, 0x340, 0x0, 0x340, 0x270, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [0x0, 0x0, 0xff000000], [], 'tunl0\x00', 'bridge_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x270}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) syz_open_dev$evdev(0x0, 0x4, 0x40a200) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) socket$netlink(0x10, 0x3, 0x0) socket(0x200000000000011, 0x2, 0x0) 0s ago: executing program 1 (id=635): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r4, &(0x7f0000000f80)={'syz0\x00', {0x5, 0xfff7, 0x4, 0x8}, 0x50, [0x800006, 0x9, 0x0, 0x1, 0x8, 0x80ea45, 0x800000e, 0x1, 0x63, 0xffffffff, 0x7f, 0xc, 0x4, 0x9, 0x1, 0x4, 0x8001080, 0x80000002, 0x1, 0x200008, 0x40, 0xa4d, 0x3ff, 0x40000005, 0x6, 0x10001, 0xffff, 0x0, 0x4, 0x6, 0x401, 0x100, 0x9, 0x4, 0x2, 0x0, 0x2, 0x4, 0x1, 0x4, 0xa, 0x6, 0x3, 0x5ff, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x8, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x80000001, 0xd77, 0x5, 0x2a, 0x1, 0x23], [0x8, 0x401, 0x9, 0x9, 0x8, 0x12, 0x7fc, 0xc, 0x0, 0x2729, 0xfd8, 0x3, 0x7, 0x7, 0x0, 0xd8, 0x2, 0xfffffff7, 0x2, 0x3, 0x5, 0x4009, 0x401, 0xb, 0xfffffff8, 0x9, 0xa1, 0x10000, 0xffffffff, 0x5, 0x10004, 0x9e, 0x2, 0xae3, 0x6, 0x7, 0xfffffffd, 0x9, 0xffff3f16, 0xa, 0x0, 0x9, 0xa, 0x5, 0xfffffeff, 0x9, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x3, 0xfffe7ff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x8, 0x6, 0x6, 0x200007, 0x8], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x3, 0xc, 0x2, 0x5, 0x7aae, 0x80000000, 0x2, 0x7ffffff7, 0x7ffe, 0x1, 0x1, 0x5, 0x400, 0x80000002, 0x2b0, 0xfffffff4, 0x97f82544, 0x8, 0xfffffffd, 0x0, 0x1, 0x5, 0x4, 0x9, 0xc90, 0xffffff3c, 0xd, 0x13, 0x4, 0x8, 0x1, 0x4, 0x2, 0x1000000c, 0x0, 0x2, 0x3, 0x8007c12, 0x5, 0x1, 0x17, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x1, 0xffffff00, 0x100, 0x1fff80, 0x5, 0x0, 0xc, 0xdd, 0x1, 0x1400, 0xc3, 0x20ffff, 0x79c], [0x9, 0x3a8e, 0xffff9a7f, 0x200, 0x6, 0x2001, 0x6, 0xfffffff3, 0xd077, 0x2, 0xf, 0x21, 0x200, 0xa, 0x6, 0x2, 0x1ff, 0xfe, 0x2, 0x66608000, 0x5e82, 0x7fb, 0x6, 0x0, 0x3, 0x5, 0x80000001, 0xffff, 0xd, 0x40, 0xfffffffd, 0x3, 0x10001, 0x8000, 0x10, 0x1002, 0xc, 0x104, 0x8, 0x20000000, 0x8, 0x9, 0xb32a, 0xec000000, 0x8001, 0x1900, 0x4, 0xc, 0x40, 0x7ff, 0x280, 0x5, 0xffffffff, 0x7, 0x6e79, 0x0, 0xc, 0x9371, 0x4f89, 0x7, 0xf, 0x2d1, 0x83, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.37' (ED25519) to the list of known hosts. [ 63.336382][ T5759] cgroup: Unknown subsys name 'net' [ 63.500070][ T5759] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 64.883774][ T5759] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 66.350072][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 66.360022][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 66.368293][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 66.376418][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 66.385081][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 66.393128][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 66.401530][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 66.409009][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 66.417757][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 66.420230][ T5784] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 66.425756][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 66.440389][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 66.447932][ T5786] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 66.454974][ T5783] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 66.455563][ T5783] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 66.463449][ T5786] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 66.470134][ T5783] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 66.483169][ T5785] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 66.485414][ T5783] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 66.504478][ T5785] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 66.514760][ T5089] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 66.525570][ T5786] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 66.532931][ T5089] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 66.540731][ T5089] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 66.894420][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 66.990913][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 67.008544][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.017202][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.024977][ T5774] bridge_slave_0: entered allmulticast mode [ 67.032363][ T5774] bridge_slave_0: entered promiscuous mode [ 67.066686][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.073821][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.081540][ T5774] bridge_slave_1: entered allmulticast mode [ 67.088378][ T5774] bridge_slave_1: entered promiscuous mode [ 67.138722][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 67.160513][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.201619][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.263589][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.271573][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.279561][ T5773] bridge_slave_0: entered allmulticast mode [ 67.286696][ T5773] bridge_slave_0: entered promiscuous mode [ 67.294233][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.301420][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.308725][ T5773] bridge_slave_1: entered allmulticast mode [ 67.316193][ T5773] bridge_slave_1: entered promiscuous mode [ 67.325529][ T5774] team0: Port device team_slave_0 added [ 67.347379][ T5774] team0: Port device team_slave_1 added [ 67.380421][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.392343][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.401895][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 67.467911][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.475103][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.482217][ T5772] bridge_slave_0: entered allmulticast mode [ 67.491572][ T5772] bridge_slave_0: entered promiscuous mode [ 67.499433][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.506976][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.514409][ T5772] bridge_slave_1: entered allmulticast mode [ 67.521088][ T5772] bridge_slave_1: entered promiscuous mode [ 67.528662][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.535820][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.561817][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.581937][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.589088][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.615378][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.629472][ T5773] team0: Port device team_slave_0 added [ 67.683445][ T5773] team0: Port device team_slave_1 added [ 67.707890][ T5774] hsr_slave_0: entered promiscuous mode [ 67.714801][ T5774] hsr_slave_1: entered promiscuous mode [ 67.733726][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.770753][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.798261][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.805416][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.831864][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.869553][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.876841][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.884300][ T5775] bridge_slave_0: entered allmulticast mode [ 67.890999][ T5775] bridge_slave_0: entered promiscuous mode [ 67.907312][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.914337][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.940704][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.969756][ T5772] team0: Port device team_slave_0 added [ 67.980086][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.989247][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.996872][ T5775] bridge_slave_1: entered allmulticast mode [ 68.003550][ T5775] bridge_slave_1: entered promiscuous mode [ 68.030049][ T5772] team0: Port device team_slave_1 added [ 68.068521][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.106641][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.113629][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.139961][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.152815][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.191726][ T5773] hsr_slave_0: entered promiscuous mode [ 68.199025][ T5773] hsr_slave_1: entered promiscuous mode [ 68.205389][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 68.213251][ T5773] Cannot create hsr debugfs directory [ 68.219864][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.227035][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.253060][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.282647][ T5775] team0: Port device team_slave_0 added [ 68.320324][ T5775] team0: Port device team_slave_1 added [ 68.356640][ T5772] hsr_slave_0: entered promiscuous mode [ 68.363308][ T5772] hsr_slave_1: entered promiscuous mode [ 68.370614][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 68.378347][ T5772] Cannot create hsr debugfs directory [ 68.400769][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.408087][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.436520][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.487539][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.497007][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 68.523063][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.535095][ T5089] Bluetooth: hci0: command tx timeout [ 68.540799][ T5089] Bluetooth: hci1: command tx timeout [ 68.586142][ T5775] hsr_slave_0: entered promiscuous mode [ 68.593037][ T5775] hsr_slave_1: entered promiscuous mode [ 68.599719][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 68.607385][ T5775] Cannot create hsr debugfs directory [ 68.624426][ T5781] Bluetooth: hci2: command tx timeout [ 68.630152][ T5781] Bluetooth: hci3: command tx timeout [ 68.807437][ T5774] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 68.820853][ T5774] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 68.858145][ T5774] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 68.868773][ T5774] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 68.978505][ T5773] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 69.000700][ T5773] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 69.019632][ T5773] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 69.029996][ T5773] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 69.095891][ T5775] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 69.135089][ T5775] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 69.155821][ T5775] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 69.168183][ T5775] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 69.199633][ T5772] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 69.213810][ T5772] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 69.225595][ T5772] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 69.244173][ T5772] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 69.282358][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.316766][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.340971][ T2955] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.348274][ T2955] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.382169][ T2955] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.389383][ T2955] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.507574][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.536961][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.586098][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.600953][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.611091][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.627878][ T1073] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.635094][ T1073] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.679743][ T1073] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.686985][ T1073] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.702940][ T1073] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.710178][ T1073] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.729824][ T1073] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.737032][ T1073] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.757364][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.792559][ T1073] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.799695][ T1073] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.829107][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.841558][ T1073] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.848775][ T1073] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.925634][ T5773] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 70.069360][ T5774] veth0_vlan: entered promiscuous mode [ 70.116396][ T5774] veth1_vlan: entered promiscuous mode [ 70.187057][ T5774] veth0_macvtap: entered promiscuous mode [ 70.217592][ T5774] veth1_macvtap: entered promiscuous mode [ 70.293002][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.318955][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.347475][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.363024][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.386327][ T5774] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.399417][ T5774] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.409775][ T5774] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.419221][ T5774] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.495581][ T5773] veth0_vlan: entered promiscuous mode [ 70.515134][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.529634][ T5773] veth1_vlan: entered promiscuous mode [ 70.571269][ T5775] veth0_vlan: entered promiscuous mode [ 70.614627][ T5781] Bluetooth: hci1: command tx timeout [ 70.614972][ T5089] Bluetooth: hci0: command tx timeout [ 70.643373][ T5775] veth1_vlan: entered promiscuous mode [ 70.660110][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.660261][ T5773] veth0_macvtap: entered promiscuous mode [ 70.682382][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.694990][ T5089] Bluetooth: hci2: command tx timeout [ 70.706538][ T5089] Bluetooth: hci3: command tx timeout [ 70.722393][ T5773] veth1_macvtap: entered promiscuous mode [ 70.741893][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.753264][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.765086][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.812004][ T5775] veth0_macvtap: entered promiscuous mode [ 70.820182][ T5772] veth0_vlan: entered promiscuous mode [ 70.826810][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.838026][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.851321][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.863173][ T3432] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.869258][ T5772] veth1_vlan: entered promiscuous mode [ 70.876689][ T3432] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.897497][ T5775] veth1_macvtap: entered promiscuous mode [ 70.912415][ T5773] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.921482][ T5773] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.930744][ T5773] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.941779][ T5773] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.039642][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.066847][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.077942][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.088758][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.101530][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.356497][ T5832] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.364727][ T5832] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.579410][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.589105][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.688629][ T5832] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 71.723647][ T5832] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 72.039470][ T5832] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.048481][ T5832] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.059089][ T5832] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.068737][ T5832] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 72.171259][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.191590][ T5832] syz.1.2 (5832) used greatest stack depth: 20488 bytes left [ 72.204331][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.232385][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.257967][ T5775] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.268136][ T5775] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.282182][ T5775] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.291068][ T5775] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.358208][ T5772] veth0_macvtap: entered promiscuous mode [ 72.416202][ T1073] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.464643][ T5772] veth1_macvtap: entered promiscuous mode [ 72.473477][ T1073] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.517083][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.526442][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.653044][ T5842] nvme_fcloop: unknown parameter or missing value 'wwnn=' [ 72.694096][ T5089] Bluetooth: hci0: command tx timeout [ 72.699687][ T5089] Bluetooth: hci1: command tx timeout [ 72.777176][ T5089] Bluetooth: hci2: command tx timeout [ 72.783632][ T5781] Bluetooth: hci3: command tx timeout [ 73.121620][ T1073] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.132227][ T2917] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.137757][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.150586][ T1073] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.185134][ T2917] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.199073][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.209385][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.224657][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.273772][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.307490][ T5844] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 73.317904][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.353936][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.363786][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.374545][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.386128][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.426878][ T5772] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.447062][ T5772] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.473693][ T5772] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.491428][ T5772] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.748679][ T2955] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.778838][ T2955] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.853054][ T5853] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4'. [ 73.862687][ T5853] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4'. [ 74.782833][ T5781] Bluetooth: hci1: command tx timeout [ 74.788407][ T5089] Bluetooth: hci0: command tx timeout [ 74.854165][ T5781] Bluetooth: hci3: command tx timeout [ 74.859636][ T5781] Bluetooth: hci2: command tx timeout [ 74.885618][ T5858] binder: 5852:5858 ioctl 80206433 0 returned -22 [ 75.172037][ T3432] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.329575][ T3432] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.628469][ T8] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 75.971671][ T5872] FAULT_INJECTION: forcing a failure. [ 75.971671][ T5872] name fail_futex, interval 1, probability 0, space 0, times 1 [ 75.990478][ T5872] CPU: 1 PID: 5872 Comm: syz.0.10 Not tainted syzkaller #0 [ 75.997738][ T5872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 76.007846][ T5872] Call Trace: [ 76.011143][ T5872] [ 76.014072][ T5872] dump_stack_lvl+0x18c/0x250 [ 76.018810][ T5872] ? show_regs_print_info+0x20/0x20 [ 76.024013][ T5872] ? load_image+0x420/0x420 [ 76.028528][ T5872] should_fail_ex+0x394/0x4c0 [ 76.033215][ T5872] get_futex_key+0x136/0x1030 [ 76.037890][ T5872] ? kasan_save_stack+0x3e/0x60 [ 76.042743][ T5872] ? __se_sys_close+0x15c/0x1e0 [ 76.047597][ T5872] ? futex_setup_timer+0xc0/0xc0 [ 76.052538][ T5872] futex_wake+0x127/0x4f0 [ 76.056872][ T5872] ? futex_wake_mark+0x150/0x150 [ 76.061807][ T5872] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 76.067809][ T5872] do_futex+0x35d/0x3e0 [ 76.071962][ T5872] ? __ia32_sys_get_robust_list+0x110/0x110 [ 76.077851][ T5872] ? slab_free_freelist_hook+0x130/0x1a0 [ 76.083484][ T5872] __se_sys_futex+0x3a9/0x440 [ 76.088163][ T5872] ? __x64_sys_futex+0xf0/0xf0 [ 76.092924][ T5872] ? __x64_sys_futex+0x21/0xf0 [ 76.097690][ T5872] do_syscall_64+0x55/0xb0 [ 76.102111][ T5872] ? clear_bhb_loop+0x40/0x90 [ 76.106799][ T5872] ? clear_bhb_loop+0x40/0x90 [ 76.111491][ T5872] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 76.117389][ T5872] RIP: 0033:0x7fcd88b9e159 [ 76.121825][ T5872] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.141540][ T5872] RSP: 002b:00007fcd89a860e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 76.149972][ T5872] RAX: ffffffffffffffda RBX: 00007fcd88e25fa8 RCX: 00007fcd88b9e159 [ 76.157955][ T5872] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fcd88e25fac [ 76.165941][ T5872] RBP: 00007fcd88e25fa0 R08: 0000000000745b08 R09: 0000000000000000 [ 76.173934][ T5872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.181909][ T5872] R13: 00007fcd88e26038 R14: 00007fffb071c020 R15: 00007fffb071c108 [ 76.189895][ T5872] [ 76.204224][ T8] usb 2-1: Using ep0 maxpacket: 32 [ 76.226562][ T8] usb 2-1: unable to get BOS descriptor or descriptor too short [ 76.237218][ T8] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 76.247117][ T8] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 76.255851][ T8] usb 2-1: config 14 has no interface number 0 [ 76.263436][ T8] usb 2-1: config 14 has no interface number 1 [ 76.305599][ T8] usb 2-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 4, skipping [ 76.329757][ T8] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 76.741476][ T8] usb 2-1: config 14 interface 228 altsetting 5 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 76.909137][ T8] usb 2-1: config 14 interface 57 has no altsetting 0 [ 76.916528][ T8] usb 2-1: config 14 interface 228 has no altsetting 0 [ 78.408087][ T5888] binder: BINDER_SET_CONTEXT_MGR already set [ 78.414328][ T5888] binder: 5886:5888 ioctl 4018620d 200000004a80 returned -16 [ 78.433241][ T8] usb 2-1: string descriptor 0 read error: -71 [ 78.451651][ T8] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 78.583968][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.645956][ T8] usb 2-1: can't set config #14, error -71 [ 78.691415][ T8] usb 2-1: USB disconnect, device number 2 [ 78.724963][ T5898] Bluetooth: MGMT ver 1.22 [ 80.379098][ T5908] Zero length message leads to an empty skb [ 80.621448][ T5908] block nbd1: NBD_DISCONNECT [ 82.408596][ T5928] binder: 5923:5928 ioctl 80206433 0 returned -22 [ 82.694038][ T43] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 83.034119][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 83.121714][ T5942] syz_tun: entered allmulticast mode [ 83.619247][ T43] usb 4-1: unable to get BOS descriptor or descriptor too short [ 83.679524][ T43] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 83.721084][ T43] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 83.878797][ T43] usb 4-1: config 14 has no interface number 0 [ 83.968288][ T43] usb 4-1: config 14 has no interface number 1 [ 84.046460][ T43] usb 4-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 4, skipping [ 84.186916][ T43] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 84.312066][ T43] usb 4-1: config 14 interface 228 altsetting 5 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 84.429715][ T43] usb 4-1: config 14 interface 57 has no altsetting 0 [ 84.475164][ T43] usb 4-1: config 14 interface 228 has no altsetting 0 [ 84.543904][ T43] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 84.587326][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.633976][ T43] usb 4-1: Product: syz [ 84.669939][ T43] usb 4-1: Manufacturer: syz [ 84.714168][ T43] usb 4-1: SerialNumber: syz [ 85.646350][ T5926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 85.711974][ T5926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.103898][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 86.823901][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 87.323813][ T787] cfg80211: failed to load regulatory.db [ 87.393911][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 87.514048][ T23] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 87.531717][ T5962] input: syz0 as /devices/virtual/input/input5 [ 87.554874][ T43] legousbtower 4-1:14.57: interrupt endpoints not found [ 87.634426][ T43] legousbtower 4-1:14.228: interrupt endpoints not found [ 87.685645][ T43] usb 4-1: USB disconnect, device number 2 [ 87.724053][ T23] usb 1-1: Using ep0 maxpacket: 8 [ 87.737094][ T23] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 87.754913][ T23] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 87.764477][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.784202][ T23] usb 1-1: config 0 descriptor?? [ 88.012291][ T5969] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 88.012291][ T5969] The task syz.2.36 (5969) triggered the difference, watch for misbehavior. [ 88.017476][ T23] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 88.441899][ T5972] netlink: 24 bytes leftover after parsing attributes in process `syz.1.34'. [ 88.572113][ T23] usb 1-1: USB disconnect, device number 2 [ 89.686548][ T5985] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 90.003457][ T5994] netlink: 24 bytes leftover after parsing attributes in process `syz.2.42'. [ 90.883005][ T6001] binder: 6000:6001 ioctl 80206433 0 returned -22 [ 90.968524][ T6003] netlink: 28 bytes leftover after parsing attributes in process `syz.0.45'. [ 91.184102][ T8] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 91.373986][ T8] usb 3-1: Using ep0 maxpacket: 32 [ 91.381728][ T8] usb 3-1: unable to get BOS descriptor or descriptor too short [ 91.393312][ T8] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 91.406247][ T8] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 91.415795][ T8] usb 3-1: config 14 has no interface number 0 [ 91.422233][ T8] usb 3-1: config 14 has no interface number 1 [ 91.433129][ T8] usb 3-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 4, skipping [ 91.450724][ T8] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 91.483849][ T8] usb 3-1: config 14 interface 228 altsetting 5 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 91.508275][ T8] usb 3-1: config 14 interface 57 has no altsetting 0 [ 91.515270][ T8] usb 3-1: config 14 interface 228 has no altsetting 0 [ 91.530597][ T8] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 91.543433][ T8] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.544190][ T5814] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 91.557833][ T8] usb 3-1: Product: syz [ 91.563230][ T8] usb 3-1: Manufacturer: syz [ 91.582817][ T8] usb 3-1: SerialNumber: syz [ 92.038600][ T6001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.113125][ T6001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.666306][ T5814] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 92.677594][ T5814] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 93.141432][ T5814] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.375972][ T8] legousbtower 3-1:14.57: interrupt endpoints not found [ 93.394670][ T8] legousbtower 3-1:14.228: interrupt endpoints not found [ 93.464931][ T5814] usb 2-1: config 0 descriptor?? [ 93.488061][ T8] usb 3-1: USB disconnect, device number 2 [ 93.505665][ T6010] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 93.518629][ T5814] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 93.793593][ T6033] netlink: 40 bytes leftover after parsing attributes in process `syz.3.56'. [ 94.670502][ T5836] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 94.695895][ T6057] syzkaller0: entered promiscuous mode [ 94.701418][ T6057] syzkaller0: entered allmulticast mode [ 94.766278][ T787] usb 2-1: USB disconnect, device number 3 [ 94.857414][ T5836] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 94.885098][ T5836] usb 3-1: New USB device found, idVendor=2040, idProduct=c601, bcdDevice= 0.01 [ 94.906688][ T5836] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.933341][ T5836] usb 3-1: dvb_usb_v2: found a 'Hauppauge 126xxx ATSC' in warm state [ 94.959107][ T5836] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 94.984343][ T5836] dvbdev: DVB: registering new adapter (Hauppauge 126xxx ATSC) [ 95.006048][ T5836] usb 3-1: media controller created [ 95.032642][ T5836] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 95.082627][ T5836] usb 3-1: selecting invalid altsetting 1 [ 95.095039][ T5836] set interface failed [ 95.095632][ T5836] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 95.114236][ T5836] error writing reg: 0xff, val: 0x00 [ 95.207335][ T5836] dvb_usb_mxl111sf: probe of 3-1:1.0 failed with error -22 [ 95.236827][ T5836] usb 3-1: USB disconnect, device number 3 [ 95.373985][ T787] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 95.566625][ T787] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 95.591737][ T787] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 95.617591][ T787] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 95.631443][ T787] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 95.644880][ T787] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 95.654333][ T787] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.920274][ T6086] md: could not open device unknown-block(1,0). [ 96.251118][ T6092] kvm: kvm [6090]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x800100000080 [ 96.878849][ T6107] syzkaller1: entered promiscuous mode [ 96.884670][ T6107] syzkaller1: entered allmulticast mode [ 98.418403][ T43] usb 2-1: USB disconnect, device number 4 [ 100.547548][ T6128] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 101.834000][ T5814] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 101.972579][ T6140] batman_adv: batadv0: Adding interface: dummy0 [ 101.981545][ T6140] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 102.008603][ T6140] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 103.034161][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 103.283979][ T5814] usb 3-1: Using ep0 maxpacket: 8 [ 103.340627][ T5814] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 103.350240][ T5814] usb 3-1: config 0 has no interface number 0 [ 103.357358][ T5814] usb 3-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 103.372113][ T5814] usb 3-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0xAB, skipping [ 103.384242][ T5814] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 103.397352][ T5814] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 103.406473][ T5814] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.424610][ T5814] usb 3-1: config 0 descriptor?? [ 103.436919][ T5814] ldusb 3-1:0.55: Interrupt in endpoint not found [ 103.646257][ T5814] usb 3-1: USB disconnect, device number 4 [ 103.653827][ T5835] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 103.854070][ T5835] usb 2-1: Using ep0 maxpacket: 32 [ 103.871550][ T5835] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 103.886572][ T5835] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 103.913929][ T5835] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 103.923177][ T5835] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.935369][ T5835] usb 2-1: config 0 descriptor?? [ 103.945191][ T5835] hub 2-1:0.0: bad descriptor, ignoring hub [ 103.951135][ T5835] hub: probe of 2-1:0.0 failed with error -5 [ 103.985930][ T5835] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 106.352471][ T6160] syzkaller0: entered promiscuous mode [ 106.364114][ T6160] syzkaller0: entered allmulticast mode [ 106.386540][ T5835] usb 2-1: USB disconnect, device number 5 [ 110.440527][ T6194] genirq: Flags mismatch irq 32. 00000000 (pcmmio) vs. 00000000 (virtio1-output.0) [ 110.795535][ T5836] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 111.114059][ T5836] usb 2-1: Using ep0 maxpacket: 8 [ 111.464330][ T5836] usb 2-1: config 218 has too many interfaces: 244, using maximum allowed: 32 [ 111.473348][ T5836] usb 2-1: config 218 has an invalid descriptor of length 0, skipping remainder of the config [ 111.514141][ T5836] usb 2-1: config 218 has 1 interface, different from the descriptor's value: 244 [ 111.523464][ T5836] usb 2-1: config 218 has no interface number 0 [ 112.718608][ T5836] usb 2-1: config 218 interface 95 altsetting 64 has an invalid endpoint with address 0xFF, skipping [ 112.761860][ T5836] usb 2-1: config 218 interface 95 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 112.787485][ T8] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 112.798801][ T5836] usb 2-1: config 218 interface 95 has no altsetting 0 [ 112.841233][ T5836] usb 2-1: New USB device found, idVendor=10f0, idProduct=2002, bcdDevice=dc.4d [ 112.864224][ T5836] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.872285][ T5836] usb 2-1: Product: syz [ 112.897146][ T5836] usb 2-1: Manufacturer: syz [ 112.901792][ T5836] usb 2-1: SerialNumber: syz [ 113.184018][ T8] usb 3-1: Using ep0 maxpacket: 16 [ 113.231850][ T8] usb 3-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 113.268367][ T8] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 113.330877][ T8] usb 3-1: Product: syz [ 113.380414][ T8] usb 3-1: Manufacturer: syz [ 113.446806][ T8] usb 3-1: SerialNumber: syz [ 113.712960][ T8] usb 3-1: config 0 descriptor?? [ 113.891802][ T5836] usb 2-1: USB disconnect, device number 6 [ 114.552001][ T5835] usb 3-1: USB disconnect, device number 5 [ 115.816838][ T6233] syz.2.118[6233]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 117.028948][ T5814] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 118.154230][ T5814] usb 4-1: Using ep0 maxpacket: 8 [ 118.177506][ T5814] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 118.203161][ T5814] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 118.238474][ T5814] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 118.249834][ T5814] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 118.260145][ T5814] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 118.273511][ T5814] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 118.282682][ T5814] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.672220][ T5814] usb 4-1: usb_control_msg returned -71 [ 119.709030][ T5814] usbtmc 4-1:16.0: can't read capabilities [ 120.257575][ T5814] usb 4-1: USB disconnect, device number 3 [ 120.954169][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 122.473949][ T5814] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 123.665786][ T5814] usb 1-1: device not accepting address 3, error -71 [ 124.303994][ T6296] netlink: 4 bytes leftover after parsing attributes in process `syz.3.136'. [ 124.314164][ T6296] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 125.065532][ T6296] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.053841][ T6315] sched: RT throttling activated [ 129.237323][ T6332] ======================================================= [ 129.237323][ T6332] WARNING: The mand mount option has been deprecated and [ 129.237323][ T6332] and is ignored by this kernel. Remove the mand [ 129.237323][ T6332] option from the mount to silence this warning. [ 129.237323][ T6332] ======================================================= [ 133.080311][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.098070][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.444244][ T6377] netlink: 8 bytes leftover after parsing attributes in process `syz.1.160'. [ 134.473109][ T6377] netlink: 8 bytes leftover after parsing attributes in process `syz.1.160'. [ 134.552335][ T6376] syz.3.161 uses obsolete (PF_INET,SOCK_PACKET) [ 142.332102][ T787] IPVS: starting estimator thread 0... [ 142.444381][ T6428] IPVS: using max 19 ests per chain, 45600 per kthread [ 144.315242][ T6440] netlink: 'syz.3.179': attribute type 1 has an invalid length. [ 144.323319][ T6440] netlink: 'syz.3.179': attribute type 2 has an invalid length. [ 145.553960][ T5836] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 145.763949][ T5836] usb 2-1: Using ep0 maxpacket: 32 [ 145.783174][ T5836] usb 2-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 145.802665][ T5836] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.821053][ T5836] usb 2-1: Product: syz [ 145.825699][ T5836] usb 2-1: Manufacturer: syz [ 145.830329][ T5836] usb 2-1: SerialNumber: syz [ 145.856678][ T5836] usb 2-1: config 0 descriptor?? [ 146.276451][ T5836] airspy 2-1:0.0: Board ID: 00 [ 146.284000][ T5836] airspy 2-1:0.0: Firmware version: [ 146.483779][ T5836] airspy 2-1:0.0: usb_control_msg() failed -71 request 11 [ 146.515228][ T5836] airspy 2-1:0.0: Registered as swradio24 [ 146.531243][ T5836] airspy 2-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 146.564713][ T5836] usb 2-1: USB disconnect, device number 7 [ 146.644310][ T5835] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 146.890197][ T5835] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 146.910691][ T5835] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 146.933719][ T5835] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 146.969191][ T5835] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.012445][ T5835] usb 1-1: config 0 descriptor?? [ 150.073693][ T6470] capability: warning: `syz.0.181' uses 32-bit capabilities (legacy support in use) [ 152.010020][ T6477] netlink: 'syz.1.188': attribute type 10 has an invalid length. [ 152.076947][ T5813] usb 1-1: USB disconnect, device number 5 [ 152.206641][ T6477] team0 (unregistering): Port device team_slave_0 removed [ 152.279751][ T6477] team0 (unregistering): Port device team_slave_1 removed [ 154.202044][ T6490] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 154.229147][ T6490] CIFS: Attempting to mount //127.0.0.1/share [ 154.274623][ T6490] CIFS: VFS: Error connecting to socket. Aborting operation. [ 154.282506][ T6490] CIFS: VFS: cifs_mount failed w/return code = -111 [ 154.338046][ T6491] nbd0: detected capacity change from 0 to 63 [ 154.984345][ T5781] block nbd0: Receive control failed (result -104) [ 159.859614][ T5781] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 159.869934][ T5781] CPU: 1 PID: 5781 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 159.877525][ T5781] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 159.887609][ T5781] Workqueue: hci0 hci_rx_work [ 159.892354][ T5781] Call Trace: [ 159.895651][ T5781] [ 159.898603][ T5781] dump_stack_lvl+0x18c/0x250 [ 159.903322][ T5781] ? show_regs_print_info+0x20/0x20 [ 159.908554][ T5781] ? load_image+0x420/0x420 [ 159.913101][ T5781] sysfs_create_dir_ns+0x26e/0x2a0 [ 159.918221][ T5781] ? __lock_acquire+0x7d80/0x7d80 [ 159.923249][ T5781] ? sysfs_warn_dup+0xa0/0xa0 [ 159.927929][ T5781] ? do_raw_spin_unlock+0x121/0x230 [ 159.933135][ T5781] kobject_add_internal+0x617/0xc90 [ 159.938342][ T5781] kobject_add+0x164/0x240 [ 159.942761][ T5781] ? kobject_init+0x1d0/0x1d0 [ 159.947443][ T5781] ? get_device_parent+0x366/0x390 [ 159.952558][ T5781] device_add+0x3fa/0xc40 [ 159.956900][ T5781] hci_conn_add_sysfs+0xd5/0x1e0 [ 159.961845][ T5781] le_conn_complete_evt+0xe9a/0x1480 [ 159.967166][ T5781] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 159.973417][ T5781] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 159.979061][ T5781] ? mutex_unlock+0x10/0x10 [ 159.983561][ T5781] ? skb_pull_data+0xf0/0x1f0 [ 159.988246][ T5781] hci_le_conn_complete_evt+0x187/0x440 [ 159.993806][ T5781] ? hci_remote_host_features_evt+0x150/0x150 [ 159.999872][ T5781] hci_event_packet+0x7b4/0x1280 [ 160.004811][ T5781] ? __lock_acquire+0x7d80/0x7d80 [ 160.009836][ T5781] ? lock_chain_count+0x20/0x20 [ 160.014690][ T5781] ? bis_list+0x290/0x290 [ 160.019023][ T5781] ? kcov_remote_start+0x513/0x810 [ 160.024132][ T5781] ? lockdep_hardirqs_on+0x98/0x150 [ 160.029415][ T5781] ? hci_send_to_monitor+0xd7/0x4f0 [ 160.034619][ T5781] hci_rx_work+0x43a/0xd60 [ 160.039047][ T5781] ? process_scheduled_works+0x975/0x1600 [ 160.044773][ T5781] process_scheduled_works+0xa60/0x1600 [ 160.050346][ T5781] ? worker_attach_to_pool+0x370/0x370 [ 160.055816][ T5781] ? assign_work+0x3cc/0x5d0 [ 160.060412][ T5781] worker_thread+0xa5e/0xfe0 [ 160.065023][ T5781] kthread+0x2fa/0x390 [ 160.069086][ T5781] ? pr_cont_work+0x550/0x550 [ 160.073764][ T5781] ? kthread_blkcg+0xd0/0xd0 [ 160.078379][ T5781] ret_from_fork+0x48/0x80 [ 160.082801][ T5781] ? kthread_blkcg+0xd0/0xd0 [ 160.087390][ T5781] ret_from_fork_asm+0x11/0x20 [ 160.092166][ T5781] [ 160.099304][ T5781] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 160.113622][ T5781] Bluetooth: hci0: failed to register connection device [ 161.914164][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 162.324792][ T787] IPVS: starting estimator thread 0... [ 162.414111][ T6529] IPVS: using max 22 ests per chain, 52800 per kthread [ 164.237302][ T5835] IPVS: starting estimator thread 0... [ 164.324379][ T6539] IPVS: using max 25 ests per chain, 60000 per kthread [ 167.034146][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 167.112387][ T5781] Bluetooth: hci0: command 0x0406 tx timeout [ 173.583942][ T5813] IPVS: starting estimator thread 0... [ 173.686169][ T6588] IPVS: using max 21 ests per chain, 50400 per kthread [ 173.729879][ T6590] netlink: 48 bytes leftover after parsing attributes in process `syz.0.221'. [ 174.547907][ T6594] bridge0: port 2(bridge_slave_1) entered disabled state [ 174.556064][ T6594] bridge0: port 1(bridge_slave_0) entered disabled state [ 176.068429][ T6594] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 176.135878][ T6594] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 176.973617][ T6594] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.994004][ T6594] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.014144][ T6594] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.029761][ T6594] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.221904][ T6603] tipc: Enabling of bearer rejected, failed to enable media [ 177.306957][ T6594] syz.0.223 (6594) used greatest stack depth: 20264 bytes left [ 177.874729][ T5781] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 177.885303][ T5781] CPU: 1 PID: 5781 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 177.892863][ T5781] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 177.902918][ T5781] Workqueue: hci2 hci_rx_work [ 177.907684][ T5781] Call Trace: [ 177.910952][ T5781] [ 177.913896][ T5781] dump_stack_lvl+0x18c/0x250 [ 177.918583][ T5781] ? show_regs_print_info+0x20/0x20 [ 177.923793][ T5781] ? load_image+0x420/0x420 [ 177.928296][ T5781] sysfs_create_dir_ns+0x26e/0x2a0 [ 177.933414][ T5781] ? __lock_acquire+0x7d80/0x7d80 [ 177.938428][ T5781] ? sysfs_warn_dup+0xa0/0xa0 [ 177.943115][ T5781] ? do_raw_spin_unlock+0x121/0x230 [ 177.948326][ T5781] kobject_add_internal+0x617/0xc90 [ 177.953542][ T5781] kobject_add+0x164/0x240 [ 177.957967][ T5781] ? kobject_init+0x1d0/0x1d0 [ 177.962759][ T5781] ? get_device_parent+0x366/0x390 [ 177.967872][ T5781] device_add+0x3fa/0xc40 [ 177.972201][ T5781] hci_conn_add_sysfs+0xd5/0x1e0 [ 177.977136][ T5781] le_conn_complete_evt+0xe9a/0x1480 [ 177.982418][ T5781] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 177.988654][ T5781] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 177.994282][ T5781] ? mutex_unlock+0x10/0x10 [ 177.998776][ T5781] ? skb_pull_data+0xf0/0x1f0 [ 178.003445][ T5781] hci_le_conn_complete_evt+0x187/0x440 [ 178.008982][ T5781] ? hci_remote_host_features_evt+0x150/0x150 [ 178.015036][ T5781] hci_event_packet+0x7b4/0x1280 [ 178.019968][ T5781] ? __lock_acquire+0x7d80/0x7d80 [ 178.024995][ T5781] ? lock_chain_count+0x20/0x20 [ 178.029829][ T5781] ? bis_list+0x290/0x290 [ 178.034147][ T5781] ? kcov_remote_start+0x513/0x810 [ 178.039253][ T5781] ? lockdep_hardirqs_on+0x98/0x150 [ 178.044442][ T5781] ? hci_send_to_monitor+0xd7/0x4f0 [ 178.049652][ T5781] hci_rx_work+0x43a/0xd60 [ 178.054099][ T5781] ? process_scheduled_works+0x975/0x1600 [ 178.059835][ T5781] process_scheduled_works+0xa60/0x1600 [ 178.065392][ T5781] ? worker_attach_to_pool+0x370/0x370 [ 178.070844][ T5781] ? assign_work+0x3cc/0x5d0 [ 178.075432][ T5781] worker_thread+0xa5e/0xfe0 [ 178.080028][ T5781] kthread+0x2fa/0x390 [ 178.084085][ T5781] ? pr_cont_work+0x550/0x550 [ 178.088768][ T5781] ? kthread_blkcg+0xd0/0xd0 [ 178.093368][ T5781] ret_from_fork+0x48/0x80 [ 178.097790][ T5781] ? kthread_blkcg+0xd0/0xd0 [ 178.102373][ T5781] ret_from_fork_asm+0x11/0x20 [ 178.107157][ T5781] [ 178.335373][ T5781] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 178.386269][ T5781] Bluetooth: hci2: failed to register connection device [ 180.853298][ T6642] tipc: Enabling of bearer rejected, failed to enable media [ 182.343275][ T6651] FAULT_INJECTION: forcing a failure. [ 182.343275][ T6651] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 182.380868][ T6651] CPU: 0 PID: 6651 Comm: syz.3.239 Not tainted syzkaller #0 [ 182.388202][ T6651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 182.398354][ T6651] Call Trace: [ 182.401711][ T6651] [ 182.404666][ T6651] dump_stack_lvl+0x18c/0x250 [ 182.409343][ T6651] ? show_regs_print_info+0x20/0x20 [ 182.414538][ T6651] ? load_image+0x420/0x420 [ 182.419037][ T6651] ? __might_fault+0xaa/0x120 [ 182.423711][ T6651] ? __lock_acquire+0x7d80/0x7d80 [ 182.428728][ T6651] should_fail_ex+0x394/0x4c0 [ 182.433418][ T6651] _copy_from_user+0x2f/0xe0 [ 182.437995][ T6651] restore_altstack+0xaf/0x4e0 [ 182.442783][ T6651] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 182.448781][ T6651] ? __lock_acquire+0x7d80/0x7d80 [ 182.453820][ T6651] ? __ia32_sys_sigaltstack+0x2a0/0x2a0 [ 182.459382][ T6651] ? _raw_spin_unlock_irq+0x23/0x50 [ 182.464574][ T6651] ? lockdep_hardirqs_on+0x98/0x150 [ 182.469763][ T6651] __ia32_sys_rt_sigreturn+0x239/0x850 [ 182.475223][ T6651] ? x64_setup_rt_frame+0xc30/0xc30 [ 182.480416][ T6651] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 182.486389][ T6651] ? lock_chain_count+0x20/0x20 [ 182.491234][ T6651] ? lockdep_hardirqs_on+0x98/0x150 [ 182.496428][ T6651] do_syscall_64+0x55/0xb0 [ 182.500837][ T6651] ? clear_bhb_loop+0x40/0x90 [ 182.505514][ T6651] ? clear_bhb_loop+0x40/0x90 [ 182.510196][ T6651] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 182.516092][ T6651] RIP: 0033:0x7f413c73f4d9 [ 182.520523][ T6651] Code: 11 06 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25 [ 182.540141][ T6651] RSP: 002b:00007f413d6c9a80 EFLAGS: 00000202 ORIG_RAX: 000000000000000f [ 182.548556][ T6651] RAX: ffffffffffffffda RBX: 00007f413ca25fa0 RCX: 00007f413c73f4d9 [ 182.556520][ T6651] RDX: 00007f413d6c9a80 RSI: 00007f413d6c9bb0 RDI: 0000000000000021 [ 182.564482][ T6651] RBP: 00007f413c83506b R08: 0000000000000000 R09: 0000000000000000 [ 182.572442][ T6651] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 182.580404][ T6651] R13: 00007f413ca26038 R14: 00007f413ca25fa0 R15: 00007ffcbc0280f8 [ 182.588397][ T6651] [ 183.250738][ T6645] bridge0: port 2(bridge_slave_1) entered disabled state [ 183.258471][ T6645] bridge0: port 1(bridge_slave_0) entered disabled state [ 184.746861][ T5781] Bluetooth: hci2: command 0x0406 tx timeout [ 185.964027][ T55] block nbd0: Possible stuck request ffff888021ce0000: control (read@0,4096B). Runtime 30 seconds [ 187.945596][ T6645] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 188.037187][ T6645] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 190.638227][ T6645] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.647354][ T6645] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.658620][ T6645] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.667656][ T6645] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.703987][ T5835] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 191.417390][ T5783] Bluetooth: hci1: command 0x0406 tx timeout [ 191.423488][ T5783] Bluetooth: hci3: command 0x0406 tx timeout [ 191.429656][ T5785] Bluetooth: hci0: command 0x0406 tx timeout [ 191.435757][ T5785] Bluetooth: hci2: command 0x0406 tx timeout [ 192.346903][ T6675] tipc: Enabling of bearer rejected, failed to enable media [ 192.473035][ T5835] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 192.491570][ T5835] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 192.511071][ T5835] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 192.520575][ T5835] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.550078][ T5835] usb 1-1: config 0 descriptor?? [ 194.534433][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.540917][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.284211][ T43] usb 1-1: USB disconnect, device number 6 [ 199.110150][ T6740] netlink: 20 bytes leftover after parsing attributes in process `syz.2.263'. [ 199.860994][ T6740] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 199.871545][ T6740] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 199.881230][ T6740] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 199.884022][ T27] audit: type=1800 audit(1790522734.744:2): pid=6740 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.263" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 204.765487][ T6801] input: syz0 as /devices/virtual/input/input6 [ 205.386404][ T6806] netlink: 'syz.0.274': attribute type 21 has an invalid length. [ 205.394728][ T6806] netlink: 128 bytes leftover after parsing attributes in process `syz.0.274'. [ 205.407509][ T6806] netlink: 3 bytes leftover after parsing attributes in process `syz.0.274'. [ 206.123937][ T5089] Bluetooth: hci4: command 0x1003 tx timeout [ 206.130807][ T5781] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 216.247516][ T24] block nbd0: Possible stuck request ffff888021ce0000: control (read@0,4096B). Runtime 60 seconds [ 222.138770][ T43] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 222.346270][ T43] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 222.374313][ T43] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 222.394044][ T43] usb 2-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 222.403143][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.450937][ T43] opticon 2-1:1.0: opticon converter detected [ 222.476107][ T43] usb 2-1: opticon converter now attached to ttyUSB0 [ 222.759733][ T27] audit: type=1800 audit(1790522757.614:3): pid=6904 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.302" name="file1" dev="sda1" ino=2044 res=0 errno=0 [ 223.472315][ T43] usb 2-1: USB disconnect, device number 8 [ 223.507366][ T43] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 223.540148][ T43] opticon 2-1:1.0: device disconnected [ 224.271955][ T6911] netlink: 'syz.3.305': attribute type 21 has an invalid length. [ 224.280848][ T6911] netlink: 128 bytes leftover after parsing attributes in process `syz.3.305'. [ 224.292816][ T6911] netlink: 3 bytes leftover after parsing attributes in process `syz.3.305'. [ 229.935125][ T27] audit: type=1800 audit(1790522764.654:4): pid=6933 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.315" name="file1" dev="sda1" ino=2044 res=0 errno=0 [ 232.959928][ T5835] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 233.883628][ T5835] usb 2-1: Using ep0 maxpacket: 8 [ 233.891346][ T5835] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 233.907360][ T5835] usb 2-1: can't read configurations, error -71 [ 239.987094][ T23] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 240.716780][ T23] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 65535, setting to 1024 [ 240.729529][ T23] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 240.740738][ T23] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 240.756741][ T23] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 240.766978][ T23] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 240.775588][ T23] usb 1-1: Product: syz [ 240.779895][ T23] usb 1-1: Manufacturer: syz [ 240.785972][ T23] usb 1-1: SerialNumber: syz [ 240.804658][ T7009] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 240.919998][ T7021] block nbd2: NBD_DISCONNECT [ 241.187042][ T23] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 7 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 241.466718][ T23] usb 1-1: USB disconnect, device number 7 [ 241.708667][ T23] usblp0: removed [ 246.622641][ T5143] udevd[5143]: worker [5765] /devices/virtual/block/nbd0 is taking a long time [ 246.648772][ T24] block nbd0: Possible stuck request ffff888021ce0000: control (read@0,4096B). Runtime 90 seconds [ 247.646058][ T7042] warning: `syz.2.348' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 247.868149][ T7049] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 254.191928][ T7101] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 256.114966][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.121310][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.154306][ T788] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 256.350451][ T788] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 256.388662][ T788] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 256.407461][ T788] usb 1-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 256.417769][ T7116] syzkaller0: entered promiscuous mode [ 256.421140][ T788] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 256.423258][ T7116] syzkaller0: entered allmulticast mode [ 256.444733][ T788] usb 1-1: config 0 descriptor?? [ 256.916645][ T788] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 257.568521][ T788] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 257.577607][ T788] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 257.585136][ T788] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 257.592570][ T788] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 257.609126][ T788] playstation 0003:054C:0DF2.0001: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.0-1/input0 [ 257.735795][ T788] playstation 0003:054C:0DF2.0001: Failed to retrieve feature with reportID 9: -71 [ 257.770385][ T788] playstation 0003:054C:0DF2.0001: Failed to retrieve DualSense pairing info: -71 [ 257.788562][ T788] playstation 0003:054C:0DF2.0001: Failed to get MAC address from DualSense [ 257.801291][ T788] playstation 0003:054C:0DF2.0001: Failed to create dualsense. [ 257.813017][ T788] playstation: probe of 0003:054C:0DF2.0001 failed with error -71 [ 257.827566][ T788] usb 1-1: USB disconnect, device number 8 [ 257.897264][ T7128] fido_id[7128]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 260.994161][ T23] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 261.262290][ T23] usb 3-1: config 1 has an invalid interface number: 3 but max is 0 [ 261.330701][ T23] usb 3-1: config 1 has no interface number 0 [ 261.404307][ T23] usb 3-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 261.475995][ T23] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.552327][ T23] usb 3-1: Product: syz [ 261.592032][ T23] usb 3-1: Manufacturer: syz [ 261.635112][ T23] usb 3-1: SerialNumber: syz [ 262.081789][ T23] usb 3-1: 3:0 : does not exist [ 262.146413][ T23] usb 3-1: 3:0 : does not exist [ 262.242699][ T23] usb 3-1: USB disconnect, device number 6 [ 262.512433][ T7167] FAULT_INJECTION: forcing a failure. [ 262.512433][ T7167] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.525935][ T7167] CPU: 1 PID: 7167 Comm: syz.3.383 Not tainted syzkaller #0 [ 262.533240][ T7167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 262.543309][ T7167] Call Trace: [ 262.546590][ T7167] [ 262.549551][ T7167] dump_stack_lvl+0x18c/0x250 [ 262.554259][ T7167] ? show_regs_print_info+0x20/0x20 [ 262.559454][ T7167] ? load_image+0x420/0x420 [ 262.564066][ T7167] ? __might_fault+0xaa/0x120 [ 262.568778][ T7167] ? __lock_acquire+0x7d80/0x7d80 [ 262.573816][ T7167] should_fail_ex+0x394/0x4c0 [ 262.578521][ T7167] _copy_from_user+0x2f/0xe0 [ 262.583120][ T7167] restore_altstack+0xaf/0x4e0 [ 262.587908][ T7167] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 262.593905][ T7167] ? __lock_acquire+0x7d80/0x7d80 [ 262.599038][ T7167] ? __ia32_sys_sigaltstack+0x2a0/0x2a0 [ 262.604589][ T7167] ? _raw_spin_unlock_irq+0x23/0x50 [ 262.609786][ T7167] ? lockdep_hardirqs_on+0x98/0x150 [ 262.614983][ T7167] __ia32_sys_rt_sigreturn+0x239/0x850 [ 262.620449][ T7167] ? x64_setup_rt_frame+0xc30/0xc30 [ 262.625681][ T7167] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 262.631932][ T7167] ? lock_chain_count+0x20/0x20 [ 262.637072][ T7167] ? lockdep_hardirqs_on+0x98/0x150 [ 262.642274][ T7167] do_syscall_64+0x55/0xb0 [ 262.647202][ T7167] ? clear_bhb_loop+0x40/0x90 [ 262.651920][ T7167] ? clear_bhb_loop+0x40/0x90 [ 262.656644][ T7167] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 262.662551][ T7167] RIP: 0033:0x7f413c73f4d9 [ 262.666969][ T7167] Code: 11 06 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25 [ 262.686675][ T7167] RSP: 002b:00007f413d6c9a80 EFLAGS: 00000202 ORIG_RAX: 000000000000000f [ 262.695099][ T7167] RAX: ffffffffffffffda RBX: 00007f413ca25fa0 RCX: 00007f413c73f4d9 [ 262.703078][ T7167] RDX: 00007f413d6c9a80 RSI: 00007f413d6c9bb0 RDI: 0000000000000021 [ 262.711056][ T7167] RBP: 00007f413c83506b R08: 0000000000000000 R09: 0000000000000000 [ 262.719071][ T7167] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 262.727043][ T7167] R13: 00007f413ca26038 R14: 00007f413ca25fa0 R15: 00007ffcbc0280f8 [ 262.735041][ T7167] [ 265.054235][ T23] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 265.284589][ T23] usb 3-1: Using ep0 maxpacket: 8 [ 265.315525][ T23] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 265.336039][ T23] usb 3-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 265.345939][ T23] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.354418][ T23] usb 3-1: Product: syz [ 265.358779][ T23] usb 3-1: Manufacturer: syz [ 265.362373][ T7193] Bluetooth: MGMT ver 1.22 [ 265.363441][ T23] usb 3-1: SerialNumber: syz [ 265.377644][ T23] usb 3-1: config 0 descriptor?? [ 265.389219][ T23] ati_remote 3-1:0.0: ati_remote_probe: Unexpected desc.bNumEndpoints [ 265.625763][ T7187] autofs4:pid:7187:autofs_fill_super: called with bogus options [ 266.845053][ T7200] overlayfs: overlapping lowerdir path [ 268.888105][ T7187] comedi comedi1: reset error (fatal) [ 268.927529][ T23] usb 3-1: USB disconnect, device number 7 [ 272.727010][ T7241] FAULT_INJECTION: forcing a failure. [ 272.727010][ T7241] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 272.749296][ T7241] CPU: 0 PID: 7241 Comm: syz.1.409 Not tainted syzkaller #0 [ 272.756646][ T7241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 272.766726][ T7241] Call Trace: [ 272.770020][ T7241] [ 272.772962][ T7241] dump_stack_lvl+0x18c/0x250 [ 272.777677][ T7241] ? show_regs_print_info+0x20/0x20 [ 272.782904][ T7241] ? load_image+0x420/0x420 [ 272.787434][ T7241] ? __might_fault+0xaa/0x120 [ 272.792131][ T7241] ? __lock_acquire+0x7d80/0x7d80 [ 272.797186][ T7241] should_fail_ex+0x394/0x4c0 [ 272.801903][ T7241] _copy_from_user+0x2f/0xe0 [ 272.806710][ T7241] restore_altstack+0xaf/0x4e0 [ 272.811517][ T7241] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 272.817533][ T7241] ? __lock_acquire+0x7d80/0x7d80 [ 272.822586][ T7241] ? __ia32_sys_sigaltstack+0x2a0/0x2a0 [ 272.828172][ T7241] ? _raw_spin_unlock_irq+0x23/0x50 [ 272.833408][ T7241] ? lockdep_hardirqs_on+0x98/0x150 [ 272.838638][ T7241] __ia32_sys_rt_sigreturn+0x239/0x850 [ 272.844131][ T7241] ? x64_setup_rt_frame+0xc30/0xc30 [ 272.849371][ T7241] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 272.855394][ T7241] ? lock_chain_count+0x20/0x20 [ 272.860286][ T7241] ? lockdep_hardirqs_on+0x98/0x150 [ 272.865513][ T7241] do_syscall_64+0x55/0xb0 [ 272.869963][ T7241] ? clear_bhb_loop+0x40/0x90 [ 272.874678][ T7241] ? clear_bhb_loop+0x40/0x90 [ 272.879399][ T7241] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 272.885323][ T7241] RIP: 0033:0x7fe71a73f4d9 [ 272.889745][ T7241] Code: 11 06 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25 [ 272.909356][ T7241] RSP: 002b:00007fe71b5cfa80 EFLAGS: 00000202 ORIG_RAX: 000000000000000f [ 272.917786][ T7241] RAX: ffffffffffffffda RBX: 00007fe71aa25fa0 RCX: 00007fe71a73f4d9 [ 272.925758][ T7241] RDX: 00007fe71b5cfa80 RSI: 00007fe71b5cfbb0 RDI: 0000000000000021 [ 272.933818][ T7241] RBP: 00007fe71a83506b R08: 0000000000000000 R09: 0000000000000000 [ 272.941791][ T7241] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 272.949759][ T7241] R13: 00007fe71aa26038 R14: 00007fe71aa25fa0 R15: 00007ffd32f93468 [ 272.958523][ T7241] [ 276.752496][ T5781] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 276.762983][ T5781] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 276.772305][ T5781] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 276.781245][ T5781] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 276.790467][ T5781] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 276.798524][ T5781] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 278.133679][ T24] block nbd0: Possible stuck request ffff888021ce0000: control (read@0,4096B). Runtime 120 seconds [ 278.478821][ T7284] zram0: detected capacity change from 0 to 65536 [ 278.853956][ T5781] Bluetooth: hci4: command tx timeout [ 279.351262][ T7269] chnl_net:caif_netlink_parms(): no params data found [ 280.575881][ T7269] bridge0: port 1(bridge_slave_0) entered blocking state [ 280.616613][ T7269] bridge0: port 1(bridge_slave_0) entered disabled state [ 280.671955][ T7269] bridge_slave_0: entered allmulticast mode [ 280.709027][ T7269] bridge_slave_0: entered promiscuous mode [ 280.749630][ T7269] bridge0: port 2(bridge_slave_1) entered blocking state [ 280.757942][ T7269] bridge0: port 2(bridge_slave_1) entered disabled state [ 280.776493][ T7269] bridge_slave_1: entered allmulticast mode [ 280.795436][ T7269] bridge_slave_1: entered promiscuous mode [ 282.006194][ T5781] Bluetooth: hci4: command tx timeout [ 282.060598][ T7269] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 282.081881][ T7269] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 282.165830][ T7269] team0: Port device team_slave_0 added [ 282.195306][ T7269] team0: Port device team_slave_1 added [ 282.278393][ T7269] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 282.293892][ T7269] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 282.343960][ T7269] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 282.367296][ T7269] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 282.403892][ T7269] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 282.483890][ T7269] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 282.579437][ T7269] hsr_slave_0: entered promiscuous mode [ 282.595993][ T7269] hsr_slave_1: entered promiscuous mode [ 282.613987][ T7269] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 282.632925][ T7269] Cannot create hsr debugfs directory [ 284.246993][ T5781] Bluetooth: hci4: command tx timeout [ 284.366399][ T7269] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 284.398829][ T7269] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 284.484599][ T7269] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 284.506992][ T7269] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 284.681539][ T7269] 8021q: adding VLAN 0 to HW filter on device bond0 [ 284.702156][ T7269] 8021q: adding VLAN 0 to HW filter on device team0 [ 285.945579][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 285.952852][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 285.973131][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 285.980340][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 286.050727][ T7269] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 286.293950][ T5781] Bluetooth: hci4: command tx timeout [ 286.412633][ T7269] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 288.109439][ T7364] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 289.080952][ T7269] veth0_vlan: entered promiscuous mode [ 289.105626][ T7269] veth1_vlan: entered promiscuous mode [ 289.228880][ T7269] veth0_macvtap: entered promiscuous mode [ 289.258691][ T7269] veth1_macvtap: entered promiscuous mode [ 289.293495][ T7269] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 289.307992][ T7269] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 289.320441][ T7269] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 289.343178][ T7269] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 289.375636][ T7269] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.401789][ T7269] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.431353][ T7269] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.449568][ T7269] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.672115][ T2955] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 289.707652][ T2955] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 289.816811][ T2955] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 289.846944][ T2955] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 295.464300][ T5813] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 295.573913][ T5781] Bluetooth: hci4: command tx timeout [ 295.734328][ T5813] usb 5-1: Using ep0 maxpacket: 16 [ 295.813547][ T5813] usb 5-1: config 4 interface 0 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 295.927662][ T5813] usb 5-1: config 4 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 32 [ 296.041151][ T5813] usb 5-1: New USB device found, idVendor=16d8, idProduct=7213, bcdDevice=b8.83 [ 297.300878][ T7397] netlink: 'syz.3.454': attribute type 21 has an invalid length. [ 297.309666][ T7397] netlink: 128 bytes leftover after parsing attributes in process `syz.3.454'. [ 297.320467][ T7397] netlink: 3 bytes leftover after parsing attributes in process `syz.3.454'. [ 297.594311][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 298.025963][ T5813] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.080181][ T5813] usb 5-1: Product: syz [ 298.098528][ T5813] usb 5-1: Manufacturer: syz [ 298.114054][ T5813] usb 5-1: SerialNumber: syz [ 298.136107][ T5813] usb 5-1: can't set config #4, error -71 [ 298.185511][ T5813] usb 5-1: USB disconnect, device number 2 [ 302.594002][ T5813] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 303.934495][ T5813] usb 5-1: Using ep0 maxpacket: 32 [ 303.960165][ T5813] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 304.001774][ T5813] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 304.044269][ T5813] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 304.082024][ T5813] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.110665][ T5813] usb 5-1: config 0 descriptor?? [ 304.319990][ T5813] usbhid 5-1:0.0: can't add hid device: -71 [ 304.352636][ T5813] usbhid: probe of 5-1:0.0 failed with error -71 [ 304.410753][ T5813] usb 5-1: USB disconnect, device number 3 [ 306.002209][ T5836] IPVS: starting estimator thread 0... [ 306.204002][ T7440] IPVS: using max 17 ests per chain, 40800 per kthread [ 308.434062][ T24] block nbd0: Possible stuck request ffff888021ce0000: control (read@0,4096B). Runtime 150 seconds [ 309.013810][ T7453] netlink: 'syz.2.465': attribute type 21 has an invalid length. [ 309.021930][ T7453] netlink: 128 bytes leftover after parsing attributes in process `syz.2.465'. [ 309.032296][ T7453] netlink: 3 bytes leftover after parsing attributes in process `syz.2.465'. [ 314.370747][ T7473] tmpfs: Unknown parameter 'usrquotaû©Ò))9‡c>¶Pc°˜‚qt9¿òœ§`ÎÌ' [ 314.398210][ T7473] hub 1-0:1.0: USB hub found [ 314.405124][ T7473] hub 1-0:1.0: 1 port detected [ 317.380740][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.390569][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 325.409042][ T7536] netlink: 16 bytes leftover after parsing attributes in process `syz.4.494'. [ 327.214821][ T7548] netlink: 'syz.3.498': attribute type 21 has an invalid length. [ 327.222722][ T7548] netlink: 128 bytes leftover after parsing attributes in process `syz.3.498'. [ 327.232181][ T7548] netlink: 3 bytes leftover after parsing attributes in process `syz.3.498'. [ 329.969008][ T7559] batman_adv: batadv0: Removing interface: dummy0 [ 330.512217][ T7559] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 330.558613][ T7559] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 333.932361][ T7562] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.940449][ T7562] bridge0: port 1(bridge_slave_0) entered disabled state [ 336.941430][ T7581] device-mapper: ioctl: ioctl interface mismatch: kernel(4.48.0), user(7.0.0), cmd(10) [ 337.006041][ T27] audit: type=1326 audit(1790522871.884:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7578 comm="syz.3.506" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f413c79e159 code=0x0 [ 338.462535][ T24] block nbd0: Possible stuck request ffff888021ce0000: control (read@0,4096B). Runtime 180 seconds [ 339.781567][ T7562] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 339.846375][ T7562] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 339.902075][ T5143] udevd[5143]: worker [5765] /devices/virtual/block/nbd0 timeout; kill it [ 339.924802][ T5143] udevd[5143]: seq 10928 '/devices/virtual/block/nbd0' killed [ 340.364131][ T7562] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.373084][ T7562] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.383142][ T7562] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.393993][ T7562] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.483050][ T7586] netlink: 'syz.2.507': attribute type 21 has an invalid length. [ 340.490994][ T7586] netlink: 128 bytes leftover after parsing attributes in process `syz.2.507'. [ 340.500127][ T7586] netlink: 3 bytes leftover after parsing attributes in process `syz.2.507'. [ 344.394067][ T5834] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 344.755949][ T27] audit: type=1326 audit(1790522879.644:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7622 comm="syz.1.514" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71a79e159 code=0x7ffc0000 [ 344.784155][ T27] audit: type=1326 audit(1790522879.644:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7622 comm="syz.1.514" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71a79e159 code=0x7ffc0000 [ 344.809873][ T27] audit: type=1326 audit(1790522879.644:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7622 comm="syz.1.514" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7fe71a79e159 code=0x7ffc0000 [ 344.870234][ T5834] usb 4-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice= 9.00 [ 344.897414][ T27] audit: type=1326 audit(1790522879.644:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7622 comm="syz.1.514" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71a79e159 code=0x7ffc0000 [ 344.921820][ T27] audit: type=1326 audit(1790522879.644:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7622 comm="syz.1.514" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=48 compat=0 ip=0x7fe71a79e159 code=0x7ffc0000 [ 344.945897][ T27] audit: type=1326 audit(1790522879.644:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7622 comm="syz.1.514" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71a79e159 code=0x7ffc0000 [ 344.972970][ T27] audit: type=1326 audit(1790522879.644:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7622 comm="syz.1.514" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71a79e159 code=0x7ffc0000 [ 345.002264][ T27] audit: type=1326 audit(1790522879.644:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7622 comm="syz.1.514" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe71a79e159 code=0x7ffc0000 [ 345.012642][ T5834] usb 4-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 345.046733][ T27] audit: type=1326 audit(1790522879.644:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7622 comm="syz.1.514" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe71a79e159 code=0x7ffc0000 [ 345.136628][ T27] audit: type=1326 audit(1790522879.644:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7622 comm="syz.1.514" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=299 compat=0 ip=0x7fe71a79e159 code=0x7ffc0000 [ 345.139004][ T5834] usb 4-1: Product: syz [ 345.287549][ T5834] usb 4-1: config 0 descriptor?? [ 345.328192][ T5834] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 345.368889][ T5834] usb 4-1: Detected FT232H [ 345.556389][ T5834] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 345.577109][ T5834] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 345.600565][ T5834] ftdi_sio 4-1:0.0: GPIO initialisation failed: -71 [ 345.619566][ T5834] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 345.663394][ T5834] usb 4-1: USB disconnect, device number 4 [ 345.709371][ T5834] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 345.759248][ T5834] ftdi_sio 4-1:0.0: device disconnected [ 346.924033][ T7635] netlink: 'syz.2.521': attribute type 21 has an invalid length. [ 346.931784][ T7635] netlink: 128 bytes leftover after parsing attributes in process `syz.2.521'. [ 346.940877][ T7635] netlink: 3 bytes leftover after parsing attributes in process `syz.2.521'. [ 350.374042][ T7661] netlink: 'syz.4.531': attribute type 21 has an invalid length. [ 350.381809][ T7661] netlink: 128 bytes leftover after parsing attributes in process `syz.4.531'. [ 350.390843][ T7661] netlink: 3 bytes leftover after parsing attributes in process `syz.4.531'. [ 352.613738][ T1073] nci: nci_ntf_packet: unknown ntf opcode 0xe2d [ 352.716880][ T7669] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.724322][ T7669] bridge0: port 1(bridge_slave_0) entered disabled state [ 354.214076][ T5813] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 354.416161][ T5813] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 354.444514][ T5813] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 354.474011][ T5813] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 354.483114][ T5813] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 354.537101][ T5813] usb 5-1: config 0 descriptor?? [ 354.563350][ T7691] FAULT_INJECTION: forcing a failure. [ 354.563350][ T7691] name failslab, interval 1, probability 0, space 0, times 1 [ 354.594315][ T7691] CPU: 0 PID: 7691 Comm: syz.2.537 Not tainted syzkaller #0 [ 354.601659][ T7691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 354.611710][ T7691] Call Trace: [ 354.614984][ T7691] [ 354.617904][ T7691] dump_stack_lvl+0x18c/0x250 [ 354.622579][ T7691] ? show_regs_print_info+0x20/0x20 [ 354.627773][ T7691] ? load_image+0x420/0x420 [ 354.632306][ T7691] ? __might_sleep+0xe0/0xe0 [ 354.636894][ T7691] ? __lock_acquire+0x7d80/0x7d80 [ 354.641928][ T7691] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 354.647852][ T7691] should_fail_ex+0x394/0x4c0 [ 354.652542][ T7691] should_failslab+0x9/0x20 [ 354.657052][ T7691] slab_pre_alloc_hook+0x59/0x300 [ 354.662080][ T7691] ? __schedule_delayed_monitor_work+0xb6/0x200 [ 354.668326][ T7691] ? kvmalloc_node+0x70/0x180 [ 354.673006][ T7691] ? kvmalloc_node+0x70/0x180 [ 354.677706][ T7691] __kmem_cache_alloc_node+0x53/0x250 [ 354.683084][ T7691] ? kvmalloc_node+0x70/0x180 [ 354.687762][ T7691] __kmalloc_node+0xa6/0x240 [ 354.692363][ T7691] kvmalloc_node+0x70/0x180 [ 354.696868][ T7691] __prealloc_shrinker+0x468/0x900 [ 354.701998][ T7691] alloc_super+0x720/0x910 [ 354.706417][ T7691] ? kill_litter_super+0xb0/0xb0 [ 354.711352][ T7691] sget_fc+0x325/0x8d0 [ 354.715417][ T7691] ? kill_litter_super+0xb0/0xb0 [ 354.720354][ T7691] ? mqueue_get_tree+0xf0/0xf0 [ 354.725118][ T7691] get_tree_nodev+0x2a/0x140 [ 354.729711][ T7691] vfs_get_tree+0x8c/0x280 [ 354.734131][ T7691] fc_mount+0x1c/0xb0 [ 354.738112][ T7691] mq_init_ns+0x3a1/0x510 [ 354.742445][ T7691] copy_ipcs+0x309/0x500 [ 354.746691][ T7691] create_new_namespaces+0x212/0x700 [ 354.751986][ T7691] unshare_nsproxy_namespaces+0x11a/0x160 [ 354.757705][ T7691] ksys_unshare+0x4fa/0x8f0 [ 354.762217][ T7691] ? sighand_ctor+0x50/0x50 [ 354.766716][ T7691] ? lock_chain_count+0x20/0x20 [ 354.771589][ T7691] ? syscall_enter_from_user_mode+0x25/0x80 [ 354.777486][ T7691] __x64_sys_unshare+0x38/0x40 [ 354.782255][ T7691] do_syscall_64+0x55/0xb0 [ 354.786673][ T7691] ? clear_bhb_loop+0x40/0x90 [ 354.791351][ T7691] ? clear_bhb_loop+0x40/0x90 [ 354.796030][ T7691] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 354.801924][ T7691] RIP: 0033:0x7f64a539e159 [ 354.806337][ T7691] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 354.825946][ T7691] RSP: 002b:00007f64a62a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 354.834384][ T7691] RAX: ffffffffffffffda RBX: 00007f64a5625fa0 RCX: 00007f64a539e159 [ 354.842370][ T7691] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000008040480 [ 354.850340][ T7691] RBP: 00007f64a543506b R08: 0000000000000000 R09: 0000000000000000 [ 354.858307][ T7691] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 354.866274][ T7691] R13: 00007f64a5626038 R14: 00007f64a5625fa0 R15: 00007fff7534e568 [ 354.874259][ T7691] [ 354.904504][ T7669] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 356.461648][ T7672] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 357.037783][ T7669] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.084844][ T7669] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.128279][ T7669] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.158567][ T7669] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.535963][ T23] usb 5-1: USB disconnect, device number 4 [ 358.875841][ T7718] kAFS: unparsable volume name [ 360.295189][ T7726] netlink: 'syz.2.548': attribute type 4 has an invalid length. [ 366.514095][ T7774] netlink: 'syz.2.549': attribute type 21 has an invalid length. [ 366.521870][ T7774] netlink: 128 bytes leftover after parsing attributes in process `syz.2.549'. [ 366.530935][ T7774] netlink: 3 bytes leftover after parsing attributes in process `syz.2.549'. [ 366.773889][ T23] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 366.985685][ T23] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 367.010600][ T23] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 367.033981][ T23] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 367.043179][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 367.072026][ T23] usb 4-1: config 0 descriptor?? [ 368.540156][ T24] block nbd0: Possible stuck request ffff888021ce0000: control (read@0,4096B). Runtime 210 seconds [ 370.616281][ T7809] input: syz1 as /devices/virtual/input/input7 [ 371.379023][ T5834] usb 4-1: USB disconnect, device number 5 [ 372.113912][ T23] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 372.297537][ T23] usb 2-1: config index 0 descriptor too short (expected 39, got 27) [ 372.311091][ T23] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 372.341397][ T23] usb 2-1: config 0 interface 0 has no altsetting 0 [ 372.372662][ T23] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 372.393967][ T23] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 372.402187][ T23] usb 2-1: Product: syz [ 372.443876][ T23] usb 2-1: Manufacturer: syz [ 372.448545][ T23] usb 2-1: SerialNumber: syz [ 372.475650][ T23] usb 2-1: config 0 descriptor?? [ 372.495093][ T23] hub 2-1:0.0: bad descriptor, ignoring hub [ 372.501058][ T23] hub: probe of 2-1:0.0 failed with error -5 [ 372.537729][ T23] usb 2-1: selecting invalid altsetting 0 [ 373.005931][ T43] usb 2-1: USB disconnect, device number 11 [ 375.854278][ T7864] netlink: 'syz.1.562': attribute type 4 has an invalid length. [ 376.048426][ T7828] syz.4.560 (7828) used greatest stack depth: 20184 bytes left [ 377.104453][ T43] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 377.306790][ T43] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 377.324115][ T43] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 377.357870][ T43] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 377.393344][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 377.447540][ T43] usb 4-1: config 0 descriptor?? [ 378.006628][ T7899] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 378.777565][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.784060][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.195049][ T7917] netlink: 24 bytes leftover after parsing attributes in process `syz.4.571'. [ 381.971377][ T43] usb 4-1: USB disconnect, device number 6 [ 388.845194][ T7984] FAULT_INJECTION: forcing a failure. [ 388.845194][ T7984] name failslab, interval 1, probability 0, space 0, times 0 [ 388.894493][ T7984] CPU: 1 PID: 7984 Comm: syz.1.593 Not tainted syzkaller #0 [ 388.901846][ T7984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 388.911920][ T7984] Call Trace: [ 388.915199][ T7984] [ 388.918152][ T7984] dump_stack_lvl+0x18c/0x250 [ 388.922842][ T7984] ? show_regs_print_info+0x20/0x20 [ 388.928042][ T7984] ? load_image+0x420/0x420 [ 388.932570][ T7984] ? __might_sleep+0xe0/0xe0 [ 388.937160][ T7984] ? __lock_acquire+0x7d80/0x7d80 [ 388.942187][ T7984] should_fail_ex+0x394/0x4c0 [ 388.946898][ T7984] should_failslab+0x9/0x20 [ 388.951410][ T7984] slab_pre_alloc_hook+0x59/0x300 [ 388.956443][ T7984] ? snd_seq_pool_new+0x51/0x1a0 [ 388.961387][ T7984] __kmem_cache_alloc_node+0x53/0x250 [ 388.966763][ T7984] ? snd_seq_pool_new+0x51/0x1a0 [ 388.971698][ T7984] kmalloc_trace+0x2a/0xe0 [ 388.976119][ T7984] snd_seq_pool_new+0x51/0x1a0 [ 388.980884][ T7984] snd_seq_fifo_new+0x62/0x1b0 [ 388.985647][ T7984] snd_seq_open+0x1fe/0x500 [ 388.990147][ T7984] chrdev_open+0x58c/0x600 [ 388.994567][ T7984] ? cd_forget+0x160/0x160 [ 388.998988][ T7984] ? fsnotify_perm+0x3ed/0x5e0 [ 389.003758][ T7984] do_dentry_open+0x880/0x14b0 [ 389.008532][ T7984] ? cd_forget+0x160/0x160 [ 389.012950][ T7984] path_openat+0x284f/0x3270 [ 389.017554][ T7984] ? do_sys_openat2+0xda/0x1d0 [ 389.022316][ T7984] ? __x64_sys_openat+0x139/0x160 [ 389.027344][ T7984] ? verify_lock_unused+0x140/0x140 [ 389.032544][ T7984] ? do_filp_open+0x430/0x430 [ 389.037233][ T7984] do_filp_open+0x1f2/0x430 [ 389.041738][ T7984] ? vfs_tmpfile+0x620/0x620 [ 389.046350][ T7984] ? _raw_spin_unlock+0x28/0x40 [ 389.051208][ T7984] ? alloc_fd+0x590/0x640 [ 389.055544][ T7984] do_sys_openat2+0x134/0x1d0 [ 389.060225][ T7984] ? do_sys_open+0xe0/0xe0 [ 389.064643][ T7984] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 389.070620][ T7984] ? lock_chain_count+0x20/0x20 [ 389.075472][ T7984] __x64_sys_openat+0x139/0x160 [ 389.080328][ T7984] do_syscall_64+0x55/0xb0 [ 389.084752][ T7984] ? clear_bhb_loop+0x40/0x90 [ 389.089428][ T7984] ? clear_bhb_loop+0x40/0x90 [ 389.094107][ T7984] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 389.100003][ T7984] RIP: 0033:0x7fe71a79e159 [ 389.104416][ T7984] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 389.124021][ T7984] RSP: 002b:00007fe71b5d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 389.132434][ T7984] RAX: ffffffffffffffda RBX: 00007fe71aa25fa0 RCX: 00007fe71a79e159 [ 389.140402][ T7984] RDX: 0000000000000000 RSI: 00002000000052c0 RDI: ffffffffffffff9c [ 389.148371][ T7984] RBP: 00007fe71a83506b R08: 0000000000000000 R09: 0000000000000000 [ 389.156352][ T7984] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 389.164315][ T7984] R13: 00007fe71aa26038 R14: 00007fe71aa25fa0 R15: 00007ffd32f93468 [ 389.172297][ T7984] [ 392.456107][ T8007] netlink: 'syz.2.601': attribute type 21 has an invalid length. [ 392.464136][ T8007] netlink: 128 bytes leftover after parsing attributes in process `syz.2.601'. [ 392.473282][ T8007] netlink: 3 bytes leftover after parsing attributes in process `syz.2.601'. [ 396.504000][ T8016] netlink: 24 bytes leftover after parsing attributes in process `syz.1.598'. [ 398.637883][ T24] block nbd0: Possible stuck request ffff888021ce0000: control (read@0,4096B). Runtime 240 seconds [ 400.596172][ T8051] netlink: 'syz.1.612': attribute type 21 has an invalid length. [ 400.604159][ T8051] netlink: 128 bytes leftover after parsing attributes in process `syz.1.612'. [ 400.613264][ T8051] netlink: 3 bytes leftover after parsing attributes in process `syz.1.612'. [ 401.334212][ T5089] Bluetooth: hci4: command 0x0406 tx timeout [ 401.905492][ T8058] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 409.523971][ T5835] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 409.637978][ T8152] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 410.390773][ T5835] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 410.403982][ T5835] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 410.454016][ T5835] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 410.463717][ T5835] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 410.800649][ T5835] usb 5-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 410.969985][ T5835] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.347031][ T8165] kvm: kvm [8164]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x800 [ 411.368809][ T8165] kvm: kvm [8164]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x800 [ 411.612425][ T5836] usb 5-1: USB disconnect, device number 5 [ 413.084327][ T8183] FAULT_INJECTION: forcing a failure. [ 413.084327][ T8183] name failslab, interval 1, probability 0, space 0, times 0 [ 413.174975][ T8183] CPU: 0 PID: 8183 Comm: syz.4.633 Not tainted syzkaller #0 [ 413.182321][ T8183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 413.192400][ T8183] Call Trace: [ 413.195701][ T8183] [ 413.198653][ T8183] dump_stack_lvl+0x18c/0x250 [ 413.203365][ T8183] ? show_regs_print_info+0x20/0x20 [ 413.208588][ T8183] ? load_image+0x420/0x420 [ 413.213120][ T8183] ? __might_sleep+0xe0/0xe0 [ 413.217732][ T8183] ? __lock_acquire+0x7d80/0x7d80 [ 413.222777][ T8183] should_fail_ex+0x394/0x4c0 [ 413.227482][ T8183] should_failslab+0x9/0x20 [ 413.232005][ T8183] slab_pre_alloc_hook+0x59/0x300 [ 413.237060][ T8183] ? gfs2_meta_init_fs_context+0x54/0x2b0 [ 413.242812][ T8183] __kmem_cache_alloc_node+0x53/0x250 [ 413.248224][ T8183] ? gfs2_meta_init_fs_context+0x54/0x2b0 [ 413.253987][ T8183] kmalloc_trace+0x2a/0xe0 [ 413.258441][ T8183] gfs2_meta_init_fs_context+0x54/0x2b0 [ 413.264027][ T8183] alloc_fs_context+0x618/0x7a0 [ 413.268912][ T8183] __se_sys_fsopen+0xa0/0x2c0 [ 413.273625][ T8183] do_syscall_64+0x55/0xb0 [ 413.278075][ T8183] ? clear_bhb_loop+0x40/0x90 [ 413.282784][ T8183] ? clear_bhb_loop+0x40/0x90 [ 413.287492][ T8183] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 413.293415][ T8183] RIP: 0033:0x7fb31419e159 [ 413.297832][ T8183] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 413.317441][ T8183] RSP: 002b:00007fb315035028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 413.325855][ T8183] RAX: ffffffffffffffda RBX: 00007fb314425fa0 RCX: 00007fb31419e159 [ 413.333834][ T8183] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180 [ 413.341831][ T8183] RBP: 00007fb31423506b R08: 0000000000000000 R09: 0000000000000000 [ 413.349797][ T8183] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 413.357760][ T8183] R13: 00007fb314426038 R14: 00007fb314425fa0 R15: 00007fffeec37758 [ 413.365737][ T8183] [ 413.369885][ T28] INFO: task syz.0.386:7161 blocked for more than 144 seconds. [ 413.386104][ T28] Not tainted syzkaller #0 [ 413.413956][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 413.427742][ T28] task:syz.0.386 state:D stack:24072 pid:7161 ppid:5775 flags:0x00004004 [ 414.234260][ T28] Call Trace: [ 414.237617][ T28] [ 414.240580][ T28] __schedule+0x15ae/0x4660 [ 414.293928][ T28] ? asan.module_dtor+0x20/0x20 [ 414.303117][ T28] ? __mutex_lock+0x66e/0xc80 [ 414.342205][ T28] ? __mutex_trylock_common+0x8a/0x270 [ 414.350093][ T28] ? trace_raw_output_contention_end+0xd0/0xd0 [ 414.393857][ T28] schedule+0xbd/0x170 [ 414.398001][ T28] schedule_preempt_disabled+0x13/0x20 [ 414.403495][ T28] __mutex_lock+0x673/0xc80 [ 414.418086][ T28] ? __mutex_lock+0x4d2/0xc80 [ 414.437032][ T28] ? blkdev_get_by_dev+0x11b/0x610 [ 414.465645][ T28] ? mutex_lock_nested+0x20/0x20 [ 414.475632][ T28] ? iput+0x33f/0x900 [ 414.484483][ T28] ? disk_block_events+0xa7/0x120 [ 414.493427][ T28] ? blkdev_get_by_dev+0x100/0x610 [ 414.506800][ T28] blkdev_get_by_dev+0x11b/0x610 [ 414.514655][ T28] blkdev_open+0x14e/0x360 [ 414.524701][ T28] do_dentry_open+0x880/0x14b0 [ 414.534797][ T28] ? blkdev_mmap+0x1b0/0x1b0 [ 414.543685][ T28] path_openat+0x284f/0x3270 [ 414.558353][ T28] ? do_sys_openat2+0xda/0x1d0 [ 414.582748][ T28] ? __x64_sys_openat+0x139/0x160 [ 414.603795][ T28] ? verify_lock_unused+0x140/0x140 [ 414.622561][ T28] ? do_filp_open+0x430/0x430 [ 414.628556][ T28] do_filp_open+0x1f2/0x430 [ 414.633171][ T28] ? vfs_tmpfile+0x620/0x620 [ 414.641589][ T28] ? _raw_spin_unlock+0x28/0x40 [ 414.647318][ T28] ? alloc_fd+0x590/0x640 [ 414.652908][ T28] do_sys_openat2+0x134/0x1d0 [ 414.660381][ T28] ? do_sys_open+0xe0/0xe0 [ 414.665152][ T28] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 414.671843][ T28] ? lock_chain_count+0x20/0x20 [ 414.680859][ T28] __x64_sys_openat+0x139/0x160 [ 414.686290][ T28] do_syscall_64+0x55/0xb0 [ 414.690817][ T28] ? clear_bhb_loop+0x40/0x90 [ 414.696213][ T28] ? clear_bhb_loop+0x40/0x90 [ 414.701006][ T28] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 414.707659][ T28] RIP: 0033:0x7fcd88b5e98e [ 414.713204][ T28] RSP: 002b:00007fcd89a64b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 414.722082][ T28] RAX: ffffffffffffffda RBX: 00007fcd89a656c0 RCX: 00007fcd88b5e98e [ 414.735474][ T28] RDX: 0000000000022180 RSI: 00007fcd89a64c00 RDI: ffffffffffffff9c [ 414.772030][ T28] RBP: 00007fcd89a64c00 R08: 0000000000000000 R09: 0000000000000000 [ 414.813483][ T28] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 414.823484][ T28] R13: 00007fcd88e26128 R14: 00007fcd88e26090 R15: 00007fffb071c108 [ 414.834613][ T28] [ 414.837945][ T28] [ 414.837945][ T28] Showing all locks held in the system: [ 414.877705][ T28] 1 lock held by khungtaskd/28: [ 414.902974][ T28] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 [ 414.960624][ T28] 2 locks held by getty/5526: [ 415.057852][ T28] #0: ffff88802d0ac0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 415.103821][ T28] #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 [ 415.230184][ T28] 1 lock held by syz-executor/5759: [ 415.248056][ T28] 1 lock held by udevd/5765: [ 415.258159][ T28] #0: ffff888021c354c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 415.269289][ T28] 1 lock held by syz.0.386/7161: [ 415.293869][ T28] #0: ffff888021c354c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 415.316113][ T28] 1 lock held by syz.4.613/8072: [ 415.333779][ T28] 2 locks held by syz.3.627/8160: [ 415.350628][ T28] [ 415.356933][ T28] ============================================= [ 415.356933][ T28] [ 415.389644][ T28] NMI backtrace for cpu 1 [ 415.394032][ T28] CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 [ 415.401220][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 415.411279][ T28] Call Trace: [ 415.414553][ T28] [ 415.417476][ T28] dump_stack_lvl+0x18c/0x250 [ 415.422146][ T28] ? __wake_up_klogd+0xd9/0x100 [ 415.426990][ T28] ? show_regs_print_info+0x20/0x20 [ 415.432181][ T28] ? load_image+0x420/0x420 [ 415.436677][ T28] nmi_cpu_backtrace+0x3a6/0x3e0 [ 415.441611][ T28] ? nmi_trigger_cpumask_backtrace+0x2f0/0x2f0 [ 415.447761][ T28] ? load_image+0x420/0x420 [ 415.452249][ T28] ? wq_watchdog_touch+0xef/0x170 [ 415.457265][ T28] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 415.463323][ T28] nmi_trigger_cpumask_backtrace+0x17a/0x2f0 [ 415.469297][ T28] watchdog+0xf59/0xfa0 [ 415.473443][ T28] ? watchdog+0x1e1/0xfa0 [ 415.477768][ T28] kthread+0x2fa/0x390 [ 415.481826][ T28] ? hungtask_pm_notify+0x50/0x50 [ 415.486843][ T28] ? kthread_blkcg+0xd0/0xd0 [ 415.491421][ T28] ret_from_fork+0x48/0x80 [ 415.495847][ T28] ? kthread_blkcg+0xd0/0xd0 [ 415.501207][ T28] ret_from_fork_asm+0x11/0x20 [ 415.505970][ T28] [ 415.509512][ T28] Sending NMI from CPU 1 to CPUs 0: [ 415.514780][ C0] NMI backtrace for cpu 0 [ 415.514790][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 415.514804][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 415.514812][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 415.514832][ C0] Code: 89 18 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d 03 f6 36 00 fb f4 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2c 89 cb 80 f9 [ 415.514844][ C0] RSP: 0018:ffffffff8ce07d80 EFLAGS: 000002c6 [ 415.514857][ C0] RAX: 658c96e2411afc00 RBX: ffffffff81631e24 RCX: 658c96e2411afc00 [ 415.514868][ C0] RDX: 0000000000000001 RSI: ffffffff8acacce0 RDI: ffffffff8b1d3ba0 [ 415.514877][ C0] RBP: ffffffff8ce07eb8 R08: ffff8880b8e36b6b R09: 1ffff110171c6d6d [ 415.514888][ C0] R10: dffffc0000000000 R11: ffffed10171c6d6e R12: 1ffffffff19c0fbc [ 415.514899][ C0] R13: dffffc0000000000 R14: 1ffffffff19d2688 R15: 0000000000000000 [ 415.514909][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 415.514921][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 415.514931][ C0] CR2: 00007f413c9f14b8 CR3: 00000000765ef000 CR4: 00000000003506f0 [ 415.514945][ C0] Call Trace: [ 415.514951][ C0] [ 415.514955][ C0] default_idle+0x13/0x20 [ 415.514977][ C0] default_idle_call+0x6c/0xa0 [ 415.514992][ C0] do_idle+0x334/0x5c0 [ 415.515013][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 415.515031][ C0] ? asm_sysvec_call_function_single+0x1a/0x20 [ 415.515058][ C0] cpu_startup_entry+0x43/0x60 [ 415.515075][ C0] rest_init+0x2e2/0x300 [ 415.515091][ C0] ? time_init+0x40/0x40 [ 415.515105][ C0] arch_call_rest_init+0xe/0x10 [ 415.515122][ C0] start_kernel+0x461/0x4e0 [ 415.515138][ C0] x86_64_start_reservations+0x2a/0x30 [ 415.515152][ C0] x86_64_start_kernel+0x60/0x60 [ 415.515172][ C0] secondary_startup_64_no_verify+0x179/0x17b [ 415.515197][ C0] [ 415.792862][ T28] Kernel panic - not syncing: hung_task: blocked tasks [ 415.799733][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 [ 415.806930][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 415.816974][ T28] Call Trace: [ 415.820234][ T28] [ 415.823147][ T28] dump_stack_lvl+0x18c/0x250 [ 415.827812][ T28] ? show_regs_print_info+0x20/0x20 [ 415.832992][ T28] ? load_image+0x420/0x420 [ 415.837508][ T28] panic+0x2ca/0x720 [ 415.841421][ T28] ? bpf_jit_dump+0xd0/0xd0 [ 415.845943][ T28] ? __irq_work_queue_local+0x13a/0x3b0 [ 415.851502][ T28] ? preempt_schedule_thunk+0x1a/0x30 [ 415.856886][ T28] ? nmi_trigger_cpumask_backtrace+0x2a4/0x2f0 [ 415.863067][ T28] watchdog+0xf98/0xfa0 [ 415.867236][ T28] ? watchdog+0x1e1/0xfa0 [ 415.871589][ T28] kthread+0x2fa/0x390 [ 415.875655][ T28] ? hungtask_pm_notify+0x50/0x50 [ 415.880663][ T28] ? kthread_blkcg+0xd0/0xd0 [ 415.885235][ T28] ret_from_fork+0x48/0x80 [ 415.889645][ T28] ? kthread_blkcg+0xd0/0xd0 [ 415.894217][ T28] ret_from_fork_asm+0x11/0x20 [ 415.898971][ T28] [ 415.902251][ T28] Kernel Offset: disabled [ 415.906584][ T28] Rebooting in 86400 seconds..